We’re rewarding the question askers & reputations are being recalculated! Read more.
598

Facebook is allowing you to make a handful of mistakes to ease the login process. A Facebook engineer explained the process at a conference. The gist of it is that Facebook will try various permutations of the input you submitted and see if they match the hash they have in their database. For example, if your password is "myRealPassword!" but you submit "...


359

One thought is to not allow form submission if there is not a value in the password box. Generally if they accidentally entered the password in the username, then there likely isn't going to be anything in the password dialog. It is worth noting that this does not have to be simply done client side, but could also be done on a server as long as the ...


355

The primary issue is that incorrect passwords have to be stored in a way that allows them to be later displayed to users. Which, as your dev pointed out, means they can't be cryptographically hashed first. The result is that you store them either as plaintext (bad) or encrypted (better but not normally recommended). The biggest risk is if this database of ...


324

This combination is called a Secure attention key. The Windows kernel is "wired" to notify Winlogon and nobody else about this combination. In this way, when you press Ctrl+Alt+Del, you can be sure† that you're typing your password in the real login form and not some other fake process trying to steal your password. For example, an application which looks ...


317

Movement that blocks the view of the item under inspection helps to defeat someone trying to use an overlay image on the video as a replacement for the actual item. For instance, I could take a short video of your ID (that shows the security features) and overlay that on the live video instead of my actual ID. But by waving my hand in front, then the ...


270

Given that this identification was likely performed according to German law, this request was to conform with BaFin Circular 3/2017 which demands (in their non-binding English translation): Any substitution/manipulation of parts or elements of the identity document must be countered by suitable measures. To this end, the person to be identified must be ...


230

Because people are lazy and/or incompetent. And, well, you know, the Internet is full of chimpanzees. I would argue that all security questions are bad, but using the mother's maiden name is exceptionally bad: At least in Sweden, I can find out anyone's maiden name just with a simple call to the tax office. It is literally public information. It's 2018, ...


222

Use the blanket of security, as seen in the Snowden documentary Citizenfour. It involves placing a blanket over your head, the keyboard and monitor and typing in the password. It will look weird but for security's sake it may be worth it. Related post with demo pic - In CitizenFour, what was Edward Snowden mitigating with a head blanket?


205

The Authorization: <type> <credentials> pattern was introduced by the W3C in HTTP 1.0, and has been reused in many places since. Many web servers support multiple methods of authorization. In those cases sending just the token isn't sufficient. Sites that use the Authorization : Bearer cn389ncoiwuencr format are most likely implementing ...


198

tldr; this is even worse than not hashing your passwords and storing them as plain text. I agree with your lead dev's concerns. In order to show past incorrect password attempts, you must store them in a reversible fashion, which means they cannot be hashed. If someone compromised the system, they would then have access to all the bad attempts, and likely ...


191

The known_hosts file lets the client authenticate the server, to check that it isn't connecting to an impersonator. The authorized_keys file lets the server authenticate the user. Server authentication One of the first things that happens when the SSH connection is being established is that the server sends its public key to the client, and proves (thanks ...


182

You could use Two Factor Authentication that uses your phone to log in along with your password. That way, even if they see your password, they would need your phone, too to log in.


177

As you said, you saw this on facebook - so I tried these steps: Login with lukas@gmail.com and real password -> works Login with lukas@gmail.cmo and real password -> works, too (!) Login with luksa@gmail.com and real password -> also works Login with luksa@mail.com and real password -> also works Login with lukas@gmail.cmo and wrong password -> Wrong ...


177

Not storing the salt is bad advice. The main purpose of a salt is that each user password has to be attacked individually. If you do not store the salt then, as you said, you need to try every single salt combination in order to validate the password. If you need to check every single salt combination, this means that the salt cannot be too long (you ...


170

OpenID is a protocol for authentication while OAuth is for authorization. Authentication is about making sure that the guy you are talking to is indeed who he claims to be. Authorization is about deciding what that guy should be allowed to do. In OpenID, authentication is delegated: server A wants to authenticate user U, but U's credentials (e.g. U's name ...


161

Right now the question is a bit broader: RSA vs. DSA vs. ECDSA vs. Ed25519. So: A presentation at BlackHat 2013 suggests that significant advances have been made in solving the problems on complexity of which the strength of DSA and some other algorithms is founded, so they can be mathematically broken very soon. Moreover, the attack may be possible (but ...


159

The system outlined in the question is actually weaker than simply requiring a single password of length A+B+C, because it permits a class of attacks that can't be used against single passwords: Say your three-password combination is E F G. An attacker can send the passwords A B C D E F G, making five attacks (A B C, B C D, C D E, D E F, and E F G) for the ...


148

From a raw security perspective, your password is simply "A B C", and the relative strength of the password is calculated accordingly. From a user perspective, this is arguably too difficult to be usable. The server isn't giving any indication as to the current state (is it looking for the second password yet?) and therefore the user can't tell which ...


148

Locking accounts is a bad idea in the first place. It might seem like you're making your organization more secure by keeping out "bad people" who are "guessing" at passwords using brute force attacks, but what have you really solved? Even with this policy and a perfect userbase who never makes security mistakes, an attacker can perform a denial-of-service ...


144

Facebook reported a data leak today and forced a large number of accounts to log off as a precaution. Source: NY Times and Facebook. That NYT article says "The company forced more than 90 million users to log out early Friday, a common safety measure taken when accounts have been compromised." Additional article from The Hacker News - "unknown hacker or a ...


137

This would store the login link with password and username in the browsers history. It could also be accidentally be captured by things like firewall logs, that wouldn't capture post variables.


129

No, not really. At least not as primary form of authentication. Biometrics in general are not good for authentication, because: You leave them all over the place, and there is no way to avoid that. They cannot be changed in case of a breach. You need to add a high error tolerance as to not cause usability problems. These tolerances lead to false positives, ...


127

Definitely problematic - and worth reporting. If the HTTPS is properly protected with HSTS and preloading, then threat actors observing the traffic wouldn't be able to see the GET contents. But since HSTS is still somewhat rare (and if they're putting plaintext passwords in a GET, they're probably not aware of other best practices like HSTS), the ...


126

Get a password manager like KeePass and store your password there. Use the auto-type or a plugin to enter the password. Unlock your KeePass database when you boot your machine, so that you don't have to unlock it with people around. Set it up so that it locks automatically when you lock the screen (just in case) Alternatively, you can remember the e-mail ...


126

A 'secret' salt is known as a pepper. From Wikipedia: A pepper can be added to a password in addition to a salt value. A pepper performs a similar role to a salt, however whereas a salt is commonly stored alongside the value being hashed, for something to be defined as a pepper, it should meet one of the following criteria that define it a more carefully ...


120

A lone password is not necessarily verifiable by itself. In particular, if the server does things properly, then it stores not the passwords themselves, but the output of a password hashing function computed over the password. A password hashing function (as opposed to a mere hash function) includes some extra features, including a salt (for very good ...


120

This should be reported right away. There is a multitude of possible attacks which could result in compromise of user accounts. The password shown as a GET parameter is not only a vulnerability according to OWASP, there are many ways those could be abused. Common vulnerabilities allow the theft of protected passwords through attack vectors such as SQL ...


119

This is an interesting question! The rule of thumb is that if someone else has control of the device (and they're determined enough), they will always be able to monitor and modify all of your actions on the device. We can (to a somewhat limited extent) get around this though! Two-factor authentication can be used to ensure that even if someone has your ...


Only top voted, non community-wiki answers of a minimum length are eligible