New answers tagged

0

The point of a "good" password" is to make it difficult to guess. That generally means you need to create a password in a way that there are too many possible passwords that your method could generate, for an attacker to guess yours in a reasonable time. The best way to do this, is to create an actual random password, using dice, or atmospheric noise, or a ...


0

Are you asking how one email service provider can collect and cosolidate mail from other services into one mail box? Well, pretty much the same way you yourself login in most services: no they don't store your password on their end or in cookies. They store session ID or other security token instead. Just like your browser gets such token on login and sends ...


0

If you want to create an encryption key or store a hashed password, you want to use a key derivation function, not a simple hashing function like SHA-256. A KDF is like a hash that gets applied many times, but is typically designed to be computationally expensive in order to make brute-force searches harder. While you might be able to use SHA-256 as a KDF ...


0

I would say this is typical, and used fairly commonly in the industry. Not the exact same way though. Many companies use password managers where the they can access employees passwords, and passwords can be shared between employees. This is mostly for logging into 3rd party services that don't support individual user accounts. This would specifically only ...


0

This actually depends on both country and/or state laws that you live. This is more of a question for employment law, than it is a cyber security question. The reason that this is an employment law question is that it depends on the size of the organization, the data and system in question, the general employment contract, and the company policies. ...


0

It's a big lie - no one needs your pass to access your account, there are an administrative accounts just to fit this purpose. Even more - it's not a common practice except for cheaters wishing to blame you and reduce/remove your payroll. Neither your pass, nor your certificate(s) are required for an Administrator to take a look at your full account.


0

The very existence of the envelop protects you from any nefarious doings by your boss. In general, you don't need to prove your innocence. Someone else needs to prove your guilt. And that is going to be quite hard if it is well known that someone else has access to the incriminating account. If you are really worried about it, just sign the envelope wonky. ...


1

Thankfully the world has evolved away from the old break-the-glass style of storing things on a USB key, and that evolution is (free and open source!) Vault. It has clear and obvious mechanisms for key rotation, uses ephemeral secrets when possible, and has full audit logging, and ultimately the very magical possibility of instantly revoking any credential a ...


2

Never had to me in any company I was in. In such case, I would put in the envelope a message saying "In case of emergency call me on mobile mobile number". In case of emergency, I can spell the password over the phone and be informed that it was used - and my boss could do anything needed. So it is all he needs. If the envelope is ...


3

Let's call it what it is: a workaround for lack of proper access control. The real solution is to fix/improve access control. Specifically, here: Why can't your boss access the things you can access with his own account? The only purpose of credentials is to authenticate an identity. If we break that, they become useless. You might as well remove the ...


3

This is unfortunately common in small companies using cloud services, without having a business relationship with the cloud provider. Mark the envelope to make it a bit more tamper proof, that's it. A former company of mine still uses my personal e-Mail address in their domain, the never managed to change their domain registration after I left. Change the ...


0

If you're worried about your boss opening the envelope, using your password for deeds of nefarious do, and then resealing your password in a new envelope and forging your signature, then just splatter a bit of paint, Jackson Pollock style, on the envelope after you sign right across the glued area, and then take a few very high resolution photos of the ...


0

I very strongly recommend you evaluate SecretServer. It is on-prem web-based, has excellent logging and auditing, supports devs, ops, security, et cetera. You can script against its API to check out "secrets" for operations that need them, as they need them, then when the "secrets" are checked back in, the password for each is reset automatically.


3

What's the best way to store passwords? This is a very broad subject that encompasses many different areas of IT. It also has the tendency to be opinion-based. However, there are some very important things we can know, and then use to make an informed decision. Also, there are many different ways to handle passwords. What size company? Small? Medium? ...


3

This should be completely unnecessary in a properly configured system, assuming you log on to a corporate domain. In a properly configured system, logging on to a corporate domain, any data you edit, create or have access to on the network or on your local system, will be stored in a location accessible by others who each have their own login credentials ...


1

I've been using keepass for years and I'm very happy with it. I have my password database synchronised between my devices using dropbox, and the database is encrypted with a password + keyfile (which I manually copy to each required device). This means that even if someone was able to compromise my dropbox, and gain access to the database, it would be ...


