New answers tagged

4

There's no question that this extra MD5 layer is better than just using the original password. The question is whether you'd be better off using a Password Manager which simply generates random passwords and stores them in encrypted form. I do see the elegance of your solution over a Password Manager. Since the final password is derived, not stored, then ...


2

There's a general principle that a hash function like MD5 cannot add entropy - which means that if this method was a tool, a piece of software that people attempting to discover the password became aware of, it would simply be another rule, another step in their attempts, and would only marginally slow them down. However, if this was a method that Bob ...


2

Yes, it is most often just a useless "security measure". We need to define the threat model and then if an on screen keyboard provides a proper mitigation. A OSK will protect against two threats: A hardware keylogger A software keylogger that is only looking at the keyboard state (does not attempt to defeat a OSK). One should note the the difference ...


3

If an attacker is aware that an OSK may be used (and that becomes more and more common with touch devices), he can prepare an OSK attack, e.g.: capture screenshots of the OSK and identify keys pressed (e.g. because they have a different color) an his own OSK on top of the existing OSK (similar to clickjacking) add a kernel mode driver to do whatever, e.g. ...



Top 50 recent answers are included