Tag Info

Hot answers tagged

9

Jack sits back, Reflects his thoughts for the moment, Scratches his head wondering if you mean the magic bytes that would be used by file(1), the signature of the internal fs, the UUID of the device... and how to phrase it to be understood by Diane. Jack - "What do you mean. What's that?" Diane thinks Jack has absolutely no idea and proceeds with ...


9

Pronounceable words are more-or-less sequences of syllables. What constitutes a syllable depends on the language, including the language variant (British, Scottish, American, Indian... versions of English are not rigorously identical). So we will make some approximations. Let's suppose that we want two-letter syllables, always a consonant followed by a ...


5

To answer your first question: As far as I know, there is no way to circumvent this. It's a security feature. To answer your second question: Yes, non-default trusted root certs are definitely potentially problematic. They are often abused. They are sometimes used for workplace or traffic monitoring (which is potentially OK if adequately disclosed, ...


4

Hard question to answer exactly. I'm going to refer to Theodore T'so's pwgen (v2.07) implementation exclusively here (pwgen -A0) These pronounceable passwords use "phonemes" as "symbols", rather than single characters, in (the English language biased) pwgen a phoneme can be 1 or 2 characters. There are 40 defined (in pw_phonemes.c), 25 are a single ...


4

Restricting yourself to only passwords that are pronounceable does decrease the entropy, which reduces strength. So in theory, the password will be weaker But password strength is a complicated beast. In particular, if choosing pronounceable passwords means you can remember a longer one than usual, then your entropy goes up and your password becomes ...


3

A bit of background as to what Yubikey is first: Yubikey is a variation on a common type of device known as a One Time Password generator. Basically a mini-computer that generates an essentially unlimited stream of passwords, usually one per minute from a deterministic algorithm embedded in the device. The trick is that next password is predictable if you ...


3

DNS management is the modern way to do this for the non-technical. Managed DNS services keep track of valid and non-valid entries in an effort to protect the non-technical in this way. Yes, you lose the granular control of whitelisting only those sites that a particular user goes to, but the admin overhead in case the user wants to change their behaviour is ...


3

The problem with a outbound filtering solution of the nature suggested is that modern web applications and software contact a bewildering array of servers on the Internet and it would be very difficult for a non-technical user (or indeed anyone) to make informed decisions about this (To get a good illustration of the problem try running glasswire or Little ...


1

My answer is would be a toned down version of this: "They are suggesting we use an unencrypted shared key authentication scheme designed for another use case. Their recommendation is bizarre and useless. There are no web browsers that are able to generate the required keyed hash for each TCP segment."


1

From my limited point of view, an attacker would not be able to immediately gain access to the database. The data source in your snippet refers to a database server on 10.#.#.#. The 10.0.0.0/8 network is reserved for private networks according to RFC 1918. If you are an external attacker without direct access to the private Network the database server is ...


1

Just because you were not able to connect directly, this still poses a few problems (will speak on them in a second). Anything and all should always be reported for a few reasons, it is informational, it illustrates that time was taken to analyze information during an engagement. Now there are a few reasons I can think of, for this happening (permissions)" ...


1

Using MD5 for consistency checking is a clear violation of CWE-327: Use of a Broken or Risky Cryptographic Algorithm. Any protection that RFC-2387 provided, is voided by the use of an outdated, and insecure algorithm. Rapid7 is making the internet less secure with this recommendation. This BS "vulnerability" is more pointless noise that drowns out real ...


1

One-factor authentication is no more or less secure than existing methods in itself because the password itself is not the main weakness; The flavor of the moment in security circles is man-in-the-middle. Adding two factor authentication, in use by Google products like Gmail, Outlook online, or RSA tokens was another layer of security, but here's an example ...


1

This works similarly to any symmetric key one-time password (OTP) technology. Point 1 - This is not meant to replace your password but instead be a second factor of authentication. Without possession of the Yubikey you are unable to generate the code necessary to authenticate to a system. Point 2 - Well, it generates one time passwords so it is more ...



Only top voted, non community-wiki answers of a minimum length are eligible