2

I'll go for the secure password manager application. However, my Approach may also apply the split knowledge for the master vault password (Should be stakeholders or senior management to hold this). Which means one party couldn't be able to delete anything without tracking. The permission level will be shown below master <== can do eveything ...


12

Password escrow as described in your situation is highly unusual and loaded with risks. The setup you describe relies on trusting your boss to not only be honest with their intentions and motivations, it also assumes your boss is storing those passwords in a secure manner. Are the envelopes kept in a safe? A locked filing cabinet? His desk drawer? A folder ...


0

But limited characters is pretty common for both password and username. In secure computing you have something called attack surface, vulnerability, and exploit. Separate is reliability. Yes more character is more random but you also have a larger attack surface. You can create sufficiently random passwords with a limited character set. ...


1

I avoid symbols in passwords because they may be difficult to type, especially on keyboard layouts or devices I'm not familiar with. Also, more importantly, I don't often trust all software developers. Once I used passwords containing spaces. Some services later changed their authentication methods so that they stripped blank spaces from passwords. This ...


7

Philipp is correct here. Let me restate something he said: In order to use your password, one needs to break the seal of the envelope you signed. When you think your password was abused, you can ask to see the envelope with your signature and check if it is still unopened. To add to what he's saying, your company appears to have grossly incorrect IT ...


11

Change your password immediately after handing him the envelope. You have fulfilled his requirement of giving him an envelope with your password, and you have fulfilled the need to keep it secure. In the unlikely event that he tries to use the envelope password, you can explain that you needed to change it and he had yet to receive the new envelope. In no ...


23

I don't think you are in a particularly worse situation than not disclosing your password. Your boss could: Get the system administrator to make a copy of your (hashed) current password Change it to something new Do something evil in your name Put the old password back (replace the hash back what it was) What does protect you is that there are, ...


119

That's what the envelope is (or should be) for: In order to use your password, one needs to break the seal of the envelope you signed. When you think your password was abused, you can ask to see the envelope with your signature and check if it is still unopened. All you need to do is that should your management ever require your password, change the ...


0

You could use the new PI zero to do just that. The low form factor makes it ideal as a peripheral for precisely this reason. Also remember, you don't need all your passwords with you.


0

As @dr jimbob said you are using the non printable character £ in your password !@£$%^&*(). If you remove the non printable character £ from your password it will be accepted what ever be the service. This is because the password encryption was developed in c or in Java in core level to maintain the high level of security. It is difficult make the non ...


0

Interesting question. Your points: secure against compromised websites, i.e. if someone breaks the database of site A and manages to obtain my password for A in plaintext, he should not get any information about my password for site B secure against a compromised local machine, i.e. if someone installs malware on my laptop he should still be unable to get ...


2

Risks of keeping logged in: CSRF and XSS attacks could be used to compromise your sessions, if the site in question is vulnerable. If the application uses weak or predictable session tokens, yours could be brute forced. A physical attack (e.g. laptop stolen), could possibly allow access to all your logged in sessions. This could be mitigated using disk ...


1

Not staying logged in increases the potential damage a keylogger could do. Also your passwords are going to be much more simpler because you need to recall them all the time. Staying logged in increases the damage a session stealer could inflict. The latter is only usable if the attacker is in the same network. If you are always in your own, safe network, ...


0

This particular sequence is just holding down SHIFT and typing 1234567890. So I am assuming that they are disallowing this particular sequence because it is simple for a hacker and a lot of people do this. For example, I have seen people use QWERASDFZXCV for a password which is insecure because you are just holding shift and moving down the left side of the ...


0

Let's equip our Legendary [Tinfoil Hat]. Can websites log my passwords? Let's assume the website did their hashing correctly. When you log into a website, they are able to take your plaintext password and compare it to the stored hash. If the passsword matches the stored hash in the database, it will allow you to authenticate. If not, it will inform you ...


1

First, don't think about password recovery, think about account recovery. (Password recovery leads to wanting to store passwords in plaintext, which is bad.) Second, there are many good critiques of these questions out there. You should ask, why use them at all? The right answer depends on how well you know your customers. A bank might use an ID check, ...


