Tag Info

New answers tagged

1

If we assume that the content of the input files is random, we can view your proposal as using MD5 as a PRNG algorithm and using the input files as the seed to the PRNG function. So your question becomes: Is it secure to use a PRNG algorithm, whose seeds are stored on my disk, as a password generator? The answer to that is clearly no because all of the ...


1

Advantages over a password manager: Little to none. Security problems: Your password generation technique would be logged in command history. Any file access mechanisms would record access to these files every time you log in. Your password would be visible on screen every time you needed to use it. If any files change without your knowledge, your ...


2

The answers so far are good but it's important to note that from a profiling point of view- I don't care if I don't get in to their account but the knowledge they're using a service is enough to social engineer a situation/monitor their social feeds for potential passwords (pets, kids, cars etc). That being said, during user signup it would be a bad UX ...


1

So I guess as a primer we need to consider what an attacker can actually do if you confirm / deny existence of an email on your system in some easily accessible way. This is a possible scenario: An attacker has gained access to a database of compromised email addresses + passwords. (i.e. they can log into any of these user's emails) They want to gain ...


3

There is sometimes a trade-off between security and usability. If it's important to you or your users that other people don't know they're using the site, then your second choice is the best one. You can always send an email to an address that doesn't exist in your system, like "Someone requested a password reset for this address, but it's not in our ...


2

First, don't store the SHA256 of your master password! See this answer for how to store the hash of the master password. Onto your question... Salt is used to prevent the attacker precomputing the hashes for many/all possible inputs. In the specific case of storing the hash of the master password, a sufficiently large and random salt will prevent an ...


0

The biggest problem I see is that it doesn't help against offline attacks, or it hurts them. You had better be salting and hashing the password, or else you're dramatically weakening the password security. And if you're doing that, then this has to be done by an external call, and all that remains is security by obscurity.


-1

Use SSH Keys. There is just simply alternative, which is the reason you will not find any other solutions used in datacenters. Create key: ssh-keygen -t rsa -b 4096 Copy key to server: ssh-copy-id <user>@<servername-or-ip> Finish and secure the server: ssh into the machine, and edit /etc/ssh/sshd_config such that PermitRootLogin is set to ...


0

In addition to the excellent answer given by Thomas Pornin in the linked question, I would add that for security reasons in your case you probably want to do some hashing on the client side, and some hashing on the server. The reasoning goes like this: Pros of server-side hashing: Lets' say you only do client-side hashing, then you are taking the string ...


0

I would definitely hash before the upload. If a user device is connected to a network with someone sniffing packets, a plain text password being uploaded is easily read. Not very secure.


4

As I've already pointed out in my previous comment, this attack has been foreseen and already countered (by most cryptography using applications). The way you do this is, you (the developer) tell the operating system (OS) not to swap out this particular section of the memory. The OS will usually honor that and "make a note" somewhere in the memory manager ...


1

You are correct about this assumption: an attacker could analyze the swap of a hard disk looking for the passwords. It is for this reason that decently-written password managers make sure that the password is always kept in RAM and never swapped on virtual memory.


-2

The answers about encryption are not wrong, but the approach is wrong. You should not encrypt. You should use a one way hash function. This means that you do a NON-reversible mathematical operation on the password, and store the result. When someone wants to log in, you perform the operation again on the password they supply, and compare it to the result on ...


2

Argon2 the winner of the PHC also allows for client side hashing. Note that this is an additional feature, and doesn't make Argon2 to a fully fledged authentication protocol. The PHC has awarded it as password hashing algorithm, not as authentication protocol. Isn't Secure Remote Password Protocol (SRP) pretty much client side hashing? For SRP, ...


0

"Secure Remote Password Protocol (SRP)" isn't "pretty much client side hashing" since SRP is a candidate PAKE protocol, so with it, the alleged server shouldn't be able to learn enough to log in. Those systems don't "avoid the plaintext equivalence problem" since the login process just consists of two messages and the server's message is predictable, ...


0

Based on the information which I've found on-line so far, the following statements are true: Passwords are always encrypted source. Chrome uses your Google Account to encrypt your synced passwords source. Whether or not you use a passphrase, your synced data is protected by encryption in transit. Your Chrome sync passphrase is stored on your computer and ...


0

You can see how banks probably do it, but the security really depends on the weakest link and personally I'd pay much more attention to web security (XSS, CSRF etc). It will be much better if the front-end is responsible for decrypting so both the master key and the clear-text passwords never exist in server memory or the network. This however limits the ...


2

What you are trying to do is to add an additional "security by obscurity" layer on top of the normal authentication layer which is the "security by design" layer. Yes, it will increase the amount of work an attacker must perform. There is a simpler solution to achieve the effect which you desire. Keypass allows you to use a key file in addition to a ...



Top 50 recent answers are included