Tag Info

New answers tagged

2

You should never be in a position to send a user their password. All passwords should be stored in a hashed format, with a sufficiently good hash function that recovering the original password is computationally infeasible. As for password resets, it depends on the application. If it's a web application, send a time-limited, use-once password reset link and ...


2

This is a terrible idea if there are no clear warnings on the example page. It encourages developers to put their secrets in their configuration files on their developer machines. Those files end up in version control, which is very, very wrong. The only location where configuration files might have secrets (see below about what I mean by secrets) is on ...


0

The complexity of password requirement should be balanced with the contents of your sites. A bank should require a highly complex password (uppercase, lowercase, number, and special characters). However, if the content is trivial, like saved searches and tracking numbers, the password requirement should be relaxed. Minimum length of 6 characters should be ...


1

In a nutshell, you are writing a program that reads information from a protected secure storage facility (so it can call external APIs). The secure storage facility itself has it's own authentication (username/password and possibly multi-factor authentication). And the key is that this authentication to the secure storage facility you want to persist ...



Top 50 recent answers are included