Tag Info

Hot answers tagged

27

There is plenty of research on which passwords are "popular." You can find a lot of it here: https://xato.net/passwords/more-top-worst-passwords/ You have no way of knowing what Google does with queries. It is almost certain that such queries are logged, and are associated with the originating IP address. That would mean Google has a list of the ...


17

There is no result for a Google search on the extremely low-strength "pa55w0rd987": https://www.google.com/#newwindow=1&safe=off&q=pa55w0rd987 Further, Google can only report data that is known to it, and there are a lot of very bad passwords that, nonetheless, do not appear on any websites. For these reasons, I assert that Google is not a useful ...


14

You should look into Certificate pinning. This is effectively allowing you to trust your self-signed certificate, and that server certificate only from your client by a hard lookup of the public key of the certificate. So the chain of authority is not followed (which is where a self-signed certificate falls down) and instead the public key is validated by ...


12

You can't. There is no secure way to transmit it if you can't authenticate the server and establish a secure channel. If you can't authenticate the server then you can't be sure if you are talking to the server or the attacker. Hence, even if you use TLS to establish a secure channel, it doesn't protect you at all since you could be talking to the attacker ...


10

Any sufficiently strong password (and many insufficiently strong passwords) will have 0 hits on Google, so, no, it's not really a feasible method. If your password consists entirely of English language words, it can be brute forced easily with a dictionary attack. If a password has any Google hits at all, it is almost certainly insufficiently secure, but ...


8

There are schemes (1 and 2) that use environmental sensors like accelerators to generate a shared secret. Two devices are shaken while held together. The specific time, pattern and magnitude of shaking should be unique to these two devices. This data can be used to calculate a secret value only these two devices should know.


8

So there are a few reasons why you don't want to do this, although I do not understand the code you presented as I do not deal with that. You should use a third party library to manage your sessions. There are several reasons... Code is vetted, tested and improved across a much wider audience when you use a built in or well know authentication scheme. When ...


7

This is a common issue, and the one thing that you have to keep in mind is that InfoSec serves the company. Your management team runs the company, so their needs are the company's needs. Your job is to educate, educate, educate, not only with technical detail, but with financial impact and risk analysis. But, in the end, it's their call. If they still ...


5

Bundle your self created root CA certificate with your application and configure it to reject all untrusted certificates. If you only use your own CA cert, this is arguably more secure than relying on the normal CAs, since CAs have been compromised in the past by attackers, and are subject to government authorities and politics as well. Rolling your own ...


4

On the face of it, with a MITM I can just get access to your webapp as long as one your users is using my "wifi" Also, why use something unproven when you can use proven technology (OAuth2 would suffice for your purposes and that has been security-tested) And you have no checking built for brute-forcing your "token" meaning I can just brute-force as soon ...


4

Not a bad start. Some things to watch for: If login fails, don't reveal whether the user exists Implement some form of brute force protection Provide a change password function; require the previous password Perform password strength checking Sessions usually have both inactivity and absolute timeouts Store passwords securely, e.g. bcrypt Use an anti-CSRF ...


4

In fact operating a computer in a public place is not a good idea. If the place you will choose can somehow be predicted, surveillance devices might be attached to e.g. film you entering your password making the snatching scenario unnecessary for your enemy. The following measures (most taken from the comments here: ...


3

Warning: there are serious security problems sending passwords out of your direct network, especially to google. Do it only if somehow it is not a problem for you! (F.e. you are working in an isolated security context which anyways is deeply google-dependent!) @PlasmaHH user did the very clear comment: "Which is stronger, 2z63hg79fg79 or ...


3

One solution is to forbid access to the folder where the sensitive files are stored, so that it is not possible to access them directly. For example, place these files under http://siteis.com/secured_uploaded_files/ and place a .htaccess file there (for apache) to prevent access. You can also place the files outside the web server's document root. Step two ...


3

Issue them two laptops: general purpose, and high-security. The general purpose laptop is somewhat like you describe, a balance between security and usability. In fact, your security steps are pretty good, certainly better than average. Hopefully you will keep common viruses off, but you'll never stop an advanced attacker. The high-security laptop is only ...


