Tag Info

New answers tagged

3

This question is rather broad and hard to answer with so few details. It really depends on your organization's setup, but I'll try to give a general answer: It's always better for a user to type in their own password rather than having an admin create a "temporary password". The main reasons for this (as far as I know) are: 1. The admin could perform ...


0

Banks are normally very large, bureaucratic organizations driven by policies written by people that were well meaning, but can't respond very well to changing threats. Are Phishing attacks worse than compromised machines where the password is stolen? I'm not sure, but it's a valid discussion. Saving the password locally is easy to understand, and for ...


3

While there are aspects of truth in what you say, you have to look at the bigger picture and look at where banks have liabilities and risks. Banks look to minimise the risk down to a certain level (eg there is a fraud appetite that is accepted by banks, as to try and reduce it further costs more and more, rapidly becoming unworkable) and many of these ...


2

Banks have real money losses, a significant amount of this comes from unauthorized access to bank accounts so they have financial incentives to make it harder for users to lose their password by storing it in the browser at their local internet cafe/library/etc.


1

Yes, you are correct. You could send an email in each case to the entered address detailing any success/failure and a generic response could be shown the user on the response page. This is known as communicating via an "out of bound" channel. So you always send the email, but it is the email itself that explains the situation at hand, and the HTML page asks ...


3

FileZilla does come with malware now and the developers are aware and probably getting money from it. Search for FileZilla Premieropinion in Google or read any of the MANY threads on Filezilla's forum: https://forum.filezilla-project.org/viewtopic.php?t=31967&start=30 https://forum.filezilla-project.org/viewtopic.php?t=30240 The developer keeps saying ...


-1

I think https://bugzilla.mozilla.org/ is already doing that for password reset mails if we upload our PGP Public Key to our account. For password reset emails, they encrypt the message and the token using our Public Key and send to our email ID.


3

I've been thinking that the better practice would be not to confirm nor deny whether the email address exists. For this reason I want to show the success message: "Instructions on how to proceed was sent to the email address provided" even when the user provided does not exist. Yes, this is the proper way to do it. A better message would be "If this email ...


0

You would be limiting yourself to the range of keys the hash may output, which is likely less than you would generate using a password manager. SHA-256 has a range of 0-9 and A-F with only 64 bytes of output, turning pXieG)MF8YRI`{H+/wCw(i/uE*ja#MFl^OQZq=oj!@R6miK_E#RffzZ9C^9}F~KYN;H>{W{7"$x.,7cK4T&9czC4Sv=.uw5\g{fD into ...


5

My question to you is: What's the advantage? Even before any analysis at crypto level, your system falls down in the event of any breach. Say your WordPress system was hacked - you would want to change the password for this system to be on the safe side. So sha-256(Wordpress+MasterPassword) becomes sha-256(Wordpress+NewMasterPassword). This means you now ...


11

First things first, you should use a password manager to solve the problem that you're trying to solve. A 256-bit hash like SHA-256 outputs to 32 bytes of hexadecimal characters. This means that for every character, there are 16 possible choices, 0-9 and a-f. Using a password manager like KeePass, you can generate a 32-digit passphrase using 64 or more ...


1

No, hashing a password does not increase your security. The security of your password is based on its randomness and length. Hash functions generate a "representation" of a given value in a specific format. The result might look random, but it is following a set of rules, the exact opposite in of randomness. This means that such a password is easier to ...


1

I wouldn't do what you are suggesting. It's too easy to guess the Website info ("Wordpress" in your example) and the salt is presumably public. You would do better hashing MasterPassword+Website where MasterPassword is a well-chosen, secure, random string. You can use the same master password for all of your sites. Even if the password for a site gets ...


0

It seems just as safe as any other scheme, however since your using the service url as a starting point you have a possible easy to guess password (part of it is now public knowledge). Now if you would use a different word you can use this trick to get your salting from the name (factorise the ascii values of the name for example). and hash the key word n ...


12

Drilling a bit deeper on the copy and paste issue: Microsoft products, particularly the Office suite, are notorious for attempting to help by adding trailing white space to items copied from, say, Outlook and pasted elsewhere. The purpose of doing this is so that you don't have to be as careful where you place the cursor when copying and pasting to avoid ...


4

It's probably a usability issue. It's very easy to unintentionally accidentally add a space to the beginning or end of a username or password, especially on certain types of devices: mobile with autocomplete, people typing via voice, people using assistive technologies that auto-insert spaces, copying and pasting passwords, etc. The other day I was ...


