Tag Info

New answers tagged

2

Hashing is indeed the opposite of what you are looking for (any change in the input leads to a completely different hash). You could try a perceptual hash instead. As a side note regarding your hash/salt attempts: why would you need salting? It is not like someone could reconstruct the original document (similar to reconstructing a password and comparing ...


5

This is usually a combination of luck, technology and hand waving. You may see that your database server was hacked (via unusual activity for instance, gigabytes being transferred to Internet, a fact detected by, say, your network provider). You may then have logs which trace activity on the database (ranging from "someone accessed the DB" to actual ...


2

I think you are missing something -- for the OPM break in, the problem was that they stole a live credential. That is very useful. Having said that, note that no password should be useful. In theory, every worker is issued a smartcard that hosts an e-auth level 4 authentication mechanism in their Personal Identity Verification card. (This is the FIPS 201 ...


19

What's the point of stealing hashed passwords? Let's say I steal a hashed password, I can take a random string, hash it, and see if the hashes match. If they do then I've just cracked your password. For example, assume that under some hash function we get the following hash table: "cat" --> AA "dog" --> AB "elephant" --> AC ... If I steal a ...


7

The login credentials were found in password dumps from other sites. They were credentials where the username was a .gov email address. The concern is that people tend to reuse passwords and the passwords used on these sites are the password for their government login credentials. Either the passwords were stored in plaintext or the hashed passwords were ...


1

By defualt WordPress usernames are not a secret by any means. As the other answers point out there are many ways of finding the usernames either by URL or even inside the content of the page itself (author class names). There are numerous methods of hiding usernames and/or fighting against brute force attacks, but the simple answer to your question is that ...


3

I had the same problem and blocked the requests for the author scanning with the following htaccess: # Stop Author Scanning RewriteCond %{QUERY_STRING} (author=\d+) [NC] RewriteRule .* - [F]



Top 50 recent answers are included