Collaborate Disseminate
Despite CISOs’ apprehension about increasing dependence on SaaS applications and the security risks the cloud represents, adoption isn’t slowing down. Continue reading CISOs: Support Vendor Security Ops for Best Cloud Results
Example strong diceware password:
widow stout harvey crest zomba zloty butyl
This password will be rejected by most sites, for example by Outlook.com. (Notable exceptions: Gmail, Stackoverflow, which seem to accept this very password (t… Continue reading Given Diceware, why does the requirement to contain uppercase, numerics & punctuation in passwords still stand?
Trying to determine if there’s a way to configure an FGPP(the policy itself) to last/be enforced only for a specified period of time or ideally, until a triggering event occurs. E.g., create temp pwds for a group w/ a 10-day expiry FGPP, … Continue reading Windows Fine-Grained Password Policies (FGPP) – Set Policy Duration
I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
I would like suggestions for a good strategy for dealing with web sites that have arcane rules about what must or must not appear in a password.
My ideal are the sites that allow a good range of characters, a relatively long… Continue reading Password generator and password limitations
A certain website I use has a section the password to which is e-mailed to you. I’m not involved with administrating it, but I’ve been able to discern the algorithm used for password creation. It uses fixed-length passwords c… Continue reading Is password generation adherent to a primitive pattern insecure?
I have always used long passphrases for my own Windows user accounts. But I know some people who use moderately common passwords (we’ll say they’re in the top 1,000 most used passwords, but not in the top 100).
From Why do w… Continue reading Do non-administrator Windows accounts need strong passwords?
I have a password policy which states that users must not write and store their passwords down in plaintext. How can I ensure that they haven’t done so by writing their password in emails, scripts, documents or files?
Continue reading How do I check that users don’t write down their passwords?
What is the history of authenticating nuclear launch codes? Were hashes used for verification? How would a nuclear launch base be able to verify that the code is correct, and how were new codes transmitted (networks? radios?)… Continue reading How were nuclear launch codes authenticated?
I am able to do the following and connect successfully without any type of credentials:
telnet <IP Address> 25
When I am in I can verfiy emails, send emails, etc. I feel like this is a security risk. Is there a way o… Continue reading Block Telnet Connection That Doesn’t Have Credentials