Tag Info

Hot answers tagged

60

Big data analysis means that your different usernames probably aren't as disassociated from one another as you think they are. In other words, they are likely all identifiable as yours. But perhaps the bigger issue is that if your password is compromised in one attack, then it becomes part of a password database the attackers can use against other password ...


16

if I use different account names in every service, then can I use the same hard-to-crack password in each? If the account names can be associated with the same person (i.e. different forums, same style of writing, similar content etc) then it does not matter if the names are different. And, contrary to the plain text or the hashed password the usernames ...


9

You should change your password when you suspect that the old one has been compromised. This is not a question of password age; thus, we are not talking about a regular password change, but about an urgent, context-dependent password change. Apart from a situation of (suspected) compromise, changing your password does not buy you much in terms of security. ...


5

I'm assuming here that your goal is (as @owen suggests) to stop the use of common passwords (e.g. password123) used by your userbase. This is generally a "bad thing" for security as you'll be artifically constraining password choice in a way that is unpredictable to the user. If you think about the end-user experience of this feature, would you give them ...


3

This is a risky idea. If someone manages to get access to your database and somehow cracks the encryption, they have access to the data of all users. Add to that that users often re-use passwords, and our hypothetical cracker has a treasure trove of valuable information. Resetting passwords may be a bit of work, but it is the safer way of doing things. ...


3

As with any question of "is X secure" the answer will, to some extent, be "that depends on your exact requirements from a security standpoint, the threats you face, the type of application and the environment that you'll deploy in" However with that caveat out of the way, I'd say that the scheme outlined above sounds relatively reasonable from a security ...


2

You really shouldn't. The reason why? Once a password common to several accounts is cracked, getting access is just a case of finding them. Since account names are relatively public, they are less well-protected than password data. A bit of innocuous research work would then give someone access to most or all of your online activity.


2

You are missing some points. If someone steals a copy of your Password Safe database file they will not be able to unlock it unless they also have physical possession of your yubikey (Even if they already know what your Pass Phrase is). Of course, if an attacker has a level of access to your system where they can read memory then you are screwed as soon ...


1

Basically what you added is like an old fashioned, physical "key" to your password storage. A "key" that no locksmith can duplicate. In your existing model the "passphrase" was the weak link. If you accidentally disclosed it, or someone shoulder surfed, or recorded your keystrokes, or you reuse it on an iffy website an attacker could get into your ...


1

The source code of password Safe is open source so you're free to do what I did: check. A HMAC takes two inputs: the key and the data. What PS does wirth the ubikey is take your input as data and send it to the UbiKey. The key is in the UbiKey itself ans stays there. So, the sequence of event is the following: You enter your passphrase. The software ...


1

The question here is always "what is your threat model?" It is meaningless to ask such questions without a proper context given by a threat model. Most of the time a different username is not as secure as a different password. Other times, such as spy vs. spy situations or duress situations, a different username can absolutely be effective. In nearly all ...


1

The simplest way that this could be broken is probably thus: One of your accounts has their password broken for some reason (we can take this as read, as if that never happens then just using the same user/pass everywhere would be fine too, so this is our starting point). Your hard-to-guess password gets put into a password dictionary. Your (not generally ...



Only top voted, non community-wiki answers of a minimum length are eligible