Tag Info

Hot answers tagged

4

As I've already pointed out in my previous comment, this attack has been foreseen and already countered (by most cryptography using applications). The way you do this is, you (the developer) tell the operating system (OS) not to swap out this particular section of the memory. The OS will usually honor that and "make a note" somewhere in the memory manager ...


3

There is sometimes a trade-off between security and usability. If it's important to you or your users that other people don't know they're using the site, then your second choice is the best one. You can always send an email to an address that doesn't exist in your system, like "Someone requested a password reset for this address, but it's not in our ...


2

Argon2 the winner of the PHC also allows for client side hashing. Note that this is an additional feature, and doesn't make Argon2 to a fully fledged authentication protocol. The PHC has awarded it as password hashing algorithm, not as authentication protocol. Isn't Secure Remote Password Protocol (SRP) pretty much client side hashing? For SRP, ...


2

First, don't store the SHA256 of your master password! See this answer for how to store the hash of the master password. Onto your question... Salt is used to prevent the attacker precomputing the hashes for many/all possible inputs. In the specific case of storing the hash of the master password, a sufficiently large and random salt will prevent an ...


2

The answers so far are good but it's important to note that from a profiling point of view- I don't care if I don't get in to their account but the knowledge they're using a service is enough to social engineer a situation/monitor their social feeds for potential passwords (pets, kids, cars etc). That being said, during user signup it would be a bad UX ...


1

If we assume that the content of the input files is random, we can view your proposal as using MD5 as a PRNG algorithm and using the input files as the seed to the PRNG function. So your question becomes: Is it secure to use a PRNG algorithm, whose seeds are stored on my disk, as a password generator? The answer to that is clearly no because all of the ...


1

Advantages over a password manager: Little to none. Security problems: Your password generation technique would be logged in command history. Any file access mechanisms would record access to these files every time you log in. Your password would be visible on screen every time you needed to use it. If any files change without your knowledge, your ...


1

So I guess as a primer we need to consider what an attacker can actually do if you confirm / deny existence of an email on your system in some easily accessible way. This is a possible scenario: An attacker has gained access to a database of compromised email addresses + passwords. (i.e. they can log into any of these user's emails) They want to gain ...


1

You are correct about this assumption: an attacker could analyze the swap of a hard disk looking for the passwords. It is for this reason that decently-written password managers make sure that the password is always kept in RAM and never swapped on virtual memory.



Only top voted, non community-wiki answers of a minimum length are eligible