Collaborate Disseminate
I’m trying to implement authentication for users on a web page using JWT tokens and, so far, I can create users and authorize them. I’m now trying to write the password reset functionality and I think I may be finished (per any examples an… Continue reading Web password reset steps
I’m building a web app in Node.js, Express, and Mongoose. I’m worried about security and optimization issues on what to send in the email link.
I see many of them sending: /:userId/:token, but if I would insert in the link only the token i… Continue reading Reset password parameters to send
Some sites lock me out for a while after too many failed attempts.
For our own site, we want to force a password reset email after X amount of failed attempts. After all, if your email is compromised, then everything is compromised.
Furthe… Continue reading Send password reset email after too many failed logins versus X minutes of lock out
There are many articles out there stating that a user’s encrypted files are lost after an administrator resets the password of that user.
I tried:
Logged on as user (Domain User) with password 54321
created a file named test.txt on the de… Continue reading EFS-encrypted files not lost when domain admin resets password
I’m not sure if what I’m trying to do is possible, so I wanted to see opinions of security people.
I have a remote nvidia device left with default credentials and someone brute-forced the device and accessed it and changed the passwords in… Continue reading Reset linux user password with ssh key based access
They say a chain is only as secure as its weakest link. When it comes to account security it seems to me that the Forgot My Password functionality is the weakest link in the security chain because it only requires an attacker to gain acces… Continue reading Forget Me Not? Abandoning the Forgot Password Functionality
Recently I started having issues with my home Wi-fi connection. My devices showed as connected to the router, but no Internet was coming through.
While trying to log into the router through my browser (at 192.168…), I found my password n… Continue reading If my home router password was reset, is that a sign of a security breach?
A new trend in account security is spreading: web services like LinkedIn reset passwords automatically when detect attempts of getting access with wrong password or from new locations. Thus, a user has to restore password every time when n… Continue reading How to force web sites and services to stop resetting passwords of accounts without user’s permission and prompt? [closed]
A new trend in account security is spreading: web services like LinkedIn reset passwords automatically when detect attempts of getting access with wrong password or from new locations. Thus, a user has to restore password every time when n… Continue reading How to force web sites and services to stop resetting passwords of accounts without user’s permission and prompt? [closed]
Reset token contains lower case a-z, 0-9 number, there will be at maximum 5 number, at minimum there will be 0 number.
It is randomly generated.
How many possiblities do we have?
How much time does this take to brute force?
Example: x8h1w7… Continue reading How to guess 8 character long reset token [closed]