Tag Info

Hot answers tagged

3

If you are allowing people to use personal accounts for external services like dropbox, you really have no control and you do not own those. Most services that offer a corporate or business version have the ability to set one or more administrators, and can disable the accounts through this interface. From a process standpoint, some organizations do this by ...


2

Short version: Your solution sacrifices logging and auditing accountability, just so as you're aware. If direct root login is a problem, use a generic non-admin user to ssh in and then sudo to root. If you want to be clever, configure sudo (via pam) to prompt for a human-specific username and password so that local privilege escalation is tied to the ...


2

I recommend that you do not permit direct login as root via ssh on any system. As mentioned in gowenfawr's comment above, it is better to have personal accounts for everyone who will be administering the system on all of the nodes, and give them access to sudo to root locally. They would not need a root password on any node for this; they would use their own ...


2

The credentials may be shared for the whole network (eg. LDAP credentials), allowing access to the local computer, mail, remote access… Also note that Phishing OS credentials is very different than phishing a website. You don't go back to a computer and fill an Email prompt without even logging in (actually, I don't think many company users enter their ...


2

The system-attention-key is mostly an historical remnant from the youth days of the engineers who designed the SAK. These engineers, when they think about security, actually think about the times when they were dabbling in security, and that was when they were students. More precisely, when they were students in the 1990s. That last item is important: in the ...


2

I would not recommend doing what you are trying to do. As you pointed out, the question/answer is much less secure than a normal user/pass, and security is only as effective as the weakest link, and obviously this sort of implementation is the weak link. Also, as an aside, it may be difficult to remember which security question was originally selected. Your ...


2

In this circumstance, it seems like the security answer effectively becomes an alternative password That's right. Which is also why this seems like a really bad idea. It will only work as a feature if the question is something simple, something the user will know without having to remember it, which means that an attacker can figure it out as well (by ...


2

I also could not find any password storage policies that mention that passwords should not be upper-cased. But I also didn't find any guides which told me not to set every password to "password", not to remove all special characters, or not to shorten them to 4 characters. It's just obvious. You should not change the password that the user supplied. This ...


2

Protecting the root account makes cleanup much easier: if an attacker can't tamper with the kernel or most of the programs, it's much harder to hide malicious code. It also means they can't tamper with the antivirus and other protection systems.


2

Well I would have to say that this is less secure than a standard password even though a initial glance shows that the entropy will be far greater You are limiting answers to "dictionary words" and more often than not a small subset of them ( for example what was your favroute childhood food would have less than 20,000 possible options and I would say ...


1

An historical example of such a poor algorithm is Microsoft's LM hash. As you said Felipe, in order to create a strong password, you need among other things to mix uppercase and lower case letters. Why? Because by doing so there can be 52 different possible letters constituting each character of the password: 26 lowercase + 26 uppercase. By converting the ...


1

To put you on the right track, we must first take you out of the wrong track. In your case: If you think "268 + 268 + 108", then you are thinking wrong. That would be the count of possible passwords, assuming that a password is either a sequence of eight uppercase letters, OR a sequence of eight lowercase letters, OR a sequence of eight digits. But that's ...


1

Here's a little drawing: And the study that support it.


1

Services such as LastPass have an auto change password feature. However, this has to be done per site. The solution of bulk updating everything is to a problem that should not exist in the first place. i.e. Passwords should not be shared between applications. Each service should have a unique, strong password of its own. Otherwise if one service gets ...


1

Interesting topic, for me the safest is password, I use 4 different passwords for different things depending on the security required, for example for a site like this I will use something like (mexico1970) which I dont care if it gets cracked since I just post to the site and there is no credit card info or any other important info to protect, then I will ...


1

While this is an interesting idea, I would suggest keeping it normal as you have it but give users option for 2 factor authentication in their account settings. In this when a user successfully enters their credentials, they would be emailed a link to click / follow. Once followed their session would be started. You have to assume your clients are stupid, ...


1

I think there is a serious flaw in your suggestion: unless I miss my mark, your "salt" isn't a salt at all: it's a challenge and, as such, it should be randomly generated each time a client attempts to authenticate. If this is the case, then you cannot use it as input for the pbkdf2 function. It will just not work. If it is not the case, then unless you're ...



Only top voted, non community-wiki answers of a minimum length are eligible