Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

All Questions

Filter by
Sorted by
Tagged with
1
vote
3answers
251 views

If no one knows a password, is there a reason to change it?

Scenario: A high level access account on a single machine, where the account is created by the system/application with a secure password, without exposing the password to a human or to any other ...
0
votes
1answer
48 views

Quantify security strength from entropy and lifetime

Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
2
votes
1answer
234 views

How do attacks on password locked accounts work?

A lot of questions here are about the safety of passwords e.g a Login Password to an account on site X. But how can attackers get in the account when they have to guess the passwords? I know there is ...
1
vote
1answer
150 views

Do non-administrator Windows accounts need strong passwords?

I have always used long passphrases for my own Windows user accounts. But I know some people who use moderately common passwords (we'll say they're in the top 1,000 most used passwords, but not in the ...
1
vote
1answer
67 views

Banking app logon - multiple fingerprints on a device vs 2 passwords known by 1 person

Yesterday I logged on to my banking app via my iPhone. The normal procedure was to enter information that consisted of: The answer to a security question. This had to be entered in full and was the ...
2
votes
3answers
325 views

Is using weak login credentials always bad?

I am currently using 9 digit numbers to authenticate writers on two apps. In the first app, this unlocks editing tools for use in making content rich dhtml documents which are stored on the local ...
63
votes
3answers
8k views

Website returning plaintext password [duplicate]

I have recently logged into a website. When I clicked on the "Update Profile" page, you are displayed with a list of text boxes for all the user fields, e.g. name, email, phone number etc. There is ...
9
votes
3answers
2k views

How does Comcast know my WiFi password?

How does Comcast know my WiFi password? I generated it via KeePass and entered it into my Arris router/cable modem myself, and I bought the router used from a friend. When I went to the account web ...
1
vote
1answer
85 views

Will SIM‐like PIN on website as second password increase security

On SIM cards, which are used in mobile telephony, PIN (and PUK) is used. Unlike a password, they are locked after some incorrect attempts to prevent brute force attack. If wrong PIN is entered 3 times,...
0
votes
0answers
18 views

Security risks in confirming the username instead of confirming the username and password combination [duplicate]

Most of the login pages like Google, Outlook and Yahoo! confirm the username first and then ask for a password instead of confirming the username and password combination altogether. Isn't it less ...
0
votes
2answers
134 views

Can a password change via CSRF lead to account takeover?

If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF ...
1
vote
0answers
37 views

Are there any reliable and updated sources or feeds for password dumps? [closed]

I am looking for any reliable, up-to-date sources (which may be RSS feeds, websites, or anything else OSINT-based) which contain password dumps and their relative links. I am looking particularly for ...
2
votes
2answers
316 views

What to do about company that sent my password information in plaintext?

I make monthly payments to a website/company who insecurely stores my information. These are in the form of loan payments, so I don't know if I can change who I pay to. I asked for login assistance ...
0
votes
0answers
59 views

Saving all secret keys, access data in heroku environ instead of config file?

I have a python/flask app and I use heroku to host it. I use some additional services, such as stripe, postgresql or emails. All these services have either secret keys or other access data, which ...
1
vote
2answers
121 views

Why is it unsafe to use a password that exists online?

I recently saw a post asking why something that appeared to be a random string of characters was a bad password. One of the answers was that it already exists on a website so you can Google it by just ...
0
votes
1answer
121 views

Is using HOTP only authorization considered weak?

Migrated from ServerFault, as advised there. I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes. I fully understand 2FA is more secure than Single ...
62
votes
5answers
23k views

Logged out of Facebook on all devices on a sudden. Should I be worried about being hacked?

A while ago, I was opening Facebook app on Android and then I got the message "Session expired. Please log in again.". I then tried logging in with my current password and was success to log in my ...
0
votes
1answer
2k views

Is it okay to save passwords as base64 strings with no other hashing or encryption beforehand?

I've just inherited a project where all the passwords on the server side are simply converted to base64 and put in the database. No salt, no hash, nothing. Just a simple db.Add(password.ToBase64) kind ...
14
votes
6answers
3k views

Is it safe to store 2FA tokens together with passwords in 1password?

I'm using 1password and I've seen 1password allows you to store 2FA tokens in the same place where you store the password. I don't like the idea of having everything in the same place as if someone ...
5
votes
2answers
161 views

Is it possible to use drawing or scribbling as a way of authentication?

There is a service called https://www.typingdna.com/ which authenticates users based on their typing habits and it works pretty well but it still requires a password. In order to try and replace the ...
2
votes
4answers
103 views

What are some existing or ideas where the use of a password can be replaced to login to a service? [closed]

The password has been a method of authentication for a long time now and we always hear of breaches happening where users passwords get stolen and sometimes are not even hashed at all or correctly. ...
1
vote
0answers
86 views

Email login bug, is it a security concern for email users?

(The name is vague on purpose because I'm not entirely sure how bad of an issue this is or if it is well known yet and I don't want to accidentally leak some kind of major breach type thing) Scenario:...
15
votes
3answers
4k views

Is this bank website secure enough? No https in login page

Today I opened a bank account to invest my savings. Here's the link to the login page: http://www1.directatrading.com/ I noticed it doesn't use Https protocol (neither is that page nor in the landing ...
45
votes
6answers
10k views

User Account with no password

I'm currently job searching, and sometimes I come across sites that are just huge databases full job postings, and before you apply you have to create an account. I came across a site, but I'm ...
17
votes
4answers
821 views

Help! My information has been stolen! What do I do now?

