I just read the paper "Honeywords: Making Password-Cracking Detectable" and have some thoughts about the reality and viability - as well as weaknesses of this approach. My initial take is that this ...
I just saw for the first time a new way to enter a password, at the Banque Postale (French Bank). You are given a virtual numeric keyboard and to type you can just leave the mouse cursor over a number ...
How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)
After the hack of Mat Honan I studied my own laundry list of accounts I have at the numerous web sites I use. There is one fact that stands out: Many of the websites severely restrict the size and ...
Even though I read a lot about hashing and how passwords are protected, I am still confused about it. If passwords are hashed at client side, it will be useless because it can be sniffed and used by ...
Do token-based authentication solutions (such as RSA SecurID) mitigate tools like incognito and/or pass-the-hash tools?
Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one: ...
I know the reasoning behind not letting infinite password attempts -- brute force attempts is not a meatspace weakness, but a problem with computer security -- but where did they get the number 3 ...