29
votes
5answers
2k views

What are the security implications of storing password blacklist?

I want to add a password blacklist that would prevent the 1000 most common passwords from being used in order to mitigate shallow dictionary attacks. Is there any negative implication of storing this ...
6
votes
3answers
670 views

Can I spoof IP addresses when attempting to brute force a login?

I am testing my website with hydra brute-force software. But accessing my apache conf remote server file, it seems that an attacker can't log-in more a limited number of times per seconds. Does hydra ...
1
vote
2answers
379 views

Brute force a GUI login?

I know I have read somewhere that the reason the UAC prompt in Windows 7 was employed is that viruses that would supposedly execute privileged instructions won't be able to "click" the confirm button ...
4
votes
4answers
888 views

Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?

I'm beginning to think this is not as simple as it looks, and many "accepted" answers here and in SO have alternative answers that criticize them. Here is what I have gathered so far Most of what I ...
1
vote
3answers
249 views

Mass account lockout prevention using CSRF tokens

I'm currently working on reducing the risk of mass account lockout on a site that (unfortunately) issues sequential, numeric user IDs. Changing the structure of the userID is not an option at this ...
6
votes
3answers
770 views

Attack vectors for brute-forcing website passwords

When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
4
votes
3answers
170 views

What alternatives do email services provide when an account is hacked?

I am concerned about how does email services like Yahoo, Gmail, Hotmail etc provide security to their costumers and prevent their account from being compromised. For example, I have seen that if ...
43
votes
8answers
64k views

Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...