Tagged Questions

113
votes
7answers
18k views

CTRL+ALT+DEL Login - Rationale behind it?

Maybe a rather noobish question: Why is CTRL+ALT+DEL required at login on Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a ...
1
vote
1answer
88 views

What is more secure for voice and SMS OTP: A random number or generated similar to HOTP?

Many providers are creating OTP authentication for their sign in. However I noticed that all the voice and SMS OTPs I've come across are a series of 6 digits... similar to the HOTP RFC Standard ...
4
votes
2answers
85 views

Logging in a user after password reset via link

Lets say password reset functionality flow is the following: User submits email address used for his account. An email is sent to that email address with a link with a password reset hash. Upon ...
7
votes
3answers
149 views

If multi factor authentication is enabled, how should that affect self-service password reset?

Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required) ...
0
votes
2answers
164 views

What are RealVNC 5.0 Authentication Protocol Security Limitations?

In the old version of RealVNC, the password length was limited to 8 characters which was easier to be cracked. They have now increased the password length by 255 characters, will this make Realvnc ...
7
votes
5answers
369 views

Are we concentrating too much on password complexity?

As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
17
votes
6answers
1k views

Why do we ask for a user's existing password when changing their password?

In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
4
votes
4answers
326 views

Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?

I'm beginning to think this is not as simple as it looks, and many "accepted" answers here and in SO have alternative answers that criticize them. Here is what I have gathered so far Most of what I ...
48
votes
12answers
2k views

How do you log in from an unsecured computer?

Suppose that you are on a cybercafe, at a friend's home or at your work office, and you need to log in on a site, but you feel that the the computer can not be trusted (e.g. your friend isn't ...
2
votes
1answer
193 views

How can passwords be stolen from Yahoo?

I always understood that servers don't actually store user passwords. Instead, they store hashes of passwords and then they validate the user input by applying the hash function, then compare the ...
3
votes
2answers
311 views

SASL Authentication Protocol with No Cleartext passwords

As you know, LDAP supports three authentication mechanisms: anonymous, simple and SASL. The first one is only suitable for particular cases, and therefore I'm not going to talk about that. The ...
5
votes
1answer
1k views

Does NIST really recommend PBKDF2 for password hashing?

We hesitated between BCrypt and PBKDF2 for password hashing. In many forums and blogs people say something like "In their Special Publication SP 800-132 NIST basically recommends using PBKDF2 for ...
5
votes
3answers
643 views

What are some good ways to verify user identity for password resets?

I'm wondering how others verify the identity of users they're resetting passwords for. We currently try to speak to a manager at work, but it frustrates end users and seems like we don't trust them. ...
8
votes
4answers
480 views

Is there any reason to show the same message for invalid username as password?

I've seen a security question/requirement that a website login return the same error message for invalid password as for non-existent user. The idea being that this it makes it impossible to discover ...
5
votes
6answers
800 views

Prevent denial of service attacks against slow hashing functions?

I've been thinking about bcrypt recently, and what I wonder is if there's a way to deal with the inherent (D)DoS problems with slow hashing functions. Namely, if I set up bcrypt so my machine takes ...
5
votes
2answers
177 views

How should hospitals handle the use of sharing credentials to access sensitive information, especially in critical situations?

Most organizations today hold individuals accountable for their actions on systems and networks by unique user IDs and passwords. However, imagine working in a hospital environment where access to ...
8
votes
2answers
470 views

Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email

Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance MSFT even went to far as create ADMINSDUser rights to put ...
17
votes
2answers
875 views

Sending temp password when users first registered - is that good for anything?

One of our clients has sent us a list of security requirements. One of them was that registration does not including setting a password - once complete, a temp password is sent to the user, and the ...
19
votes
3answers
811 views

Am I wrong to believe that passwords should never be recoverable (one way hash)?

I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
3
votes
6answers
444 views

Sharing passwords and credentials between founders and employees

What's the best way to share passwords and credentials from the business's various accounts in a secure manner? For example, email doesn't work because if someone gets into one of your employee's ...
198
votes
16answers
19k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
35
votes
5answers
2k views

Do security questions subvert passwords?

Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
12
votes
3answers
1k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...