Hot answers tagged

28

I find it hard to see what security benefits this could provide. In multifactor authentication, the point is to use different factors — i.e., "something you know", "something you have", "something you are". Just repeating the same factor twice seems a bit pointless. But let me speculate some about what the purpose could be. 1. Stop keyloggers Only ...


16

A system which locks out an account, even temporarily, in response to invalid password attempts will make it very easy to conduct a denial-of-service attack against someone. Using a two-part authentication makes it possible to have very strict lockout policies on the second part while still remaining resistant to denial-of-service attacks. If someone found ...


15

If you want strong authentication without the cost of sending SMS you can use TOTP with the Google authenticator app. Indeed, the pin solution doesn't seem to add a lot of additional security. I also don't fully understand the mechanism. They enter 3 digits from a 6 digit pin. How did they obtain the 6 digit pin and how are the tree digits selected? Also 10^...


9

I'm assuming that you are talking about additional hashing. So it would look like this: Client --sha1(password)--> Server --bcrypt(sha1(password)--> Database I think you are aware of this, but just to make it explicit: the transfer needs to happen via SSL to defend against eavesdroppers, hashing client-side would be no help against them at all. ...


8

Password strength meters are notoriously weak: New research from Concordia exposes the weakness of password strength meters and shows consumers should remain skeptical when the bar turns green. In general, adding a character to a password will not make it weaker. There are only specific situations where this isn't true. For example, MyPasswor is ...


7

John is not typically run on victim's computers. It has two uses. First, an attacker runs john on their computer to try and crack a victim's password. Second, a sysadmin can run john locally to look for weak passwords. So I wouldn't assume that you've been hacked just because john was installed. From the message in your post, it looks like you installed ...


7

The point of multi-factor authentication is to require information from multiple sources so that if a user is compromised in one way (say they write their password down somewhere and it's found), then there is still a layer of security preventing account access. Usually, the three types of authentication information are something you know - like a ...


3

Sufficiently long passwords generated by a secure random number generator hashed by an algorithm with long output (at least 128 bit) and no known weakness (at least SHA256) will become infeasible to bruteforce (either against a single hash or compute a useful rainbow table) and salting will not be necessary. Your description of your implementation doesn't ...


2

As tim wrote, it could help mitigating the effects of password reuse for users in a few cases, but if what you're thinking of is hashing it client side instead of on the server side, this would be a major design flaw. https://en.wikipedia.org/wiki/Pass_the_hash This problem plagues the NTLM authentication, where it's actually even worse than in the common ...


2

The purpose of salting is, that one cannot build a rainbow table to get several passwords at once. Without salting: An attacker could search the internet for precalculated rainbow-tables and find the passwords with no effort. With a constant salt: The attacker has to build one rainbow-table for this specific salt, and can then get all the passwords with ...


2

Such strong passwords can be safely stored unsalted with a fast algorithm like SHA256, there is no problem in that. The problems are different, you have to trust the client, the secure transportation to the server, and you have to make sure that the generated passwords are indeed unpredictable.


2

The phone should know these passwords if it wants to use it, so it obviously keeps them somewhere in a readable format. If the phone is compromised the attacker would be able to read them. That's actually why some mail providers (GMail, etc) are moving to oAuth so that the phone stores a revokable token instead of the actual password. While that is possible,...


1

No, the method you have provided is considered to be security through obscurity or the belief that a system of any sort can be secure so long as nobody outside of its implementation group is allowed to find out anything about its internal mechanisms. and generally considered to be a bad idea.


1

It would have a slight advantage that bots or attackers that haven't done their reconnaissance properly may be wasting time on password guesses with passwords that the system can't possibly accommodate. If an attacker can register for their own account, they should have checked the maximum password length and other password rules by trying to reset their own....


1

The only security disadvantage of password-length restrictions (I.e. "Not too large") is if the software is vulnerable to a buffer-overrun. Those are not difficult to defend against for password fields, so this is just laziness on their part. Other than that, password length restrictions can only artificially reduce the possible entropy in a password.


1

What version of Excel are you using? Since Office 2007, the encryption used in MS Excel is 128 bit AES with at least a 50,000 interation SHA-1 hash. If you use the built-in encryption with a sufficiently hard password you should not have to worry about offline attacks. How to define "sufficiently hard" will probably change slightly every few years, but if ...



Only top voted, non community-wiki answers of a minimum length are eligible