/explore
|
You are here 
|
honeypot.net | ||
| | | | |
pboyd.io
Here's a fun list to look through: Dumb Password Rules. Most of the rules seem arbitrary, like only allowing digits, but some hint at deeper problems. For instance, preventing single-quotes. They aren't inserting passwords into a database without a SQL placeholder, right? Nearly every site on that list has a needlessly short maximum password size. If they're storing passwords correctly, there's no need for this. This post will go through a few bad ways to store a password and you can see what I mean.... |
|
| | | | | ||
| | | | |
myers.io
Every so often I see posts on Stack Exchange, or Hacker News where someone has figured out that their passwords are being sent to the server and the server can see them! The logic that we see is that if the password is hashed client side, then only the hash needs to be sent to the server, so the server never knows the password. Unfortunately, I sometimes even see this go one step further when people suggest that with this arrangement, HTTPS isnt required. Wrong. |
|
| | | | | ||
| | | | |
kevquirk.com
Ever wondered how websites check your password? I mean, how can they check your password without being able to read it? It's a catch 22, surely? |
|
| | | | | ||
| | | | |
www.rasikjain.com
Here are three scenarios for implementing authentication workflows. Internet Applications (Public facing) For internet web applications and APIs, Session based (SessionID cookie) and Token Based (JWT) Authentication can be implemented. Session Based: Implemented for a majority of traditional and stateful web applications. Once the user is authenticated, A Session state is created and stored in an external State server or SQL database. The Session state is identified by a unique SessionID.... |
|
| | | |||
