86% of CrashCrate subscribers used passwords already leaked in other breaches
1–10 of 145 posts
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#2If you're responsible for running a website, how are you going to be resilient against attackers who come to your site with legitimate usernames and passwords of your members?
One way is to email the user when they log in from a new device or computer.
They then have to enter a 6 digit one time password from the email.
Someone who grabs the users email and password from a breach would also need access to their email.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#3The truth is the password is just another failed security concept- because those that work, cant be remembered by the users.
So ones security researches terrible, is a neurologists reasonable. The actually embarrassing part is that after years of research- we still do not have a alternative.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#4If you're responsible for running a website, how are you going to be resilient against attackers who come to your site with legitimate usernames and passwords of your members? One way is to email the user when they log in from a new device or computer. They then have to enter a 6 digit one time password from the email. Someone who grabs the users email and password from a breach would also need access to their email.
Also if someone attempts to change an email address linked with an account, an email could be sent asking for confirmation. 2FA is also becoming easier to implement for low level developers with Authy and Google Authenticator offering simple to follow boilerplates and documentation. Validation algorithm that forces a dictionary attack on password before successful registration could also be prudent.
Just like SQL injection and query prepare statements, issues are very much known but it's the want and need to act on them. GDPR should start to help this, but management tier individuals who push development time scales are also needing to be 'sold' the importance of this.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#5The truth is the password is just another failed security concept- because those that work, cant be remembered by the users. So ones security researches terrible, is a neurologists reasonable. The actually embarrassing part is that after years of research- we still do not have a alternative.
> because those that work, cant be remembered by the users
Remind me what's wrong with "correct horse battery staple" again?
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#6I'm still not sure why most services don't default to just mailing you a one time, short lived login link.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#7The truth is the password is just another failed security concept- because those that work, cant be remembered by the users. So ones security researches terrible, is a neurologists reasonable. The actually embarrassing part is that after years of research- we still do not have a alternative.
> because those that work, cant be remembered by the users Remind me what's wrong with "correct horse battery staple" again?
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#8The truth is the password is just another failed security concept- because those that work, cant be remembered by the users. So ones security researches terrible, is a neurologists reasonable. The actually embarrassing part is that after years of research- we still do not have a alternative.
> because those that work, cant be remembered by the users Remind me what's wrong with "correct horse battery staple" again?
Remembering a unique one for every site is hard.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#9If you're responsible for running a website, how are you going to be resilient against attackers who come to your site with legitimate usernames and passwords of your members? One way is to email the user when they log in from a new device or computer. They then have to enter a 6 digit one time password from the email. Someone who grabs the users email and password from a breach would also need access to their email.
No, please don't. This is arduous for those of us who like a bit of privacy and regularly clear their cookies etc.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#10I'm still not sure why most services don't default to just mailing you a one time, short lived login link.
Because my password manager is faster than checking mail. Because spam. Because people change mails and may forget to let you know. Because bots scan emails and they are mostly in clear text.