Hot answers tagged password
4
There is no simple solution to this problem. Static passwords may be shared among friends. Tracking mechanisms (IP-addresses, cookies) will turn up "false positives" (i.e. rejecting real paying members) - which is very bad for business.
Using a OTP (One Time Password), as suggested by Steve, is probably not practical, as it does not allow casual use, and ...
4
Without storing the passwords you can only evaluate the quality by counting the number of different types of character (upper case, numbers, special characters) when the user first sets or subsequently resets their password.
You could enable the counting and store that information (you just need the number of characters and the number of each type of ...
4
Your assumptions are generally true. But without looking into the cPanel code myself, I don't know what the actual situation is. However, there is such a thing as locality-sensitive hashing.
Unlike a normal hashing algorithm, where you want even minimal changes to produce huge differences, locality-sensitive hashing produces hashes that reflect the ...
2
It's a security measure on so many levels!!!
I. Typing it twice is to make sure you entered it correctly!
What if you entered it just once, made a typo and didn't notice?
The site might have a ToS preventing multiple accounts for the same person/email!
You might never be able to login to that account/website ever again!
II. Passwords should NEVER ...
2
A simple solution on the Apache server side is using Basic access authentication.
See the section "Getting it working" for an example. And here some answers on Stackoverflow.
Pro: If you have access to the command line and your webserver it's a 2 minute set up that blocks access to your project.
Con: Managing access this way for many users might be ...
2
Best way to do this, is to create a script that would log in to SMTP account by PHP, with SSL. If the process succeeds - set a cookie/session and let him go on.
Here is some code snippet PHP SMTP mailer
You don't need most of it, just the top part where it try to log
2
This is a question that only you can answer.
If your web-hosting provider and their choice of control panel is returning your password in plain text formatting, it would suggest that they don't take the security of their platform seriously.
Typically, a good hosting provider will provide security in depth. That is, multiple layers of security ranging from ...
2
No - Joomla! does not store the password.
It stores a hash of the password with a salt.
To reset the password you could use one of the tools on the Joomla! Extension Directory (JED) in the Security Section.
We tend to do it manually, but I've heard that people have used the "Reset Admin Password" tool successfully.
2
Sounds like you are reinventing the wheel. There are plenty of scripts that will check password quality http://www.webresourcesdepot.com/10-password-strength-meter-scripts-for-a-better-registration-interface/
2
It is pretty difficult to implement something like this. You can't do it based on IP number because most people have dynamic IP. Even if it was only some people, you would have a problem.
You could do it via a cookie, but I reckon you are creating a support nightmare for yourself as some people don't accept cookies, people delete cookies. Besides, what ...
2
It appears that Chrome now ignores autocomplete="off" unless it is on the <form autocomplete="off"> tag (which applies to the entire form). You used to be able to add the tag to any <input> field, which gave you a lot more control.
You may also need to start the document with this DTD:
<!DOCTYPE html>
1
Put each field into its own form, and use nonsensical field names and ids. Then, onchange, use javascript to copy the contents to hidden fields in the main form.
<form name=fake1 onsubmit="return false" autocomplete="off">
New Email Address: <input type=text id=xy1 name=xy1 onchange="document.mainform.newemail=this.value">
</form>
...
1
To change a user password manually:
Login to your database
Select the database where Joomla is installed
Select the table "Users"
Choose the user you want to edit
Click "Edit"
Identify the "Password" field
Choose "MD5" from the drop-down.
Enter your new password.
Press "OK" to save the changes.
[I can not post images because of a lack of reputation.]
1
If you are going to do that, DO NOT store a rating or additional information about the contents of passwords directly mapped in some way to each password. If your database was hacked, this would be the equivalent of saying "These passwords are the easy ones to crack, and here's some information about them to get you started."
Instead, you could store ...
1
First of all PGP is used to encrypt using private and public keys. It has nothing to do with your password or the algorithm used to encrypt it on a hosting server. It's highly likely an MD5 hash is used to store the password. A clear text version may be stored for the sole reason to keep you from using the same or similar passwords in the future. My hosting ...
1
I'm not sure why this question was migrated.. there are quite some questions with valid answers on stackoverflow about this.
First: use BCrypt-hash, it is the recommended hashing algorithm today.
Sha256 is a general purpose hashing algorithm, designed to be fast; you do not want your hashing algorithm to be fast for password hashing.
Second: use a random, ...
1
It's most likely a vulnerability in a plugin installed on one of your domains. Your theme could even be using a vulnerable version of timthumb.php. Most reputable hosts scan for vulnerable versions of this file and notify you of it being updated.
Hostmonster.com makes you set a very length and strict password with both upper case lower case and special ...
Only top voted, non community-wiki answers of a minimum length are eligible
