Tag Archives: Password

Password Strength Testers Work For Important Accounts

msm1267 writes “Many popular online services have started to deploy password strength meters, visual gauges that are often color-coded and indicate whether the password you’ve chosen is weak or strong based on the website’s policy. The effectiveness of these meters in influencing users to choose stronger passwords had not been measured until recently. A paper released this week by researchers at the University of California Berkeley, University of British Columbia, and Microsoft provides details on the results of a couple of experiments examining how these meters influence computer users when they’re creating passwords for sensitive accounts and for unimportant accounts.”

Read more of this story at Slashdot.




Slashdot

Mitigating Password Re-Use From the Other End

An anonymous reader writes “Jen Andre, software engineer and co-founder of Threat Stack, writes about the problem of password breaches in the wake of the LivingSocial hack. She notes that the problem here is longstanding — it’s easy for LivingSocial to force password resets, but impossible to get users to create different passwords for each site they visit. We’ve tried education, and it’s failed. Andre suggests a different approach: building out better auditing infrastructure. ‘We, as an industry, need a standard for auditing that allows us to reliably track and record authentication events. Since authentication events are relatively similar across any application, I think this could be accomplished easily with a simple JSON-based common protocol and webhooks. … [It] could even be a hosted service that learns based on my login behaviors and only alerts me when it thinks a login entry is suspicious— kind of how Gmail will alert if I am logging in from a strange location. Because these audit entries are stored on a third-party box, if a certain web application is compromised, it won’t have access to alter its audit log history since it lives somewhere else.’”

Read more of this story at Slashdot.




Slashdot

Twitter to roll out new password security control?

Word has it that the social network is planning to debut two-factor authentication to cut down on user account hacking. [Read more]

    




CNET News

Google Joins PayPal-Backed Effort to Kill the Password

The search giant has signed up to a consortium that wants hardware to have a role in authenticating people.







New on MIT Technology Review

Your next password: a passTHOUGHT

Forget what you heard about magic rings, eye scans and two-step verification, the bar for log-in security has officially been raised with the most private password of all time: a thought.


FOX News

Your MI6 password, Bond: Insecure

It seems that British Intelligence’s passwords are kept in plain text. Complete with username. All non-encrypted. Ergo, plainly not so secure. [Read more]


CNET News

Apple ID security issue fixed, password page back online

The page was taken down yesterday, after reports of an exploit that could let hackers with a user’s e-mail address and birth date change the user’s Apple ID password. The company has fixed the issue. [Read more]


CNET News

Apple ID accounts reportedly vulnerable to password reset hack, forgot password page taken offline for maintenance (update 2: back)

Apple ID accounts reportedly vulnerable to password reset hack, forgot password page taken offline for maintenance

Gaping security holes are a pretty terrifying thing, especially when they involve something as sensitive as your Apple ID. Sadly it seems that immediately after making the paranoid happy by instituting two-step authentication a pretty massive flaw in Cupertino’s system was discovered and first reported by The Verge. Turns out you can reset any Apple ID password with nothing more than a person’s email address and date of birth — two pieces of information that are pretty easy to come across.

There’s a little more to the hack, but it’s simple enough that even your non-tech savvy aunt or uncle could do it. After entering the target email address in the password reset form you can then select to answer security questions to validate your identity. The first task will be to enter a date of birth. If you enter that correctly then paste a particular URL into the address bar (which we will not be publishing for obvious reasons), press enter, then — voilà — instant password reset! Or, at least that’s the story. While we were attempting to verify these claims Apple took down the password reset page for “maintenance.” Though we’ve received no official confirmation from Apple, it seems the company is moving swiftly to shut down this particularly troublesome workaround before word of it spreads too far.

Update: We’ve heard back from Apple on the matter, which stated, “Apple takes customer privacy very seriously. We are aware of this issue, and working on a fix.” No real surprises that a fix is in the works, but there you have it from the horse’s mouth.

Update 2: The forgotten password page is back as of late Friday evening — that was (relatively) quick.

