Hot answers tagged password
8
I wrote an answer, then read a little more, and substatially edited my answer.
This question has already been debated on Stack Overflow. The accepted answer on this question is a good starting point, follow the links.
My take is that:
The static salt (which you call global) is somewhat valuable because:
It is simple to implement, and doesn't require a ...
5
First of all find out what sort of webserver you are using by using the method suggested in this question: http://superuser.com/questions/120783/can-i-detect-what-webserver-a-website-is-using
If it's Apache
How do I setup authentication on a specific folder using .htaccess?
If it's IIS
http://serverfault.com/questions/193273/iis-password-protection-for-php
...
4
There is no simple solution to this problem. Static passwords may be shared among friends. Tracking mechanisms (IP-addresses, cookies) will turn up "false positives" (i.e. rejecting real paying members) - which is very bad for business.
Using a OTP (One Time Password), as suggested by Steve, is probably not practical, as it does not allow casual use, and ...
4
Without storing the passwords you can only evaluate the quality by counting the number of different types of character (upper case, numbers, special characters) when the user first sets or subsequently resets their password.
You could enable the counting and store that information (you just need the number of characters and the number of each type of ...
4
Your assumptions are generally true. But without looking into the cPanel code myself, I don't know what the actual situation is. However, there is such a thing as locality-sensitive hashing.
Unlike a normal hashing algorithm, where you want even minimal changes to produce huge differences, locality-sensitive hashing produces hashes that reflect the ...
3
US federal law pertaining to Fraud and related activity in connection with computers suggests that it is unlawful to:
intentionally access a computer
without authorization or exceeds
authorized access, and thereby obtain
information contained in a financial
record of a financial institution, or
of a card issuer as defined in section
1602 ...
2
If you are asking whether this can be configured in the administrative backend, then no, you cannot do this, the respective functionality is currently hard coded within user_pass_validate().
However, you are probably aware already that one of Drupals strength is the relative ease in which it can be programmatically customized or extended via modules. I'm ...
2
An alternative approach:
Have the user provide the email address they used when they registered
Verify that email address does indeed belong to an account (report an error if it does not)
Send an email to that email address with...
...a new password that is auto-generated (dictionary words are better than random characters) and expires after a set ...
2
This is a question that only you can answer.
If your web-hosting provider and their choice of control panel is returning your password in plain text formatting, it would suggest that they don't take the security of their platform seriously.
Typically, a good hosting provider will provide security in depth. That is, multiple layers of security ranging from ...
2
It's a security measure on so many levels!!!
I. Typing it twice is to make sure you entered it correctly!
What if you entered it just once, made a typo and didn't notice?
The site might have a ToS preventing multiple accounts for the same person/email!
You might never be able to login to that account/website ever again!
II. Passwords should NEVER ...
2
A simple solution on the Apache server side is using Basic access authentication.
See the section "Getting it working" for an example. And here some answers on Stackoverflow.
Pro: If you have access to the command line and your webserver it's a 2 minute set up that blocks access to your project.
Con: Managing access this way for many users might be ...
2
Best way to do this, is to create a script that would log in to SMTP account by PHP, with SSL. If the process succeeds - set a cookie/session and let him go on.
Here is some code snippet PHP SMTP mailer
You don't need most of it, just the top part where it try to log
2
Sounds like you are reinventing the wheel. There are plenty of scripts that will check password quality http://www.webresourcesdepot.com/10-password-strength-meter-scripts-for-a-better-registration-interface/
2
No - Joomla! does not store the password.
It stores a hash of the password with a salt.
To reset the password you could use one of the tools on the Joomla! Extension Directory (JED) in the Security Section.
We tend to do it manually, but I've heard that people have used the "Reset Admin Password" tool successfully.
2
It is pretty difficult to implement something like this. You can't do it based on IP number because most people have dynamic IP. Even if it was only some people, you would have a problem.
You could do it via a cookie, but I reckon you are creating a support nightmare for yourself as some people don't accept cookies, people delete cookies. Besides, what ...
2
It appears that Chrome now ignores autocomplete="off" unless it is on the <form autocomplete="off"> tag (which applies to the entire form). You used to be able to add the tag to any <input> field, which gave you a lot more control.
You may also need to start the document with this DTD:
<!DOCTYPE html>
1
Put each field into its own form, and use nonsensical field names and ids. Then, onchange, use javascript to copy the contents to hidden fields in the main form.
<form name=fake1 onsubmit="return false" autocomplete="off">
New Email Address: <input type=text id=xy1 name=xy1 onchange="document.mainform.newemail=this.value">
</form>
...
1
To change a user password manually:
Login to your database
Select the database where Joomla is installed
Select the table "Users"
Choose the user you want to edit
Click "Edit"
Identify the "Password" field
Choose "MD5" from the drop-down.
Enter your new password.
Press "OK" to save the changes.
[I can not post images because of a lack of reputation.]
1
If you are going to do that, DO NOT store a rating or additional information about the contents of passwords directly mapped in some way to each password. If your database was hacked, this would be the equivalent of saying "These passwords are the easy ones to crack, and here's some information about them to get you started."
Instead, you could store ...
1
First of all PGP is used to encrypt using private and public keys. It has nothing to do with your password or the algorithm used to encrypt it on a hosting server. It's highly likely an MD5 hash is used to store the password. A clear text version may be stored for the sole reason to keep you from using the same or similar passwords in the future. My hosting ...
1
It's most likely a vulnerability in a plugin installed on one of your domains. Your theme could even be using a vulnerable version of timthumb.php. Most reputable hosts scan for vulnerable versions of this file and notify you of it being updated.
Hostmonster.com makes you set a very length and strict password with both upper case lower case and special ...
1
I'm not sure why this question was migrated.. there are quite some questions with valid answers on stackoverflow about this.
First: use BCrypt-hash, it is the recommended hashing algorithm today.
Sha256 is a general purpose hashing algorithm, designed to be fast; you do not want your hashing algorithm to be fast for password hashing.
Second: use a random, ...
1
Check your .my.cnf config file for the lines user=root and password=whatever. These enable you to log in without a username or password. Delete those lines if you want to be prompted for a password instead.
1
My standard operating procedure:
First, prompt the user for their email address or login name. If the information is not found, it's nice to tell the user that the address is bogus, but that can also help people brute-force this information. In systems where the login and email address are not identical, asking for either of these on the same page may be ...
1
By nature HTTP is stateless, which means that you'll be prompted to input the username and password every time you try to get something. However what happens is that your browser sends the username and password every request, so you don't have to fill them in every time. What happens here is that the browser doesn't re-send the information. Technically ...
1
I just read this question and it reminded me of a question I posted on SO about a year ago: Comprehensive information about hash salts. You might be interested in reading over the question and answers as it has some other information which could be very useful to anyone interested in learning a bit more about hashes.
I should also note that implementing ...
Only top voted, non community-wiki answers of a minimum length are eligible
