Tag Info

Hot answers tagged

28

You're not comparing apples to apples in your comparison of password strength to your bank PIN. Most traditional passwords strength theologies are predicated on the fact that your username and password is all that stands between you and your precious secure data. These are merely two objects that you know and as such it's in your best interest to have a ...


8

Originally it's to do with the difficulty of a brute force attack on the password. Most websites are concerned about the possibility that some attacker might get hold of a file containing everyone's hashed passwords, and conduct an offline brute force attack using that. A properly set up attacker might be able to make millions of guesses per second (exact ...


7

The card knows this, the reader doesnt. When you put a pin in the reader talks to the microcontroller on the card to verify - which also logs the incorrect attempts. So multiple readers wont help trying to guess somebodies pin! Thats more or less the extent of my knowledge, but an overview of how it works. The underlying protocols I have no knowledge of ...


4

There is an OpenPGP standard for encrypting and signing email so that you can provide, confidentiality, integrity and authentication towards the person who is reading your email.


3

If your debit card has an EMV chip (almost all chips are based on EMV today), it very likely does know your PIN (or at least how to verify an entered PIN). Whether that capability is actually used depends on the type of transaction and terminal; if the terminal is online capable, it might as well verify the PIN directly with your bank's servers, which also ...


3

It is only part of the authentication, with the physical presence of the card also being part of the proof. You get locked out after a sequence of failed attempts, so with a 4-digit only PIN the total chance of someone guessing the PIN is generally 0.03%, or 0.003% and 0.0003% for 5- and 6-digit PINs and less than 0.00025% when you have the option of 4-, 5- ...


2

The requirements for passwords which contain digits, symbols and mixtures of upper-and-lower case letters are predicated on the idea that the attacker has a copy of the hashed password. Since the attacker has a copy of the hashed password, the attacker can run millions and millions of guesses against it, based on probing innumerable dictionary entries, plus ...


1

The standard solution for secure email is exchanging public keys and using PGP. When you or the other party doesn't want to install PGP, a more convenient alternative is to put the data into a password-protected (encrypted) ZIP archive and tell them the password via another communication channel. However, keep in mind that some email servers might reject ...


1

You can use a web-based encyption service like Infoencrypt or Sendinc for sending your emails. They are free and they encrypt your email from end to end. There is also an extension for google chrome, SafeGmail, although I have never used it.



Only top voted, non community-wiki answers of a minimum length are eligible