Filed under: ,

Comments

Source: The Verge

Engadget RSS Feed

Google to add password sync to new version of Chrome

The beta version of Chrome 26 will let uses sync their passwords across multiple devices. [Read more]


CNET News

A Password You Wear on Your Wrist

Mobile security startup PassBan offers smartphone owners a slew of authentication options—including one you can wear.

A mobile security startup called PassBan thinks the best way to keep mobile devices secure is to allow people to choose from a bevy of different authentication options—including one that you wear on your wrist.







New on MIT Technology Review

Twitter calls for smarter password habits following Jeep, Burger King hacks

Twitter is urging its account holders to be smarter with their passwords following two recent attacks by hackers directed at Burger King and Jeep that took control of those accounts.
Computerworld News

SSH Password Gropers Are Now Trying High Ports

badger.foo writes “You thought you had successfully avoided the tiresome password guessing bots groping at your SSH service by moving the service to a non-standard port? It seems security by obscurity has lost the game once more. We’re now seeing ssh bruteforce attempts hitting other ports too, Peter Hansteen writes in his latest column.” For others keeping track, have you seen many such attempts?

Read more of this story at Slashdot.




Slashdot

PayPal, Lenovo Launch New Campaign to Kill the Password

A new standard that gives phones and PCs a bigger role in authentication could disarm attacks that rely on stealing passwords.

A consortium including PayPal and Lenovo, the world’s second-largest PC manufacturer, has launched a set of technology standards that could reduce reliance on passwords, potentially making online accounts more secure.







New on MIT Technology Review

Just Go Change Your Twitter Password Now

3831467723_8150d8b015_zAccording to Twitter, it was hacked and 250K accounts were affected, so they received emails from the company to change their password. This is not the first time this has happened, but this time it was a real hack, rather than a blend of real hacks and “false alarm” blast of emails like last time. Way to start off our weekends, Twitter. Who knows if you’ll even get the email from Twitter about it, I know that I filter all of those things out. You can read all of the details about the hack and the company response here. I find it really confusing when anything like this happens, because it feels like companies try to diminish the perception of the impact of the situation. Fact of the matter is, its users are seeing sad tweets from their friends about how they got hacked. I even had one person tell me that they felt like they weren’t cool enough because they didn’t get hacked. Instead, or in addition to, just go change your password. We’re all cool enough to get hacked. The number, 250K affected, seems a bit too tidy to me, and I’m not saying that Twitter is lying, I’m just saying that it’s better to be safe than sorry. Twitter also suggests this course of action, which is way too much for most people’s brains to process on a Friday: We also echo the advisory from the U.S. Department of Homeland Security and security experts to encourage users to disable Java on their computers in their browsers. Sure, OK. Happy Tweeting (Maybe)! While you’re at it, change all of your passwords for everything. It’s a good thing to do once in a while, especially if you use the same one for every single site you log into. [Photo credit: Flickr]
TechCrunch

‘Andyhave3cats’ is a better password than ‘Shehave3cats,’ study finds

A password made up of a phrase or short sentence may be more secure than a carefully constructed long one, countering the recommendations of some security experts.
Computerworld News

Bad Grammar Make Bestest Password, Research Say

An anonymous reader writes “NewScientist reports, ‘Along with birthdays, names of pets and ascending number sequences, add one more thing to the list of password no-nos: good grammar.’ Researchers from Carnegie Mellon University seem to have developed a password cracking algorithm that targets grammatically correct passwords. Can bad grammar really make your password secure?”

Read more of this story at Slashdot.




Slashdot

Google taps Yubico for password USB rings of the future

This week it’s been revealed that Google is getting pumped up about working with the company known as Yubico with intentions of creating a sort of “Password Key” that exists in a USB plug around your finger. The report that’s about to be published in IEEE Security & Privacy Magazine is bringing word from Google

Read The Full Story
SlashGear

Google’s password proposal: One ring to rule them all

In a forthcoming paper, Google engineers float the idea of supplementing passwords with hardware you wear. Or carry. Or slip onto a finger. [Read more]


CNET News

Google sees one password ring to rule them all

Google thinks it might have found an answer to the vexing problem of forgotten or weak passwords: "physical" passwords, which might come in the form of a piece of jewelry such as a ring.
Computerworld News

Google’s Alternative to the Password

Life would be more secure if we used USB sticks, or even jewelry, to log into computer accounts, suggest Google engineers

Google is using its workers as guinea pigs in an effort to do away with the password as the vulnerable lynchpin that secures everything from social media profiles to bank accounts.







