Tag Info

New answers tagged

1

To me this is like saying that you don't need to bother locking your car because if someone really wanted to get in they'd just smash a window. Even if you leave your LastPass session signed-in (which is not advisable if anyone else has access to your computer), it is still stronger in several ways than using any system where the keys are stored on the disk ...


1

You are asking about how to be secure under the assumption that a malicious actor has started a process on your system (or hijacked another process with their own code) running with "user trust". On Windows, you could trigger this action yourself by -- for example -- downloading http://example.com/virus.exe and then running it voluntarily. Even if you are ...


3

Most antivirus will try to protect processes from code injection. However, this is ultimately heuristic: the only clear distinction between malicious code injection, and normal process behaviour, is at the human level: did the human user actually wanted that to happen, or not. Software in general, AV in particular, cannot fathom the intricate psychological ...


4

For n-character passwords without two identical adjacent characters, @Stephen gives the solution: that's 94*93n-1 passwords. Reasoning is simple: you are free to use any of the 94 characters for the first character, then for each subsequent character you may use any of the 94 except the one which you just used, so 93. For n = 16, you may see that you keep ...


0

I'm going to assert that software developers are not free of responsibility on this count. If you're the developer, does it seem fair to assert that it is at least your responsibility to provide a solid mechanism for enforcing the policy chosen by your customer? What should the default policy be for non-savvy customers? In other words, for most of your ...


0

There are two possibilities -- either the attacker has found the actual password, or the attacker has found a hash collision. In the former case, changing the salt is pointless, in the later case it might help. Whether it would help depends largely on whether they found the match by brute forcing the password (starting with "", and ending up with ...


0

You may want to consider other ways of deterring that behavior. Detection could be difficult or unreliable. If users had some motivation to keep their account private, even from friends or close coworkers they would self-police, solving your problem. Policy is one option, people who are found to be sharing passwords can be punished or fired or their ...


3

I believe you are concerned with multiple people reusing a shared identity, not just the specific case of shared passwords. If you are using some kind of persistent session, you can close the one session when the next one signs on. You can consider a GeoIP solution to see if your users could have traveled to the new location in the amount of time between ...


0

Valve's Steam will only let you to log on to your account from computers and locations that are registered and allowed. If you try to log on from a different computer or location, you will receive and have to confirm an email allowing it first. I think it is pretty functional and reasonably safe in the sense that a Steam user would have to lose both its ...



Top 50 recent answers are included