Tag Info

New answers tagged

0

You can store them in a Keepass database (with a good password). You can print them on paper, and keep that somewhere safe. You can create an Android VM in Virtualbox, install Authenticator and use that as backup for 2FA. In Amazon AWS you can use several of these accounts, but I don't know if Google allows this. That VM should be kept on an encrypted ...


0

For your application, I would suggest, storing the recovery keys on plain paper that you put inside a home safe. Thats enough security. They rather steal the phone or 2FA token from you if they really want your account. And physical attacks are very rare. Actually, you dont even need to put them in a safe. You can put them in the desk drawer at home. But do ...


0

The checkbox in the screenshot refers to the Firefix Password Manager without Master Password, although it doesn't check and it works in both cases. I guess most of the time people use the password manager in Firefox without master password. They login to a site, Firefox offers to store the password, they agree, and that's it. This is the use case for most ...


1

In my opinion, Lastpass is referring to the Firefox password manager insecure when the user is not using master password for Firefox. Which won't be apples-to-apples comparison. Firefox uses 3DES for storing passwords and in case master password is not set, null ("") is used, which is insecure for sure. To read in detail about how Chrome, IE and Firefox ...


1

This doesn't really give any help with choosing what places to memorize your passwords (as @schroeder notes in his comment), but it will help yo memorize them once you have chosen. one way to help memorize strong passwords is here: http://xkcd.com/936/ another method that is slightly less secure but adds to ease of memorization is to use a standard prefix ...


0

If your internal production AD is critical and contains sensitive systems, DATA etc, which would have a high business impact if compromised then you should consider a seperate forest. If a completely isolated "DMZ" forest is not practical or too costly to manage (high admin costs through account duplication and so on) you can consider a new "DMZ" forest ...


1

If you want to store data in a way that the person holding the data cannot read it, then You need to encrypt the data client-side. Encrypting server-side opens the possibility that someone (say, the operator of the service) can record the data while it's in transit. The encryption needs to be done using client-selected keys. If anyone else provides the ...


1

No. The correct/incorrect old password is just data used in a recovery process. Google knows how you changed the password (via forgot password, via the normal change screen) and when, and how old the password is in numbers (eg you changed password 2 times after this old password). So this data is used in a general scoring model to determite if you are a ...


0

I run a digital agency and we often have to manage a range of passwords and share them between our team of developers/managers etc. so have been doing research on the best way to manage this. (We previously used KeePass synced over Dropbox, but it was becoming unmanageable.) We've decided on a cloud/hosted solution that can be accessed from our computers ...


7

There are three main areas of difference. First, password management is a feature for browser developers, while it is the entire product for the third parties. So typically, the browser managers only offer basic core features. The 3rd parties add lots of useful stuff on top to differentiate their product. For example: Storing other information apart from ...


1

On Windows, your Chrome saved passwords are encrypted using DPAPI. This mechanism ultimately derives a key from your Windows account password to keep the data secure, and so once you've logged in, the data can be decrypted by applications that rely on this store. So, Chrome doesn't have access to your Windows account password at all. It relies on the ...


3

The short answer is that it's possible there is no way to find out more details about this. You should definitely enable two-factor and change your password ASAP. That being said, I can give you a few suggestions if you want to try to find out more. Google deliberately masks source IPs in their SMTP headers to protect your privacy. This is why you see a ...


2

I do very similar, and the way I see it there are two major potential points of failure and I don't really have a good solution for one of them. First major risk is that LastPass itself is hacked and it's data dumped. While data is encrypted locally, my password used to encrypt that data is not very strong. LastPass has recognized that entering in a strong ...


3

The UUID of your cellphone isn't a meaningful second factor as it can be spoofed. On the long passwords, it is reasonably secure to use long, sentence based passwords, but the amount of security provided drops DRASTICALLY if it has anything to do with what you are connecting to. It may still seem hard to guess, but establishing a relationship rather than ...


1

In order to support "partial passwords", the bank must necessarily store either the plaintext password, or at least some values that would allow fast reconstruction of the complete password. It is easily seen in the following way: when the bank asks for, say, the 3rd, 4th and 8th letters of the password, then there are less than one million possibilities ...


1

They are probably storing the password encrypted (i.e. not hashed); encryption is reversible so there is no reason why they cannot use code which takes the user input characters, decrypts the stored password and checks the input matches the characters in the password. If done correctly the program used to do this would only temporarily store the plaintext ...


6

The purpose of password hashing is that not even you know the users password. Creating a backup of the cleartext password defeats the whole purpose, because then you have a copy which can get stolen. Password hashing and telling the user their password are mutually exclusive. When a system uses password hashing, resetting the password to something else is ...


-1

Quoting wikipedia: It is good practice to not store passwords in cleartext. Instead when checking a whole password it is common to store the result of passing the password to a cryptographic hash function. As the user doesn't supply the whole password it cannot be verified against a stored digest of the whole password. Some have suggested storing ...