This is an attempt to ask a canonical question to expand upon another post with a similar name. The goal is to create something helpful that can be used as a duplicate when non experts ask about ...
3
votes
3answers
404 views

Password manager and account recovery

I'd like to start using a password manager, but I'm not sure how to handle account recovery. I'm not a criminal or a secret agent, so if I lose my master password (or my second authentication factor, ...
3
votes
1answer
5k views

Should user account be locked after X amount of failed logins?

I have almost finished developing my login system and there is one more thing that I'm not sure about. So many debates I found on the internet about counting invalid logins and locking users account. ...
-1
votes
2answers
150 views

Is there a single change that could have made the biggest password hacks much harder?

In recent years there have been a number of spectacularly huge hacks. As examples: The 2013-14 hack of Yahoo involving 3 billion accounts The 2016 hack of Adult Friend Finder involving 400+ million ...
0
votes
1answer
60 views

What are the most frequent ways someone's password “leaks”? [closed]

List of user:hash published? Same password for web and local (os...)? Phishing?
-3
votes
3answers
194 views

Password Stealing vs Account Hacking [closed]

Which is more likely to occur, and by how much: getting your password stolen, or getting your account hacked by brute-force?
2
votes
3answers
597 views

How secure is a password made up of three or four three-letter words?

According to this, a password such as dinwryran is secure against a brute-force attack. Is this true? If not, why?
11
votes
4answers
5k views

What's the best length for randomly generated passwords? (Security vs. compatibility)

It's generally recommend to use a unique password for each online service, a random password generator to create them and a password manager to store them. I've started to replace all my online ...
-5
votes
1answer
127 views

How to prevent the usage of databases leaks to connect on other websites that use the same email/password? [closed]

On the dark net we can buy database leaks with nicknames, emails addresses, passwords, questions/answers to prove identity, and other fields. Sometimes the passwords/answers are in clear, sometimes ...
2
votes
1answer
426 views

Is there a well-researched and user-friendly solution to the password problem? [closed]

The Password Problem has been spoken on many times, but most places I've seen offer terrible solutions such as modifying a dictionary word, changing your password requirements to include special ...
1
vote
1answer
162 views

Do I need high password security if I also require a Client Certificate for validation?

Due to an ongoing discussion in my office, I was wondering if anyone had any comments on whether password hashing security needs to be very strong if client certificate validation is also required for ...
92
votes
5answers
26k views

What is the purpose of confirming old password to create a new password?

Suppose that someone stole my password, he/she can easily change it by confirming the old password. So, I am curious that why do we need that step and what is the purpose of using old password ...
1
vote
1answer
62 views

external logins having to confirm email

i allow members to sign up/ login in using external logins (social networks and such), the problem is that, if i didn't ask them to confirm their emails then how would i validate their ownership to ...
0
votes
2answers
142 views

Is there any real security benefit to forced password change intervals? [duplicate]

This question is quite basic, but it bugs me and I'm sure it bugs a lot of other people as well. What is the real security benefit to forcing users to change their password say every 60 days or every ...
3
votes
2answers
687 views

Attacking KeePass

I recently saw this new attack on KeePass (see here and the source code). I don't know how to use this attack (I'm a newbie to these things), so I want to know: How can this attack be used? What does ...
1
vote
2answers
113 views

How to proceed after attempted cracking to accounts? [closed]

I was woken today at 05:15 by a phone call from my bank, notifying me that the PIN number is XXXX. I did not ask to change my PIN number, and actually, have not accessed the bank account ...
3
votes
1answer
339 views

Yahoo account “secure” but spam sent from my address

My Yahoo account shows no suspicious activity, only log-ins from my desktop and 2 of my devices. But a friend was spammed twice within a short time today from my email address. I use Yahoo's Account ...
1
vote
1answer
131 views

What are the problems with users sharing network passwords?

I have just taken control of a small corporate network with aprox 50 users. They have no firewall, no internet monitoring, thankfully they do have AD set up.... Anyway its just the way its grown up ...
-1
votes
1answer
35 views

How to secure access to build system credentials?

We have a build system, which fetches the sources and executes build commands. At present a dedicated person (build master) does the fetching with her personal account in the source control system. ...
4
votes
4answers
849 views

Whatsapp is adding passwords: what is the threat model that they want to protect their users from?

Whatsapp has announced that they are introducing 2FA to their service. Normally, services rely on a password (what you know), and adding 2FA means that they require an additional code sent via SMS to ...
17
votes
4answers
4k views

One Time Password Algorithm for Humans

Is there a one time password generation algorithm (based on predefined secret and a changing value/time/counter/etc) that is simple enough that it can be processed by an average human but safe enough ...
2
votes
5answers
442 views

Why should the *nix system administrator account (root) have a strong password if remote root logins are disabled?

It is a commonly accepted best security practice to disable remote root logins on *nix systems including Linux. Thus, in order to log in directly as root, you need to have physical access to a trusted ...
0
votes
2answers
88 views

How simple a password could be when the only account data is the email address?

I have a case where the only data stored on the user account is his email address. My client wants to avoid complicated passwords because the audience is young. Some of my colleagues still want to ...
4
votes
4answers
2k views

Password managers with U2F security risks

After a lot of research about password manager and a lot of reference obtained from this discussion How safe are password managers like LastPass? I come to the conclusion that password managers have ...
2
votes
2answers
791 views

Accidentally typing part of password in username on secure website

My question is already partially answered here. However I would like to know if the answer would be any different considering the following circumstances: When logging into a banking website the ...
1
vote
4answers
328 views

Is National Insurance number considered for 2 factor authentication

Is National Insurance number considered as something you have for 2 factor authentication as it is unique to each individual?