Reminder: Change Your Passwords (Now and Often)

s0ap

s0ap

Regular Member
Joined
Sep 23, 2008
Messages
218
Reaction score
847
In light of recent events, I want to take a second to advise all our members to change their passwords. While we should all be doing this frequently anyway, complacency can and does cause us to do things that may otherwise be common sense. I would also recommend changing any shared passwords that you may have used for BHW and other sites/services.

Here are a few tools if you need help coming up with a new password:
http://www.pctools.com/guides/password/
http://keepass.info/

As we continue to sort out the extent of the damage and the attack vector used, I remind you that due diligence is your responsibility alone. If you receive any email or other correspondence from staff members or administrators that you consider suspect, please bring it to our attention before proceeding. The BHW IRC server is an excellent resource for this as there is almost always two or more staff members online at a given time.
 
Advertise on BHW
I got a reminder email from BHW, had realised I hadn't changed my pwd for a VERY long time! For any web application that involves user interaction, NEVER forget to add salts to every password a user registers with - and encrypt them using SHA1 or SHA2 encryption. Also for forms make sure forms have some kind of token to help mitigate CSRF and XSS attacks. For any of my work that includes serverside interaction - be it php, ruby or asp, I always make sure this is done before rollout.

I know that most people would already know this, but just some friendly words of advice to noob web developers :).
 
I using lastpass for my password management, and it's free.
Code: 
https://lastpass.com/
 
Security is a very sesitive matter. If your important information get hacked you will be in great trouble. So follow the advice.
 
This can't be said enough: Use different passwords for every account you have, everywhere. Change those passwords at least once every 30 days. Use the most sophisticated passwords the system will allow, including special characters, alternating caps, and spaces where available.

I personally use keepass, with the browser plugins for automating credential input. I disable the browser storage of logins, and run all portable apps inside a sandbox, stored within a truecrypt container. Using a password manager allows you to use ridiculously complex passwords without having to remember them, and helps prevent you from falling into the habit of using the same credentials for multiple sites. It's also damn handy when it comes to rerolling passwords on a regular basis.
 
Thanks for the advice Soap. I usually change them each month. But better safe then sorry guys.
 
BleemZ said:
This can't be said enough: Use different passwords for every account you have, everywhere. Change those passwords at least once every 30 days. Use the most sophisticated passwords the system will allow, including special characters, alternating caps, and spaces where available.

I personally use keepass, with the browser plugins for automating credential input. I disable the browser storage of logins, and run all portable apps inside a sandbox, stored within a truecrypt container. Using a password manager allows you to use ridiculously complex passwords without having to remember them, and helps prevent you from falling into the habit of using the same credentials for multiple sites. It's also damn handy when it comes to rerolling passwords on a regular basis.
Click to expand...

Good Information bz. I am going to give this a try as well.
And thank you sOap for the good insight!

RedClover
 
I had to format my laptop yesterday because of all the dodgy stuff going around at the moment!
 
Very, very useful advice. As for me, I store every password offline in a notebook with encrypted writings. If I have to change them, then I just stroke the old ones. I keep those notebook around my desk but so far no one bothers to look at it (I know because I will notice if someone has touched it). Any time I need to need to come up with a new password, just use creativity with a little bit of paranoia and come up with the most ridiculous password.
 
I already need to maintain a spreadsheet to keep track of my passwords. :p
nice post.
 
Security is one of the major concerns of todays world. So to be secure you need to change your password very often or you should use any complex password that contains alpha,numeric and symbols.
 
Yes, it is absolutely true and its our response to keep our accounts safe rather than blaming developers.
 
Well this explains why I had to enter a new password when I logged on for the first time in a few months.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top