Tag Info

Hot answers tagged

13

The simplest thing to do is employ a dead man's switch that sends vital information to someone that you trust, and have established an agreement with to carry on or conclude a select few of your affairs or ventures if something should render you unable to continue with them. In the simplest case, you have something set up to send an email to several people ...


8

I wrote an answer, then read a little more, and substatially edited my answer. This question has already been debated on Stack Overflow. The accepted answer on this question is a good starting point, follow the links. My take is that: The static salt (which you call global) is somewhat valuable because: It is simple to implement, and doesn't require a ...


5

First of all find out what sort of webserver you are using by using the method suggested in this question: http://superuser.com/questions/120783/can-i-detect-what-webserver-a-website-is-using If it's Apache How do I setup authentication on a specific folder using .htaccess? If it's IIS http://serverfault.com/questions/193273/iis-password-protection-for-php ...


5

Your assumptions are generally true. But without looking into the cPanel code myself, I don't know what the actual situation is. However, there is such a thing as locality-sensitive hashing. Unlike a normal hashing algorithm, where you want even minimal changes to produce huge differences, locality-sensitive hashing produces hashes that reflect the ...


4

There is no simple solution to this problem. Static passwords may be shared among friends. Tracking mechanisms (IP-addresses, cookies) will turn up "false positives" (i.e. rejecting real paying members) - which is very bad for business. Using a OTP (One Time Password), as suggested by Steve, is probably not practical, as it does not allow casual use, and ...


4

Without storing the passwords you can only evaluate the quality by counting the number of different types of character (upper case, numbers, special characters) when the user first sets or subsequently resets their password. You could enable the counting and store that information (you just need the number of characters and the number of each type of ...


3

It's a security measure on so many levels!!! I. Typing it twice is to make sure you entered it correctly! What if you entered it just once, made a typo and didn't notice? The site might have a ToS preventing multiple accounts for the same person/email! You might never be able to login to that account/website ever again! II. Passwords should NEVER ...


3

US federal law pertaining to Fraud and related activity in connection with computers suggests that it is unlawful to: intentionally access a computer without authorization or exceeds authorized access, and thereby obtain information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602 ...


2

If you are asking whether this can be configured in the administrative backend, then no, you cannot do this, the respective functionality is currently hard coded within user_pass_validate(). However, you are probably aware already that one of Drupals strength is the relative ease in which it can be programmatically customized or extended via modules. I'm ...


2

This is a question that only you can answer. If your web-hosting provider and their choice of control panel is returning your password in plain text formatting, it would suggest that they don't take the security of their platform seriously. Typically, a good hosting provider will provide security in depth. That is, multiple layers of security ranging from ...


2

A simple solution on the Apache server side is using Basic access authentication. See the section "Getting it working" for an example. And here some answers on Stackoverflow. Pro: If you have access to the command line and your webserver it's a 2 minute set up that blocks access to your project. Con: Managing access this way for many users might be ...


2

Best way to do this, is to create a script that would log in to SMTP account by PHP, with SSL. If the process succeeds - set a cookie/session and let him go on. Here is some code snippet PHP SMTP mailer You don't need most of it, just the top part where it try to log


2

An alternative approach: Have the user provide the email address they used when they registered Verify that email address does indeed belong to an account (report an error if it does not) Send an email to that email address with... ...a new password that is auto-generated (dictionary words are better than random characters) and expires after a set ...


2

Sounds like you are reinventing the wheel. There are plenty of scripts that will check password quality http://www.webresourcesdepot.com/10-password-strength-meter-scripts-for-a-better-registration-interface/


2

It is pretty difficult to implement something like this. You can't do it based on IP number because most people have dynamic IP. Even if it was only some people, you would have a problem. You could do it via a cookie, but I reckon you are creating a support nightmare for yourself as some people don't accept cookies, people delete cookies. Besides, what ...


