Tagged Questions
0
votes
2answers
110 views
Bruteforce Passphrase of Dictionary Words
Consider the all lowercase passphrase:
"lazy fox haggles treaty"
Assume all four words are in a dictionary of 2000.
Bruteforcing word combinations, how long does it take to crack this password at ...
4
votes
1answer
76 views
Could a password hash that's prone to more collisions provide better overall security?
Website security breaches seem to be a common occurrence, giving the attacker password hashes that he can conduct a brute force attack against, often given him a list of passwords that will work on ...
1
vote
2answers
123 views
Avoiding Brute Force Attacks in a Web Based Login Form
My login form uses Ajax so it doesn't need to reload if the password is wrong. A PHP script process the request and creates the session if the credentials are right. My idea is to have the PHP script ...
3
votes
2answers
135 views
Web & insecure HTTP - Using RSA for encrypting passwords on the client side
I used client side password hashing in my register and login project.
Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in ...
1
vote
1answer
198 views
Use brute force to mitigate brute force
Just an idea I had, and I am sure there is a lot of material about this subject, so I am looking for a pointer as to where I can find more information.
My idea is this...
When storing a password in ...
2
votes
1answer
426 views
How long it will take to crack a RAR password?
I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we ...
10
votes
2answers
284 views
Zip file with two password
I used this command to password protect a zip file on Linux :
zip -P 9000 hash.zip hash.py
and it creates the zip file just fine, then I wrote a program to test every possible password on it from 1 ...
10
votes
2answers
952 views
Why are GPUs so good at cracking passwords?
What is it about GPUs that lets them crack passwords so quickly?
It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
2
votes
1answer
95 views
Pointers for john the ripper rulesets
I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to ...
1
vote
2answers
187 views
Password Protected Zip: if attacker had one file, can use it to decrypt all files?
Consider a folder containing the following files:
(file1.txt, file2.doc, file3.pdf) all zipped and password protected, if attacker had one of these file, can use it for decrypting all without knowing ...
9
votes
3answers
1k views
Cracking MS-CACHE v2 hashes using GPU
As most people here will know, Windows caches domain/AD credentials in a format known as MS-Cache v2. Obviously, these would be excellent passwords to gain during a penetration test when local access ...
4
votes
4answers
293 views
Insecure to require numbers in passwords?
Earlier, I went to a site that required a number and special character, and it got me thinking – wouldn't that make the password easier to brute force? If you assume most passwords have around 12 ...
3
votes
2answers
199 views
is it easier to get the original password if you have multiple hashes of it?
Most users tipically use the same password for multiple applications. Let's say all of these applications hash the password in some way. Would it be easier for an attacker to get the original password ...
3
votes
0answers
275 views
Can an attacker guess my password length from a hash? [duplicate]
Possible Duplicate:
Possible to detect password length from hash? Is doubling your password adds more security?
Considering I do not provide him any personal information relating to it, are ...
6
votes
7answers
627 views
How can I prevent users from entering bad passwords in my web application?
There is a long discussion on whether it's the responsibility of the user or the system administrator to deal with the strength of the password. Obviously, the password is a very private thing, but ...
3
votes
5answers
503 views
Increased security with keepass
I am using keepass for securing passwords. I have a reasonable password, but if someone got hold of the file I am sure eventually they could brute force it.
I was thinking of using a key file as ...
6
votes
3answers
207 views
How much added security do I really get with a longer key size?
Imagine I have a cipher which supports keys of 128, 192 or 256 bits. Suppose that there are no vulnerabilities in the cipher regardless of key length. I'm going to use it to encrypt something, and ...
2
votes
2answers
277 views
Is a password easier to brute force if it contains a repeating pattern?
My question is different from this previous question: Does repeating one word to form a password result in a similar pattern in its encrypted format?. I'm specifically wondering about brute force ...
1
vote
2answers
262 views
Known password length, brute force character in place?
We all know that brute forcing is a very slow process and trying all unnecessary possibilities is dumb. By knowing the password length, we can skip trying possibilities of other password lengths and ...
4
votes
1answer
326 views
Can a Bitlocker To Go user pin be brute forced?
I have a external hard disk and protected a partition on it with Bitlocker To Go. I printed the recovery code but I lost it. I can't remember the user PIN either. If I could only know the first ...
3
votes
2answers
5k views
Remove Password Protection from XLS Document
Similar to what is listed here, http://datapigtechnologies.com/blog/index.php/hack-into-a-protected-excel-2007-or-2010-workbook/, is there a way to remove the password from an XLS (Excel 2003) ...
2
votes
3answers
297 views
How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)
After the hack of Mat Honan I studied my own laundry list of accounts I have at the numerous web sites I use. There is one fact that stands out:
Many of the websites severely restrict the size and ...
2
votes
2answers
243 views
Seeking advice on how to build a box to brute force hashes? [closed]
I work in a startup security firm, and I need to build a GPU-based to brute force password/hashes, which can be used to validate password strength and test hashing algorithms. I expect some high ...
1
vote
2answers
228 views
Hash, encryption of file… key? Need help [closed]
So my previous question was with some help on pcap files as I am doing a security course and we have a challenge to figure out what was going on in our network. Now one of the files I retrieved is an ...
-2
votes
6answers
335 views
Are passwords made up from concatenating a few foreign words better than shorter random characters?
Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example:
"pussiMeansCatInEskimo"
"caballoMeansHorse"
"CatIsGatto"
"SalopeMeansBitch"
...
