Hot answers tagged

203

These 'security measures' aren't for your security, but for theirs. Symbols like hyphens, apostrophes, percent signs, asterisks, slashes, periods, etc. are useful to attackers for performing "injection" attacks, like SQL Injection, XPath Injection, file path injection, etc. By blocking those characters, the site owners hope that they are preventing you ...


119

That's what the envelope is (or should be) for: In order to use your password, one needs to break the seal of the envelope you signed. When you think your password was abused, you can ask to see the envelope with your signature and check if it is still unopened. All you need to do is that should your management ever require your password, change the ...


76

The question is why did they say that its insecure to allow symbols in passwords when symbols make it safer? More than likely you were dealing with someone in customer service that has no clue as to why certain rules were put in place and has come to the conclusion, either through using this excuse in the past and having results or making it up in ...


35

Because they're probably using input sanitation instead of parameterized queries and output sanitation. If they had parameterized queries, this would not be a problem. If they knew how to sanitize their output, this would not be a problem. More than likely, their code is vulnerable to a lot of other things, such as unicode-based smuggling. To many "secure ...


34

You can't. Your users are doing this because the reset mechanism has become obtrusive to them getting work done. People are clever enough to get around any of the mechanisms you're going to devise. Those that aren't will quickly learn from those that are. Information like this travels fast. If you somehow were to figure out how to counter the password1 ...


23

I don't think you are in a particularly worse situation than not disclosing your password. Your boss could: Get the system administrator to make a copy of your (hashed) current password Change it to something new Do something evil in your name Put the old password back (replace the hash back what it was) What does protect you is that there are, ...


14

Agree with your analysis that allowing symbols allows for more security, but generally it's not that much. Especially when compared to going to slightly-longer passwords (assuming the password is completely randomly chosen symbols). Using any of the 95 printable ascii characters: ...


12

A bit long fetched but… Say, John’s mother gets given a IPad for Christmas, she then decided to log into her bank using it (rather than her laptop), but can’t work out how to “type” the symbol on the IPad. So she asks someone to show her how to type her password….. Now think about the support issues with customers having passwords they don’t know how to ...


12

Password escrow as described in your situation is highly unusual and loaded with risks. The setup you describe relies on trusting your boss to not only be honest with their intentions and motivations, it also assumes your boss is storing those passwords in a secure manner. Are the envelopes kept in a safe? A locked filing cabinet? His desk drawer? A folder ...


11

Change your password immediately after handing him the envelope. You have fulfilled his requirement of giving him an envelope with your password, and you have fulfilled the need to keep it secure. In the unlikely event that he tries to use the envelope password, you can explain that you needed to change it and he had yet to receive the new envelope. In no ...


8

I would suggest giving each phone a name, then for the password use the keys on the num pad to represent the dots to hit. For example, if you have a swipe pattern in the shape of an L (starting on top left), your password would be 74123. If you go with every dot in a "Z" shape (starting on top left), the password would be 789654123. Most can't store ...


7

Some of the symbols may not be available on all keyboard layouts you interact with. That would prevent you from logging in. This would be a problem for availability, not for security. But this could become a slight problem of security if the symbol in question were available on an unfamiliar keyboard layout you are working with, but not in a familiar ...


7

Philipp is correct here. Let me restate something he said: In order to use your password, one needs to break the seal of the envelope you signed. When you think your password was abused, you can ask to see the envelope with your signature and check if it is still unopened. To add to what he's saying, your company appears to have grossly incorrect IT ...


5

Easy enough: You have a prospective password of "password1". Test "password" and "password0" to see if they work with the old hash. There's no need to see the plaintext of the old password for this to work. However, this isn't going to work for the reasons Steve Sether lays out.


5

This has been discussed at various points, and most discussions seem to come back to the concept of password topologies - the patterns which lots of passwords have. There is a good OWASP presentation on YouTube, which suggests that a lot of passwords which have to follow complexity rules follow similar patterns: Password1! - If you enforce at least one ...


4

Number the dots 1-n like a phone key pad and record the sequence of numbers.


4

Your argument is: 1. a randomly generated password with symbols is stronger than a randomly generated password of the same length with just letters and numbers 2. therefore allowing symbols in passwords make them stronger. This is valid if and only if people generate passwords randomly. Let's however compare a password created with the following algorithm: ...


4

Most people can't type symbols without slowing down and pressing multiple keys at once, so there is a small decrease in security if you're trying to type where you might be observed by a human.


3

It is straightforward to prevent the specific problem of user's updating new passwords that are too similar to previously used passwords (e.g., only a single digit/character changes). On the same password change screen, simply require the user to enter their old password, as well as their requested new password. It is good practice anyway to require users ...


3

A password manager allows you to set extremely complicated passwords that are unique for every site. If left to a human brain, we would most likely reuse or use a variation of similar passwords since there is a limit to how much we can remember. Remembering one very complex master password is easier than remembering many complex passwords for different ...


3

This should be completely unnecessary in a properly configured system, assuming you log on to a corporate domain. In a properly configured system, logging on to a corporate domain, any data you edit, create or have access to on the network or on your local system, will be stored in a location accessible by others who each have their own login credentials ...


3

What's the best way to store passwords? This is a very broad subject that encompasses many different areas of IT. It also has the tendency to be opinion-based. However, there are some very important things we can know, and then use to make an informed decision. Also, there are many different ways to handle passwords. What size company? Small? Medium? ...


3

This is unfortunately common in small companies using cloud services, without having a business relationship with the cloud provider. Mark the envelope to make it a bit more tamper proof, that's it. A former company of mine still uses my personal e-Mail address in their domain, the never managed to change their domain registration after I left. Change the ...


3

Let's call it what it is: a workaround for lack of proper access control. The real solution is to fix/improve access control. Specifically, here: Why can't your boss access the things you can access with his own account? The only purpose of credentials is to authenticate an identity. If we break that, they become useless. You might as well remove the ...


2

This is kind of tricky. Its easy to enforce complexity because complexity is relativley easy to discribe but a complex password is in many cases not a good one. For example if your policy forces a min. length of 10 characters, a special char, a number and upper and Lower cases many people will do this: David1989$ Which is the first Name, the year of birth ...


2

From the comments, it sounds like the core question is, and please do comment if I'm wrong here: "We have a centralised authentication provider (LDAP) and multiple applications which end users authenticate against this. Is there a way of making it so that if the user changes their password on one of these applications, the change can automatically be applied ...


2

Since password restrictions are usually defined by people with a strong technical background but zero insight into psychology, the status quo ultimately decreases security. What security guys fail to understand is that the users do not have to memorize ONE password. One might think "a person should be able to memorize one password, even with my crazy ...


2

You are looking for a MDM (Mobile Device Management) solution: Mobile device management (MDM) is an industry term for the administration of mobile devices, such as smartphones, tablet computers, laptops and desktop computers. MDM is usually implemented with the use of a third party product that has management features for particular vendors of mobile ...


2

Sounds like you're trying to implement something like single sign-on between two of your apps. In this case, you should be able to without any significant security issue. Instead of authenticating with login credentials, you could have App B authenticate with App A's session ID. Obviously give the ID the same protections you'd give login creds, i.e. only ...


2

XML / Json Hypothesis: May be the password is sent to a webservice (hopefully through a safe channel) and they found that special characters resulted in invalid XML or Json. Instead of escaping entities they restricted all symbols. One security issue is that if you are able to use the escape characters " in XML and \" in Json and the XML/Json is ...



Only top voted, non community-wiki answers of a minimum length are eligible