New on MIT Technology Review

The Difference Between A Vulnerability And A Moron Using Google Services Trying To Phish Your Password

1276202472_ce7e194cf2_oToday, The Next Web covered a post about a potential XSS “vulnerability” on Google’s app and gadget hosting services used on Google-hosted domains. Bunk.
TechCrunch

Skype Disables Password Resets After Huge Security Hole Discovered



another random user writes with news of a vulnerability in the Skype password reset tool “All you need to do is register a new account using that email address, and even though that address is already used (and the registration process does tell you this) you can still complete the new account process and then sign in using that account Info (original post in Russian)” concealment adds a link to another article with an update that Skype disabled the password reset page as a temporary fix.

Read more of this story at Slashdot.


Slashdot

Replacing Your Password with a Finger Swipe

The new device could transmit a user-specific ID through the skin.

Touching and finger-swiping are the dominant method of navigating on hundreds of millions of smartphones and tablet computers. The same touch might soon confirm your identity, too.







Technology Review RSS Feeds

Blizzard Entertainment warns of password breach

Blizzard Entertainment, maker of popular multiplayer online games such as World of Warcraft, Diablo and Starcraft, warned on Thursday that its internal network was breached, revealing scrambled passwords and email addresses.
Computerworld News

New Mac Trojan Installs Silently, No Password Required



An anonymous reader writes “A new Mac OS X Trojan referred to as OSX/Crisis silently infects OS X 10.6 Snow Leopard and OS X 10.7 Lion. The backdoor component calls home to the IP address 176.58.100.37 every five minutes, awaiting instructions. The threat was created in a way that is intended to make reverse engineering more difficult, an added extra that is more common with Windows malware than it is with Mac malware.”

Read more of this story at Slashdot.


Slashdot

Fake Password Reset E-mail Hits 7,500 Black Hat Registrants



An anonymous reader writes “7,500 Black Hat USA 2012 attendees may have been surprised to get a fake password reset e-mail sent to accounts they used to register for the conference. Black Hat has apologized and explained the lame phishing spam attempt.”

Read more of this story at Slashdot.


Slashdot

Yahoo strengthens security in aftermath of password breach

It’s been a harrowing few days for Yahoo. Earlier this week, the Yahoo Contributor Network became the victim of an SQL injection attack, with the hackers taking 450,000 email addresses and passwords with them when they left. Today, Yahoo says that it has put additional security measures in place in the aftermath of the attack,

Read The Full Story
SlashGear

How to create a picture password in Windows 8

Tablet and PC users alike can create a picture password in Windows 8 as a visual way of signing in. Here’s how:
[Read more]
CNET News

KPN closes portal after finding most corporate customers use default password

KPN closed a self-service portal for corporate ADSL customers on Tuesday after it discovered that 120,000 of its 180,000 business clients were still using default passwords, all variants of "welkom01," a company spokesman said Friday.
Computerworld News

LinkedIn posts update on password leaks

Blog post addresses what company is doing to protect members after millions of user passwords were discovered online.
[Read more]
CNET News

LinkedIn Password Leak: Salt Their Hide



CowboyRobot writes “Following yesterday’s post about Poul-Henning Kamp no longer supporting md5crypt, the author has a new column at the ACM where he details all the ways that LinkedIn failed, specifically related to how they failed to ‘salt’ their passwords, making them that much easier to crack. ‘On a system with many users, the chances that some of them have chosen the same password are pretty good. Humans are notoriously lousy at selecting good passwords. For the evil attacker, that means all users who have the same hashed password in the database have chosen the same password, so it is probably not a very good one, and the attacker can target that with a brute force attempt.’”

Read more of this story at Slashdot.


