Collaborate Disseminate
In this Help Net Security video, John Bennett, CEO at Dashlane, discusses their recent Global Password Health Score Report, detailing the global state of password health and hygiene. Poor security habits like password reuse remain widespread. With pass… Continue reading The state of password security in 2024
I am using graphql and my login function is resolved using a promise. The username is an email address.
The steps in the logic are the following: –
Validate CRSF token else return generic response ("Invalid username or password"… Continue reading Preventing authentication (login) timing attacks in a nodejs application
Are there any tools that can be used to enumerate all possible combinations of a narrowly-defined set of possible passwords to aid in password recovery?
I encrypted a file using symmetric encryption with a long passphrase. I forgot the pas… Continue reading Password Guesser Enumerator Tool (Password Recovery) [migrated]
In case you haven’t noticed, 5-digit PIN-codes are incredibly rare, with their 4-digit and 6-digit counterparts being profusely more common.
In fact, I’d be impressed if you can name a single popular system that uses one.
Why was five skip… Continue reading Why are 5-digit PIN-codes so rare? [duplicate]
I just know everyone is going to shout at me that public key is better but let me spell out the actual scenario first.
I have a small LAN at home, basically I’m the only regular user but other members of the family are connected occasional… Continue reading Relative security of ssh password and public key to remote systems
Let’s suppose I’m an Evil Hacker™ and I just breached a website, stole all their bcrypt passwords, and defaced their site for the lulz. But since it’s bcrypt I can’t crack anything.
I feel like what I’d do in this situation (as an Evil Hac… Continue reading When might it *not* be a good idea to reset your password immediately?
Internet Archive was recently hacked. They posted a message:
What we know: DDOS attack-fended off for now; defacement of our website via JS library; breach of usernames/email/salted-encrypted passwords.
I have an account on Internet Arch… Continue reading Should I reset my password on Internet Archive?
I only store password hashes in the database and use them to verify the password entered by the user. As far as I know, reversing a hash is impractical. So even if I have the password hash, I can only compare it with other hashes, not calc… Continue reading Why is it a problem when password hashes are leaked?
How does Windows manage passwords used for whole disk encryption? Is the password linked to the Windows account in a way where Microsoft has access to the password and thus a legal obligation to provide the password to any law enforcement … Continue reading Is the Windows Password that’s Used for Window Encryption available to Microsoft?
I decided to code my own password manager. There are similar posts to this, but with less specific (or not fully covered) answers/requests.
Seeing how popular OSes are coded bloated with little security in mind I want to at least minimize … Continue reading Coding language + libs + gui suggested to ensure secure strings for password manager [migrated]