Tag Info

New answers tagged

3

Your wife is not using LastPass because she has better things to do, not because she's incapable of realising its utility. You would think that once people properly understand the risks they're exposed to (which requires a serious amount of education), they would automatically start to comply with whatever security advice is thrown their way. Well, this ...


0

Fear Yes it sound awful, but it's really the same thing that makes you choose strong passwords. Fear of someone stealing your money from your bank, fear of someonce accessing your private emails, etc. It's not truly insane to want to educate her about her short-sightedness (no offence intended, but let's call it what it is). You should probably mention how ...


0

Your problem is more a question of awareness and practice. The fact that as security specialists, we take our job very seriously (which is the right thing) and "expect" others to take security seriously as well. Since you are more closer to the world of the "bad cyberspace", you are well aware of the controls that need to be kept in place to prevent them. ...


2

No, there is no overwhelming need to hash password reset tokens, as long as they are time-limited and single-use. There's some benefit to hashing reset tokens, but the benefit is less than with passwords, so I wouldn't consider hashing of reset tokens absolutely necessary. Typically, password reset tokens are time-limited. For instance, they might be good ...


10

Yes, you should hash password reset tokens, exactly for the reasons you mentioned. But no, it's not quite as bad as unhashed passwords, because 1) reset tokens expire and not every user has an active one, and 2) users notice when their passwords are changed, but not when their passwords are cracked, and can thus take steps to limit the damage (change ...


0

In general, you should take steps to prevent a hash from being exposed perhaps by using encrypted email or at least an encrypted connection. That being said... I believe the risk of 1 (connection compromised) or 2 (email intercepted) happening is pretty low, and number 3 (solving the hash) is the part that matters the most, because if the answer to 3 is ...


2

By default, the htpasswd utility tends to use an Apache-specific hashing password called "apr1" and documented here. It seems to be a custom construction that invokes MD5 1000 times. Assuming that there is no structural weakness in that construction, the attacker can still try out passwords at a rather fast rate. As documented here, an AMD R9 290X GPU is be ...


3

As a countermeasure against phishing emails. Such emails will look like legit email asking you to change or update your password, but their link will direct you to a false website (still looking as legit as possible, with URL such as micr0s0ft.com: here the letter 'O' was replaced by zeros '0', it looks like "microsoft.com" but it is not "microsoft.com") ...


1

At first glance, this seems like it might be a good idea. Like many suggestions relating to passwords, in some situations it may even be an OK solution. However, when you consider it in more detail, a number of shortfalls become evident. If I was trying to crack someones password, one of the first things I would do is try to find out as much information ...


0

I suppose that the term "one way encryption" gets back to the days when no cryptographic hash function was available, so to get a password hash on Unix systems for instance an encryption function was used (DES). However, instead to provide a fixed key to encrypt the password (normal usage of this algorithm but which would allow to decrypt the password using ...


0

Maybe a simple way to proceed with such research would be to use some of the tools normally dedicated to game cheating by analyzing and directly editing the target software memory content. Search for things like "game memory search cheat" on your favorite search engine, and you should find several of them. The programs I'm referring to take a snapshot of ...


1

The two main methods that I have considered for this are: 1. User Defined Questions Most of the default questions I see on sites seem to be the same or very similar, easily researchable through social media, etc. I would generally think that allowing users to write their own security questions would be better with some guidance. e.g., "Come up with two ...


0

Salt prevents hacker from pre-generating hashes. He can only generate the hashes once he has the salt. It also prevents the same password from having the same hash. It slows the hacker down. The secret key is a secret key! It is not tied to each user, it is tied to your web server. It's useful if the key is in an HSM, or the hacker can get the db passwords ...


0

I would like to say DON'T DOWNLOAD FILEZILLA! It installs a spyware application to your computer and gives out a malware. It seems like it would be a good FTP as all of the good reviews but the spyware takes personal information off your computer and leaks it on various websites, being perfect for DDoSers, Hackers and many, MANY more people who could do bad ...