0

You've designed a Password Manager with less protection and usability than all the other mature products out there. The file needs to travel with the user. The password to access the pseudo-password manager is a 9 char password comprising only of digits. The pseudo-password manager file only works for a single login location. The file is not protected in ...


0

There's some interesting thinking going on in Microosft Research labs that supports your approach. http://research.microsoft.com/apps/pubs/default.aspx?id=227130 for example. They make the point that not all password secured accounts are equal. They categorise them as: don’t-care accounts (unlocked doors). low-consequence accounts (latched garden doors). ...


0

I would look into Lastpass. Each user has its own acount and unique login to lastpass. You create one master account, which has all company logins. You can share logins, and choose to hide or show the password to the other user(s). I have to warn you that it's fairly easy for a user to get the password anyway. With some IT skills, you can copy the login ...


2

Also consider that using a password in isolation means that if an attacker has access to the password file they would not need to find a password for a specific user, they only need to find a password that has been selected by any authorised user, obviously as the user population increases the greater the probability of an attacker choosing a 'live' ...


7

If you assume the attacker has the file, then you're actually relying on the number N as your password. You have stated that this is a user selected number, and it's likely that users would just chose (for example) 111....111, 123..., 000...000, or something similar. This could be countered by telling the user what value of N to use at "generation time", ...


1

This is similar in functionality to using an algorithm to generate password information. Since you provided an example site: http://hash.tknetwork.de/, we can describe how you might generate a new password when you are required to change it. You can add an integer, date, or other value to the 'parameter' to iterate it You can have multiple master keys ...


14

This basically looks like something along the lines of PBKDF2 or sha512crypt, only with a bunch of "cryptographic voodoo" applied. Salts have a very specific cryptographic purpose: to tie an password-guessing attempt to a single password instance. Having company-specific salts, user-specific salts, per-iteration salts, and (to steal a snark) hand-harvested, ...


1

Just to be clear, there is something else called password hashing that is completely different to what you describe, so that is a terminology collision, which is unfortunate. To handle "exceptions", you must have some storage. One method could be to store (e.g. in a local file) a map from server name to some string, e.g. an integer. The scheme would be: ...


1

Short answer: Nothing can stop the users from changing the passwords in some predictable sequence. Detailed answer: You can try various ways of detecting sequential password changes, but users will always find a simple sequence pattern that you haven't foreseen. If not number suffix - then number prefix, if not numbers - then letters. If not suffixes and ...


1

A fairly simple method would be to check if the last value is a number, subtract one, use the old function to check wether it matches the old pass: // We start with 'example1', md5 -> c1285a470f0fc8f14f54851c5d8eb32f $pass = 'example2'; $lastChar = substr($pass,-1); if( ctype_digit( $lastChar ) ){ // the last character is digit, substract one: ...


7

There are a few different ways to check whether users' old and new passwords are similar, and each has its own strengths and weaknesses. String Permutation Comparison The first approach relies on creating a list of permutations that are not allowed. This might be a list of regular expressions or some similarly defined string changes that you evaluate ...


0

Is the benefit to changing passwords invalidated because users have the opportunity to change them to almost-but-not-quite the same password? Yes, I would say it is. If you do want to have sequential password updates, I would try to prevent users from choosing similar passwords. Is there something I can do to improve that flaw (if it's a flaw)? ...


0

Keep it simple. Sending signed mails with given, parseable format makes things rather complicated. If a user opts for encrypted mail, send him (all, including all other) mail encrypted, including password resets. Selbstauskunft.net (German language only), a service for sending requests to companies request information they store about you based on privacy ...


-2

Some tools (hashcat) can perform password permutation attack based on a dictionary or initial password, it opposes a possible password hash against the current password hash (that was captured somehow) : You cannot use this tool to prevent your user from following this pattern. In the same fashion, you cannot use hashes to recognizes password patterns, this ...


18

You cannot reasonably prevent "sequence passwords" unless you have a human administrator inspect them (which would have its own set of security issues, not even considering the expensiveness of human labour). You can try to automatically detect such patterns, but you cannot hope to find them all; besides, if you only keep hashes of the previous passwords, ...


1

If you store previous password hashes you could potentially check to see if the current password is a variation like you suggested. Say your users previous password was: password = 5f4dcc3b5aa765d61d8327deb882cf99 If you store previous version of password hashes, you can compare variations of the new password to determine if it is different enough. So ...


1

There are a number of different possibilities that you can implement to try and curtail password permutations. One of the best ones that I could find was actually on stackoverflow: http://stackoverflow.com/questions/21031661/how-do-you-test-if-two-hashes-passwords-are-similar The only problem is, you have to store a ton of password hashes. You can also try ...



Top 50 recent answers are included