481–490 of 596 posts
Earlier quoted context omitted.
I can't think of any security implications of hashing on the client-side. What's your thinking?
Does salting work if you hash in the browser?
Then I tried to set up 2 factor authentication but I am unable to do it. It keeps rejecting the same phone number as being either invalid or not recognised as a contact, no matter which format I choose to enter it. I've dropped the interational prefix, added it, added and dropped the plus sign, added and dropped the 0 after the international prefix etc etc.
I'd dump yahoo altogether except it's the email for my paypal for over a decade and i can't change that.
Earlier quoted context omitted.
My preferred method: Add an "expires" field to the token, this should contain a date after which the token is no longer valid. Now all token s auto-invalidate after a certain period. Allow some or all tokens to "refresh" by calling a particular endpoint (call with valid token and get a token with expiry from now). Optionally add some form of identifier to the token (user_id works great) so that you can push a message…
> Now all token s auto-invalidate after a certain period. You need to make sure that there is some process that will refuse to keep on re-upping the cookie lifetime. Otherwise an attacker could indefinitely keep the stolen cookie alive.
Earlier quoted context omitted.
> Now all token s auto-invalidate after a certain period. You need to make sure that there is some process that will refuse to keep on re-upping the cookie lifetime. Otherwise an attacker could indefinitely keep the stolen cookie alive.
You CBS Combine a session cookie with a jwt Token That get sent over a Header
I'd forgotten my yahoo password but wanted to change it. They sent a code to my phone and I was able to do that. Then I tried to set up 2 factor authentication but I am unable to do it. It keeps rejecting the same phone number as being either invalid or not recognised as a contact, no matter which format I choose to enter it. I've dropped the interational prefix, added it, added and dropped the plus sign, added and d…
Regarding 2FA at Yahoo!, I've also had issues... SMS stopped arriving altogether and I had to disable it.
Earlier quoted context omitted.
But would it require users to change their password? The way I would have implemented it, but would be keen to know how secure it is, is that you start with the md5 of the password ( md5(password) ). You then bcrypt or scrypt that md5 ( bcrypt(md5(password)) ) and replace the md5 in your database with the bcrypt hash. When a user logs in, all you need to do is to calculate the md5 first then check that md5 against th…
The method I've used is to add the column for the new stronghash then you update the old column to stronghash( ), where is dumbhash(password) check against that on login stronghash(dumbhash(password)) and generate just stronghash( ) while you have the plaintext password in memory and update the row to add the new hash (simple and interoperable, not dependent on dumbhash) and drop the stronghash( ). After a limit (to…
I'd forgotten my yahoo password but wanted to change it. They sent a code to my phone and I was able to do that. Then I tried to set up 2 factor authentication but I am unable to do it. It keeps rejecting the same phone number as being either invalid or not recognised as a contact, no matter which format I choose to enter it. I've dropped the interational prefix, added it, added and dropped the plus sign, added and d…
I've changed my paypal email twice in the past already when I started getting too much spam. Regarding 2FA at Yahoo!, I've also had issues... SMS stopped arriving altogether and I had to disable it.
> August 2013 > hashed passwords (using MD5) I don't even know what to say. > investigating the creation of forged cookies that could allow an intruder to access users' accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies How is this possible? Aren't most auth cookies just a session ID that can be used to lo…
1) As Yahoo "upgraded" all password storage in UDB (where all login / registration details are stored) to be bcrypt before 2013, I'm curious how this was possible. 2) Yahoo doesn't use a centralized session storage. If you know a few values (not disclosing the exact ones) from the UDB, it's theoretically (guess not so theoretical now) possible to create forged cookies if you steal the signing keys. To my knowledge, t…
Isn't that highly confidential company information?
Earlier quoted context omitted.
race is a bogus concept anyway, "racism" is the everyday term for xenophobia. give it a break.
Race is not a bogus concept. It may be cultural but it's still real. Offshore is not a race. That's just xenophobia.