Skip to main content
Share Your Experience: Take the 2024 Developer Survey

New answers tagged

10 votes

Is there a problem with having a combined login/register screen?

You've defined your threat model as: An attacker gaining a list of registered users in your system. Irrespective of your UX/UI decision to combine login/register into one page or keep them separate, ...
MonkeyZeus's user avatar
19 votes

Is there a problem with having a combined login/register screen?

Allowing anybody to check whether a particular e-mail address is registered at your site is both a privacy and a security issue. The privacy impact of this information of course depends on how ...
Ja1024's user avatar
  • 7,777
30 votes

Is there a problem with having a combined login/register screen?

Obviously you'd be able to enter a bunch of emails and check whether or not they are registered on our system but is that a problem? We have 2FA for registered accounts as well as complex password ...
Steffen Ullrich's user avatar
0 votes

Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password?

Full Unicode including non-trivial characters is problematic. As defined by Unicode, there is a large number of byte sequences that are defined to be the same. Take the made-up character “capital O ...
gnasher729's user avatar
  • 2,394
2 votes

Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password?

I would like to add a couple of additional points to Adam Katz's outstanding answer. Unicode normalization The Unicode normalization issue is not merely a theoretical problem. The specification in ...
Jeffrey Goldberg's user avatar
9 votes

How to track PBKDF2 progress?

Messing around with cryptographic code just to get a more accurate progress bar to display to users on a login seems like a very dangerous idea for limited benefits. It's very easy to introduce subtle ...
Gh0stFish's user avatar
  • 11.7k
22 votes
Accepted

How to track PBKDF2 progress?

If your PBKDF2 calculations take so long that you need a progress bar, there's something seriously wrong. The calculations shouldn't take more than a few seconds, otherwise the number of iterations is ...
Ja1024's user avatar
  • 7,777
0 votes

How to track PBKDF2 progress?

PBKDF2 does a number of iterations. The correct way to track progress is to add some code to the loop that reports the current iteration number. If your current crypto implementation does not support ...
Sjoerd's user avatar
  • 30.8k
4 votes

Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password?

Yes and no. While there is merit to this obfuscation method, it's not magic and you need to be highly concerned with portability. At the end of the day, all that matters is complexity. How many ...
Adam Katz's user avatar
  • 11.7k
0 votes

Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password?

Firstly, please see: Can using emojis make someone's password safer? because this question is very much related to emojis in passwords. I’d think systems would receive the emoji as UTF-8 (0xF0, ...
security_paranoid's user avatar
0 votes

Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password?

Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password? In theory, yes. But some applications do not handle well Unicode/emojis characters internally. But if you reuse the same password elsewhere and ...
Kate's user avatar
  • 8,345
4 votes

Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password?

In theory, it should work. Practically, as others have said, there may be issues. NIST 800-63c says unicode characters should be normalized before they are hashed, and that users should be warned &...
user10489's user avatar
  • 2,043
0 votes

Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password?

In an application, there are multiple components involved in processing a password. Whether or not a particular password is supported depends on all of those components. Password hash algorithms deal ...
Ja1024's user avatar
  • 7,777
0 votes

Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password?

If the application or system handles those characters then then it should work (as do passwords containing other unusual characters like emoji) - although if they're not handling non-ascii characters ...
Gh0stFish's user avatar
  • 11.7k
0 votes

Is it safe to enable password sync on Microsoft Edge?

Could a bad actor hack the password database from the browser directly? Perhaps this might be harder on macOS than Windows? Assuming they already have code execution on your machine, and either ...
CBHacking's user avatar
  • 49.1k
4 votes

Security of a non-random password but that relies on information an attacker cannot possibly know

Adam's answer is better than this, but I'm going to elaborate on my initial comments anyway: If you think the entropy is 0, I don't think you have understood those other questions you read. Your ...
Michael come lately's user avatar
5 votes
Accepted

Recommended way to store password that needs to be used as plaintext?

If this is a desktop app, connect to your session-locked password store (e.g. GNOME keyring/KWallet for Linux, Apple Keychain for Macs, or Credential Manager for Windows). If this is a server system, ...
Adam Katz's user avatar
  • 11.7k
11 votes

Security of a non-random password but that relies on information an attacker cannot possibly know

The mental disconnect I think you have here is that the strength of the password is different than the strength of the rule used to generate it. You are assuming that because the rule you use to ...
Jared Smith's user avatar
  • 2,106
30 votes
Accepted

Security of a non-random password but that relies on information an attacker cannot possibly know

The only thing "an attacker cannot possibly know" is something nobody knows. Take your example, "the surnames of the first 5 people that I ever fancied". Your password would be ...
Adam Katz's user avatar
  • 11.7k
10 votes

Security of a non-random password but that relies on information an attacker cannot possibly know

Trying to compute the entropy of a password and then evaluating the security of a password scheme based on this, very often results on arguing about the correct method to calculate some entropy while ...
Steffen Ullrich's user avatar

Top 50 recent answers are included