Slashdot

What the password leaks mean to you (FAQ)

CNET helps you make sense of the password fiasco that has hit LinkedIn, eHarmony, and Last.fm.
[Read more]
CNET News

LinkedIn Working With Law Enforcement On Password Leak, Says User Email Logins Haven’t Been Published

linklockIt’s been over 24 hours since LinkedIn revealed that “some” of their users’ passwords were indeed compromised in that massive leak, and while the investigation is still on going LinkedIn director Vicente Silveira once again took to the company’s blog to update their users on the situation.

First things first, though there’s still no word on how many users were affected, Silveira points out that as far as the team can tell none of the email addresses that correspond to those dumped passwords have been published.
TechCrunch

Dating site eHarmony confirms password breach

The online dating site eHarmony confirmed late Wednesday that passwords for its members were exposed in a breach, a second major compromise following LinkedIn's password exposure.
Computerworld News

Why LinkedIn’s Password Leak Endangers Security Across The Web

Hackers can now access the many sites on which we used the same password as LinkedIn.

Using the same password over and over again, across many sites, is extremely common. We’re not sure how common — estimates range between 10 percent and 50 percent of all passwords are re-used — but I would be shocked if more than a small portion of LinkedIn users hadn’t re-used their LinkedIn password at least once.







Technology Review RSS Feeds

University of Cambridge conducts largest-ever password study

Do you have a weak password? Probably. Even if you think your password can’t be hacked, there might be a good chance that a lot of other people thought the exact same thing and chose a very similar password. These are the results from Joseph Bonneau at the University of Cambridge, who analyzed passwords from

Read The Full Story
SlashGear

Ask Slashdot: Open Source Multi-User Password Management?



An anonymous reader writes “I work in a network environment that requiring multiple people have access to numerous Wireless Access Keys, iTunes/iCloud accounts/passwords, hardware appliance logins, etc. Attempting to replace the ever popular ‘protected’ excel spreadsheet that exists in almost every network with all usernames and passwords just waiting to be discovered. Are there any open source, multi-user, secure and preferably Linux based password management tools that the slashdot community would recommend?”

Read more of this story at Slashdot.


Slashdot

Microsoft fixes Hotmail password glitch

Microsoft has quashed a glaring bug in its Web-based Hotmail email software that allowed Firefox users to easily reset the password another user’s Hotmail account, effectively locking them out of access to their own email. Luckily, it seems like it was a pretty simple fix because it went from being discovered to being patched in

Read The Full Story
SlashGear

Researchers suggest haptics and audio for discreet password input

Researchers suggest haptics and audio for discreet password input

You can use as complex as a password as you like, but that won’t do you much good if someone’s able to watch or record you entering it. Researchers Andrea Bianchi, Ian Oakley and Dong-Soo Kwon have some ideas for overcoming that little problem though, and recently put together a video demonstrating a few of the possibilities they’ve come up with. All of those rely on haptic input systems — either on their own or in conjunction with some audio output (through headphones for privacy). That includes things like a dedicated haptic keypad or haptic wheel, and different methods that could take advantage of a haptic display on a smartphone. As you can see in the video after the break, some of those options could be a bit more time consuming than an easy-to-remember password, but there’s certainly plenty of potential applications where security would trump convenience.

[Thanks, An]

Continue reading Researchers suggest haptics and audio for discreet password input

Researchers suggest haptics and audio for discreet password input originally appeared on Engadget on Mon, 09 Apr 2012 02:06:00 EDT. Please see our terms for use of feeds.

Permalink   |  sourceIEEE Computer Society, YouTube  | Email this | Comments
Engadget

Scientists Release Working Prototype Of CAPTCHA-Based Password Assistant



An anonymous reader writes “Last year Slashdot ran a story on scientists from the Max-Planck-Institute for Physics of Complex Systems in Dresden, Germany developing a novel method to improve password security. A strong long password is split in two parts; the first part is memorized by a human, and the second part is stored as a CAPTCHA-like image of a chaotic lattice system. Today, after a year of work, the same group at Max Planck Institute released an working prototype online, where everybody can try this technology to encrypt files (Java plugin required).”

Read more of this story at Slashdot.


