This is a useful starting point if your company does not yet have an anti-hacking security procedure in place. Even if you know every one of these, odds are good that there are plenty of folks you know who have never given these steps a first thought, let alone a second.
Any suggestions for additions/changes to the list?
These are good tips, but I stopped reading when Siraj explained that HTTPS sites “don’t store your password on their servers.” This is good practice for any website, but not a guarantee of a website just because it implements HTTPS.
Looks like Samsung USA sends out its password resets in plain text. http://3mn.ca/3/v7
thank you for being the first person to point that out. SSL says exactly nothing about how passwords are handled. It does two things: 1) Encrypts the conversation (passwords and not) between your browser and the server implementing SSL, and 2) gives you a high degree of comfort that the server you’re talking to is the one you think you’re talking to.
SSL no more hashes passwords than it turns them into a yeti.
Honestly, there’s so much ignorance in the article, it’s almost a guide as to “why people who don’t know what they are talking about shouldn’t write articles about tech stuff”
This article really galls me in its ignorance. The stuff they present would never pass a baseline sec audit much less PCI-DSS. Not to mention companies of the size suggested by this article generally have a sec staff, ASAs, and a host of other tools that would make most of this “advice” moot. Dumb article is dumb.
Surprised? Not really.