full-disclosure - PassMark?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <9f08cff0606122128r1e64827en11e21f31a953fb91@mail.gmail.com>
Date: Tue Jun 13 05:28:35 2006
From: qballus at gmail.com (Q-Ball)
Subject: PassMark?

I would agree as well, having recently reviewed them with others in the same
field. Apart from relying on users to only enter their password if they saw
an image, the solution heavily relied on cookie usage. This works fine for
most people but a lot of corporate environments have persistant cookie
polices so this ends up being an annoyance and ineffective for this segment
of users. It also makes it susceptible to keystroke loggers due to the ease
of which the challange can be generated. I'd also have trouble justifying
this as anything other than a 2 x 1-factor solution and as such it may not
meet FFIEC guidlines.
The bigger issue, as with any other web based authentication solutions, is
what does this protect you against and the answer these days is not a lot.

Q-Ball

On 6/13/06, Randal T. Rioux <randy@...cyonlabs.com> wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: RIPEMD160
>
> Gary E. Miller wrote:
> > Yo All!
> >
> > I thought I'd actually risk a real security question here.
> >
> > Any one seen the "PassMark" (www.passmarksecurity.com) security system
> > in action?
> >
>
> Yes.
>
> Bank of Bangalore^H^H^H^H^H^H^H^H^HAmerica uses it, as well as a recent
> financial client corp. of mine.
>
> I'm not impressed with it.
>
> Randy
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.2.2 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQFEjjYIRrGMQdCNGUERA5rnAJ94fz+ll9VzSazzp0zfhha8BwQURQCfYch0
> o6/Swjo9ZIyc4Hsb7223koo=
> =s8LO
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060613/9d368d1a/attachment.html