104
votes
Accepted
Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?
Password managers are not meant to hide your passwords from yourself
It's as simple as that. To whit: most password managers let you view your own password anytime you want anyway. I say "most&...
- 31.7k
30
votes
Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?
[self-answer]
You can trivially unmask a password field with right-click > Inspect Element > change type="password" to type="". So there's really no reason not to put a "...
- 59.3k
20
votes
Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?
There are many good answers already, but I would like to add one point.
Quite frequently, I have to enter passwords on computers that I don't have my password manager installed on. When that happends, ...
- 65.8k
19
votes
Accepted
Should one reject login attempts when the correct password is newly added to a password deny list?
There is no single right choice, i.e. it depends on the details of your actual use case, as often it is a trade-off between usability and security. Some aspects to consider:
If the account is ...
- 208k
16
votes
Accepted
Password expiration and compliance (ISO, NIST, PCI, etc)
The current version of PCI DSS is 3.2.1*, and in section 8.2.4 it requires users to change their passwords every 90 days. Section 8.2.5 requires that passwords must not be the same as any of the four ...
- 34.7k
13
votes
How do I decide which security framework is most suited to my organization?
There are 3 main considerations when deciding to choose a framework:
What are your stakeholders expecting from you?
Why are you choosing a framework? I.E. What outcomes are you looking for?
Which ...
- 132k
12
votes
Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?
Consider that your first quote explicitly references "paste" functionality, which implies a clipboard. As opposed to autofill that directly enters data into a webpage form.
Common clipboard ...
- 1,228
11
votes
Should one reject login attempts when the correct password is newly added to a password deny list?
What is your threat model - how much damage can be done with a compromised account?
The best option, if you do have an additional/stronger authentication method, like 2FA or biometric, is to suspend ...
- 2,770
10
votes
Accepted
What is the recommended expiration for a password reset link?
It depends on how you’re communicating with the client. NIST recommends the following during the enrollment process when it’s considered a part of the authentication process; which I would consider ...
- 34.7k
8
votes
Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?
I would say that these requirements do not compete nor are mutually exclusive.
The only thing what must made sure is, that pasting the password does not trigger the "show last character" for ...
- 4,143
7
votes
I need assistance in properly understanding the IA-7 control in NIST SP 800-53
Waking the zombie at my own peril and for the benefit of people looking to understand this control. I did a fair amount of research on the subject and was able to find a pretty definitive answer. ...
- 71
6
votes
Accepted
Why Microsoft claims that SQL Server is the least vulnerable database?
When they say that, they are probably referring to the number of published exploits and vulnerabilities for their product. If true, this is a very, very bad idea.
I'm actually surprised it says that. ...
- 3,414
6
votes
Accepted
What is the format of an X9.62 key?
It indeed is not ASN.1.
(AFAIK all) The formats from X9.62 are replicated in SEC1 free from SECG with a curve point (which is the actual public key value, excluding metadata) in 2.3.3 and 2.3.4.
...
- 11.1k
6
votes
Should one reject login attempts when the correct password is newly added to a password deny list?
I would advocate against rejecting the login attempt. That would be giving the wrong signal to the user.
Much better to communicate it without disabling their account. But do add a banner with ...
- 9,063
5
votes
What are some best practices for WiFi security, in light of recently discovered vulnerabilities?
With all the recent WIFI hacks, how we should configure our organizational Wifi security configs and version?
You may need to be a bit more explicit with your concerns. You mention KRACK; I posted ...
- 4,057
5
votes
Password expiration and compliance (ISO, NIST, PCI, etc)
To answer your Questions first, from an ISO 27001 perspective, it does not prescribe what should be your Expiration duration, neither does it specify how many old Passwords you should retain.
...
5
votes
Accepted
API to Get CVE Info
You can use the CVE API that Red Hat maintains. It has a lot of options to search for a vulnerability given a CVE or other parameters, you can even run a search by components with a range of dates (...
- 1,574
4
votes
In-Memory Database Storage and Security (MemSQL, Spark, Redis, Geode, et al)
Encrypting in-memory data stores/caches is generally not done because all the working data is stored in RAM and so will the encryption key at some point and if an attacker has access to the memory of ...
- 619
4
votes
What are vendor affirmed algorithms in FIPS 140-2
This is a bit of a guess, but on page 6 of the Derived Test Requirements for
FIPS PUB 140-2, we have (emphasis mine):
Required Vendor Information
VE01.12.01: The vendor shall provide a validation ...
- 59.3k
4
votes
Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?
In addition to the other answers: any password manager worth using uses a Master Password that needs to be entered before any passwords can be copied over. If you know that master password, the ...
- 7,583
4
votes
Should one reject login attempts when the correct password is newly added to a password deny list?
Remember that availability is a security requirement. If you are a bank and your security policy prevents a customer from paying his rent, that is a failure of your security policy. Of course there ...
- 1,887
3
votes
Accepted
Why would Bill Burr of NIST say N3v$r M1^d?
Data
The Wall Street Journal article says:
The problem is the advice ended up largely incorrect, Mr. Burr says.
Change your password every 90 days? Most people make minor changes
that are easy ...
- 73.3k
3
votes
Suggestions on satisfying security controls described in NIST SP 800-53?
Probably too late, but first, I feel your pain. And to top it off, authorizing officials (AOs) usually want the controls documented in MS Word, a static solution that does not match the requirements ...
- 31
3
votes
Accepted
Practical applications of NIST new password policy
Other strategies would not only be difficult to implement, they might be counter to the intent of NIST 800-63b. Fortunately, there are multiple blacklisting solutions, so you probably don't need (or ...
- 9,717
3
votes
Accepted
Public vulnerability feed with CVSS v3
NIST follows trends and recently has added new (beta) JSON feeds with CVSSv3
- 31
3
votes
Is there a documented security standard that forbids or discourages rolling your own crypto?
Perhaps you are looking for FIPS 140-2.
The Federal Information Processing Standard Publication 140-2, (FIPS PUB 140-2), is a U.S. government computer security standard used to approve cryptographic ...
- 8,213
3
votes
Accepted
Incident Response and when to consider an incident resolved
My reluctance here is that this will impact SOC performance metrics.
So, your process of resolving an incident has 2 distinct stakeholders:
the SOC team to measure "Time to Resolution"
the ...
- 132k
3
votes
Accepted
Why is "not storing data protection keys" not a popular choice?
You're misunderstanding the recommendations. This is not about authentication (i.e., verifying the correctness of a password), nor does it offer a way to avoid storing password verification data like ...
- 23.1k
2
votes
I need assistance in properly understanding the IA-7 control in NIST SP 800-53
A "cryptographic module" is defined as hardware, firmware or software that implements cryptographic functions such as encryption, decryption, digital signatures, authentication techniques and random ...
- 962
2
votes
Conflicting requirements in FIPS 140-2 regarding manual key entry
No the manual entry referred here is done by an external device (i.e. a pinpad) which is connected to the cryptographic module.When you enter the key you give an input to the cryptographic module so ...
- 572
Only top scored, non community-wiki answers of a minimum length are eligible