3
votes
1answer
391 views
Reasonable (BruteForce) Attempts/Second Estimate?
I've read various articles on password strength and passwords vs pass phrases (including the one from XKCD and its thread here), but most of those articles seem to be focused on online passwords, and ...
17
votes
7answers
738 views
Are common passwords at particular risk?
The question Should we disallow common passwords like “password” and “12345”? on User Experience immediately made me think that these common passwords were extremely dangerous not because they are ...
2
votes
1answer
304 views
Academic papers on GPU password cracking?
Are there any scientific papers or publications on GPU password cracking?
0
votes
1answer
136 views
Stripping / appending characters from user password before hashing to conceal it forever?
I had this idea to permanently conceal user password by requiring minimum length then stripping certain characters. For example if the user password is secret123, the system will strip it down to ...
2
votes
2answers
276 views
Can key files be brute-forced like passwords?
Let's say you use a program like Truecrypt or Keepass which allows you to have a password + key file. I understand that passwords can be brute-forced/dictionary-attacked but is the same true for key ...
5
votes
2answers
189 views
Are more passwords breached via dictionary/bf attacks or via packet-sniffers/key-loggers?
This question has always intrigued me whenever the subject of passwords is brought up. Does anyone have direct experience or a reputable source to answer what percentage of password breaches are ...
5
votes
3answers
622 views
Can ssh keyfile security be broken in a few hours if the file is exposed?
At this link there is a claim that if an RSA key has a strong passphrase security might be broken in a few hours if an attacker has the private key.
Is there something weak about the security of RSA ...
17
votes
5answers
1k views
What's the practical limit for rainbow-table based bruteforce?
Say we have a hash of a password. The password can be considered to be made of of totally random characters and has a fixed length of N. The hash is SHA1(password+salt), where the salt is of length M. ...
3
votes
1answer
303 views
Non English password dictionaries
What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
4
votes
3answers
882 views
What are the odds of brute-forcing an archive with 256-bit encryption?
I have a file (a stand-alone archive). I lost the password to it, but it has been encrypted using 256-bit encryption. The password is some 20-odd characters long (including non-alphanumeric ...
3
votes
2answers
563 views
Known Password Lengths and security considerations
Many people wil often brag about the length of their password, like "yeah nobody is ever going to crack my password cause its 22 characters long." I was thinking, if you knew the exact length of their ...
2
votes
1answer
12k views
How long to brute-force WPA password?
Bob has a password (for his WPA encrypted wifi) which is 8 characters, all lowercase, and not a dictionary word.
Eve lives next door to Bob and wants to illegally hack his WPA. The number of ...
7
votes
3answers
403 views
It is possible that brute force attempts are successful before the worst case, correct?
When I read about a password being secure and stating that it would take X amount of week, years, etc. isn't that referring to the worst case?
What happens if the brute force method is successul in ...
2
votes
3answers
762 views
what is the fastest and cheapest way to crack this kind of hash - md5(md5($password) + salt))?
I'm looking for a program that can use any GPU (ATI\NVIDIA) and can brute force a vBulletin hash - md5(md5($password) + salt)).
I have the salt and hash.
the password contains the symbols - ...
9
votes
2answers
283 views
How much security is compromised if we accept other characters as login (other than the original password)?
I've just realised that facebook accepts 3 forms of a password:
Source:
Facebook actually accepts three forms of your password:
Your original password.
Your original password with the ...
5
votes
3answers
649 views
Attack vectors for brute-forcing website passwords
When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
4
votes
4answers
705 views
Brute-force heuristics used in password cracking
Existing questions on this site discuss some of the heuristics used by password cracking tools to avoid doing a completely naive brute-force search (for example, "dictionary word with number ...
6
votes
4answers
907 views
Password entropy in layman's terms
Entropy is a term used often in relation to password security and brute-force attacks, but it is a topic that can get complicated quickly. What is the best way to describe password entropy (what it is ...
17
votes
9answers
2k views
Best password strength checker
In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or ...
10
votes
4answers
400 views
Are there state-of-the-art techniques or theory specifically for attacking passphrases over passwords?
With passphrases becoming more and more common based on length being more important than complexity, I'm assuming there must be some work going on involving techniques aimed specifically at cracking / ...
12
votes
2answers
509 views
Are there some good papers (or discussions) on using Markov chains or Hidden Markov Models for password auditing/cracking?
As a programmer and language enthusiast I've been very interested in Markov chains for some time. Considering the influence of natural language on password and passphrase selection (by humans of ...
4
votes
4answers
1k views
Are there lists of most common words or ngrams used in passwords and passphrases?
I've been thinking about ways to focus brute forcing dictionary attacks on passwords and passphrases based on the assumption that certain words, combinations of letters, and combinations of words are ...
5
votes
5answers
1k views
What password cracking software is commonly used?
I am curious to know how secure my passwords are.
What password cracking software is commonly used?
Preferably open source.
EDIT: I am actually looking to crack my passwords used on services I ...
6
votes
2answers
1k views
Dictionary Attack on Wifi
I know a few people with pretty weak passwords. What kind of systems exist to prevent dictionary attacks? Would it make sense to restrict the number of connection attempts in a certain timeframe?
...
3
votes
2answers
1k views
Why limit passwords to ascii printable characters? [duplicate]
Possible Duplicate:
Do non-keyboard characters make my password less susceptible to brute forcing?
Every article on password security that I read tells people to make the password more ...
