0
votes
1answer
39 views

CNN Money Portfolio and Heartbleed [duplicate]

Is/was CNN Money Portfolio ever vulnerable to heartbleed? It states 256 bit SSL bank level encryption on the website..
1
vote
2answers
93 views

LastPass login security

If LastPass does not store your master password, then how can you login to use their web app? Surely you must type it in, it is sent over using SSL, and then salted/hashed on the server-side, and ...
-2
votes
2answers
95 views

Hydra https-form-post

I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives. This is what I have done so ...
1
vote
1answer
406 views

Are post requests secure?

If a post request is sent from a client on a website without SSL, is the request secure? For example, I visit a site badsecurity.com, and I login using a password: Will this password be encrypted ...
2
votes
0answers
49 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
5
votes
2answers
262 views

Can I trust large companies like Google not to store failed password attempts?

Let's say, for example, that I accidentally entered my Microsoft account password instead of my Google account password when logging in to some Google web service. After getting an error message, I ...
7
votes
3answers
1k views

Is HTTPS and Basic Authentication secure enough for banking webservices (RESTful)?

I have been reading about SSL/TLS for the last few days and looks like it has never been practically cracked. Given SSL/TLS is used for all communications between client application and the server, ...
2
votes
2answers
438 views

A protocol to authenticate users without login/password

A casual message exchange on reddit yesterday got me thinking whether it might be possible to design a protocol that removes the need for users to remember a unique password for every service (s)he ...
11
votes
4answers
995 views

Handling passwords in a web application

I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client ...
2
votes
3answers
111 views

Is password authentication worse that signed messaging if done over SSL?

Let there is a public API: HTTP-based via SSL there are no browsers, just connections between custom written programs The first authentication scheme that came to my mind was... client signs their ...
2
votes
1answer
298 views

Pure SRP authentication without TLS

IF using a SRP for client/server application authentication without TLS. Will it be vulnerable to man-in-middle attack, since if using SRP, the public info doesn't really useful to calculate the ...
1
vote
1answer
191 views

Implementing Secure Remote Password with Remote Desktop Application

I had read the Secure Remote Password Protocol paper written by Tom Wu. This protocol is resistant to dictionary attacks. I have also go through some papers regarding to VNC attacks due to weak ...
1
vote
4answers
194 views

Secure login feature with low CPU power

I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
9
votes
2answers
469 views

How insecure is PowerShell Web Access?

Windows Server 2012 comes with a new feature that allows you to administrate the server via a PowerShell command line in any modern browser including Smartphones. This sounds cool and scary at the ...
0
votes
1answer
131 views

Proxy Non-HTTPS logins through EC2

I've been thinking a lot about password security these days, and have been becoming more and more hesitant to use services that have login forms that are not on HTTPS. As I was researching security, ...
2
votes
1answer
999 views

Should we block all plaintext authentication and require authentication over an encrypted channel?

Should we configure our servers to require the authentication happen over an encrypted channel and block all methods of unencrypted, plaintext authentication over? I recently configured my servers to ...
7
votes
4answers
3k views

HTTP Basic auth password storage more secure than Digest auth

If you are using SSL already, it appears Basic auth is the way to go since you can perform bcrypt with the password when you store it in the database, where as Digest auth only allows md5. As we know, ...
4
votes
3answers
175 views

Is using encryption the only viable option to thwart password sniffing?

I'm using HTTPS Everywhere on my browser to chose SSL versions of websites when available, but many sites don't offer a secure version. Is SSL the only viable option to thwart password/clear text ...
19
votes
5answers
1k views

Is it alright to tell everyone your encryption information?

I have an account in an online banking system and they have the FAQ with something like this: How secure is the <Online Banking System Name>? Each page you view and any information ...
17
votes
4answers
4k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
24
votes
2answers
5k views

I just send username and password over https. Is this ok?

When a user's logging in to my site, they send their username and password to me over https. Besides the ssl, there's no special obfuscation of the password - it lives in memory in the browser in the ...
14
votes
4answers
1k views

What to transfer? Password or its hash?

Let's say in my database I store passwords hashed with salt with a fairly expensive hash (scrypt, 1000 rounds of SHA2, whatever). Upon login, what should I transfer over the network and why? Password ...