New answers tagged

0

This is how I would do it. Have the web app generate a public/private pair (say DH). Show the public key on the screen as QR code, the user then scans it with the phone. From this point onward, the phone can send anything to the web app securely.


1

In your specific use case, this assertion is faulty: ... suggested that a small digest is susceptible to rainbow tables and other attacks ... A rainbow table is only a lookup table of pre-computed digest values. Think of your use of a hash like the index at the end of a book, telling you what page number to read to find the real context containing ...


1

Let me answer this based on how PGP/GPG works. So you have a file for say Client X, and you are using FTP as a delivery mechanism. You want to ensure that your data is protected (encrypted) and only Client X can read it. To do so, you would be using your PGP key for signing, and they will use their key for decrypting. You (PGP key which can be looked up on ...


1

It is possible, if your server accepts files uploaded by an anonymous user and if you don't provide a hash (e.g. SHA-256, SHA-512,...) in order to check that cred.gpg actually contains passwords.pdf and not evilfile.pdf.


2

In practice it literally doesn't matter. If your key size is 512-bit (I'm not sure what cipher you're using, as none that I'm aware of use 512-bit keys, but whatever) then you've got two scenarios: In a small digest you've got so many collisions that discovering the original key by looking for matching values will give you a silly number of results. Not ...


2

Risks of Exposing Encrypted Information With it being encrypted I assume having it publicly accessed wouldn't affect security as the encryption setup would make it pointless for anyone to try and decrypt it. Your encrypted information will stay private as long as the crypto works (no flaws in the underlying mathematical principles are found), the ...


2

This reminds me of how Dan Kaminsky got hacked. He used to use passwords like: fu*k.hackers fu*k.mysql fu*k.vps So bad guys has revealed his pattern and the rest of the "job" was easy. The lesson of the story is; stay away from this.


3

Your system is also known as the monthly updates of passwords where the last two positions of a password are change with the number of the month. It didn't work 20 years ago and it will not work in the future. Computers are much better at generating random strings and/or telling remote systems that you are you. So getting a good password managers and ...


4

Password patterns are subject to the same fault: they are only secure if the pattern is unknown. Worse still, in your pattern, it is subject to the site it is found on, making the pattern more obvious. What happens if someone gets ahold of one of your passwords in clear-text? They can derive all the rest of your unique passwords. Patterns can have their ...


0

Here is a list of tools I evaluated for us. sysPass sysPass is a PHP web based Password Manager for business and personal use. AES-256 encryption in CBC mode RSA for sending passwords from forms Two factor authentication HTML5 and Ajax interface Users, groups and profiles management (up to 20 access levels) MySQL, OpenLDAP and Active Directory ...


1

Yes, they need your plaintext password to make the VPN work, simply because their service is badly configured. They shouldn't need your password in plaintext. The problem is that they use your plaintext password in their authentication procedure. When a new user creates an account, the VPN provider should properly hash their password and use that hash to ...


0

My new found understanding: Two types of logons for this- one stores and one doesn't: Interactive logon occurs when a user enters their logon creds at boot, RDP, or other interface on the local machine. This logon type injects user’s credentials into memory as Kerberos tickets TGT, NTLM, LM, or plain text. This logon type is the primary security concern ...


4

Yes, several things. While this is unfortunately standard procdure, it's a bad idea: Those passwords should be invalidated after a short period of time (and especially if the emails are not end-to-end encrypted). There are good chances, someone else has those passwords, too, because Emails are post cards rather than letters. If the passwords are ...


1

it seems that the issue isn't with sending passwords, but storing plaintext passwords. No, the issue is indeed with sending passwords. Storing them in plaintext is a different issue (the two can occur at the same time of course). If you send passwords via email, access to the users email means access to the password (eg gained via brute force, if a ...


0

Send a password by email is not considered to be secure. There are several issues with sending passwords by email: The email travels in plain text across the internet. As a result, a Man-in-the-middle could intercept the email containing the password. (a MitM attack is a very real thread, even more so with the wide prevalence of public wifi spots). The ...


0

Is this a one-time-use password connected only with a particular transaction? If so, then the solution is rather secure (and it is similar to the solution used by many banks - using one-time-use pincode sent over a text message (SMS) for authorizing transactions).


1

If you give a guest a wifi password, they can share that password though obviously you could politely ask them to not share it. The only way to prevent that is never share one global wifi password with guests you do not trust. The best practice would be to maintain your home wifi network (secret password, never give to others) and a shareable guest network ...


0

Actually, you have two options: guest network - fast and dumb solution. It can be reconfigured as many times as you need, but it will require you to re-provide the credentials. But it can be an "isolation layer" that will properly separate your Wireless devices from aguest ones. MAC access control - a little elaborating, but secure solution if applied ...


0

Here are some options: You could buy an additional cheap router, and turn it off and on whenever needed. You could add Network Access Control, you could configure your existing router to ONLY accept your devices' MAC addresses. When a guest comes in, add his MAC to the list, ignoring all unknown MAC addresses, and remove their MAC when they leave. Or you ...


0

What you want is an AP that offers some sort of Guest Network functionality. This would allow you to give out the wifi password, guests can then access the internet (since they probably have no business talking to your devices directly) and then every few days you can reset that password to the detriment of anyone else who might know it at that moment. ...


