New answers tagged

0

Usually, not secure at all. It really depends on your threat model, but the data is usually saved: unencrypted, encrypted with a publicly-known passwords or encrypted with a user given master password On Windows (I believe 7 and over) Chrome uses an OS facility for the storage, which ties the encryption to the logged in user. On Linux systems Chrome ...


0

Suppose you have an iOS app that accepts a username and passcode. This login information would be entered by the user, then you could store that state by saving the credentials in the Keychain, which is the only place secure enough to store that information on device. If the above is already in place, than adding Touch ID only increases security because the ...


1

@Anders answered your point on encryption, a note on Normal passwords are hashed so this isn't a problem. You can hash a password when you do not need to use it to authenticate further, but only to check if a password currently presented to you is the same as the one which was hashed. In other words, if you need the plaintext version of a password (...


4

Using a good password manager that generates unique, long, random passwords is a good idea. The passwords are not "stored in strings or encoded". They are encrypted, hopefully with a strong encryption algorithm like AES. The encryption key is usually generated from the master password with an algorithm such as PBKDF2, specifically designed to be slow so as ...


-2

Yes security is improved because there an additional HOTP "password". This would foil keylogger trojans which can grab normal passwords.


3

Forcing the user to pick a password you generated is an efficient way to prevent password reuse. That means both (a) that your passwords will not be usable on an other site if an attacker steals them, and (b) your users accounts will not be breached even if they were all on LinkedIn, MySpace, Sony and Ashley Madison. On the other hand, it will wake them way ...


0

Having an unique password per site isn't about people targeting that individual site, but instead the problem of 'cross contamination' from other sites. People are notorious for using the same password on multiple systems. Its been well documented that attacks take place by setting up a website of similar interests to your target (for example, a World of ...


2

Yes, it is most often just a useless "security measure". We need to define the threat model and then if an on screen keyboard provides a proper mitigation. A OSK will protect against two threats: A hardware keylogger A software keylogger that is only looking at the keyboard state (does not attempt to defeat a OSK). One should note the the difference ...


3

If an attacker is aware that an OSK may be used (and that becomes more and more common with touch devices), he can prepare an OSK attack, e.g.: capture screenshots of the OSK and identify keys pressed (e.g. because they have a different color) an his own OSK on top of the existing OSK (similar to clickjacking) add a kernel mode driver to do whatever, e.g. ...


3

My guess would be that for google it allows them to handle all their various different options for TFA(two factor authentication) more easily. Off the top of my head they support 3 or 4 different methods at least. They also allow you to have multiple TFAs enabled at once so you can pick which one to use. Not saying you couldn't also handle all that on the ...


0

It would have made sense to me if they asked for the second factor too in the re-authentication, but they don't. And the new passwords page needs re-authentication if opened again. So its very similar to the 1st case but split into 2 pages. So no opportunities for CSRF. I GUESS it was more of an architectural choice rather than security. Plus old and new ...


0

One thing to consider is that Google has spent a lot of time engineering its authentication system -with what amounts to a PHD-level think-tank of engineers. It seems as if protecting the password change form is just another implementation of that functionality -such is the purpose of portable and reusable code. IMHO, it should be leverage more often. This ...


-1

For a desktop application I would prefer password hashing with salt. Hashing with SHA-256 or SHA-1 plus salt seems good. Because Ideally an encryption key for a standalone system as explained above can be obtained by some malicious trick. hashing is a one way street salt ensure some strength, so it isn't so bad


0

I would suggest using String m_androidId = Secure.getString(getContentResolver(), Secure.ANDROID_ID); This will give you a unique ID, that require no permissions, that does only change during factory reset, and can be used to track so nobody spams the database. I would also suggest hashing with a app-specific key. However, you still need to have any ...


1

Several different factors might influence LastPass state: Automatic logging out is a feature of LastPass that is intended to protect user passwords. The idea being that a computer left without attention for a long time might indicate it was compromised. As LastPass has no other way of telling who is using the computer, it checks asking for password (which ...


3

These measures will greatly reduce the impacts, and or attempts to circumvent them. The issue with passwords are, no matter how much you try to educate anyone, it rarely works. Individuals prefer comfort over security, as indicative by making a password: "P@ssw0rd1" to meet complexity requirements. As long as there are passwords, people will keep creating ...


2

What version of Excel are you using? Since Office 2007, the encryption used in MS Excel is 128 bit AES with at least a 50,000 interation SHA-1 hash. If you use the built-in encryption with a sufficiently hard password you should not have to worry about offline attacks. How to define "sufficiently hard" will probably change slightly every few years, but if ...


1

I will need to explain some things before answering your questions. Okay, so password can be 2 things, by that I mean it can be just Authentication or it can be Authentication with Encryption. Just Authentication: just Authentication means that there is just one wall of defence between files and the user who is trying to access it. Just Authentication ...


0

Another situation if you store your encrypted password file in the cloud is in the rare situation where your cloud provider gets shut down, like https://en.wikipedia.org/wiki/Megaupload did for copyright infringement; some legitimate companies had data on that site in addition to all the illegal movies, etc.


1

It would have a slight advantage that bots or attackers that haven't done their reconnaissance properly may be wasting time on password guesses with passwords that the system can't possibly accommodate. If an attacker can register for their own account, they should have checked the maximum password length and other password rules by trying to reset their own....



Top 50 recent answers are included