Subject: Redeem: $25 Voucher

From: $25 Gift-Card <[email-masked]>
Date: Wed, 18 Jun 2014 13:07:33 -0700

Hello Atompub-archive,

Kohl's Cares Rewards: b5be7ca5dd14aeb21bc7ffdc0c5918e9

REDEEM YOUR KOHL'S CASH NOW

__________________________________

| Kohls Rewards |

Redeem Gift Card:

Card # 35472

Heres how easy it is to redeem Kohl's Cash:

Complete the 1 minute survey: HERE

Enjoy the GOLDSTAR Clearance Event

Regards,

Kohl's Rewards

To stop further notifications from Current Update Alerts

write to 1644 Doral Dr Brookings, SD 57006 or go here

o other way to save random number of nonce except save it to db? If the hacker can get hashed_password from db, sure he able to get nonce from db too zac1987 Jan 2 '12 at 18:18

Great revision. I've been using bcrypt for some time now, and I guess I'll start looking into scrypt for future projects. luiscubal May 25 '12 at 17:50

1

I think even emailing a new password in case of a lost one is a bad idea. Why not email a link to a secure site that allows the user to change his password? That's much more comfortable (no need to change the password after logging in with the random one) and more secure since no password went over the wire unencrypted - remember, users are lazy and chances are good that they do not change the random password. ThiefMaster Jun 11 '12 at 2:03

3

Sending a temporary password through email that requires the user to change it the first time they use it and sending a "secure" link over email that allows them to set their password are equally risky. In either case anyone who intercepts the email can access the account as long as they use the link or password before the intended recipient does. Tim Gautier Aug 2 '12 at 21:10

Regarding your most recent edit: "require at least 1 upper case letter, 1 lower case letter, a number, and a symbol" is in direct contradiction with the xkcd comic in the link. It shows an example of a password with no symbols, but high entropy. luiscubal Jan 5 '13 at 23:03

@luiscubal I'm not sure Randall is right, so I don't 100% endorse his suggestion though I've tried it. With lowercase/spaces your entropy is ~4.75/character, which for 28 characters is about 131-133 bits of entropy. But there's only four words there, with ~1 million words in the English language that's 1e+24 combinations versus upper/lower/symbols at 28 characters is 3.18855e+55 or so. Anyway, I'm not 100% convinced. Robert K Jan 7 '13 at 14:08

1

@RobertK Humans are imperfect random number generators, which greatly lowers the entropy in both cases. They won't pick a perfectly random [a-zA-Z0-9_%#]{28} sequence - they are more likely to just pick something like justinBieber28. luiscubal Jan 7 '13 at 14:26

@luiscubal You are correct. However a password manager that can do just that is invaluable. Which is the other problem with Randall's suggestion: his method produces pseudorandom combinations less random than our pseudorandom gibberish passwords. That's why it was only a suggestion of something to do. One's probably as secure as the other (for now). Robert K Jan 7 '13 at 16:04

@RobertK Note that he never truly checks the entropy of "complete gibberish", because people tend not to use complete gibberish for passwords. Computer-generated passwords can be much better than human-generated passwords, but how many people would just hit the "regenerate" button until they got something easy to remember? Or even tweak the result to be simpler? All that lowers entropy. luiscubal Jan 7 '13 at 16:12

@luiscubal I said a password manager not just a generator. I personally use LastPass to generate/remember passwords, and just make the best password I can to lock that service down. That keeps entropy high for other sites. As a user it's the best solution I've come across so far. Robert K Jan 7 '13 at 17:52

Just read the update, and it looks much better. Removing my -1. Perhaps it would be worth mentioning the new 5.5 APIs: php.net/manual/en/ref.password.php and the compatibility project: github.com/ircmaxell/password_compat And thanks for updating the answer ircmaxell Jan 14 '13 at 20:17

requiring at least 1 upper case letter, 1 lower case letter, a number, and a symbol will not improve the entropy of the password, it will just make it harder for people to remember. Popnoodles Jan 19 '13 at 16:19

@popnoodles By expanding the character set and the number of used characters it expands the bits of entropy per character, it does NOT safeguard against non-random passwords by users. Robert K Jan 21 '13 at 19:28

1