A passphrase is a longer password that typically consists of multiple words.

learn more… | top users | synonyms

3
votes
1answer
27 views

Change LUKS encryption key (not passphrase) without dataloss

You can change the LUKS passphrase without dataloss, but can you also change the actual key? I reckon you would have to re-encrypt the whole disk, but that would be acceptable to me. Background We ...
4
votes
1answer
63 views

Why use a passphrase for RSA key?

Today I generated my first key pair, so my knowledge here is - so to speak - very limited. On client side I am using Windows and to log in I use PuTTY and I used PuTTYGen to create the keys. Here ...
24
votes
5answers
1k views

Would turning a Diceware phrase into a sentence decrease its security?

Diceware passphrase lengths are on the rise - up to six or seven words now. The old adage that passphrases are easier to remember may be true for shorter phrases, but six truly random words can be ...
3
votes
1answer
46 views

Single randomly generated passphrase for both identity and authentication

There are questions about using a password only to identify and authenticate a user, rather than an email address or username plus password: Why do we authenticate by prompting a user to enter both ...
1
vote
2answers
116 views

Is it a good idea to combine words from different languages to increase a password's strength? [duplicate]

I was thinking of a way to generate a password that is easy to remember, but hard to crack, like the famous "correct horse battery staple" suggested by XKCD, also discussed here, and I've realized ...
72
votes
10answers
12k views

If I enter a password on the wrong site, should I consider it compromised?

I have recently started to make use of a password manager and good password practices. I have a different password for each site that I use. If I accidentally use the password from another site when ...
8
votes
1answer
178 views

Does eliminating the possibility of repeat words make Diceware passwords significantly less secure?

I read about Diceware passphrases and whipped up a little program to generate passwords in that style. I do this by taking the list of dictionary words to create passwords and "ordering them" by a ...
3
votes
1answer
32 views

Standard for Generating Multiple WEP Keys From a Passphrase

I've been reading a lot about WEP recently and why it was bad. To make sure I understand it, I've been writing scripts to show how it works and highlight its vulnerabilities. But I want to have a full ...
13
votes
4answers
2k views

How does correct grammar affect password security?

When using the XKCD password methodology, entropy is calculated solely on the basis of individual words, assuming that the individual words are independent. This is, of course, not necessarily a valid ...
3
votes
2answers
159 views

With openssl des3, what are the passphrase parameters?

I'm using OpenSSL's des3 tool to encrypt a file, e.g. openssl des3 -salt -k SUPER_SECURE_PASSPHRASE < inputFile > outputFile Everything's working, but now I have to choose a final, fixed ...
28
votes
2answers
3k views

Is it possible for my password to have more than one password combination?

Can my password have more than one password combination? I read up on physical combination locks (the lock you open with numbers) and I learned that a combination lock can have about 40 or more ...
11
votes
8answers
267 views

How to choose a password that I have to remember for a long time but do not use a lot

I have a scenario where I have to remember a password / keyphrase, which I will not be able to recover if I forget it, for a long time (probably more than 10 years). The problem is because this ...
2
votes
1answer
74 views

Strength of variable-length generated password

I am contributing to the Word Sequencer plugin for KeePass password manager, which can generate diceware-style passwords using a high-quality PRNG. Something in particular I'm working on is estimating ...
1
vote
0answers
30 views

Storing user private key paraphrase during session

We have a web application which is used to store secrets (passwords, pins etc) and share them to other system users. Currently for encryption we use AES with single encryption key, and all secrets ...
10
votes
2answers
1k views

How should I make diceware passphrases more memorable?

I find that truly random diceware passphrase, more often than not, either contain a word that is easily misspelled or has an order that is illogical. I think there are three ways to make a diceware ...
2
votes
5answers
761 views

passphrases - lowercase and dictionary words

Amid all the discussion about password length vs. complexity (summarized by the famous xkcd strip and the followup dicussion) I am trying to make up my mind about passphrases made up with dictionnary ...
1
vote
1answer
152 views

How to detect whether a GnuPG private key has passphrase on it from a script?

