Collaborate Disseminate
I am working on this application that can be deployed and run by anyone on their server. Most often, it is run as a web service. In our new version, we removed the possibility for admins to set and view a user´s new password … Continue reading Admin able to set new plaintext user password – security problem?
I’m currently migrating the encryption functionality used in a PHP project from mcrypt (which was deprecated in PHP 7.1.x and no longer works from PHP 7.2 onward) to openssl, using the defuse/php-encryption library.
I am testing a website with a password reset functionality that provides a link with a token like most websites. I asked for multiple password reset links to see any pattern in the tokens. All the tokens had 8 characters, all alphabetes ca… Continue reading Is an 8 characters long password reset token strong enough?
Popular web hosting provider Hostinger has been hit by a massive data breach, as a result of which the company has reset passwords for all customers as a precautionary measure.
In a blog post published on Sunday, Hostinger revealed that “an unauthoriz… Continue reading Hostinger Suffers Data Breach – Resets Password For 14 Million Users
I am implementing the password reset functionality using OTPs (one-time passwords). When the user clicks on the ‘forgot password’ link, he / she is sent an OTP and is redirected to the OTP input page. After typing in the OTP,… Continue reading When resetting a password using OTPs, how can I prevent users from bypassing the OTP input page?
I am implementing the password reset functionality using OTPs (one-time passwords). When the user clicks on the ‘forgot password’ link, he / she is sent an OTP and is redirected to the OTP input page. After typing in the OTP,… Continue reading When resetting a password using OTPs, how can I prevent users from bypassing the OTP input page?
My webapp has “password reset” and “password change” functionality.
Password “reset” is typical: user clicks “I forgot my password”, enters his email, one-time link emailed there, he visits a form to choose a new password.
Late last night I received a “password reset” email from info@mailer.netflix.com.
It looked legit, but I had not requested a password reset. I checked my account’s “recent account access” but saw nothing unusual there.
I di… Continue reading Possible attack via Netflix; what action should I take, if any?
I searched for a long time, and never really find any articles or posts that fully explain how a password reset token should be created.
What I know so far:
It should be random.
Its hash should be stored in the database.
It should expir… Continue reading How to properly create a password reset token?
More victims of a 2015 credential-harvesting incident have come to light. Continue reading Slack Initiates Mass Password Reset