addressalign-toparrow-leftarrow-rightbackbellblockcalendarcameraccwcheckchevron-downchevron-leftchevron-rightchevron-small-downchevron-small-leftchevron-small-rightchevron-small-upchevron-upcircle-with-checkcircle-with-crosscircle-with-pluscontroller-playcrossdots-three-verticaleditemptyheartexporteye-with-lineeyefacebookfolderfullheartglobegmailgooglegroupshelp-with-circleimageimagesinstagramFill 1linklocation-pinm-swarmSearchmailmessagesminusmoremuplabelShape 3 + Rectangle 1ShapeoutlookpersonJoin Group on CardStartprice-ribbonprintShapeShapeShapeShapeImported LayersImported LayersImported Layersshieldstartickettrashtriangle-downtriangle-uptwitteruserwarningyahoo

Re: on password encryption and storage

From: Darren M.
Sent on: Thursday, July 19, 2012 12:51 PM

Having been a code auditor in a previous life... 

Note that new laws are coming in to place in Australia that will force everybody 
| to be quite a bit more responsible with user data. Best to keep it secure. 

Also mind that CREloaded somehow passed its PCI DSS certification with this 
| code in place, while it clearly breaches basic safety guidelines. So, it slipped 
| through. PCI DSS and other certification on e-commerce components are *not* 
| a guarantee that the code is good/safe. 

Unfortunately there is a *lot* of disillusionment over what the various security auditors and accreditations are.

Even with an experienced auditor involved, it is *extremely easy* to get a client over the line, regardless of what type of audit is being conducted.

That said, it shouldn't be... but commercial realities of 2012 and requirements of performing the audit for a given price / time frame / etc tend to overshadow good intent.

Relevant regulatory requirements, both existing and planned, aren't worth the paper they are written on unfortunately - btu I think a lot on this list already know that (preaching to the converted is easy)


Darren Mackay
Enterprise Research, Forensics and Consulting
mobile: [masked]
twitter: @darrenmackay
email / xmpp: [address removed]

Our Sponsors

People in this
Meetup are also in:

Sign up

Meetup members, Log in

By clicking "Sign up" or "Sign up using Facebook", you confirm that you accept our Terms of Service & Privacy Policy