Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

The tag has no usage guidance.

3
votes
2answers
126 views

How should multiple system-generated, centrally managed passwords be distributed securely (if at all)?

In a system where a single admin user is responsible for the creation of multiple (up to 500) user accounts, including passwords and these user accounts do not have an associated email address how ...
30
votes
6answers
9k views

How to generate easy to type passwords without sacrificing security?

How can one generate a password that is easy to type but does not sacrifice security? An example of a password that is easy to type but sacrifices security (I imagine) would be qwe123!@#. For this ...
3
votes
2answers
231 views

How to properly store, encrypt and backup passwords for home and office use

I am in close proximity to the moment, where I will need to migrate from my old ssd and data hdd to new ones (wear and age), so I'm rethinking my environment. Please, give me suggestions about what ...
2
votes
2answers
125 views

Why isn't applying security and usability best practices enough?

I have a homework question that suggests that applying security and usability best practices isn't enough to create a secure and usable system. What am I missing? Why isn't this enough? If I follow ...
1
vote
2answers
317 views

Security vs Usability [closed]

When looking at the internet for ways to secure yourself, I normally see that people use weak security because the more secure you become, the lower the usability is. Weak passwords trump strong ...
3
votes
3answers
4k views

Jump Servers for security

In my network, I have the clients directly connected to the server; but in the new PCI policies, they required to use jump servers. What is the advantage of using jump servers for security reasons? ...
2
votes
2answers
297 views

Would a multilingual Diceware password be more secure than a monolingual one? [duplicate]

I've been reading up on Diceware recently, and I'm wondering if using a mix of languages would make it even more secure. On the face of it, it would force a potential attacker to consider an even ...
3
votes
1answer
76 views

How to check if redirected site like OAuth is genuine?

One common security advise is to open sites only from bookmarks (see also Explain to non tech savvy person how to check that your connection to mybank.com is safe? ). This approach fails if a site ...
32
votes
7answers
5k views

Explain to non tech savvy person how to check that your connection to mybank.com is safe?

I was reading the security advice given by the Swedish Bankers' Association. They included these two pieces of advice (my translation), that I assume is to teach the user to check for SSL/TLS and ...
1
vote
3answers
120 views

How to communicate security expectations to users in an end-to-end encrypted chat app?

I am developing a chat application that has end-to-end encryption, with no third party being able to eavesdrop on conversations. This is rather easy by simply deploying apps that people download and ...
90
votes
16answers
14k views

How to tell users that they shouldn't disclose their password over the phone to our help desk?

I work for a help desk, and we recently launched an online service where our members can log in. A problem we are having is that users who are calling us often ask us to confirm that the password ...
58
votes
7answers
7k views

Are there security advantages gained from forcing a website to be available from just one tab at a time?

I just found that a website of one Polish bank forces the users to open it in one browser tab only. You cannot for example check your transfer history while looking for an account number that you ...
1
vote
1answer
105 views

Warn on (plain, unencrypted) HTTP: in which prominent security talk was this advocated? [closed]

Some months ago, I watched online a video recording of a talk/presentation aimed at an audience interested in information security. The talk concerned UI/UX/usability, convenience, and security, and ...
3
votes
2answers
397 views

Usability and CSRF tokens

In a lot of different products the CSRF token is stored in a session. Which means that if the session has expired then the next form submit will fail. Example scenario: you open a login form, the ...
14
votes
3answers
2k views

In what cases can overly strict security policies be detrimental to organisations?

In a philosophical sense is heterogeneous security, a system where people are given more autonomy, better than security policies/procedures written in stone? I've worked at some companies where ...
4
votes
2answers
616 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
15
votes
3answers
2k views

Should I reject obviously poor passwords?

UPDATE: My questions and concerns below boil down to: "Should I reject obviously poor passwords like 'hellomydarling' or 'password'? My guess is yes and I want to know to what extent. I'm using a ...
6
votes
4answers
621 views

Contact person by phone, when their phone might have malware

I have a problem setting where I want to contact a user by phone, and where I need to protect the integrity of the phone call as much as possible. I'm wondering about how to design the interaction in ...
0
votes
2answers
875 views

Can you trust the URL shown when 'hovering' on a link? [duplicate]

When using a modern web browser, if you hover on a link, the browser will show you the link in a little display on the bottom left corner of the browser screen. Can I trust this? Can this display be ...
5
votes
1answer
224 views

Can skeuomorphic UI design create security vulnerabilities?

Skeuomorphic design is common in desktop computer and mobile telephone applications. Sometimes interfaces and cues from the real world are used to good effect (swiping to move backwards and forwards ...
33
votes
4answers
4k views

Is it safe to show users why their password is not allowed?

/////////////////////////////// Updated Post Below //////////////////////////// This question has received a lot of hits, more than I ever thought it would have on such a basic topic. So, I thought I ...
10
votes
3answers
2k views

Should the password field be cleared after an unsuccessful login attempt?

Let's assume following workflow for logging in a) On a device with keyboard: I type my username and password Press enter [realization] I made a typo Password field is cleared: not a big deal, I can ...
19
votes
5answers
2k views

From a security standpoint should users be asked to confirm their password when registering?

Is it advisable to have users re-type their password to confirm it's correct? On User Experience the general consensus seems to be no but I'm wondering if this has security ramifications? EDIT: my ...
5
votes
3answers
764 views

Unmasking passwords during sign up, is it a good idea?

I just read this article about unmasking passwords at sign up for usability reasons. On the surface it seems reasonable to me, but I'm wondering what additional security concerns that might generate, ...
4
votes
2answers
8k views

Security Alert - Office File Validation - how to decide whether to proceed?

Recently, when opening a Microsoft Word document that came from a trusted source, I received the following warning message: The warning message is titled "Security Alert - Office File Validation". ...
15
votes
5answers
14k views

Is client side encryption really better than server side?

Web application may encrypt all user data at client side to convince users that it can't decrypt them. When user enters password, it's used to encrypt data in browser and then it's sent to server in ...
1110
votes
23answers
223k views

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...