Hot answers tagged

6

One thing you could do is store the passwords inside a configuration file (for example Laravel stores it inside .ENV) and then avoid committing it to the repo, by adding it to .gitignore. Users will have to create one manually after downloading the repo.


4

If someone has physical access to a machine, the root password is no longer a protection. Among things that can be done (from simpler to harder): interrupt a boot sequence. Some systems directly open a shell with root account without asking for password in order to allow the operator to try to recover manually after a major disaster (lost of password file, ...


3

Well, all of the sensible answers can be summed up in one simple rule: Don't do that! There is just no safe way to commit passwords or other sensitive values into a Git repository that will be cloned by a rotating cast of developers. And there is no foolproof automated way of catching such mistaken commits. So all the advice has to be built around ...


3

An important reason for the "tick some boxes" approach is because too many sites have their own unique password policies (your password must be a palindrome in iambic penatameter etc.) But in average, I don't understand why making sure that there's at least 1 char from every lists is more secure than a purely randomly generated password. I wouldn't ...


3

Many sites have complexity requirements. One advantage of the check boxes is to guarantee your password will actually be accepted by the website that you are generating it for. Another reason is psychological. People will believe the password is less susceptible to guessing if it has these character requirements. Realistically, a password with 80 bits of ...


2

You should use WPA2-Enterprise, it allows you to issue per-user credentials that can be revoked at will, in addition to using unique keys for each user (so you can't decrypt someone else's wireless traffic even if you are allowed to access the network, something possible with WPA2-Personal where the key is the same for everyone). You'll need a RADIUS server ...


2

There is not so much you can do with securing wireless network from a router standpoint, but key points to hardening are:- Change default password. If available use WPA, not WEP. Disable remote administration Change the default SSID name Enable router firewall Disable SSID broadcast Enable wireless MAC filter


1

I suppose I'll indulge this. One solution to something like this would be to have a multi part key like bitcoins so-called "multisig keys" held in different legal jurisdictions.


1

The question is whether the ISP's device and the Linksys can pair together in order to provide a single WiFi node (with the same settings and password). If they can do this then you simply need to perform the typical hardening of a device that you normally would (no external access to the admin page, change the default password, etc.)


1

Fundamentally, this sort of authentication is only as strong as the email account the user is using. However, the same criticism can be levied at any relegated authentication model - OpenID or OAUTH included. However, I think that this is still well worth it - by leveraging existing services that users value, it means that they are not tempted to use throw-...


1

To answer the question you specifically asked...No, hashing the Int32 value to use as the salt is not significantly stronger than using the Int32 directly. It would, as you already suspect, be more obscurity than security. As Martin pointed out in his answer, the key property of a salt is that it be globally unique. You do not get this property with ...


1

The short answer is NO. NEVER EVER MAKE YOUR OWN HASHING ALGORITHM! Home cooking algorithms for hashing are never ever secure and therefore a very bad idea. It's also a bad idea to mix two algorithms together as it can make things even more insecure. There are many other algorithms out there that you could use. You can use Bcrypt, Scrypt, sha2, sha512 , ...



Only top voted, non community-wiki answers of a minimum length are eligible