0

I'm using the portable version 3.16.1 and the passwords are encrypted. Once the data file is in a different directory than usual (ex: portable disk) and all passwords are encrypted, it is sufficiently safe for me.


10

How does Firefox save the passwords? Previous answers have already presented the general idea, but a more in-depth explanation can be provided. Firefox stores all user information in the profile folder. On Windows, it's located under %APPDATA%\Mozilla\Firefox\Profiles\; and on Linux, ~/.mozilla/firefox/. The profile folder is created the first time ...


1

Unfortunately, if everything required to get your site password is stored on your computer then it is potentially vulnerable to malware. The only way to avoid this is to have user input (in some form). It is basically a trade-off between convenience and safety. If you don't have a password manager you trust and are willing to put some effort into ...


0

There's another aspect to this discussion beyond the technical: if it is your design to not secure passwords, then you, as the service operator, are responsible and liable for them. Passwords are security measure for individuals. They aren't the property of the service. If passwords are properly secured (hashed, etc.), then the service operator has done its ...


0

There is a slew of reasons you shouldn't plaintext store passwords. I'll go through some of them (since realistically you should only need ONE reason not to do it - it's not hard) travel - at some point your password has to be read from the database and that requires it to actually GO somewhere, having the passwords not in plaintext grants another level of ...


5

To make it simple, if passwords are in plain text, the security would be compromised by anyone having a glance at it. Now, you need to remember that website log-in isn't the only access to a database. An attacker might be able to get some information from your database in various ways. First you need to know that it happens. And a hacker typically won't ...


2

Why should I don't store passwords in plaintext? There are 2 main reasons: If a database dump is obtained, attackers can simply login with the plain-text password in the dump. If the passwords were hashed, the password would first need to be brute-forced. Lots of users reuse passwords, as bad an idea as it is, so your security failure could compromise ...


19

Firefox can decrypt the passwords without you entering a password. That means it must have the decryption key--which means any program that knows how Firefox stores things can find them. This applies to any program that stores information on your system. Encryption is only a strong defense if you have to provide the decryption key before accessing the ...


49

Passwords saved by Firefox are not encrypted (they are encrypted but the key can be read out) until you set a master password. I don't think that this is a bug, but every virus could read those passwords nonetheless


2

No, as you have seen, the salt is part of the resulting hash value (the 22 characters after the cost factor). The BCrypt.Verify() function will extract the salt from the stored hash, so it is pointless to store it separately. You can call the function with only one parameter, the library will then generate a salt and the cost factor on its own: string ...


2

There's two main approaches: Force the user to pick a password The device ships with no password. The setup process forces the user to pick a password. This may mean that the device is unprotected until the user does that - but that's probably not a big problem. Ship with a random password After you clone the image onto an SD card, update the root ...


2

Consider to build your application in a way that hardware access and other high privileged actions are done by a service which is running as a privileged user (Try to avoid using root) and has a stable and well defined interface while all other logic is done without this privileges. This will reduce the attack surface and you don't need to store non-hashed ...


1

No, this approach is not widely used and here's why: If the client hashes the password and sends this to the server, then doesn't that hash become "the password"? As an attacker, can't I just intercept the hash and use that in a replay attack? You said "A salt can be added also". This one actually is done in some protocols, when you add in a random value ...


4

I think that if you continue down that line of thinking towards a rock-solid solution, you're going to have to consider things like "what if the weekly email is spoofed?" ... "Maybe I need to digitally sign those lists", etc and you are going to end up inventing something very similar to a Certificate Authority. Use an in-house Certificate Authority I ...


0

[Disclosure: I work for AgileBits, the makers of 1Password] As others have pointed out, there are lots of things that need to go wrong for the attack that you describe to happen. But from what you describe (I haven't studied the product itself in sufficient detail to comment on anything other than what you describe), an attacker can end up with something to ...


1

The best way to store passwords in a retrievable way would probably be to encrypt them with a symmetric cipher. Have the passwords stored on the device that intends to use them only in their encrypted form and then perhaps on startup of the service have the key to be used to decrypt the API passwords be derived through external methods (You yourself ...


0

Wikileaks wents through a lot of effort to redact the diplomatic cables. They also released an a big insurance file that contained all of the unredacted diplomatic cables in an encrypted container. Unfortunately they reused a password for this purpose that Wikileaks also used when sharing files with the Guardian. David Leigh, a journalist of the Guardian ...


2

There was a study conducted by the Ponemon Institute and IBM in 2015 which estimated that the average information breach costs a business $3.79M, with an additional $1.57M in reputational damage. Source: http://www.csoonline.com/article/2926727/data-protection/ponemon-data-breach-costs-now-average-154-per-record.html However, it's really hard to determine ...


1

There are a number of mitigations you aren't considering. To directly answer your question: Yes, provided an attacker has full purview over all phone activity (some android phones are difficult/impossible to "root" so this is not a given even at that level) they could capture the cloud part of the key and brute force the combinations within a short time ...


1

Am I right to worry about this attack, or is it implausible/preventable somehow? The attack is semi-plausible, assuming that the user can get past your device's lockscreen (because if you aren't securing that, you have bigger issues). It is not especially likely, as it requires: your device to be stolen for the thief (or a fence) to want to get at the ...



Top 50 recent answers are included