Hot answers tagged

5

There's a big gap between "does not require" and "implemented by the lowest bidder". why do we even use full-power database software and SQL queries Because if you're already running a SQL database for your transactional data, implementing a second technology stack with appropriately trained development and support staff for a very specific function is ...


4

A quick search turned up the link below. They created a new technology called CredentialGuard, which isolates secrets in virtualized secure environments rather than storing everything in LSA like they used to. Mimikatz can no longer just dump lsass.exe process memory and parse the contents. They're still in some memory, strictly speaking, but not memory ...


4

Do not use SHA256 to hash passwords. SHA256 is a message digest algorithm. It is designed to be very fast. Use an algorithm which is intentionally designed to be slow and hard to implement in specialized hardware. Why? Because fast algorithms allow an attacker to brute-force a large number of passwords until they found one which works. "They'll still have to ...


3

Special characters don't add as much to security as you might think. They increase the number of possible characters, but the most powerful multiplier comes from password length. Let's say you have a very limited character set consisting of [A-Z][a-z][0-9], giving you 62 possible characters. Therefore a 10 character password has 62^10 possible passwords, ...


3

The security lies in that you have a unique "access token" per client. So you can revoke and control as you will. Look at for example, Googles "App Passwords" which are the same thing. These tokens, of course make the 2FA no longer 2FA, but thats required for software and programs that do not support 2FA at all. The idea is that if a token becomes ...


3

Your action is justified from me. I have never been asked from any major and respectful company such information, neither for a service, nor even for account recovery. Send a message to the official support team and see if these info are actually needed if this thing causes you lots of inconvenience. But be aware of this - you might be scammed.


2

I think that onetimesecret.com it's a very useful service, and it fits your needs. Of course, you should share the onetimesecret password by a different channel in order to increase the security and avoid the case of compromising the sensitive information if someone has access to the email account. I have dealt with these situations before and, depending on ...


1

It depends on where and how you store them. The character set is what comes into play here. As long as all parts in the chain that use the password are setup to use a character set that allows these characters than yes, it's perfectly fine. A warning I say all parts because if one part of the chain doesn't support them, it can cause all sorts of problems. ...


1

If the login service is programmed properly there shouldn't be a problem with you using any of those characters. In fact, it is suggested you use a special character! When I say "programmed properly" its because sometimes a programmer will not set up his database to support "UTF-8" and then a character such as "รง" might not work...


1

Trusted party is exactly that. Someone who is trusted when he identifies you. The most basic vouching happens when you go in front of the HelpDesk and tell them that you forgot your password and are now locked out of your account. Then the IT staff vouches that it's you and resets your password. Now suppose that no domain admin was available when you went ...


1

Where I work we have a solution that will automatically detect sensitive information and replace the content with a link to a secured server. The company that sells this makes a business out of it so this isn't a crazy idea. As long as you make the links impossible to guess (long crypto-secure random strings.) The solution we use actually requires the ...


1

There already is a solution for encrypting email: It's called PGP and there are plugins available for most email programs on most operating systems. Its main problem in the real world is that you need the public key of anyone you are going to send an email to, but when you are using it internally you can fix that by setting up a keyserver on your company ...


1

For encrypting data, it's generally recommended to store a random key and encrypt this with the appropriately salted password. This means that if/when the user changes their password, you only need to decrypt and re-encrypt their key, and not all their data.


1

Yes, there are several requirements for an iterative hash function: It should not be possible to do any precomputation, such as using rainbow tables. The implementation should avoid running into cycles or fixed points in the hash function. The implementation should be as fast as possible, because that is what the attacker would use. Especially on the ...


1

If you have (or get) a Mac, and enable FileVault full disk encryption, you can then use Find My Mac to locate your laptop while it remains encrypted, and the confidentiality of data remains. This relies on the fact that "guest mode" is active, allowing a guest user to physically login and connect your laptop to wifi, allowing it to phone home where you can ...



Only top voted, non community-wiki answers of a minimum length are eligible