15

They trim passwords to deal with the (sometimes insecure) process of people copying and pasting them.


9

Because they trim whitespace. The why of that is not known, but is not unusual, and often is related to the inability for humans to discriminate - you and I know that foo bar has a space in the middle, but it's hard for us to say how many spaces are in foobar if any of them are trailing. Judging from productforums posts, this policy is not new.


0

If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security? This is why you should protect your LastPass account with a second factor of authentication. LastPass have several options available such as Google Authenticator, or Yubikey. Good ...


0

For example, the salt element of the password derivation algorithm presumably must reside on their server rather than on my own computer/device LastPass uses PBKDF2 with SHA-256 for their password hashing. Your data key is calculated as follows: DK = sha256("foo@example.com" + password) This is not sent directly to LastPass, it is hashed first: key ...


1

As far as things like rainbow table cracks or brute force or things like that, I don't think this is an issue. You can expect that LastPass will be using proper security practices (at least as much as you can expect it from other companies who store highly-sensitive info (PayPal, Google, etc)) and therefore can probably safely assume that there are no ...


1

"is email a trusted way to carry such sensible data" No. Do many websites do it? Yes. A saving grace is to make the link one-time-use-only and require the user to choose a new password immediately. That way, if an attacker does intercept the email and use it to hijack the account, when the legitimate user clicks on the link later, they will get an error ...


2

Though it's better in the sense that communication is automatically between two windows (and you can hope the object disappears after it's transferred), I'm voting no¹ because: It uses Automation, its interface is public It's not thread-safe (so it's global) Windows in Windows can be hooked The only protection I saw was at the process level: you ...


1

Why not just store all passwords in a password manager but don't store the whole password? Make it so that, on their own, compromised passwords are useless. You do this by just remembering a prefix, suffix, infix, or combination of the three. I think of my password list as just the random salt for my single password which stays in my mental password manager. ...


4

I'm going to disagree with your premise that it makes sense to keep some passwords out of a (secure and non-proprietary) password manager. While it might seem like some passwords might make sense outside of it I think those might be limited to two types: A full-disk encryption key on a device which contains your password manager itself. This is mostly ...


12

The vast reduction in risk you enjoy simply by using a password manager (no password reuse, stronger passwords, phishing resistance, etc.) dramatically outweighs any minuscule additional risk of keeping your email password in the same vault. That is, assuming you protect the password vault with a strong password. Additionally, those accounts are the ones I ...


0

TLDR: you cannot keep anything secret in a client application, you can only make it harder to find. You need to obfuscate the secret key to make it hard enough for an attacker to want to reverse engineer it. client applications, which have to be deployed to the end user device are subject to reverse engineering and hence NOTHING can be kept secret. But it ...


2

A smart malware which got on your computer can even benefit from a password manager like KeePass to steal all your passwords at once. On a PC it is simply not possible to completely protect processes against each other. A malware could intercept your KeePass master password and keyfile when you log into your password manager and use it to decode your ...


0

What is the benefit of trying to remember a password, or storing a password in a manager if a user can reliably get a password reset link every time they wish to login to the site ? Because if you can log into your account with your known password you know that an attacker hasn't changed your password. Password resets create noise. In logs on the ...


1

What is the benefit of trying to remember a password, or storing a password in a manager if a user can reliably get a password reset link every time they wish to login to the site ? This is roughly equivalent to Yahoo's passwordless authentication concept. It really only makes sense in scenarios where you authenticate rarely enough that going through an ...


0

You're basically correct that an email account via which you reset your passwords each time you use them is functionally equivalent to a password manager. The only difference in terms of security is the possibility of the email account being compromised vs. the possibility of your password database being compromised. The main advantage of a password ...


24

Your argument is contingent upon using a web based service. If you use your password manager for SFTP, encrypted drives, desktop apps, etc. then you don't have a self service reset option. If we then want to continue the argument only for web apps, here are some issues: This requires you to use one email address, which may not be practical (work versus ...


4

I believe you are asking the wrong question. The correct question would be, in this day of 100 different accounts by each person (email, forums, websites, etc.) can you remember a different password for each one? No, you realistically can't. And, with the prevalence of hacks that steal the password database (encrypted or not) from one website or ...


8

My answer would be no, they are not obsolete. Your scope is too narrow. You are thinking all passwords stored in a password manager can be reset. You do not account for: passwords for operating systems passwords to protect certificates passwords to protect network equipment These passwords cannot be "reset" with a simple reset link and require more ...



Top 50 recent answers are included