Tag Info

Hot answers tagged

25

You can use source code as password. However I'd strongly recommend against using source code as a passphrase. The reason for this is entropy. Passwords / passwphrases need to provide lots of entropy (100 bits+) and programming languages usually pose severe constraints on the formulation of instruction thus resulting in less entropy per character than even ...


18

Like most password generation algorithms, this one relies on security through obscurity. As long as nobody suspects that you use this method, nobody will use a cracking tool which tries random valid source code snippets and the rule of strength = possible_characters ^ number_of_characters will stay valid. But as soon as someone suspects that you might be ...


8

It looks like GMail knows the hashes of earlier passwords for users. While this is not true in your case, treating it as a special case would cost the developers time, and it would provide attackers a clue about your password habits. It is a good thing that GMail doesn't advertise that you never changed your password.


3

As a countermeasure against phishing emails. Such emails will look like legit email asking you to change or update your password, but their link will direct you to a false website (still looking as legit as possible, with URL such as micr0s0ft.com: here the letter 'O' was replaced by zeros '0', it looks like "microsoft.com" but it is not "microsoft.com") ...


2

I also could not find any password storage policies that mention that passwords should not be upper-cased. But I also didn't find any guides which told me not to set every password to "password", not to remove all special characters, or not to shorten them to 4 characters. It's just obvious. You should not change the password that the user supplied. This ...


2

Beyond the obvious "don't make it more complex that you have to", there are tow reasons why a password recovery process shouldn't attempt to tailor the challenge to the known data: It is a form of information disclosure (in your case, it would indicate that the password has not been changed since it was created) It doesn't actually change the result of the ...


2

Many email clients protect the password in similar ways to a password manager (and some do not). No flaw in your logic, although once you get malware designed to steal password manager passwords, all bets are off anyway. That's once reason why 2FA is so important. By setting up 2FA, even if malware gets your email password, they cannot use it apart from ...


2

To answer your two specific examples: Most Western computer systems don't have fonts with complete coverage of CJK characters, and when they do, the appearance isn't always correct. Having a password displayed to you as a series of boxes isn't particularly useful, and worse, some programs will replace those un-displayable characters with substitutes, ...


2

It is true that if your password is compromised, your access to all other systems in the directory goes with it. However, there are other differences that make the practise of password reuse a completely different ball game: Directory: Once the breach has been reported, the account can be disabled or the password changed from a central location. Separate ...


2

By default, the htpasswd utility tends to use an Apache-specific hashing password called "apr1" and documented here. It seems to be a custom construction that invokes MD5 1000 times. Assuming that there is no structural weakness in that construction, the attacker can still try out passwords at a rather fast rate. As documented here, an AMD R9 290X GPU is be ...


1

At first glance, this seems like it might be a good idea. Like many suggestions relating to passwords, in some situations it may even be an OK solution. However, when you consider it in more detail, a number of shortfalls become evident. If I was trying to crack someones password, one of the first things I would do is try to find out as much information ...


1

The two main methods that I have considered for this are: 1. User Defined Questions Most of the default questions I see on sites seem to be the same or very similar, easily researchable through social media, etc. I would generally think that allowing users to write their own security questions would be better with some guidance. e.g., "Come up with two ...


1

It's best to use a method that would stay secure even if everyone used it. You'll have less to worry about and it lets you collaborate with others in tweaking the method to be the most secure, because you don't have to keep your methods secret. This "the enemy knows the system" approach is a huge motor for innovation and advancement in information ...


1

You can deal with your password problem with some variation of challenge-response authentication: done properly, it prevents replay attacks, and since the password itself is never sent, a hostile server or man-in-the-middle can't trick you into revealing it. The problem you're going to run into is verifying you're connecting to the server you think you are. ...


1

Is it safe to signup on multiple applications with single email address? The same thing applies here too. One thing is when you sign up on other applications through social networks, your circle may get notifications of your activity. If you have privacy issues, you can set your social media settings to private. Keep your passwords and security questions ...


1

The problem I see is that while you're going to a lot of effort to avoid transmitting the users password, saltedSecret has essentially become a password. The main threat to a transmitted password is that a man-in-the-middle (MITM) will be able to observe it (in the absence of any other forms of encryption) and log into your system. If we look at how a ...


1

An historical example of such a poor algorithm is Microsoft's LM hash. As you said Felipe, in order to create a strong password, you need among other things to mix uppercase and lower case letters. Why? Because by doing so there can be 52 different possible letters constituting each character of the password: 26 lowercase + 26 uppercase. By converting the ...



Only top voted, non community-wiki answers of a minimum length are eligible