3

The good news is two-factor can be free. Google authenticator is free and mixed with FreeRadius should work with just about any access device. It is not as fancy or secure as RSA's or some of the others but it is pretty simple to implement and does satisfy a second factor to username and password. From what I can tell it looks to be certificate based ...


3

Well it all depends on the number of faces you can choose from. Let's compare it with another, often-used two-factor mechanism: one-time passwords. A one-time password often contains 6 numbers. Thus, there are 10^6th possibilities: 1000000. The chance of a hacker guessing your OTP is 1/1000000. Generally, this is considered to be a pretty high chance, ...


3

If the end user is the one who initiates the account setup and they provide a password, the use of a temporary password that they will have to change upon first logon provides no benefit. And will only serve to annoy the user. Temporary passwords are useful when someone else initiates the account set up. As an example, a new employee coming into a company ...


3

It isn't terribly common, but it isn't terribly uncommon either. It's simply a way to do email validation without having to store extra state information. So, it's simple, which has some benefits in that complexity is the enemy of security, so simple solutions are typically better for security than more complex alternatives that do the same thing. ...


3

And that is why there are key signing parties. They're only parties in name, and not in practice. Except if there exists food and beer. A truism if there ever was one.


3

In your scenario the hashes add little security because the client sends the hash to the central server, however the client should send the attempted password, the central server then checks the hash of the password against the submitted hash. Hashing is very important in this scenario, because you may have a malicious user. The malicious user has a real ...


2

I could not find any suitable HMAC libraries Err, the standard library has one. So does the cryptography library. Question 1: Why does AWS use a complex signing key (produced via HMAC) instead of the shared secret itself? One good reason I can see for doing it this way is to avoid a leaked signing key compromising the entire AWS account. Deriving ...


2

Since this is about security, I would say regardless on how you do it, the security boils down to how many charachters that is suitable to use as "verification code". However, using a single direct-activation link that is NOT a custom protocol registred as in the above comment, there is a risk that a unaware user clicks this links and inadvertly activates a ...


2

If you take the standard session-id pattern, and implement it using a persistent cookie rather than the more typical session cookie, you get exactly what you describe, only you get a professional implementation of it done by the browser. Remember: not only can your algorithm have flaws, but your implementation can have flaws as well. The more you have to ...


2

If you're using TLS already, I would lean towards using a secret API key in the header. With an API key you can store that encrypted which protects you in the case of a breach. Make sure your application and server aren't logging the secret key in any form and I would push your client to use long, complex keys. These will be handled by systems not people ...


2

If you work somewhere with someone at the top willing to back you when you say "no" the answers of restricting management is the best. On the other hand if it's the owner/CEO insisting and they can't be dissuaded then less effective strategies may be needed. Most of the other answers are better but I'd like to add one nice approach I was told of. The CEO ...


2

Nothing is "uneditable"; what science can create, science can replicate with sufficient funding and time, particularly with a sample. The closest you're going to reasonably get is a cryptographic dongle, something like a smartcard you provide with your software, after you've generated keys on said smartcard prior to shipment. If you get a FIPS 140-2 ...


2

This is what oAuth is for. oAuth lets a third party service request to do certain operations on behalf of a user with the users consent, For example read access to a users contacts. The third party receives a token which allows it to perform these actions and it is the back end responsibility to validate the token and the actions it is allowed to perform. ...


2

Sites like Google and Facebook implement protocols such as OAuth to accomplish what you describe and what is known as Delegated Authorization. In short, the answer to your question is no. Sites that allow you to sign in with your other accounts never see your account credentials. In simple terms, Google / Facebook are creating a limited use token that links ...


2

The Google Authenticator needs a remote system to validate the entered otp value. This could be a remote site, a server or in the easiest case it is the pam-google-authenticator, which stores the secret key in the home directory of the user. You can have OTP for free and as open source. Take a look at privacyidea. It works as a backend, can assign different ...



Only top voted, non community-wiki answers of a minimum length are eligible