Tag Info

New answers tagged

2

Most businesses require employees to cooperate with thieves to the best of their abilities, along with insurance to replace anything lost during a fire, theft, or natural disaster. It is hugely more expensive to repair the bad press and pay your workers compensation (or worse, pay when your spouse sues them after you die)! It's just not worth it! If you ...


3

Sometimes we forget what counts: The system is protecting things, you and your coworkers are a people. When kidnapped, just cooperate and try to keep harm to persons as low as possible; it's just not worth it. With this corrected attitude, it doesn't matter what security system you pick, because it will only work with the thieves, not with the robbers.


1

From the blog post itself they state that unlike Google Authenticator, the Authy system actually generates new, separate keys for each device. As such I don't see any reason that they would need to store them so an attacker compromising their database should not be able to access them. An attacker who compromised one of your devices would have access to a ...


1

Yes it is possible. If tokens are server generated by creating a cryptographically secure random sequence stored against the account, this token could be refreshed and reissued on a certain interval, invalidating the old one. The token would only be refreshed on active use so it won't invalidate the old one when the client computer is off. This approach ...


0

Is it possible to implement a login system that protects against this scenario, while still allowing your user the convenience of "Remember this computer for 30 days"? No. To put it bluntly, it is impossible. That will be a huge, complicated and simply a non feasible task for an authentication system to fulfill. All what you can do is to be ...


1

The one-time token offers much more security than the secret question simply because it implements 2-factor authentication; all things being equal, 2FA (password + code via SMS, password + RSA SecurID token, etc) is always safer than a simple password. On the other hand, the infamous "secret question" - so often offered by web services as a security ...


1

Can anyone help me enumerate all the reasons that the one-time token is more secure than the security questions? To assess the security of a system we need not only praise its advantages but also its drawbacks. So I am rather focusing on this last aspect as you and @JohnWu mentioned the essential positive sides of OTPs but which are vulnerable to ...


5

Are there others I am missing? The one-time password has more entropy than dog's name and is less vulnerable to enumeration/dictionary attacks. On a phishing site, it is fairly easy to display some trivial personal question (e.g. what is your dog's name). The phishing site doesn't need to know the answer. On the other hand it is pretty ...


1

I think I have a better understanding of what you asking now: Having "a trust this computer" is not really a security weakness. This feature is to tell the company that this is a common computer you log in from and more of a user convenience. In order to have malicious software perform this check in your place, they would need to perform Session Hijacking. ...


1

There are different types of two factor authentication. Some types will protect against the threat you describe, others will not. Here are some common types of 2FA that will keep you protected against the key logger: Texting a one time use code to a mobile phone. Emailing a one time use code with the assumption that the user will not check the email on ...


4

It's not actual 2FA but 2-step authentication. As linked by StackzOfZtuff they are in fact plain SMS messages. The reason it's two step and not two factor is because two-factor would imply you need true possession of the object where the token is generated and there has to be assurance the token cannot be intercepted by another party. This is where SMS is ...


6

This really depends on the site, the level of information being stored, and the TTL (time to live) for the record. Google tends to handle a lot of different accounts for people: gmail, YouTube, blogger, Android accounts, search histories, contacts, calendars, etc; all of the stuff a spearphisher wants. Likewise their app, Google Authenticator, changes keys ...



Top 50 recent answers are included