Tag Info

New answers tagged

1

At first glance, this seems like it might be a good idea. Like many suggestions relating to passwords, in some situations it may even be an OK solution. However, when you consider it in more detail, a number of shortfalls become evident. If I was trying to crack someones password, one of the first things I would do is try to find out as much information ...


1

It's best to use a method that would stay secure even if everyone used it. You'll have less to worry about and it lets you collaborate with others in tweaking the method to be the most secure, because you don't have to keep your methods secret. This "the enemy knows the system" approach is a huge motor for innovation and advancement in information ...


-1

Use Malbolge. After all that's essentially random, right? (=<`#9]~6ZY32Vx/4Rs+0No-&Jk)"Fh}|Bcy?`=*z]Kw%oG4UUS0/@-ejc(:'8dc That's the hello world program.


18

Like most password generation algorithms, this one relies on security through obscurity. As long as nobody suspects that you use this method, nobody will use a cracking tool which tries random valid source code snippets and the rule of strength = possible_characters ^ number_of_characters will stay valid. But as soon as someone suspects that you might be ...


-2

This is actually a very good idea. You won't find this kind of passwords easely in rainbowtables, and most bruteforce attacks don't include characters like this or search for such long passwords. Its only weakness is the fact that it is a short code (not a short password), if someone knows you have a script as password it could be easy for them to guess. ...


25

You can use source code as password. However I'd strongly recommend against using source code as a passphrase. The reason for this is entropy. Passwords / passwphrases need to provide lots of entropy (100 bits+) and programming languages usually pose severe constraints on the formulation of instruction thus resulting in less entropy per character than even ...


0

On Software Testing: If you sign up for Fortify-On Demand at http://hpfod.com, you will notice that there are a variety of offerings, the primary three being dynamic security analysis, static security analysis, and mobile analysis. A few others such as IBM and Cigital mirror this model. All three of these vendors supply Software-Testing-as-a Service ...


0

A short and sweet answer would be: Software Testing revolves around code review and compliance with secure coding practices. A Penetration Tester utilizes various methods to emulate an attack and fully exploit a target system/network. They're related because a Penetration Tester may gain access to your system through exploitable software(I.e. buffer ...


0

I'll explain in rather simple words by explaining what actually they do. Lets start with penetration testing, as I work as one !! Penetration Testers usually are assigned a project (in your case a web application) to test , They go through the website ,Do some reconnaissance and try to find important functions of the web application e.g. For a Ecommerce ...


2

I'll put a slight different spin on the second part of your question concerning discipline cross-over, since I have experience doing these in my career. A good Penetration Tester has a hacker mindset. They work to defeat what security protections have been put in-place, by whatever creative means available to them and their knowledge set. A good PenTester ...


0

I would say you should view relationships between these 3 types of activities like that: penetration testing is a subtype of security testing which is in turn is a subtype of software testing. Security testing deals with very specific types of defects: security defects; ones that could result in compromised system, ruined reputation and stained public ...



Top 50 recent answers are included