4
votes
2answers
2k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
6
votes
2answers
1k views

How do I block LinkedIn from extracting data from Microsoft Exchange Server?

LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click ...
15
votes
2answers
381 views

Mitigating the loss of a mobile phone used for second-factor login

Take the following scenario: John is using GMail for his primary email account and LastPass as his password management system. Both of these accounts are using the Google Authenticator mobile ...
1
vote
1answer
251 views

What is more secure for voice and SMS OTP: A random number or generated similar to HOTP?

Many providers are creating OTP authentication for their sign in. However I noticed that all the voice and SMS OTPs I've come across are a series of 6 digits... similar to the HOTP RFC Standard ...
8
votes
3answers
272 views

If multi factor authentication is enabled, how should that affect self-service password reset?

Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required) ...
4
votes
1answer
2k views

Which cross-platform password managers support encryption using a hardware token?

I am looking for a really secure password manager and I really like the fact that Password Safe supports encryption/decryption using a Yubikey programmed in challenge-response mode. Read more here: ...