New answers tagged

-1

For a given length, the multiple numbers per button make it significantly harder, though by no means hard, for a casual soulder-surfer to memorize the password as they see being typed.


1

Wouldn't it depend on what actually happens when you want to input the second number on each button (I assume you press it twice)? Case 1: Two keystrokes on the same button simply outputs two of the same digit, similar to pressing the same button twice on a single number button keypad, then the result is just a reduced number of buttons, but longer code. ...


11

No, assuming equally long passcodes, having fewer buttons cannot increase security in any way. Depending on how the passcodes are chosen, and whether or not the buttons are regularly cleaned to remove smudges*, it (might or) might not decrease security significantly, but reducing the number of buttons certainly cannot make the lock more secure. So you're ...


1

Not by itself. The total number of combination is XY where X is the number of buttons, and Y is the length of the combination. For example: a 6 digits combination of 5 buttons is 56 = 15 625 combinations. a 4 digits combination of 10 buttons is 104 = 10 000 combinations. If you don't know the length of the combination, the number of buttons is ...


25

Think about the technical implementation, not about the user or what's painted on the buttons: it's a keypad with 5 buttons. In order to unlock the device, it needs a sequence of those 5 buttons (however many presses of those 5 button it allows). More buttons would make it harder to brute-force the combination. Imagine having only 2 buttons, or imagine ...


0

I've seen several web applications that implement a "sudo mode". In your example, it might look something like this: I, an admin, am logged into your application, and stay logged in for long periods of time (perhaps the session expires after 30 days). I protect this account with reasonable amount of security, but I'm not super paranoid about it. When I ...


3

I'll propose a rule of thumb which may help you with your decision: When switching from a lower privilege level to higher, make them login again. When switching from higher to lower, do not require another login. Here's an example of how bank ATMs implement this rule. Consider these 2 scenarios: You put in your ATM card, enter your pin, select ...


0

You open yourself up to bad user behavior at that point. Really you want to keep them safe by making sure you protect against as much bad user behavior as possible. If an admin opens the web view it makes it easier for them to forget they are in the admin area and leave without signing out of the admin area, leaving it open to someone sitting down and ...


1

The UUID can be tracked by TeamViewer, but do not expect them to tell you anything as that would likely require a subpoena. But let's take another look at this. So you gain the knowledge that the UUID belongs to say: Drugov Russianomov somewhere in Romania. Now what? Your course of action to minimize the potential of someone 'owning' your TeamViewer sessions ...


1

The Authorization: <type> <credentials> pattern was introduced by the W3C in HTTP 1.0, and has been reused in many places since. Many web servers support multiple methods of authorization. In those cases sending just the token isn't sufficient. Sites that use the Authorization : Bearer cn389ncoiwuencr format are most likely implementing ...


1

Long before bearer authorization, this header was used for Basic authentication. For interoperability, the use of these headers is governed by W3C norms, so even if you're reading and writing the header, you should follow them. Bearer distinguishes the type of Authorization you're using, so it's important.


5

Lets look at some different attacks and how they impact the two different systems, followed by some usability considerations. Control of phone (draw) If the attacker has full controll over the phone, it is game over no matter what. However, an attacker may have been able to get a trojan onto ther phone that only has limited permissions. At least on ...


1

DO NOT USE IP ADDRESSES FOR AUTHENTICATION Once that's off the table, what you describe is a "remember me" function for a web application. This has been discussed frequently here. (and product recommendations are off-topic)



Top 50 recent answers are included