Tag Info

New answers tagged

1

Okay, so you are trying to protect against an attacker who HAS access to your database from benefiting from it. If I was said attacker I would cycle through your user table and create new hashes for a standard password for all of the users. As you are using a salt that will mean that the hash table grows by the number of users, but since you have such a ...


0

If the server is performing the encryption and decryption then you have created a "promise not to peak". Once your application has been compromised, though legal or technical means, then this promise is voided. All of the suggested solutions in the above post fall into this category. In order for a users secrets to remain a secret, the secrets must only ...


1

TL;TR It really depends on the organization. Things to consider: How seriously do they take security? Is there a lot of travel that would lead to an increased risk of compromise? Is a stolen computer or physical removal of a drive a risk? The overhead for putting this into place is low. For a large company with lot of company travel it's worth it to ...


0

To paraphrase you: "these days" people also dump everything in cloud storage, and mail it all over the world. Once the files leave the encrypted disk, the only protection they have is the password. And since you are talking about 'an organization' it is hard to predict peoples' behaviour about this. Your users may be "expected to follow password management ...


2

An implementation of what you suggest has been a round for a while: it's called SecurID The clocks are synced and the token ID and clock are used to create a time-limited password unique to the token. In essence, an ever-changing password.


14

Welcome to the world of enterprise IT security. As you've found out, it's easy for security departments to make recommendations waving vaguely at "best practice". It's much harder to implement this on the ground. But you can address this, and you will get some benefits. One-click deployments - new releases should be packaged so they can be installed easily. ...


19

I haven't personally had to make this decision, though I do work in an environment where such separation of duties is implemented. Are you the owner of this business or are you working for someone else? Reason I ask is because realistically this comes down to a business decision. (barring the obvious infosec perspective of - "SEPARATE ALL THE THINGS!") ...


4

I agree with the other answers that the "security questions" really don't do much good. The theory behind them is that only you will know the answers to those questions, and they will be used to let you back in to your account should you have forgotten your password. Unfortunately, the answers to most security questions can be found online if the attacker ...


2

Security question is actually a misnomer as it doesn't really improve security of an account but is more like having a back door to the house. You don't have a key (password) to the front door, no problem, enter from the back if you know the number to open the combination lock. That said, the method you proposed is akin to requiring the same key for the ...


7

I generally dislike security questions in general; they usually ask for information that is more or less public. Mother's maiden name? Ancestry.com will tell you that. Your high school? Facebook, LinkedIn, any of a number of social media sites that use the info to suggest potential friends will not only have it, they'll advertise it if you aren't careful ...


0

One thing to consider is how the information might leak. If search indexing sees the file, your passwords might get stored in the search index. Or maybe the text editor you use will store temporary versions of any file it opens. Or maybe your virus scanner will scan any file you open and maybe store some information about it. Or maybe your OS likes to store ...


0

I think one of the main reason people advise to move away from Filezilla is clearly the fact passwords are stored as plain text and thus, easilly stolen. Filezilla bad reputation began some years ago when some malwares began to target specifically Filezilla. Using critical flaws in third party softwares (namely flash and acrobat reader) these malwares were ...



Top 50 recent answers are included