Tagged Questions
-3
votes
0answers
73 views
My Evaluation on the Recent Honeywords Paper [closed]
I just read the paper "Honeywords: Making Password-Cracking Detectable" and have some thoughts about the reality and viability - as well as weaknesses of this approach.
My initial take is that this ...
19
votes
3answers
975 views
Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers?
I just saw for the first time a new way to enter a password, at the Banque Postale (French Bank). You are given a virtual numeric keyboard and to type you can just leave the mouse cursor over a number ...
2
votes
3answers
301 views
How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)
After the hack of Mat Honan I studied my own laundry list of accounts I have at the numerous web sites I use. There is one fact that stands out:
Many of the websites severely restrict the size and ...
1
vote
4answers
294 views
How password hashing is useful in MITM attack?
Even though I read a lot about hashing and how passwords are protected, I am still confused about it.
If passwords are hashed at client side, it will be useless because it can be sniffed and used by ...
2
votes
1answer
376 views
Token Based Authentication & Pass-the-hash Attacks
Do token-based authentication solutions (such as RSA SecurID) mitigate tools like incognito and/or pass-the-hash tools?
10
votes
3answers
2k views
How can I prevent someone from accessing a Windows XP system via boot disk?
Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one:
...
50
votes
13answers
7k views
Why do sites implement locking after 3 failed password attempts?
I know the reasoning behind not letting infinite password attempts -- brute force attempts is not a meatspace weakness, but a problem with computer security -- but where did they get the number 3 ...
