619

Facebook is allowing you to make a handful of mistakes to ease the login process. A Facebook engineer explained the process at a conference. The gist of it is that Facebook will try various permutations of the input you submitted and see if they match the hash they have in their database. For example, if your password is "myRealPassword!" but you submit "...


365

One thought is to not allow form submission if there is not a value in the password box. Generally if they accidentally entered the password in the username, then there likely isn't going to be anything in the password dialog. It is worth noting that this does not have to be simply done client side, but could also be done on a server as long as the ...


355

The primary issue is that incorrect passwords have to be stored in a way that allows them to be later displayed to users. Which, as your dev pointed out, means they can't be cryptographically hashed first. The result is that you store them either as plaintext (bad) or encrypted (better but not normally recommended). The biggest risk is if this database of ...


329

This combination is called a Secure attention key. The Windows kernel is "wired" to notify Winlogon and nobody else about this combination. In this way, when you press Ctrl+Alt+Del, you can be sure† that you're typing your password in the real login form and not some other fake process trying to steal your password. For example, an application which looks ...


318

Movement that blocks the view of the item under inspection helps to defeat someone trying to use an overlay image on the video as a replacement for the actual item. For instance, I could take a short video of your ID (that shows the security features) and overlay that on the live video instead of my actual ID. But by waving my hand in front, then the ...


273

Given that this identification was likely performed according to German law, this request was to conform with BaFin Circular 3/2017 which demands (in their non-binding English translation): Any substitution/manipulation of parts or elements of the identity document must be countered by suitable measures. To this end, the person to be identified must be ...


237

The Authorization: <type> <credentials> pattern was introduced by the W3C in HTTP 1.0, and has been reused in many places since. Many web servers support multiple methods of authorization. In those cases sending just the token isn't sufficient. Sites that use the Authorization : Bearer cn389ncoiwuencr format are most likely implementing ...


232

Because people are lazy and/or incompetent. And, well, you know, the Internet is full of chimpanzees. I would argue that all security questions are bad, but using the mother's maiden name is exceptionally bad: At least in Sweden, I can find out anyone's maiden name just with a simple call to the tax office. It is literally public information. It's 2018, ...


222

Use the blanket of security, as seen in the Snowden documentary Citizenfour. It involves placing a blanket over your head, the keyboard and monitor and typing in the password. It will look weird but for security's sake it may be worth it. Related post with demo pic - In CitizenFour, what was Edward Snowden mitigating with a head blanket?


199

tldr; this is even worse than not hashing your passwords and storing them as plain text. I agree with your lead dev's concerns. In order to show past incorrect password attempts, you must store them in a reversible fashion, which means they cannot be hashed. If someone compromised the system, they would then have access to all the bad attempts, and likely ...


186

OpenID is a protocol for authentication while OAuth is for authorization. Authentication is about making sure that the guy you are talking to is indeed who he claims to be. Authorization is about deciding what that guy should be allowed to do. In OpenID, authentication is delegated: server A wants to authenticate user U, but U's credentials (e.g. U's name ...


179

You could use Two Factor Authentication that uses your phone to log in along with your password. That way, even if they see your password, they would need your phone, too to log in.


178

As you said, you saw this on facebook - so I tried these steps: Login with lukas@gmail.com and real password -> works Login with lukas@gmail.cmo and real password -> works, too (!) Login with luksa@gmail.com and real password -> also works Login with luksa@mail.com and real password -> also works Login with lukas@gmail.cmo and wrong password -> Wrong ...


176

Not storing the salt is bad advice. The main purpose of a salt is that each user password has to be attacked individually. If you do not store the salt then, as you said, you need to try every single salt combination in order to validate the password. If you need to check every single salt combination, this means that the salt cannot be too long (you ...


171

Right now the question is a bit broader: RSA vs. DSA vs. ECDSA vs. Ed25519. So: A presentation at BlackHat 2013 suggests that significant advances have been made in solving the problems on complexity of which the strength of DSA and some other algorithms is founded, so they can be mathematically broken very soon. Moreover, the attack may be possible (but ...


