41–50 of 104 posts
can someone please make a hall of shame for all the big Companies which where hacked! i think there are quite a lot by now.
It shouldn't be a hall of shame for companies being hacked, getting hacked is thing you can only mitigate not prevent. The shaming should be for storing your sensitive data in an insufficiently secure manner. If a company used scrypt to hash their passwords then they would essentially have no issue with getting hacked.
can someone please make a hall of shame for all the big Companies which where hacked! i think there are quite a lot by now.
Openness about this kind of thing should be encouraged.
To add insult to injury, another (though less severe of course) security issue is this - I went to the "change password" page per their recommendation, and typed my email. Usually, security best practices say that you should not volunteer any information for a potential attacker, e.g. don't tell the user if an email was sent or not, as this can be used for example to eventually construct a list of all their user's em…
I'm going to speak strongly against the prevailing view in the security community here: a forgot password email/username oracle is not an issue . Not in any way, shape, or form. Why? Because if I go to register an account with a given email or username, it's going to tell me if that account is already registered! Unless you make multiple accounts with a given username/email possible (please, please don't do that), th…
Thanks for this insight.
To add insult to injury, another (though less severe of course) security issue is this - I went to the "change password" page per their recommendation, and typed my email. Usually, security best practices say that you should not volunteer any information for a potential attacker, e.g. don't tell the user if an email was sent or not, as this can be used for example to eventually construct a list of all their user's em…
No one encrypts passwords. They just refer to one-way hashes, typically MD5, as encryption.
In fact, there are some large vendors of software that truly use encryption instead of some form of one way hashing. Sadly, I have to deal with software like this and there's no chance it's going to change any time soon.
I just got an email about this from Ubisoft, with a link to change my password. Yet another incident to prove that unique passwords and utilities such as RoboForm / Dashlane / Lastpass are a necessity.
I've been looking for a Lastpass alternative forever. Had no idea Dashlane existed, thanks!
Sure they can't read the data right of the disk, but what about a MITM? If the intruder had access to the application server, there's a good chance the credit card data was in memory at some point. If the data ever touches the server memory in an unencrypted form, the intruder could have it...
Earlier quoted context omitted.
I've been looking for a Lastpass alternative forever. Had no idea Dashlane existed, thanks!
Why don't you like lastpass? Genuinely curious. I've been pretty happy with them.
Let's play the guessing game: by "encrypted" they mean MD5'd?
I received an email from them - the password was included in the email, in plaintext. So I don't know exactly what they mean, but it's at best symmetric encryption.
Ouch... that's oversimplified... Here: https://en.wikipedia.org/wiki/Symmetric-key_algorithm http://cseweb.ucsd.edu/~mihir/cse207/w-se.pdf
Earlier quoted context omitted.
Is there even any reasonable excuse for limiting the length of passwords to something less than hundreds of characters?
The only reasonable restriction is in overall POST body length. I recall an exploit once on node.js where unreasonably large POST requests could DDOS a server with minimal effort.