New answers tagged

2

If only the database server is compromised: yes. If the application server is compromised: no. Store a HMAC of the final password hash along with the hash itself: SIG = HMAC(hash, secret). secret is a single value only known to the application server. It never changes. When verifying a login attempt, recalculate the HMAC and compare. This way the attacker ...


3

The clipboard indeed cannot be considered a safe place, this for several reasons: Malware accessing the clipboard content: in your question you focused on malware installed in your machine, however there could be transient malware (like a malicious Adobe Flash banner on a website you visited for instance...) which will not infect your computer when run, ...


2

When malware is present on the device, indeed, having the pasteboard store this data would be the least of your worries. However, this is still bad practice. You should not store important user data in the clipboard. You shouldn't even be putting it in the pasteboard/clipboard anyway. Why? Because a malicious application could access your clipboard data. ...



Top 50 recent answers are included