for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.

learn more… | top users | synonyms (1)

-1
votes
2answers
90 views

How secure is aes-256-cbc with a 40 char password

I'm using this command from this article to encrypt a file: openssl enc -aes-256-cbc -in /etc/services -out services.dat -k MYPASSWORD If MYPASSWORD is 40 characters in length, roughly how long ...
1
vote
0answers
105 views

Find salt from md5 hash if password is known

I have a salted MD5 hash and I also know the password. How can I recover the salt using tools like John The Ripper (I have JTR jumbo installed)?
-3
votes
2answers
68 views

How high is the security risk if a hacker got your wordpress wp-config.php file and a dump of your database?

If a hacker got a hold of your wordpress wp-config.php file and a dump of your database containing your hashed password? How hard would it take for them to easily cracked your password even if you are ...
51
votes
7answers
9k views

Is it possible to determine password strength without knowing the password?

I have just got some report of a penetration test and one of the recommendations was to strengthen passwords. I however realized that no passwords were provided for the testers, and I wanted to find ...
0
votes
2answers
86 views

Cracking WI-FI keys offline at distance?

Let's suppose I was able to get a handshake from my target's network ready to crack, but would like to crack the password far away from that network location. Would it be possible, or do I have to be ...
5
votes
1answer
111 views

Is Google's objective to kill passwords justified?

Google's Trust API has already been tested out in “several very large financial institutions” in June. It apparently uses a combination of multiple weaker indicators such as biometric indicators as ...
4
votes
1answer
79 views

How secure is a Windows 10 PIN not needing enter?

I've searched around about Windows 10 PINs and although have seen a few answers regarding the security of them as a whole, I haven't found any discussing the fact that when I type in my PIN, the ...
0
votes
1answer
35 views

Short integer hashes to mitigate timing attacks on passwords

Assuming we want to protect against timing attacks on our hashed passwords because even to know the hash may give to the attacker a significative advantage then we may want to perform a constant-time ...
0
votes
1answer
93 views

How to crack encrypted disk (crypto-LUKS) in an efficient way?

I had a disk encrypted by crypto-LUKS but forgotten password. I read a question posted here. LUKS HDD Encryption crack But before that I want to know if there's some free software I can use to ...
0
votes
3answers
75 views

Are there any security advantages to forcing a password-character limit on reset, but allowing unlimited character in password-login?

I was resetting a password a few moments ago, and I was given a character limit of around 10 characters to make a secure password with. After resetting the password, I went to enter my password, and ...
1
vote
1answer
55 views

Do these packages indicate nefarious activities?

Being security paranoid, I could help but notice that in my autoremove list that there were two packages I did not immediately recognise and was immediately suspicious of: The first one was ...
-6
votes
2answers
55 views

How to brute force this token in php, if it is possible

it is possible to brute-force this token (MD5 Hash) of the following script (PHP) in a realistic time (0,5h - 24h)? If the answer is YES, how could I do it, for example with PHP or Python? $time = ...
0
votes
2answers
71 views

How would I brute-force a Bitlocker recovery key?

I have imaged a hard disk and used passware, but to no avail - it says Encryption key External key, and not the actual key. How do you think I would go about brute forcing it? Lets assume I had ...
4
votes
1answer
84 views

Calculate GPU cracking time

Calculating the number of password attempts to crack a password seems fairly simple (John the Ripper - Calculating brute force time to crack password) as an example. What I can't figure out is how ...
0
votes
1answer
70 views

Is it safe to send the user's encrypted password back to them in the browser? Why?

I have planned to send the encrypted password from the application back to the user. I am currently using AES to encrypt user passwords. I want to send the user's encrypted password back to them in ...
5
votes
4answers
132 views

What are possible methods for calculating password entropy?

I noticed there are tons of questions and answers about password entropy on this forum, some even suggesting formulas for calculating it. None did answer my exact question. What are possible or ...
2
votes
2answers
71 views

Periodic password change needed when using 2-step verification?

