Tag Info

New answers tagged

0

The risk is you have one key on multiple servers (from what I understand). If it's not encrypted and someone who shouldn't have it got it, then you have a problem. That being said, AES is very safe if used with randomized IVs.


1

Make sure that these attempts won't become a DoS attack when you're under load. Attempting to access a phpMyAdmin page should fail quickly when it's obviously a vulnerability scan (especially if you don't actually use it). Some kind of blacklist of shady GET parameters would do the trick.


2

TLDR: Scan your systems first and build & configure them to be secure. Then continue scanning your systems for vulns and signs of breaches, and build a secure lifecycle. The scans demonstrate that someone, somewhere, is trying to learn about your systems ostensibly to break in. Assuming that you (and your organization) value the servers and/or what they ...


20

I ignore them. There will always be compromised systems continually scanning the entire Internet for arbitrary vulnerabilities. Trying to block them is no more effective than spitting into the wind. You'll get far more value out of focusing on the security of your servers and applications, and keeping an eye out for attackers who seem to specifically ...


0

You can store them in a Keepass database (with a good password). You can print them on paper, and keep that somewhere safe. You can create an Android VM in Virtualbox, install Authenticator and use that as backup for 2FA. In Amazon AWS you can use several of these accounts, but I don't know if Google allows this. That VM should be kept on an encrypted ...


0

For your application, I would suggest, storing the recovery keys on plain paper that you put inside a home safe. Thats enough security. They rather steal the phone or 2FA token from you if they really want your account. And physical attacks are very rare. Actually, you dont even need to put them in a safe. You can put them in the desk drawer at home. But do ...


0

You cannot ever trust a third party to verify password strength. Because what's important isn't the output of your password but your input. You can't assume that a password cracker it taking a purely brute force approach. The dictionary of common words is around 2000. 2000 ^ 3 is 8 billion, which could probably cracked in a negligible amount of time. ...


2

TL;DR: Rather write down strong passwords than remember weak ones. Always use unique passwords! Passwords for offline use should be stronger than for online use. You can use a password made of words if long enough, or take a long sentence and use all first letters as your password. For a password of a given length, a "random" string consisting of ...


4

A little test at the site you mentioned suggests they're considering length, alphabet, and brute force attacks only. The password you posted does indeed return an answer of 100 billion years. Changing it to "yummy candy yum" returns 'only' 49 million years. An eight character word, with or without numbers, returns eleven minutes. Adding one symbol ...


0

I am not sure how the website you posted exactly works; but this is my intuition; When you say the password is solely made of english letters; this might not be correct from the 'creator of the website' point of view. You used spaces in between the words; as you can see, these were also treated part of your password, it can be that the algorithm that assures ...



Top 50 recent answers are included