4

Your argument is: 1. a randomly generated password with symbols is stronger than a randomly generated password of the same length with just letters and numbers 2. therefore allowing symbols in passwords make them stronger. This is valid if and only if people generate passwords randomly. Let's however compare a password created with the following algorithm: ...


2

XML / Json Hypothesis: May be the password is sent to a webservice (hopefully through a safe channel) and they found that special characters resulted in invalid XML or Json. Instead of escaping entities they restricted all symbols. One security issue is that if you are able to use the escape characters " in XML and \" in Json and the XML/Json is ...


7

Some of the symbols may not be available on all keyboard layouts you interact with. That would prevent you from logging in. This would be a problem for availability, not for security. But this could become a slight problem of security if the symbol in question were available on an unfamiliar keyboard layout you are working with, but not in a familiar ...


12

A bit long fetched but… Say, John’s mother gets given a IPad for Christmas, she then decided to log into her bank using it (rather than her laptop), but can’t work out how to “type” the symbol on the IPad. So she asks someone to show her how to type her password….. Now think about the support issues with customers having passwords they don’t know how to ...


4

Most people can't type symbols without slowing down and pressing multiple keys at once, so there is a small decrease in security if you're trying to type where you might be observed by a human.


2

Alternatively to their own security, imagine that you have to remember password containing upper and lowercase letters, digits and special characters, most of people going for them would write that password on a piece of paper, possibly together with their login, that would be considered high security risk And if you use simpler password that you can ...


14

Agree with your analysis that allowing symbols allows for more security, but generally it's not that much. Especially when compared to going to slightly-longer passwords (assuming the password is completely randomly chosen symbols). Using any of the 95 printable ascii characters: ...


35

Because they're probably using input sanitation instead of parameterized queries and output sanitation. If they had parameterized queries, this would not be a problem. If they knew how to sanitize their output, this would not be a problem. More than likely, their code is vulnerable to a lot of other things, such as unicode-based smuggling. To many "secure ...


203

These 'security measures' aren't for your security, but for theirs. Symbols like hyphens, apostrophes, percent signs, asterisks, slashes, periods, etc. are useful to attackers for performing "injection" attacks, like SQL Injection, XPath Injection, file path injection, etc. By blocking those characters, the site owners hope that they are preventing you ...


76

The question is why did they say that its insecure to allow symbols in passwords when symbols make it safer? More than likely you were dealing with someone in customer service that has no clue as to why certain rules were put in place and has come to the conclusion, either through using this excuse in the past and having results or making it up in ...


0

Ok, here is my opinion. Using Keepass(or any password manager) you could generate a random password like this "CslmHD5Rh6" This is a fairly secure password. According to grc haystack the chances of breaking this password would be 1 in 853,058,371,866,181,866. The only way to break this would be with the hash of the password which if they were able to get the ...


1

one way might be using a smartcard or similar for the authentication, nobody can read a password or similar from a smartcard and when you pull it, nobody is going to access your HSM, at least in theory.


0

I think that you are over-thinking things! Also, you are not being realistic about the risks. Also remember that any password is "security through obscurity" so it isn't always the "bad boy" it is made out to be. So, a sensible approach might be a hybrid. Low sensitivity logins - use a password manager. Most have various protections to help reduce the ...


1

The swipe grid can be thought of as a two-dimensional array: Which means you can pick whichever representation of an array you like. Graph theory and computer science have many ways to abstractly represent the data, especially data structures like a directed graph, a linked list, etc. You don't have to write code, but you could list something like [0][0], ...


8

I would suggest giving each phone a name, then for the password use the keys on the num pad to represent the dots to hit. For example, if you have a swipe pattern in the shape of an L (starting on top left), your password would be 74123. If you go with every dot in a "Z" shape (starting on top left), the password would be 789654123. Most can't store ...


4

Number the dots 1-n like a phone key pad and record the sequence of numbers.


3

A password manager allows you to set extremely complicated passwords that are unique for every site. If left to a human brain, we would most likely reuse or use a variation of similar passwords since there is a limit to how much we can remember. Remembering one very complex master password is easier than remembering many complex passwords for different ...


0

your approach is right; while you want to keep just one account and share it with others for a while, the best way is to change password before-share and then re-change after-share. regards



Top 50 recent answers are included