Tag Info

Hot answers tagged

20

It's a long question but I think your main point is this: We wish to simplify the accessing of the cameras over multiple devices (tablet, phone, PC?). First have a look how SSH keys work. That would work for you mostly as it is. At first the customers public key is added into his camera during the initial configuration. He can authenticate himself ...


12

Short version: /etc/shadow contents will tell you what format each user uses, but needs root to see them - @MikeScott nails it. /etc/pam.d/* files will tell you what format a system encodes new passwords with, and should be accessible to regular users, which may be all you have. Long version: Most modern Unix and Linux systems use PAM, the Pluggable ...


10

If you have root access, use it to cat /etc/shadow (on most Unix flavours) and take a look at it. The second field in the file is the hashed password for each user, and it is generally separated by $ signs into three parts, which are the hashing algorithm, the salt and the hash itself (if it doesn't have the first section then it's using the default hash ...


9

You should at least hash the passwords. Use a secure hash function, e.g. SHA-256 to hash a password and store it like this. When generating a new password, you can send the user the new password, but hash it and store the hashed version in the camera/database. When checking if password is correct, hash the password that has been input and compare it to ...


6

What I would consider a proper design is one in which the services you host and the hardware you sell are not too tied to each other. The customers should be able to use those two products separately if they so choose, and I for one wouldn't buy a piece of hardware that I would no longer be able to use if the company which sold it went out of business (or ...


5

There are three reasons I can see why this assumption is dicey. Hooks are only removed in Windows 7 and above. This is probably the least of your concern, but worth mentioning. The hook is silently removed, and your application has no way of knowing if these actions occurred and/or were successful. So even if your assumption is correct there is no way ...


4

Storing default passwords in cleartext Is it insecure? Yes. Is it avoidable? No. You need a way to provide the user with his password. It it manageable? Yes: disallow remote access with a default password set. At this point, you might as well revert to using a standardised default password. It would save you a lot of hassle and customer service work. ...


4

First off, for as much as possible you need to switch over to something like Windows Active Directory or using LDAP* for internal permissions. That way, users get permissions based on a central repository, don't know other users passwords, and you can audit who is able to - and who did - access what. I'll assume you aren't in a regulated industry (if you ...


3

Google's application password is computer-generated, and so likely to be much stronger than a human-generated password. That is OK because the generated password is stored by the device, not memorized by a human. Google's application passwords appear to be 16 lowercase letters. That gives 4x1022 combinations. An attacker who can try ten billion ...


3

I am of the impression that you require an automated method, I would recommend using SMSes to send the information to your clients. There are a number of number of web based SMS APIs out there such as Twilio and Plivo. They might not be free but the cost is generally in cents. You would preferably want to generate a new password and send it to them. For ...


3

So what is this computationally feasible way to test a password for similarity to previous passwords without storing previous passwords with reversible encryption? Would it require applying any or all of the following simplifications to the definition of similarity, and if so, would those simplifications compromise the password system's security in ...


2

If you want to prevent your own employees from accessing the camera or saved streams without customer's permission, you'll need to encrypt the video stream before the stream is sent out to your server for remote storage on your server. The stream should be encrypted with a session key, the session key is then encrypted again, once for each of the customer's ...


2

I am not 100% sure of what I am about to say, but most likely it is correct. Messages are dispatched from source (S) and travel to the destination (D). Hooks (Hx) are logically located between those 2 points. Hooks can be used to process the travelling message for whatever purpose (for example, traffic filtering). With this in mind, we can visualize a ...


2

I don't think you are missing anything obvious. The other article's question and answers actually focus on stopping the key logger sending messages out of the network. The technique you're talking about is how an application, which knows it may be a target for a key logger, may stop the key logger getting the information in the first place.


2

I'd like to suggest that you consider why people change passwords. It could be because the user believes the password is compromised, or "because security;" the system is forcing regular changes in the belief that such changes somehow improve security. I would argue that a strong password needs to be changed only in the case of compromise. Further, there ...


