Tag Info

New answers tagged

1

Up front: Yes, a long password with symbols has more average entropy than a long password without. Ultimately password security choices are left up to the people who design the systems that you use. There may be other additional security features that they use to secure your account information other than a username and password combination. IP/Network ...


3

Disallowing symbols is usually a sign that someone in the development process heard about SQL injection, code injection, or cross-site scripting and decided to take a brute-force approach to preventing it rather than going to the effort of understanding what the real risks and prevention techniques are. Length limits are either a sign that someone didn't ...


0

I wouldn't say it is more user friendly. Personally, I want fewer characters to remember, but I also hate artificial limits being placed on me. A more interesting approach might be to calculate the entropy of a users password and simply require a certain amount of entropy. If the user does not enter anything other than lower case letters, it would ...


21

If you want the password scheme to be most user friendly, then you got to let the user choose what he/she wants instead of enforcing such a limitation by second-guessing what the user might prefer. Every human is unique. Some may prefer a short complicated password that can be entered quickly by virtue of pure muscle memory while others may prefer a ...


1

There is a trade off between: asking users to type short sentences or phrases, without the need for validation of upper case, non-alpha characters very short text strings with character complexity Users will measure their experience as the %age hassle and success for typing their password in and you will have different results with different audiences ...


10

17 random single-case alphabetic characters have the same entropy, and are even easier to remember and type.


0

The whole "unique and random" serves a double purpose in this imperfect world, where websites cannot be trusted to either do the right thing nor have good intentions. The website could sell the username password combos to crackers for research and incorporation into advanced dictionary attacks. Aka doing intentional harm. Provide a free game, require ...


2

I would personally disagree with the storing of plain-text passwords is ALWAYS bad, because it depends on the application or purpose of the password being stored. Generally speaking, yes, storing passwords in plain-text is a poor security choice for all of the obvious reasons. However, that doesn't mean it is a super-bad choice in all circumstances. If the ...


2

Short answer, it’s never ok to store plain-text passwords and doing so is a bad practice. From your description, there is limited risk associated with the organization supporting the app because there’s no compliance or direct monetary risks attached. That risk is passed on to the users. It’s possible for the users of this software to have their passwords ...


2

The two defences you list are meant to protect against two different attacks. Unique password for every login This is meant to protect against a leak of someone else's password database. Even if the attacker works out your password, it's useless as it only allows access to the single website the leak happened on (which you've probably changed by the ...


0

I have a login and password that is read-only access. That is the login I use when sites such as paypal asks for it. I also use the read only account for my quicken software. If you are curious what paypal does with the login data, read the user agreement or contact support for more details.


5

Well, it certainly doesn't make it more insecure. You still have your primary password, which we'll just assume is stored correctly. And in addition to this (I'm going to assume that you have to enter both, not one or the other; if that would be the case, this wouldn't be very secure, see the links @D.W. provided in the comments.), they have a secondary ...


4

The way I see it, even if it's random, it's just eight very, very, very low entropy passwords (1 character). Which will be super easy to break by brute force (as usual, we have to assume that attacker has the salts). Randomization of the challenge will be useless if the attacker knows the secondary password. But I think this will have additional security if ...


15

Is my password sent to Paypal? Yep. Giving your password to PayPal may be a breach of your bank's Terms and Conditions and/or make you personally liable for any fraud that takes place through that system. Also PayPal can see the personal information and transaction history associated with that account. Hope you trust PayPal real good now! Or is ...


8

Your information does go to PayPal, who will likely use it to login to your bank account. That way they can verify your information is valid. However - technically - they can also see other information. Anything you see after logging in (your account balance, the various deposits / withdrawals) is visible to them, and they may or may not store that. ...


18

Once you submit that form, the information clearly goes to PayPal. So, yes, your password is definitely sent to PayPal. However, PayPal is saying that that it only uses your bank account credentials to confirm/verify your account. What seems to happen is that PayPal takes your information then sends it to your online banking provider for verification. What ...



Top 50 recent answers are included