Tag Info

Hot answers tagged

14

The simplest thing to do is employ a dead man's switch that sends vital information to someone that you trust, and have established an agreement with to carry on or conclude a select few of your affairs or ventures if something should render you unable to continue with them. In the simplest case, you have something set up to send an email to several people ...


10

It's not about emailing plain text passwords vs. a URL, it's about storing passwords in plain text vs. hashing them. Storing passwords in plain text is not considered secure because if the site (or server, or database...) is exploited, the hacker has access to the user's account on that site along with any other site on which they use the same username and ...


9

Here are a number of simple steps which will make it easy for someone to take over after you are gone: Give clients plenty of time to figure it out. Don't register domains for only one year at a time, go longer. Domains are fairly cheap and there is little reason to choose shorter-term registration. For client websites, record all necessary details that ...


8

I wrote an answer, then read a little more, and substatially edited my answer. This question has already been debated on Stack Overflow. The accepted answer on this question is a good starting point, follow the links. My take is that: The static salt (which you call global) is somewhat valuable because: It is simple to implement, and doesn't require a ...


6

If you're emailed your password and three months later someone gets access to your email, they can get into your account (unless you've changed the password, which is unlikely). If you're emailed a password reset link and three months later someone gets into your account it won't do anything, because even if you've not used it, it will have expired. It ...


5

Your assumptions are generally true. But without looking into the cPanel code myself, I don't know what the actual situation is. However, there is such a thing as locality-sensitive hashing. Unlike a normal hashing algorithm, where you want even minimal changes to produce huge differences, locality-sensitive hashing produces hashes that reflect the ...


5

First of all find out what sort of webserver you are using by using the method suggested in this question: http://superuser.com/questions/120783/can-i-detect-what-webserver-a-website-is-using If it's Apache How do I setup authentication on a specific folder using .htaccess? If it's IIS http://serverfault.com/questions/193273/iis-password-protection-for-php ...


4

This pretty much has already been asked on StackOverflow: Double salt for hashing passwords?


4

There is no simple solution to this problem. Static passwords may be shared among friends. Tracking mechanisms (IP-addresses, cookies) will turn up "false positives" (i.e. rejecting real paying members) - which is very bad for business. Using a OTP (One Time Password), as suggested by Steve, is probably not practical, as it does not allow casual use, and ...


4

Without storing the passwords you can only evaluate the quality by counting the number of different types of character (upper case, numbers, special characters) when the user first sets or subsequently resets their password. You could enable the counting and store that information (you just need the number of characters and the number of each type of ...


3

In addition to weak patterns, we hash an entry and try to look it up from one of the largest known password list available at https://dazzlepod.com/uniqpass/.


3

It's a security measure on so many levels!!! I. Typing it twice is to make sure you entered it correctly! What if you entered it just once, made a typo and didn't notice? The site might have a ToS preventing multiple accounts for the same person/email! You might never be able to login to that account/website ever again! II. Passwords should NEVER ...


3

All applications I worked for, we place link to change password in user profile page (if you have user profile page). In other case, you can put the link in "Preferences page".


3

Not sure this would work for you, but I was able to reclaim a YouTube account utilizing the Copyright and Trademark section of their website. If you can prove that the trademark belongs to you and that the account utilizes the trademark, they may be able to transfer the account.


3

US federal law pertaining to Fraud and related activity in connection with computers suggests that it is unlawful to: intentionally access a computer without authorization or exceeds authorized access, and thereby obtain information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602 ...


3

UPDATE: Based on the fact this is is a .com domain, that you do the following: Go to https://www.verisigninc.com/en_US/domain-names/com-domain-names/index.xhtml. Click on the Chat with Support link at the bottom of the page. Explain the situation to them and tell them what documentation, if any, you have to establish that you or your client is the ...


2

If you are asking whether this can be configured in the administrative backend, then no, you cannot do this, the respective functionality is currently hard coded within user_pass_validate(). However, you are probably aware already that one of Drupals strength is the relative ease in which it can be programmatically customized or extended via modules. I'm ...


2

An alternative approach: Have the user provide the email address they used when they registered Verify that email address does indeed belong to an account (report an error if it does not) Send an email to that email address with... ...a new password that is auto-generated (dictionary words are better than random characters) and expires after a set ...


2

This is a question that only you can answer. If your web-hosting provider and their choice of control panel is returning your password in plain text formatting, it would suggest that they don't take the security of their platform seriously. Typically, a good hosting provider will provide security in depth. That is, multiple layers of security ranging from ...


2

A simple solution on the Apache server side is using Basic access authentication. See the section "Getting it working" for an example. And here some answers on Stackoverflow. Pro: If you have access to the command line and your webserver it's a 2 minute set up that blocks access to your project. Con: Managing access this way for many users might be ...


2

Best way to do this, is to create a script that would log in to SMTP account by PHP, with SSL. If the process succeeds - set a cookie/session and let him go on. Here is some code snippet PHP SMTP mailer You don't need most of it, just the top part where it try to log


2

Sounds like you are reinventing the wheel. There are plenty of scripts that will check password quality http://www.webresourcesdepot.com/10-password-strength-meter-scripts-for-a-better-registration-interface/


2

To change a user password manually: Login to your database Select the database where Joomla is installed Select the table "Users" Choose the user you want to edit Click "Edit" Identify the "Password" field Choose "MD5" from the drop-down. Enter your new password. Press "OK" to save the changes. [I can not post images because of a lack of reputation.]


2

No - Joomla! does not store the password. It stores a hash of the password with a salt. To reset the password you could use one of the tools on the Joomla! Extension Directory (JED) in the Security Section. We tend to do it manually, but I've heard that people have used the "Reset Admin Password" tool successfully.


2

It is pretty difficult to implement something like this. You can't do it based on IP number because most people have dynamic IP. Even if it was only some people, you would have a problem. You could do it via a cookie, but I reckon you are creating a support nightmare for yourself as some people don't accept cookies, people delete cookies. Besides, what ...


2

Sadly without running a brute force which I can't advise on you can not since cPanel is normally setup to use ProFTPD and PureFTP both of these servers used hashed passwords and they are not viewable in any form - if it's your server just reset the password.


2

It appears that Chrome now ignores autocomplete="off" unless it is on the <form autocomplete="off"> tag (which applies to the entire form). You used to be able to add the tag to any <input> field, which gave you a lot more control. You may also need to start the document with this DTD: <!DOCTYPE html>


2

You should change the password immediately. There are several reasons for this: If the account has been compromised allowing the old password will mean that the account is still compromised and the attacker will be able to change it again. Every other system changes the password immediately, so this is what the user will be expecting. If you allow the old ...


2

Probably not. If any of your clients post the URL in just about anything, search engines will likely discover it. They may also find it while crawling domain registration sites and the like... As Google states here: If you need to keep confidential content on your server, save it in a password-protected directory. Googlebot and other spiders won't be ...


2

Hope this helps someone: This is how mediawiki saves the user password in the database. Please see @Aleksander's answer for more details.



Only top voted, non community-wiki answers of a minimum length are eligible