Collaborate Disseminate
Picture a state of the art implementation of a website registration and login system.
I’m interested in analyzing what a defender gains and loses by feeding the user password to a key-stretching KDF function (e.g. argon2).
Let’s start from… Continue reading On the gains and losses of an additional client side stretching of the user password
Picture a state of the art implementation of a website registration and login system.
I’m interested in analyzing what a defender gains and loses by feeding the user password to a key-stretching KDF function (e.g. argon2).
Let’s start from… Continue reading On the gains and losses of an additional client side stretching of the user password
We’re managing a shared hosting environment of Wordpress websites on a web server.
Each site has its own database password and FTP password, both are randomly generated and stored in AWS ParameterStore (not secrets manager for cost reasons… Continue reading Reuse credentials if same data in same security environment
I want to generate 6 random words using Wiktionary and random numbers from /dev/random. I’ll get a random number with /dev/random and then use the word from that index.
I know /dev/random should be used to generate random keys, but if it’s… Continue reading How does /dev/random not leak future bytes from old ones
One-time passwords (OTPs) usually serve as the 2nd factor in a 2FA scheme. But, in isolation, I believe they are more secure than passwords, since they are ephemeral and passwords are still badly reused in the wild. Unless end-to-end encry… Continue reading Can OTPs substitute password? [duplicate]
For example, a password hash is: edgjcgo4866864rfhobd38790g764hkp
Does having the hash of the password make it easier for the attacker to crack the password than not having the hash?
If yes, why does having the hash make it easier to crack… Continue reading Does having the hash make it easier to crack the password than not having the hash? [duplicate]
I am setting up a postgres db that will never be used by humans. In fact, I really don’t need to know it myself ever. I assumed that just using a 256bit(64 alphanumeric chars) hash of a unix timestamp IE:
date +%s%3N | sha256sum
A very im… Continue reading Is a sha256 hash of a unix timestamp a strong password
SMB owners across the globe are still relying only on usernames and passwords to secure critical employee, customer, and partner data, according to the Global Small Business Multi-Factor Authentication (MFA) Study released by the Cyber Readiness Instit… Continue reading Companies around the globe still not implementing MFA
Cybercriminals typically rely on weak passwords to break into online accounts of unsuspecting victims, which often leads to severe consequences. But despite understanding the importance of strong passwords as a critical security best practice, for most… Continue reading The importance of secure passwords can’t be emphasized enough
Passwork aims to enable efficient and secure working processes through the automated management of passwords and corporate accounts. Quickly access all employee credentials. Local system administrators are tasked with monitoring and controlling employe… Continue reading Product showcase: Passwork – the best solution for work with corporate passwords