Failing with passwords
Did a talk about implementing password security right last night at Five Minutes of Fame.
(Source: tersesystems.com)
Vía @schneierblog Crypto shocker: four of every 1,000 public keys provide no security (updated)
Más en http://www.schneier.com/blog/archives/2012/02/lousy_random_nu.html
“The cause of this is almost certainly a lousy random number generator used to create those public keys in the first place. This shouldn’t come as a surprise. One of the hardest parts of cryptography is random number generation. It’s really easy to write a lousy random number generator, and it’s not at all obvious that it is lousy. Randomness is a non-functional requirement, and unless you specifically test for it — and know how to test for it — you’re going to think your cryptosystem is working just fine. (One of the reporters who called me about this story said that the researchers told him about a real-world random number generator that produced just seven different random numbers.) So it’s likely these weak keys are accidental.”
Contraseñas basadas en imágenes: Microsoft’s “Picture Password”: A Breath Of Fresh Air On The Lock Screen, Of All Places | TechCrunch
Apple patenta un sistema de recuperación de contraseñas mediante el cargador de corriente. Vía @jagelado:
Apple patenta un sistema de recuperación de contraseñas mediante el cargador de corriente.
(vía Apple patent application details password-protecting power adapters | iPhone Atlas - CNET Reviews)
"When PuTTY has sensitive data in memory and has no further need for it, it should wipe the data out of its memory, in case malware later gains access to the PuTTY process or the memory is swapped out to disk or written into a crash dump file. An obvious example of this is the password typed during SSH login; other examples include obsolete session keys, public-key passphrases, and the private halves of public keys."
—
PuTTY vulnerability password-not-wiped
(Cuidado con las variables sensibles en los programas)
Google Remembers Your Old Passwords
No creo que recuerde las claves, sino más bien los ‘hashes’ o resúmenes de las claves, que no es lo mismo. En todo caso, es bueno saberlo….