160

The system outlined in the question is actually weaker than simply requiring a single password of length A+B+C, because it permits a class of attacks that can't be used against single passwords: Say your three-password combination is E F G. An attacker can send the passwords A B C D E F G, making five attacks (A B C, B C D, C D E, D E F, and E F G) for the ...


148

From a raw security perspective, your password is simply "A B C", and the relative strength of the password is calculated accordingly. From a user perspective, this is arguably too difficult to be usable. The server isn't giving any indication as to the current state (is it looking for the second password yet?) and therefore the user can't tell which ...


147

Locking accounts is a bad idea in the first place. It might seem like you're making your organization more secure by keeping out "bad people" who are "guessing" at passwords using brute force attacks, but what have you really solved? Even with this policy and a perfect userbase who never makes security mistakes, an attacker can perform a denial-of-service ...


144

Facebook reported a data leak today and forced a large number of accounts to log off as a precaution. Source: NY Times and Facebook. That NYT article says "The company forced more than 90 million users to log out early Friday, a common safety measure taken when accounts have been compromised." Additional article from The Hacker News - "unknown hacker or a ...


138

This would store the login link with password and username in the browsers history. It could also be accidentally be captured by things like firewall logs, that wouldn't capture post variables.


129

No, not really. At least not as primary form of authentication. Biometrics in general are not good for authentication, because: You leave them all over the place, and there is no way to avoid that. They cannot be changed in case of a breach. You need to add a high error tolerance as to not cause usability problems. These tolerances lead to false positives, ...


127

Get a password manager like KeePass and store your password there. Use the auto-type or a plugin to enter the password. Unlock your KeePass database when you boot your machine, so that you don't have to unlock it with people around. Set it up so that it locks automatically when you lock the screen (just in case) Alternatively, you can remember the e-mail ...


127

Definitely problematic - and worth reporting. If the HTTPS is properly protected with HSTS and preloading, then threat actors observing the traffic wouldn't be able to see the GET contents. But since HSTS is still somewhat rare (and if they're putting plaintext passwords in a GET, they're probably not aware of other best practices like HSTS), the ...


126

A 'secret' salt is known as a pepper. From Wikipedia: A pepper can be added to a password in addition to a salt value. A pepper performs a similar role to a salt, however whereas a salt is commonly stored alongside the value being hashed, for something to be defined as a pepper, it should meet one of the following criteria that define it a more carefully ...


124

In Session-based Authentication the Server does all the heavy lifting server-side. Broadly speaking a client authenticates with its credentials and receives a session_id (which can be stored in a cookie) and attaches this to every subsequent outgoing request. So this could be considered a "token" as it is the equivalent of a set of credentials. There is ...


121

A lone password is not necessarily verifiable by itself. In particular, if the server does things properly, then it stores not the passwords themselves, but the output of a password hashing function computed over the password. A password hashing function (as opposed to a mere hash function) includes some extra features, including a salt (for very good ...


121

This should be reported right away. There is a multitude of possible attacks which could result in compromise of user accounts. The password shown as a GET parameter is not only a vulnerability according to OWASP, there are many ways those could be abused. Common vulnerabilities allow the theft of protected passwords through attack vectors such as SQL ...


119

This is an interesting question! The rule of thumb is that if someone else has control of the device (and they're determined enough), they will always be able to monitor and modify all of your actions on the device. We can (to a somewhat limited extent) get around this though! Two-factor authentication can be used to ensure that even if someone has your ...


114

Many people have looked at the reasons not to allow name changes from both a security and a community standpoint. However, there are plenty of legitimate reasons to allow username changes, even if the username is separate from the display name, for example: Someone has changed their real life name or the name by which they'd prefer to be called, due to ...


Only top voted, non community-wiki answers of a minimum length are eligible