Tag Info

Hot answers tagged

18

You cannot reasonably prevent "sequence passwords" unless you have a human administrator inspect them (which would have its own set of security issues, not even considering the expensiveness of human labour). You can try to automatically detect such patterns, but you cannot hope to find them all; besides, if you only keep hashes of the previous passwords, ...


11

I too have tried to come up with a good solution for this. But I found https://onetimesecret.com/ which works great. Basically you create a link containing a password and you send this link to the intended recipient. As soon as the receiver clicks on the link, the link expires and the password is deleted. So the receiver only has one time to copy the ...


10

On most Unix systems the command line is visible to all users, via the ps command. This may not matter greatly if you're on a single-user system, but this is the reason that this approach is generally labelled as insecure. For example: MySQL manual. A better alternative is to store the password in a file, which avoids this leak. You need to make sure the ...


7

The problem you're running into is that GET is supposed to be both "safe" and "idempotent": that is, calling it isn't supposed to make any change on the server, and calling it many times should have the same effect as calling it once. From a standards standpoint, you should be using a POST to use the token. Obviously, you can't do that from an email. One ...


7

There are a few different ways to check whether users' old and new passwords are similar, and each has its own strengths and weaknesses. String Permutation Comparison The first approach relies on creating a list of permutations that are not allowed. This might be a list of regular expressions or some similarly defined string changes that you evaluate ...


4

If you don't have permission, breaking into someone else's network is illegal regardless of why you're doing so. If you really want to learn about the security vulnerabilities of WPA-PSK and WEP, I recommend setting up your own AP and practice breaking into it.


3

This basically looks like something along the lines of PBKDF2 or sha512crypt, only with a bunch of "cryptographic voodoo" applied. Salts have a very specific cryptographic purpose: to tie an password-guessing attempt to a single password instance. Having company-specific salts, user-specific salts, per-iteration salts, and (to steal a snark) hand-harvested, ...


3

There is no foolproof way to ensure secrecy, but you can make it quite difficult. One may assume that all electronic communication is constantly monitored so is insecure. However physical mail is certainly not going to be intercepted unless the sender or recipient is under suspicion or is being observed. I suggest you write the password down and mail it in ...


2

You can't recover it that way, but you could try dumping the password hashes (assuming you're talking about a local account). If you can't break the hash, you can simply replace it with a hashed version of another string. Maybe try using HBCD? Unless your disk is encrypted.


2

Unless you had a keylogger running, there's no way to get all the data you typed on your keyboard.


2

I would personally disagree with the storing of plain-text passwords is ALWAYS bad, because it depends on the application or purpose of the password being stored. Generally speaking, yes, storing passwords in plain-text is a poor security choice for all of the obvious reasons. However, that doesn't mean it is a super-bad choice in all circumstances. If the ...


2

Short answer, it’s never ok to store plain-text passwords and doing so is a bad practice. From your description, there is limited risk associated with the organization supporting the app because there’s no compliance or direct monetary risks attached. That risk is passed on to the users. It’s possible for the users of this software to have their passwords ...


2

Possibly. It's not immediately clear if you are relying on the email address as the sole identifier (i.e. you're using it as the username) or if a separate username is in play. If the latter case, then the obvious flaw is that an attacker can supply the username of someone else, but provide their own email address as the destination for the recovery ...


2

For sending not very sensitive stuff, eg. holiday family pictures I place an encrypted ZIP file on my dropbox and send an email with the link. In the email I describe the password verbally, using information that is hard to know to the public, but easy to know for the recipient. Much like you do. However, in my experience, unzipping an encrypted ZIP file ...


1

This is similar in functionality to using an algorithm to generate password information. Since you provided an example site: http://hash.tknetwork.de/, we can describe how you might generate a new password when you are required to change it. You can add an integer, date, or other value to the 'parameter' to iterate it You can have multiple master keys ...


1

Just to be clear, there is something else called password hashing that is completely different to what you describe, so that is a terminology collision, which is unfortunate. To handle "exceptions", you must have some storage. One method could be to store (e.g. in a local file) a map from server name to some string, e.g. an integer. The scheme would be: ...


1

Short answer: Nothing can stop the users from changing the passwords in some predictable sequence. Detailed answer: You can try various ways of detecting sequential password changes, but users will always find a simple sequence pattern that you haven't foreseen. If not number suffix - then number prefix, if not numbers - then letters. If not suffixes and ...


1

If you store previous password hashes you could potentially check to see if the current password is a variation like you suggested. Say your users previous password was: password = 5f4dcc3b5aa765d61d8327deb882cf99 If you store previous version of password hashes, you can compare variations of the new password to determine if it is different enough. So ...


1

There are a number of different possibilities that you can implement to try and curtail password permutations. One of the best ones that I could find was actually on stackoverflow: http://stackoverflow.com/questions/21031661/how-do-you-test-if-two-hashes-passwords-are-similar The only problem is, you have to store a ton of password hashes. You can also try ...


1

The entropy of a password doesn't increase proportionally to its length. The entropy may decrease because pattern regularity of the password increases or because the password is approaching a dictionary attack vulnerable point. Here is the result of a blind test with the Google password strength estimate. The tested password entropy is decreasing with ...


1

If your not opposed to snail mail... I know that the military uses DHL mailing service with tracking in order to ship sensitive material. You could write down the code seal it in an envelope which you then hand sign across the seal. Place that envelope inside of another manila envelope which is not see through and seal all edges of this envelope with ...


1

You seem to talk about two different things: retrieving mail and encrypting mail. From reading the question I think encryption is not what this is about. So for now I forget about it. When you login to Hotmail or Gmail via your browser, you use your login. It looks like you have more email addresses and possibly popboxes. Now it depends on how you setup ...


1

Updated There are many variation on how you could implement what you have requested, they all have pros and cons so it really depends on your business requirements as to which is the best. Keychain: Prompt for group password and cache The least complicated way would be to ask the each user for the password and then cache the group password privately for ...


1

We are talking about the database of a bank, and that's not your average database. It's a special kind of database, when every step is audited, every alteration is logged. So a database leak is very, very unlikely. If someone can get access to the bank database, why bother with PIN or password for any user? They can go direct to the money. The reason to ...



Only top voted, non community-wiki answers of a minimum length are eligible