New answers tagged password-management
0
I think Kousha is asking why use either Static Password or Challenge-Response. This page from KeePassXC may be helpful.
https://ewen.mcneill.gen.nz/blog/entry/2017-07-23-keepassxc-with-yubikey-challenge-response/
KeePassXC YubiKey support is via the YubiKey HMAC-SHA1
Challenge-Response authentication, where the YubiKey mixes a shared
secret with a ...
4
Say I'm using Argon2(di) to store passwords. Should I use the second method or first method to hash passwords?
No. Argon2 takes the salt as a separate argument from the password, and takes responsibility internally about how to incorporate them both into the computation. As any specialized password hashing function should.
Ideally, though, you should use ...
2
For the specific scenario you outline (theft of your computer or hard disk), that will probably work. Note that EFS is based on your Windows password, and Windows' password hashing is incredibly weak by modern standards, so your password will need to be extremely good to prevent a dedicated attacker from brute-forcing the hash.
Additionally, EFS provides ...
0
I felt it's worth sharing my answer to this question, which is marked as a duplicate of this question.
I think credential storage is best for storing cryptographic secrets.
You can choose among the following choices depending on your security
need -
A software-based credential storage
A system-managed credential storage
A hardware-based ...
2
Well, first and foremost, check you are hashing and salting the password correctly. It is a lot more critical if the hash is available more easily to attackers. Also keep in mind that even correct hashing can't protect short passwords from determined attackers.
Second of all, if you are using this hash to the authenticate to the online server, you should be ...
2
If I understand correctly, PHP is only ever executed server side. If I’m correct in that, then high value user secrets are going to be transmitted to your server even if encrypt them right after you get them.
At this point I should disclose that I work for a popular password manager, but I’m not trying to discourage competition. But I do recommend that you ...
0
You could use SendPass (https://sendpass.app)
In my opinion, the two biggest risks of sending plain-text passwords are that they may reside in archives, logs or still in the user's mailbox, and the second one being interception of the password and the actual recipient not knowing of this (and therefore not notifying the admin).
To address these risks, I ...
0
It all boils down on how the users does the "randomly" picking of words.
And the main problem are users not understanding things or doing bad choices.
We don't really need to discard first-last pages nor words on the page. That would be mostly useful IMHO for forbidding extremely bad practices, such as a user that chose as the password the first 4 words ...
3
Pretty much all of my answer is based off of my own interpretation of the results from this paper:
https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0041531
(aka, I'm not an expert in how the human brain works and I haven't done tons of research). I'll start with the most important detail and then answer your question
Under realistic ...
1
Regarding the issue mentioned by Adi about passwords being stored in plain text, it's good to know that since version 3.26.0-rc1 (2017-05-25), FileZilla has support for encrypted passwords protected by a master password. Hence, there is no reason to say that FileZilla is less secure than other FTP clients.
See developement diary entry.
To change that ...
2
Should we generate a strong password offline, keep it closely guarded secret, and use the same one across all copies of the device?
Absolutely not. There are two primary problems which make the risk (likelihood x impact) of an attack high:
The first is that you are likely underestimating likelihood: It is very hard to keep something a secret in your own ...
Top 50 recent answers are included
