I want to add a password blacklist that would prevent the 1000 most common passwords from being used in order to mitigate shallow dictionary attacks. Is there any negative implication of storing this ...
I am testing my website with hydra brute-force software. But accessing my apache conf remote server file, it seems that an attacker can't log-in more a limited number of times per seconds. Does hydra ...
I know I have read somewhere that the reason the UAC prompt in Windows 7 was employed is that viruses that would supposedly execute privileged instructions won't be able to "click" the confirm button ...
I'm beginning to think this is not as simple as it looks, and many "accepted" answers here and in SO have alternative answers that criticize them. Here is what I have gathered so far Most of what I ...
I'm currently working on reducing the risk of mass account lockout on a site that (unfortunately) issues sequential, numeric user IDs. Changing the structure of the userID is not an option at this ...
When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
I am concerned about how does email services like Yahoo, Gmail, Hotmail etc provide security to their costumers and prevent their account from being compromised. For example, I have seen that if ...
I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...