Tag Info

New answers tagged

6

Explanations for weak password rules Well, those are obviously bad rules. But here are some possible explanations (or "explanations") for it: Must not start with a number The site owner might actually think that this is a good rule. To prevent for example 1234546 or just prepending a common phrase with '1' (e.g. 1password) Must not have a special ...


3

One reason for enforcing weaker passwords is that a weaker password is easier to remember for the user. When the user forgets their password, an automatic password retrieval procedure must be used. Such a procedure usually entails that a plaintext password is sent to an email account. This offers a lot of attack surface which is outside of the control of the ...


12

If you use the same password for several distinct sites, then you are doing something wrong. Each password shall be site-specific. Therefore, there shall be no reason why the "weaker standards" would have any impact on "all your passwords". (Similarly, there is no rational reason for changing all your passwords on a regular basis. There is a widespread ...


-1

NO, period! the more 0 users the worse it gets.. just because script kiddies try the root user.. does not means they can't find any other username... what a surprise if someone cracks a dictionary made user for example "dcolings" and find out they are already user 0 ... there are hundreds of solutions for anyone to not loose a password or a ssh key.. if ...


0

I am going to answer your question as a generalization of my real world experience. Except for BYOD (Bring Your Own Device) workplaces, I would say that most work places supply their employees with the computers they are using. Which means that legally speaking the computers and whats on them belong to the company. Most companies will also have some form ...


4

First of all, I would not call that a backdoor. A backdoor usually refers to methods of bypassing normal authentication, which would not include an Administrator account owned by IT. Nearly all corporations I have worked with have the IT department own the Administrator accounts and functions for all workstations and servers in the environment, whereas the ...


2

A lot of software exists for this reason. And some of it can be managed by a single person, or a whole team of people. The main principle about this is: Identify what you will be logging. Identify what type of information you need (operational or security) Identify use cases; malicious user logs in, someone logs in at odd hours, someone who isn't supposed ...


2

The chain is not verified "by itself". A given system (say, a Web browser) will consider a server's certificate as valid because it could build a valid chain (with all signatures corrects and matching names and all the rules of X.509) which ends with the certificate to validate (the server's certificate), and starting with a root CA that the client already ...


2

There are lots of flaws with the current PKI, and trust chain is one of them, but not the only one and not in all cases. Each browser/OS comes with lots of CAs and the trust is enabled by default. So once you get the browser you implicitly trust all these CAs for your communication. You need to explicitly disable trust settings if you want to control whom ...


2

I would not call it blind trusting, but yes - you rely on the trustworthiness of the root certificate and all the intermediate authorities on the way depending on the implementation and configuration. A website's certificate is verified with a CA. In order to make sure this CA is indeed the actual CA you intend to trust, you can verify its own certificate ...


1

Don't worry, the sites don't need to store your old passwords. They simply need to store the salts and hashes of your previous passwords. So, even if their system was compromised, your previous passwords would not be revealed. As for why they want to make sure you don't reuse any previous passwords, that's simply in case any of your previous passwords were ...


1

Security: It might sound like a security hole to you. But trust me, It is one of the strongest security pattern. It prevents you from avoiding you to create an old password of yours even in your hurry times. It is really necessary for you not to re-create your old passwords, since there is always a chance of some people knowing your history(friends or foes, ...


2

Nothing is 100% secure, however, this feature of keeping old-passwords protects you from using the passwords which are known to other unauthorized people. Let's say you have a password 123, someone got hold of it, and then you changed it. Sometime later you realized that you are in need of changing the password again. So, if you enter '123,' the system ...


1

Most likely, someone would be typing your old password when they had already obtained it (a former bf/gf trying to stalk you, a hacker who stole a password you reuse). So, letting them know that the password used to be valid still doesn't let them in. It's a very nice feature for user experience. You might have forgotten you had changed the password, you ...


1

Here is a quick fix for your datetime format conversion http://www.linuxquestions.org/questions/linux-software-2/how-can-i-read-the-audit-time-stamp-msg%3Daudit-1213186256-105-20663-a-648547 As to your lack of hostname that is a factor of using the name argument as you are (defaults to none if not properly configured) - see ...



Top 50 recent answers are included