Search Results

People who don't care are going to have weak passwords regardless. … Passwords must be viewed by the customer as an opportunity to secure themselves from a largely insecure internet. You can't do it for them. …

But how do I remember all of these random, long, unique garblygoop passwords??? You don't. Use a password manager! …

If you stored your passwords in their own schema (pass.passwords instead of dbo.passwords), you could restrict access to the pass schema to whatever you would like. … Technically applications don't necessarily need to access the tables where passwords are stored, but they do need the salts, which aren't a secret anyways. …

Well, in the example you gave, that is like me setting my password manager to generate a random password of length 8 with no restrictions to the alphabet used, and it producing 'password' as a result. …

Some celebrities with really weak passwords had their passwords guessed. But the headlines will still read that Apple's cloud got hacked. … And that is why you don't allow users to use really weak passwords. …

Ideally you wouldn't need to store it, after email generation you should be able to discard it. I wouldn't be too terribly concerned. If the email is lost or deleted before account creation is finali …

I'm going to recommend that our users start using a password manager and start creating strong random passwords. Though I don't know what size of a password to recommend. … I want them to have passwords that are strong, random, and long enough so that even if the hashed password table were stolen, that no brute-force or rainbow attack will ever* be able to guess it. …

Lets say a secret word is say, the name of your first pet. Mother's maiden name is also a common one. When does it make sense to challenge the user with this? Or, what actions should be secured by a …

Assuming that hackers steal passwords by logging into the DB with application or admin users, what about putting passwords into it's own schema with air-tight privs? …

When they hack a website and 'data dump' a password table they now have access to all of the hashed passwords. This gives the opportunity to bruteforce attack. …

I use a password manager and use passwords of length 22 (why 22?) or however long they'll let me. … I still get around to changing my passwords when I can remember to. …

It isn't unheard of. Goldkey is a product that has a hierarchy of grandmaster, master, and normal. I'm not sure this is necessarily a back door, as the intention is that a department member can't acc …

I think so, but its important to understand true entropy when it comes to how computers brute force. A word in the dictionary in any language can be thought of as a character, similar to a chinese ch …

I commend their effort to make the internet a safer and easier place to navigate. The centralization risk is no different than with any other password manager in that if the password vault is comprom …

Typically a multifactor challenge happens either after password authentication or at the same time. I don't think telling your customers what went wrong during login is going to hurt your security so …