2

To change a user password manually: Login to your database Select the database where Joomla is installed Select the table "Users" Choose the user you want to edit Click "Edit" Identify the "Password" field Choose "MD5" from the drop-down. Enter your new password. Press "OK" to save the changes. [I can not post images because of a lack of reputation.]


2

No - Joomla! does not store the password. It stores a hash of the password with a salt. To reset the password you could use one of the tools on the Joomla! Extension Directory (JED) in the Security Section. We tend to do it manually, but I've heard that people have used the "Reset Admin Password" tool successfully.


2

You should change the password immediately. There are several reasons for this: If the account has been compromised allowing the old password will mean that the account is still compromised and the attacker will be able to change it again. Every other system changes the password immediately, so this is what the user will be expecting. If you allow the old ...


2

It appears that Chrome now ignores autocomplete="off" unless it is on the <form autocomplete="off"> tag (which applies to the entire form). You used to be able to add the tag to any <input> field, which gave you a lot more control. You may also need to start the document with this DTD: <!DOCTYPE html>


2

Probably not. If any of your clients post the URL in just about anything, search engines will likely discover it. They may also find it while crawling domain registration sites and the like... As Google states here: If you need to keep confidential content on your server, save it in a password-protected directory. Googlebot and other spiders won't be ...


1

An easy method would be to use a trigger, calling a php file that physically exists on the disc and calling it in your dynamic content which should trigger the password prompt. You'd just need to use an empty php file in say /protected/ and ensure that the rest of the file isn't processed until the empty php file is read.


1

According to this forum thread your database password is not stored in the database. It is stored in a configuration file. For Joomla version 1.5 It will be in the configuration.php normally on line 54 'var $password =' 'yourpassword'; For Joomla version 1.0 it will also be in configuration.php but you need to look for $mosConfig_password = ''; ...


1

The email to reset the password shouldn't change the password until the recipient clicks on the link in the email. If the password is changed when the email is sent out, then you have effectively locked out the real user in the case that somebody else had requested that their password be reset. Once the user clicks on the link in the email to reset the ...


1

Put each field into its own form, and use nonsensical field names and ids. Then, onchange, use javascript to copy the contents to hidden fields in the main form. <form name=fake1 onsubmit="return false" autocomplete="off"> New Email Address: <input type=text id=xy1 name=xy1 onchange="document.mainform.newemail=this.value"> </form> ...


1

If you are going to do that, DO NOT store a rating or additional information about the contents of passwords directly mapped in some way to each password. If your database was hacked, this would be the equivalent of saying "These passwords are the easy ones to crack, and here's some information about them to get you started." Instead, you could store ...


1

First of all PGP is used to encrypt using private and public keys. It has nothing to do with your password or the algorithm used to encrypt it on a hosting server. It's highly likely an MD5 hash is used to store the password. A clear text version may be stored for the sole reason to keep you from using the same or similar passwords in the future. My hosting ...


1

My standard operating procedure: First, prompt the user for their email address or login name. If the information is not found, it's nice to tell the user that the address is bogus, but that can also help people brute-force this information. In systems where the login and email address are not identical, asking for either of these on the same page may be ...


1

It's most likely a vulnerability in a plugin installed on one of your domains. Your theme could even be using a vulnerable version of timthumb.php. Most reputable hosts scan for vulnerable versions of this file and notify you of it being updated. Hostmonster.com makes you set a very length and strict password with both upper case lower case and special ...


1

I'm not sure why this question was migrated.. there are quite some questions with valid answers on stackoverflow about this. First: use BCrypt-hash, it is the recommended hashing algorithm today. Sha256 is a general purpose hashing algorithm, designed to be fast; you do not want your hashing algorithm to be fast for password hashing. Second: use a random, ...


1

cPanel is not meant for this purpose. paulmorriss says: Do the developers have to use cPanel? Can they just use FTP to get at their directories? Lèse majesté says: I don't see why any developer would want to use cpanel over shell/sftp. It's easier to just create a separate shell/sftp account for each dev and limit them to their own directory. If ...



Only top voted, non community-wiki answers of a minimum length are eligible