Tag Info

New answers tagged

0

Lastpass encrypts and decrypts your data only locally, probably using Javascript, in the browser. Your master password is not sent do the Lastpass servers. Well, it should not and up til now I trust them not to do this. It sends the encrypted database to its servers. When you login on another computer, you enter your email address and password. Then ...


3

As with any question of "is X secure" the answer will, to some extent, be "that depends on your exact requirements from a security standpoint, the threats you face, the type of application and the environment that you'll deploy in" However with that caveat out of the way, I'd say that the scheme outlined above sounds relatively reasonable from a security ...


0

You give an easy way to check the most common password on your database, this seem to me like a really bad practice. Let imagine someone find 5 passwords this way, he know he is capable to open 1/200 account in less than five try ( if he can guess the username of other account). You want to prevent a problem by you just simplify the attack by common ...


5

I'm assuming here that your goal is (as @owen suggests) to stop the use of common passwords (e.g. password123) used by your userbase. This is generally a "bad thing" for security as you'll be artifically constraining password choice in a way that is unpredictable to the user. If you think about the end-user experience of this feature, would you give them ...


9

You should change your password when you suspect that the old one has been compromised. This is not a question of password age; thus, we are not talking about a regular password change, but about an urgent, context-dependent password change. Apart from a situation of (suspected) compromise, changing your password does not buy you much in terms of security. ...


3

This is a risky idea. If someone manages to get access to your database and somehow cracks the encryption, they have access to the data of all users. Add to that that users often re-use passwords, and our hypothetical cracker has a treasure trove of valuable information. Resetting passwords may be a bit of work, but it is the safer way of doing things. ...


1

Basically what you added is like an old fashioned, physical "key" to your password storage. A "key" that no locksmith can duplicate. In your existing model the "passphrase" was the weak link. If you accidentally disclosed it, or someone shoulder surfed, or recorded your keystrokes, or you reuse it on an iffy website an attacker could get into your ...


2

You are missing some points. If someone steals a copy of your Password Safe database file they will not be able to unlock it unless they also have physical possession of your yubikey (Even if they already know what your Pass Phrase is). Of course, if an attacker has a level of access to your system where they can read memory then you are screwed as soon ...


0

The following Google search produces a number of academic papers. inurl:\.edu\/ filetype:pdf password manager As a test you could run bulk_extractor on a memory image looking for a known username/password combination.


1

The source code of password Safe is open source so you're free to do what I did: check. A HMAC takes two inputs: the key and the data. What PS does wirth the ubikey is take your input as data and send it to the UbiKey. The key is in the UbiKey itself ans stays there. So, the sequence of event is the following: You enter your passphrase. The software ...


-4

I find it funny how there are all these really complicated answers. To me it seems simple, just keep it random and long. That way no algorithm can figure out a trend in your passwords apart from the fact that they are all random which won't be of any help to a hacker. So when making a password for a site, just go crazy with your keyboard like so: ...


0

It is very common for a site to ask for email address instead of username, that can cause problem for you, and if you are using different email that can be hard to manage. From security point of view it is a good idea , and it can confuse those hackers who know you on social networking or any other public site and try to use your same username on bank or ...


0

It's easy to overestimate how interested hackers are in figuring out how 2 usernames fit. If someone really wants to, they can figure it out, but most hackers don't really care about that. To them usernames are just 1 part of a 2 part identity confirmation form, and the only reason they would care about that is if it can bring them money. Obviously, a bank ...


1

The question here is always "what is your threat model?" It is meaningless to ask such questions without a proper context given by a threat model. Most of the time a different username is not as secure as a different password. Other times, such as spy vs. spy situations or duress situations, a different username can absolutely be effective. In nearly all ...


1

The simplest way that this could be broken is probably thus: One of your accounts has their password broken for some reason (we can take this as read, as if that never happens then just using the same user/pass everywhere would be fine too, so this is our starting point). Your hard-to-guess password gets put into a password dictionary. Your (not generally ...


2

You really shouldn't. The reason why? Once a password common to several accounts is cracked, getting access is just a case of finding them. Since account names are relatively public, they are less well-protected than password data. A bit of innocuous research work would then give someone access to most or all of your online activity.


60

Big data analysis means that your different usernames probably aren't as disassociated from one another as you think they are. In other words, they are likely all identifiable as yours. But perhaps the bigger issue is that if your password is compromised in one attack, then it becomes part of a password database the attackers can use against other password ...


16

if I use different account names in every service, then can I use the same hard-to-crack password in each? If the account names can be associated with the same person (i.e. different forums, same style of writing, similar content etc) then it does not matter if the names are different. And, contrary to the plain text or the hashed password the usernames ...


1

Most common folks dont care and arent as paranoid as us about this kind of thing so they usually use the same password(or variations of it), in most services whether those are their bank accounts, email, game username, forum username, (etc you name it) and the same applies for usernames(relating to your question). This makes the general population of our ...


0

On the technical level, the fundamental problem here is that the help desk can reset the password and leave the "user must change password" checkbox unchecked. I don't know of a way to force leaving this checkbox checked. There might be one, but I don't know how. One way around this might be to not give help desk personnel delegate access to AD Users and ...


0

Maybe you can use a kind of Vault for storing secrets. There is an Open Source project named Vault at https://vaultproject.io/. It provides a lot of options and access control. Take a look. As others already said, this is bad practice. Authentication is made to link virtual account with physical person. That's actually breaking this.



Top 50 recent answers are included