2

This is a difficult question to answer, since there's no technical reason why this is true, so you have to speculate why the developers haven't chosen to address the problem. There's a couple of possibilities, but mainly it's one of compatibility. SSH is 20 years old now, and has had a stable format for key storage for a long time. If you suddenly changed ...


1

Without a master of some kind for each password there's no way to actually check if you're correct short of using it to log in. This means if you're wrong most sites will lock you out, so I don't recommend this. That being said: Preparation USE A PENCIL. Make one flash card for each site that lists the site's url, i=0, l=today's date, n=today's date ...


1

Is there a security risk? No. Is there a security advantage? No. Using HTTPS means that the password is protected in transit, and that it is being sent to the server you intend to. Hashing the password client-side and sending the hash gains nothing: an attacker in a position to look inside the SSL tunnel and steal a plain-text password (eg. malware ...


1

The latest version of msed had been pushed to github with executables at www.r0m30.com/msed. The 0.20beta release has a PBA for bios machines and the ability to load it after activating the locking SP. I'm still developing some real documentation but the announcement contains some quick and dirty instructions for activating OPAL 2.0 hardware FDE using ...


1

Some of these answers are pretty dated, but the subject is important enough that I think it merits revisiting. LastPass assertion is that they offer a Zero-knowledge proof implementation - i.e. the encryption happens client-side (with the password being the key) and that they, presumably, cannot decrypt the data even if they wanted to. If they're served ...


1

If reasonably strong passwords are used it doesn't. Passwords should be changed regularly though, because they can eventually be cracked offline if an attacker has managed to extract hashes from the database. If an attacker has managed to do this undetected, you have bigger problems, however I can see this being entirely possible on many systems. Most users ...


1

Basic answer: don't do that! Our current model at my employer is fundamentally flawed in my opinion Your opinion is totally correct. Storing passwords in a file like this is A Very Bad Thing. Anti-weakpasswords is also correct: the first thing you should be doing in this situation is to implement a "proper" corporate access control infrastructure. For ...


1

You can choose one of the available fonts by following this path: Tools/Options Once there, choose the tab called Interface.


1

Depend on your purpose, I would recommend 2 different approaches: Sending login credentials Avoid doing this if possible. If you have no choice, then you should at least try to protect these information on 2 fronts: 1. Protect it from a malicious party from intercepting and read the information and 2. Protect it from an insider threat, e.g. a malicious ...


1

Send them the username and a link to a "Setup / Reset password" page. The Setup/Reset Password page would ask for the username and some other identifying information (e.g. Phone Number, Zip Code, Client Number, etc). If authenticated, the client then gets to setup a new password for themselves. As an additional layer of authentication, a confirmation code ...


1

Passwords are stored as one-way hashes if done correctly, so you can't send them those. And if you can, make it your top priority to not be able to do so. Password reset workflows through SSL are the way to do that. For other sensitive data, I'd keep it simple and just require them to log into your system. If not knowing their password is what prevents ...


1

If you have no idea about where to start, I would highly recommend using an existing provider (for example, Authy). More info about a standard for time-based codes here — https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm — you can also search for existing open-source libraries based on terms used on that Wikipedia page.


1

The topic is quite broad, so I'm not aware of a generic "best practices list" which addresses your questions. The topic quickly becomes very platform-specific. Very generically: do check your specific scenario you're trying to defend of. There is no silver bullet. restrict (file) access permissions to those who do need access to that file. Password-based ...


1

The proposed technique isn't very helpful against keyloggers for two reasons: It relies on the fact that the newly installed hook is executed before the keylogger's one so it won't always work even with hook-based keyloggers. What is more important, only the simplest of keyloggers use SetWindowsHookEx. There are over a dozen different methods ranging from ...


1

There have been a few "encrypting text editors" around for a long time. I don't know what kind of longevity most of them have, really. UltraEdit will encrypt text files and it's been around forever. A short search sort of turned up these alternatives: http://www.ultraedit.com/support/tutorials_power_tips/ultraedit/encrypt_decrypt_text_files.html ...



Only top voted, non community-wiki answers of a minimum length are eligible