I've written a script to help our developers store a copy of their private keys without a passphrase inside our Puppet tree (not committed to Git) so our Vagrant boxes can use Hiera with eyaml + gpg ...
4
votes
4answers
4k views

Passphrase - what is it exactly?

Well, according to Wikipedia, this is a passphrase; A passphrase is a sequence of words or other text used to control access to a computer system, program or data. A passphrase is similar to a ...
0
votes
2answers
114 views

How much stronger does a paragraph/sentence based password becomes with random characters added?

I was reading some questions on here regarding the correct horse battery staple method, and the conclusion was that, assuming any words in the list of most common English words, every word adds about ...
-1
votes
2answers
82 views

Should I worry that passphrase length leaks information? [duplicate]

I have been thinking about how to generate random passphrases from a public dictionary of words (similar to XKCD/Diceware passphrases). One thing in particular I was thinking about is that the ...
7
votes
0answers
110 views

Which format of secret would be the most efficient for human memory? [closed]

I am talking about something-you-know identification factor. Examples of those formats are passwords, passphrases, pin-s, picture passwords ( ...
1
vote
1answer
529 views

Can you recover the password from ZipCrypto encrypted ZIP file?

I know that "legacy ZIP-crypto" is not secure and you can get at the contents of the file quite easily. Now the question is, can you also get at the password (assume this is a very long, very high ...
8
votes
1answer
62 views

GnuPG passphrase entry and X11 sniffing

Each time when I’m entering my passphrase in pinentry-gtk-2, every other X11 app may sniff it, as seen in $ xinput test-xi2 running in the background. What can be done about it? Or do I have to ...
2
votes
1answer
30 views

What will happen if my GnuPG passphrase is discovered?

Hypothetically, should I be concerned if someone has my public key and knows my passphrase? Will they be able to decrypt messages sent to me?
18
votes
5answers
683 views

What concrete parameters can I change to make my passphrase-protected private gpg key more secure

There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever. Rather than ...
1
vote
1answer
485 views

Does AES 256 encryption support a master key and generated (time-bombed) keys?

I have a scenario where semi-sensitive [1] data for a corporate web application is to be stored in the browser's localized storage (Indexed DB to be specific, via JavaScript). The intention is to ...
1
vote
1answer
104 views

why are passphrases not the standard

I have seen many questions concerning passwords: how to measure password strength, why don't we pick passwords for the users and obviously the best one: passwords vs phrases and the one i would like ...
2
votes
0answers
110 views

Is there any merit to the RFC 3414 (SNMPv3 User Security Model) password-to-key method?

RFC 3414 (published 2002) specifies a method of generating keys based on password in its Appendix, which essentially takes any "passphrase", and keeps on repeating it until there is a 1MB string, at ...
3
votes
2answers
1k views

Expiration / enforce change of passphrase for private ssh keys

Out of curiosity, and also to check whether this is doable at all: Is there any way using standard tools to assign an expiry date [only] to the passphrase of an ssh private key, or to enforce the ...
1
vote
3answers
261 views

cleartext passphrase for keystore

How is passphrase for a keystore to be stored? we have all passwords encrypted and the key to encrypt is stored in keystore , so how is the passphrase for the keystore to be stored? in clear text? if ...
7
votes
2answers
203 views

Realistically, how much added security does having a passphrase on a ssh key have?

Let's assume ssh key brute force is unrealistic. It seems to me your greatest vulnerability would be someone gaining access to a client filesystem. If that's the case then key loggers and a host of ...
3
votes
2answers
921 views

LUKS, how to make strongest possible and reasonable passphrase?

Let us say I have a volume encrypted under LUKS with a 512-bit key. That would mean there are 2 ^ 512 possible values which the key may be. Now I need a passphrase which is at least as resistant to ...
11
votes
2answers
2k views

Would an unnecessarily long password degrade performance of a WPA2 wireless network?

My friend wants to keep his home network super-secure, due to some trouble that he's had with unwelcome Wi-Fi intruders. So, naturally, he devised an ultra-long WPA2 passphrase (on the order of 100+ ...
1
vote
1answer
380 views

What does the SSID have to do with a networks security concerning rainbow tables?

