637
votes
Accepted
Why can I log in to my Facebook account with a misspelled email/password?
Facebook is allowing you to make a handful of mistakes to ease the login process. A Facebook engineer explained the process at a conference. The gist of it is that Facebook will try various ...
- 3,995
357
votes
Accepted
Is there any reason to not show users incorrectly entered passwords after a successful login?
The primary issue is that incorrect passwords have to be stored in a way that allows them to be later displayed to users. Which, as your dev pointed out, means they can't be cryptographically hashed ...
- 8,416
322
votes
Why did I have to wave my hand in front of my ID card?
Movement that blocks the view of the item under inspection helps to defeat someone trying to use an overlay image on the video as a replacement for the actual item.
For instance, I could take a ...
- 128k
295
votes
Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?
The
Authorization: <type> <credentials> pattern was introduced by the W3C in HTTP 1.0, and has been reused in many places since. Many web servers support multiple methods of authorization. ...
- 3,152
276
votes
Accepted
Why did I have to wave my hand in front of my ID card?
Given that this identification was likely performed according to German law, this request was to conform with BaFin Circular 3/2017 which demands (in their non-binding English translation):
Any ...
- 1,906
238
votes
Accepted
Why is Mother’s Maiden Name still used as a security question?
Because people are lazy and/or incompetent. And, well, you know, the Internet is full of chimpanzees.
I would argue that all security questions are bad, but using the mother's maiden name is ...
- 65.4k
223
votes
Accepted
How should I securely type a password in front of a lot of people?
Use the blanket of security, as seen in the Snowden documentary Citizenfour.
It involves placing a blanket over your head, the keyboard and monitor and typing in the password.
It will look weird but ...
200
votes
Is there any reason to not show users incorrectly entered passwords after a successful login?
tldr; this is even worse than not hashing your passwords and storing them as plain text.
I agree with your lead dev's concerns. In order to show past incorrect password attempts, you must store them ...
- 9,192
180
votes
Accepted
Does anybody not store salts?
Not storing the salt is bad advice.
The main purpose of a salt is that each user password has to be attacked individually.
If you do not store the salt then, as you said, you need to try every ...
- 6,981
179
votes
How should I securely type a password in front of a lot of people?
You could use Two Factor Authentication that uses your phone to log in along with your password. That way, even if they see your password, they would need your phone, too to log in.
- 128k
179
votes
Accepted
Does correcting misspelled usernames create a security risk?
As you said, you saw this on facebook - so I tried these steps:
Login with [email protected] and real password -> works
Login with [email protected] and real password -> works, too (!)
Login with luksa@...
- 3,188
146
votes
Is displaying remaining password retry count a security risk?
Locking accounts is a bad idea in the first place. It might seem like you're making your organization more secure by keeping out "bad people" who are "guessing" at passwords using brute force attacks,...
- 2,984
145
votes
Accepted
Logged out of Facebook on all devices on a sudden. Should I be worried about being hacked?
Facebook reported a data leak today and forced a large number of accounts to log off as a precaution. Source: NY Times and Facebook.
That NYT article says "The company forced more than 90 million ...
- 6,898
138
votes
Is it bad practice to use GET method as login username/password for administrators?
This would store the login link with password and username in the browsers history. It could also be accidentally be captured by things like firewall logs, that wouldn't capture post variables.
- 1,321
131
votes
Accepted
Is face recognition a good security feature?
No, not really. At least not as primary form of authentication. Biometrics in general are not good for authentication, because:
You leave them all over the place, and there is no way to avoid that.
...
- 29.5k
127
votes
How should I securely type a password in front of a lot of people?
Get a password manager like KeePass and store your password there. Use the auto-type or a plugin to enter the password.
Unlock your KeePass database when you boot your machine, so that you don't have ...
- 1,478
127
votes
Does anybody not store salts?
A 'secret' salt is known as a pepper.
From Wikipedia:
A pepper can be added to a password in addition to a salt value. A pepper performs a similar role to a salt, however whereas a salt is ...
- 3,961
126
votes
Accepted
Is a redirect showing the password in plain text a security vulnerability?
Definitely problematic - and worth reporting.
If the HTTPS is properly protected with HSTS and preloading, then threat actors observing the traffic wouldn't be able to see the GET contents. But since ...
- 9,443
120
votes
Secure way to log in to a website on someone else's computer
This is an interesting question!
The rule of thumb is that if someone else has control of the device (and they're determined enough), they will always be able to monitor and modify all of your ...
- 1,231
119
votes
Is a redirect showing the password in plain text a security vulnerability?
This should be reported right away.
There is a multitude of possible attacks which could result in compromise of user accounts.
The password shown as a GET parameter is not only a vulnerability ...
- 3,833
117
votes
Accepted
Is it unsafe to show message that username/account does not exist at login?
This is a consideration between security and usability, and therefore there is not really a right answer here. So here follows my opinion.
If you can keep usernames secret, then do so. In this case ...
- 29.6k
115
votes
Accepted
Is it possible make brute-force attacks ineffective by giving false positive answers to failed log-in attempts?
The answer always depends on your threat model. Security is always woven into a balance between security and usability. Your approach inconveniences the hackers trying to break into the account, but ...
- 9,256
113
votes
Accepted
Why hasn't it become the norm to inhibit repeated password guesses?
I'd like to challenge your assumption that this isn't being done.
[warning: wild approximations to follow]
Remember that a successful brute-force attack will require millions or billions of guesses ...
- 58.8k
113
votes
Accepted
Is it good or bad practice to allow a user to change their username?
Many people have looked at the reasons not to allow name changes from both a security and a community standpoint. However, there are plenty of legitimate reasons to allow username changes, even if the ...
- 1,352
111
votes
Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
Simple Terms
OpenID is about verifying a person's identity (authentication).
OAuth is about accessing a person's stuff (authorization).
OpenID Connect does both.
All three let a person give their ...
- 1,453
111
votes
Accepted
What should a verification email consist of?
How are you generating the 25 character string which you include in the URL? Is it completely random, or is it based off the current time, or the users email? It should be random and not guessable.
...
- 5,100
108
votes
Accepted
How to prevent username and password matches when changing a username?
The only sensible way to get what you want is to ask for the password when a user changes their username. This way the server always has the information needed to conduct an accurate comparison ...
- 29.5k
106
votes
Is Plaid, a service which collects user’s banking login information, safe to use?
I want to point out that despite Plaids apparently honest attempts at security, their approach is a privacy nightmare, as you give full access to Plaid, to all and every single information your bank ...
- 1,061
99
votes
My email address is being used to enroll for online services. Should I be concerned?
Should I be concerned about this?
Yes.
This should be of concern to you because an attacker was able to obtain the valid password for your Gmail account. From the details of warning you have ...
- 3,921
99
votes
Accepted
What's the point of Microsoft Account 2FA if it still lets me log in using password instead?
You didn't actually set up 2FA. You set up your authenticator as an alternative method of single-factor authentication. This is clear from the first screenshot: "... to sign in without a password&...
- 46.4k
Only top scored, non community-wiki answers of a minimum length are eligible