2

It is true that if your password is compromised, your access to all other systems in the directory goes with it. However, there are other differences that make the practise of password reuse a completely different ball game: Directory: Once the breach has been reported, the account can be disabled or the password changed from a central location. Separate ...


0

My simple recommendation, and what I have done to mitigate DoS attacks on slow password hashing, is to use a password strength calculation score as primary validation method. So for a user login example: I get the user record by email. Then first check if the strength score match against the plain text password (which is obviously fast, just a couple ...


1

It's best to use a method that would stay secure even if everyone used it. You'll have less to worry about and it lets you collaborate with others in tweaking the method to be the most secure, because you don't have to keep your methods secret. This "the enemy knows the system" approach is a huge motor for innovation and advancement in information ...


-1

Use Malbolge. After all that's essentially random, right? (=<`#9]~6ZY32Vx/4Rs+0No-&Jk)"Fh}|Bcy?`=*z]Kw%oG4UUS0/@-ejc(:'8dc That's the hello world program.


2

Many email clients protect the password in similar ways to a password manager (and some do not). No flaw in your logic, although once you get malware designed to steal password manager passwords, all bets are off anyway. That's once reason why 2FA is so important. By setting up 2FA, even if malware gets your email password, they cannot use it apart from ...


2

To answer your two specific examples: Most Western computer systems don't have fonts with complete coverage of CJK characters, and when they do, the appearance isn't always correct. Having a password displayed to you as a series of boxes isn't particularly useful, and worse, some programs will replace those un-displayable characters with substitutes, ...


18

Like most password generation algorithms, this one relies on security through obscurity. As long as nobody suspects that you use this method, nobody will use a cracking tool which tries random valid source code snippets and the rule of strength = possible_characters ^ number_of_characters will stay valid. But as soon as someone suspects that you might be ...


-2

This is actually a very good idea. You won't find this kind of passwords easely in rainbowtables, and most bruteforce attacks don't include characters like this or search for such long passwords. Its only weakness is the fact that it is a short code (not a short password), if someone knows you have a script as password it could be easy for them to guess. ...


25

You can use source code as password. However I'd strongly recommend against using source code as a passphrase. The reason for this is entropy. Passwords / passwphrases need to provide lots of entropy (100 bits+) and programming languages usually pose severe constraints on the formulation of instruction thus resulting in less entropy per character than even ...


2

Beyond the obvious "don't make it more complex that you have to", there are tow reasons why a password recovery process shouldn't attempt to tailor the challenge to the known data: It is a form of information disclosure (in your case, it would indicate that the password has not been changed since it was created) It doesn't actually change the result of the ...


8

It looks like GMail knows the hashes of earlier passwords for users. While this is not true in your case, treating it as a special case would cost the developers time, and it would provide attackers a clue about your password habits. It is a good thing that GMail doesn't advertise that you never changed your password.


1

You can deal with your password problem with some variation of challenge-response authentication: done properly, it prevents replay attacks, and since the password itself is never sent, a hostile server or man-in-the-middle can't trick you into revealing it. The problem you're going to run into is verifying you're connecting to the server you think you are. ...


1

Is it safe to signup on multiple applications with single email address? The same thing applies here too. One thing is when you sign up on other applications through social networks, your circle may get notifications of your activity. If you have privacy issues, you can set your social media settings to private. Keep your passwords and security questions ...


1

The problem I see is that while you're going to a lot of effort to avoid transmitting the users password, saltedSecret has essentially become a password. The main threat to a transmitted password is that a man-in-the-middle (MITM) will be able to observe it (in the absence of any other forms of encryption) and log into your system. If we look at how a ...


1

An historical example of such a poor algorithm is Microsoft's LM hash. As you said Felipe, in order to create a strong password, you need among other things to mix uppercase and lower case letters. Why? Because by doing so there can be 52 different possible letters constituting each character of the password: 26 lowercase + 26 uppercase. By converting the ...


2

I also could not find any password storage policies that mention that passwords should not be upper-cased. But I also didn't find any guides which told me not to set every password to "password", not to remove all special characters, or not to shorten them to 4 characters. It's just obvious. You should not change the password that the user supplied. This ...



Top 50 recent answers are included