51–60 of 173 posts
Also, never ever roll your own encryption - it will be flawed (unless you employ at least 3 crypto experts and get it peer reviewed - and even then it's probably still flawed).
Earlier quoted context omitted.
This is frightening. Who is running the security teams at these large companies?
You'd be surprised how often this happens. I had a similar situation with someone who accidentally used my email when buying a new car. For a while I was getting emails from the Hyundai dealership that had auto-login links that would have let me do all kinds of things, including requesting a (paid) tow of the car from my house back to the dealership , scheduling (or cancelling) maintenance, ordering extras and part,…
I abandon any sites which give me direct logins via URLs sent over plain text emails. I know, password reset keys are as bad as login keys, but usually they expire after a certain time frame. F*ck login keys.
I abandon any sites which give me direct logins via URLs sent over plain text emails. I know, password reset keys are as bad as login keys, but usually they expire after a certain time frame. F*ck login keys.
I recently found out that piwik also uses a login token of the MD5 of the password[0]. So this mistake is still very prevalent. If you want to provide a one-click automatic login to Piwik for your users, you can use the ‘logme’ mechanism, and pass their login & the md5 string of their password in the URL parameters: https://stats.example.org/index.php?module=Login&action=logm... [0] - http://piwik.org/faq/how-to/#faq…
Earlier quoted context omitted.
Completely agree, Match.com does the same thing. Not so long ago a user signed up to their site using my email address (never figured out why). They were able to create an account and subscribe to the site without ever verifying the email, so for a week or so I was getting notifications sent to me without any way to unsubscribe from the email. Clicking any of the links in the email signed me in as the user and gave m…
This is frightening. Who is running the security teams at these large companies?
Earlier quoted context omitted.
If I breach your environment and get access to bcrypt hashes, they are useless to me as-is. If I have enough processing power to brute-force compare them, I can eventually get the original password back, but that isn't a zero-cost effort in terms of time. As soon as you realise you have been breached, I would expect you would have initiated a lockdown of some kind, either preventing access to accounts until the owner…
If you have the computing power? If you're compromising peoples boxes you likely also have a botnet, which has practically limitless potential.
Edit: moreover, the GP has already mentioned that "[brute force] isn't a zero-cost effort in terms of time," even if you have access to humongous amounts of processing power. The point of encryption isn't to protect data forever; just long enough for them to become uninteresting.
Earlier quoted context omitted.
Any attacker who snags the server's database will have access to all accounts. When the passwords are hashed, they won't.
I don't quite follow. If they have access to the server's database, then unless the rest of the DB was encrypted using a key derived from the users password, will they not have access to all the accounts anyway? (edit: I should perhaps make it clear that I'm not suggesting that passwords shouldn't be hashed, merely that if you have access to the database containing the password hash, then in many cases you'd already…
As an example, if you're a bank, if someone gets your database of data, but the passwords are well protected, they can find out how much money you have in your account. If they get your password, too, then they can login as you and transfer your money to their offshore account.