I have noticed in a few places people mention that if a popular SSID is used, it makes a network more vulnerable to rainbow table attacks. I saw this in one location and assumed they'd mistakenly used ...
0
votes
1answer
172 views

Are there best practices concerning application account credentials?

I am looking for best practices concerning application account credentials. For example, suppose I got a corporate application which uses an Active Directory application user account to communicate ...
1
vote
1answer
113 views

SSH key passphrase update and multiply locations

I have a ssh key which I use to upload code to github. the private key is located on several locations from where I upload/download data. I wonder how can I update (or expire) old keys after I update ...
7
votes
3answers
8k views

SSL Certificate - is passphrase necessary and how does apache know it?

I want to generate a Certificate Signing Request for my server and in order to do so, I first need a secure private key. When I create a private key by using openssl genrsa -des3 -out server.key 2048, ...
24
votes
1answer
7k views

Can a dictionary attack crack a Diceware passphrase?

Everyone knows the words used in Diceware passwords (all 6^5 = 7776 words are published) -- they're all common words. Everyone seems to know that we're not supposed to use dictionary words for ...
4
votes
2answers
472 views

XKCD-like passphrases to stdout

I'm trying to find a way to crack XKCD-like passphrases (correcthorsebatterystaple) from word dictionaries. Basically concatenate X number of words from a dictionary file. Right now it honestly ...
5
votes
3answers
397 views

How secure is this method to remember security questions?

So I found an interesting method of remembering those pesky security questions. Basically, the guy takes a hash of the question (IE what is your mother's maiden name?) and then appends his own ...
-4
votes
7answers
2k views

Are passwords made up from concatenating a few foreign words better than shorter random characters? [duplicate]

Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example: "pussiMeansCatInEskimo" "caballoMeansHorse" "CatIsGatto" "SalopeMeansBitch" ...
0
votes
4answers
407 views

How long does a passphrase have to be to be as secure as a random collection of letters, digits, punctuation, etc.?

If one uses a passphrase which is grammatical, such as "I put my keys under the doormat because they're safe there."... how many words (on average) must it contain to be as secure as a password with ~ ...
2
votes
2answers
452 views

Is it really “Time to add a word” if there are no tools to crack passphrases of 3 words and up?

It's "time to add a word" says Arnold Reinhold, the creator of Diceware, in his blog (3/2014). He advices to use 6 word sentences (or 5 words with one extra character chosen and placed at random) from ...
3
votes
1answer
2k views

find passphrase on encrypted ssh private key

I have an openssh encrypted private key. I don't remember the pass-phrase. I may be able to suggest words or patterns that may be in the phrase. I am looking for software that will help me recover ...
5
votes
3answers
3k views

What should I do if I type my password in the address bar, or type password in google search?

When someone accidentally types his or her password in one of the following three locations and presses enter, what should they do? username text box address bar Google search What do you suggest, ...
9
votes
2answers
2k views

How can a passphrase with 256 bits of entropy practically be constructed & memorized?

Quoting Wikipedia: A password with, say, 42 bits of strength calculated in this way would be as strong as a string of 42 bits chosen randomly[.] Assuming that interpretation is correct, combined ...
1
vote
1answer
156 views

Minimum SHA256'd UTF8 encoded passphrase length not stored anywhere

For a passphrase that is UTF8 encoded and then SHA256'd, what is the minimum length to achieve a practically collision free result? The implementation is for a 32 byte cryptocurrency ed25519 seed ...
16
votes
3answers
3k views

Is a passphrase-protected SSH private key susceptible to a dictionary attack?

If I have a passphrase-protected SSH private key, AND if this passphrase is sufficiently random and long (say, 20-, 30-, 40-characters long, or even more!), AND if I make this private key of ...
1
vote
1answer
349 views

how to use hash passwords to retrieve keys from keystore or access database

How do I hash the password for a keystore? How do I then use the hash to retrieve something from keystore? Similarly, how do I use a hashed password for accessing the database? I have encrypted the ...
2
votes
2answers
527 views

If I change my private key PGP passphrase, will the old private key+old passphrase work to decrypt already encrypted data?

Suppose I have a script that contains my PGP private key in plain text and requires me to manually type in the key passphrase to decrypt some data. Later, I decide that my passphrase is compromised ...