Slashdot

Teacher’s Aide Fired For Refusing To Hand Over Facebook Password



An anonymous reader writes “You can add this one to the short but growing list of employers demanding access to Facebook accounts. After refusing to give her Facebook password to her supervisors, Kimberly Hester was fired by Lewis Cass Intermediate School District from her job as an aide to Frank Squires Elementary in Cassopolis, Michigan. She is now fighting a legal battle with the school district.”

Read more of this story at Slashdot.


Slashdot

Facebook: No “immediate plans” for password legal action

Facebook may have updated its policies to stop employers demanding user’s passwords for the social network, but the company says it has “no current plans” to follow through on the legal action it originally threatened. The change to the Facebook Statement of Rights and Responsibilities followed widespread reports earlier this month that some companies were requesting access

Read The Full Story
SlashGear

Throwing Light On Elcomsoft’s Analysis of Smartphone Password Managers



An anonymous reader writes “Security firm Elcomsoft analyzed 17 iOS and BlackBerry password-keeping apps and found their actual security levels well below their claimed level of protection. With additional digging, however, Glenn Fleishman at TidBITS found that Elcomsoft’s criticisms rely on physical access to the apps’ data stores, and, for some of the more common apps, on the user employing a short (6 characters or fewer) or numeric password. In other words, there really isn’t much risk here.”

Read more of this story at Slashdot.


Slashdot

DIY password dongle logs you in, saves you from RSI (video)

Password USB dongle

Any of you who have spent time in corporate America know that companies can be pretty paranoid about your passwords. Change them every three months, have a minimum of one upper case and one lower case letter, one number, one special character and be at least 12 characters long. We’ve even seen requirements for how many characters must be different from one password to the next. Joonas Pihlajamaa apparently got tired of trying to keep up and built himself a USB key, based around an ATtiny85, that automatically inputs a password for him when plugged into a computer and can even generate a new one with just a few key presses. You can see it in action after the break or hit up the source to learn how to build your own.

Continue reading DIY password dongle logs you in, saves you from RSI (video)

DIY password dongle logs you in, saves you from RSI (video) originally appeared on Engadget on Mon, 05 Mar 2012 20:50:00 EDT. Please see our terms for use of feeds.

Permalink Hack a Day  |  sourceCode and Life  | Email this | Comments
Engadget

Hacker on hacker: Zeus bot master dupes Anonymous backers into installing password stealer

Hackers have duped supporters of the Anonymous group into installing the Zeus botnet, which steals confidential information from PCs, including banking usernames and passwords, security researchers said last week.
Computerworld News

Trustwave finds most common business-compliant password is Password1

It appears that even requiring users to implement hard-to-hack password requirements doesn’t prevent them from being as generic as possible. In a study of more than 2 million systems, Trustwave found that, not surprisingly, the most common password was “password,” or some variation thereof. And among systems that required an upper-case letter and a number, [...]
SlashGear

Note to self: Encrypt data, memorize password

Court rules that prosecutors can’t force people to decrypt data that could potentially be used against them.
[Read more]
CNET News

Google Chrome Password Generator tosses logic in the trash

There’s a feature coming out in a future version of Chrome (either the browser or the OS or both) which will generate a password for you, one “impossible” for a human to remember, and sync that password across your Chrome account. The reason this method is terrible, I must explain, is that unless this generator [...]
SlashGear

Google Working On Password Generator For Chrome



Trailrunner7 writes “Google is in the process of developing a tool to help users generate strong passwords for the various and sundry Web sites for which they need to register and authenticate. The password-generator is meant to serve as an interim solution for users while Google and other companies continue to work on widespread deployment of the OpenID standard. The tool Google engineers are working on is a fairly simple one. For people who are using the Chrome browser, whenever a site presents them with a field that requires creating a password, Chrome will display a small key icon, letting the users know that they could allow Chrome to generate a password for them.”

Read more of this story at Slashdot.


Slashdot

Hacked Syrian Officials Used ’12345′ As Email Password



Nominei writes “The Israeli newspaper Haaretz reports that the Syrian President, aides and staffers had their email hacked by Anonymous, who leaked hundreds of emails online. Reportedly, many of the accounts used the password ’12345′ (which their IT department probably warned them to change when the accounts got set up, of course).”

Read more of this story at Slashdot.


Slashdot