Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
4
Newest
 Teacher
Impact
~4k people reached

  • 0 posts edited
  • 0 helpful flags
  • 64 votes cast
Feb
1
comment How can I protect myself from false accusations when our company practices password escrow?
@CJDennis The only argument for frequent password change I have seen is as follows: assume the password hashes were stolen and it went unoticed. Somebody is running some bruteforce to get the password, but that is expected to take x amount of time (given password complexity requirements and estimate of expected processing power of the attacker at time of computation). So you should change the password with intervals no longer than x, so when the attacker is done and tries to use the password, it has already been changed. Edit: yes, you should use a strong salt, and moore's law anyway.
Jan
13
comment How to securely counter users from adding a single digit to their old password upon creating a new one?
I agree that OP suggest the pass are known and talks what storage mechanism to use. Also that plaintext should never ever - not until the death of the universe - be used... 1) the check can be done by asking the user to introduce the old pass - which you check with the hash (and salt) - and compare it with the new one. 2) Education takes - and has already taken - too long to solve this. We need systems that encourage and facilitate to do the right thing. Btw it is moot, with long enough salt and a good pick of hash, similar pass are only a problem if leaked - any pass is a problem if leaked.
Dec
31
comment not allowing pasting of bank account number
If you have to type it (and even if you paste it) spyware may get it. As I see it, It doesn't really add security one way or the other. [You know those graphical keypads that change the position of the numbers and that the numbers disapear when you hover the mouse? - spyware may get those to, modern ones record video.]
Dec
29
revised Is physical security less important with disks on a server being encrypted?
deleted 4 characters in body
Dec
29
comment Is physical security less important with disks on a server being encrypted?
I understand that information is - probably - the most valuable asset for you, and chances are it is also valuable for your competition. But if you are the target of a "hacktivist", criminal or terrorist group that just want you out of the game, leaving an small explosive on the server room seem pretty effective. Even if we don't go to that extreme wiping your disk, stealing them (maybe replacing them), or installing malicious hardware or software (as the current answers has pointed out) can do a lot of damage.
Dec
29
answered Is physical security less important with disks on a server being encrypted?
Jul
2
revised Is possible to get infected by only staying connected to the Internet (nothing else)?
added 339 characters in body
Jun
30
awarded  Teacher
Jun
28
awarded  Editor
Jun
28
revised Is possible to get infected by only staying connected to the Internet (nothing else)?
added 437 characters in body
Jun
28
answered Is possible to get infected by only staying connected to the Internet (nothing else)?
Nov
11
awarded  Autobiographer
Nov
11
awarded  Supporter