I know that it's considered good online security hygiene to change one's login passwords every 6 months or so. Is that needed on sites with 2-step verification? Isn't the 2nd step what will keep my ...
14
votes
1answer
2k views

Understanding brute-forcing algorithms [duplicate]

I've been reading up on brute-forcing techniques and possible methods of prevention, but there is one issue that I haven't been able to find a clear answer to. The way I understand it, a 'simple' ...
-5
votes
1answer
132 views

Where do webstites store the hashes? [closed]

I understand that lots of websites store passwords in hashes but where do they actually store the hashes? How can a website compare your hashed version of a password with theirs? Is it stored ...
62
votes
5answers
5k views

Do 2FA sites leak info by confirming a correct password guess?

Here's my relatively layman's view of the issue. Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly. ...
0
votes
2answers
107 views

Secure password generation for different websites [duplicate]

I came up with the idea to generate passwords for internet sites by the following shema: $masterpassword $hostname $TLD hashfunction($TDL.$masterpassword.$hostname) So the actual password is a ...
8
votes
4answers
370 views

Is autocorrecting typos in passwords secure?

Technology Review's Why Autocorrect for Passwords is a Great Idea says: New research shows those frustrations could be avoided using the same approach used to fix typos in text messages and ...
-3
votes
1answer
38 views

need a help with creating a wordlist [duplicate]

i wanna create a 8 digit long password list containing simple & capital letters+all the numbers,but not with stupid passwords like all the 8 digits in numbers or simple or capital..should contain ...
1
vote
0answers
72 views

Opening a password protected PDF document with pdf2john

When I try to open the document with a reader I get prompted for a password. I tried pdf2john: root@kali:~# ./pdf2john.py test.pdf > hash.txt test.pdf : File not encrypted Is pdf2john only for ...
17
votes
6answers
3k views

Correct terminology when describing password security to layman

I am writing a page for our website which describes the measures we take to keep our customer's information secure. On this page one section describes how we keep their passwords secure. We are ...
-3
votes
2answers
97 views

Will hashing a password, and then splitting it into multiple db fields increase security? [duplicate]

I've been reading up on Password hashing, and it seems like there is a lot of opinions on "What's right." I'm curious about the possibility of storing a split of a Hashed password in multiple user ...
-2
votes
3answers
84 views

Is there something other than “if” and “else”

There are many ways for protecting a password like using strong algorithms like SHA-512, using salts, encrypting the database where the password is stored, packing the license file with UPX etc and ...
0
votes
1answer
163 views

Encrypt password with salt

Can anyone explain why formula 1 is safer than formula 2?I don't get it even I get the answer. According to 2, it says as s is in plaintext form, the attacker can decrypt the password by (y.s). Isn'...
2
votes
3answers
971 views

Is there a civilian friendly indicator of stored password safety?

As I understand it, by using one-way encryption we can protect stored password data in the event that they are stolen. Broadly speaking, password data can usually be cracked by guessing so the ...
0
votes
1answer
60 views

Use John the Ripper to permutate cases in one password?

I'm currently testing standard pentest stuff on a Windows XP SP3 VM. I managed to compromise it and saved the SAM file with the password hashes. I used ophcrack with the "fast and free" and "small and ...
0
votes
0answers
56 views

Passwordlist generation, permutations and long passwords

I was wondering what could be a way of generating a list where the passwords were like: CorrectHorseBatteryStaple BanjoTurtleNinjaHobo PizzaSurfMotherMetal etc... I already fiddled a little with ...
33
votes
12answers
9k views

Is it acceptable practice to only increment a number when changing a password?

Note: I'm not asking about this password scheme is the best or not (of course it isn't); I'm asking about its theoretical or practical secureness relative to the optimal password scheme based on the ...
5
votes
2answers
118 views

What are the risks of sending sensitive documents that are on physical media and password protected via postal carrier using registered mail?

Background The company I work for is extremely risk averse when it comes to adopting the use of cloud services for improving business flows. We currently use a very famous search company's business ...
-1
votes
2answers
83 views

How does a dictionary attack use it's “words”?

Does it assemble/concatenate the dictionary elements into candidate passwords, or does it just use the dictionary elements/words as passwords (which sounds strange)? I'm wondering about "SmartKey ZIP ...
3
votes
5answers
537 views

How secure is changing or adding a single character in your passphrase?

I'd wager quite a many people are required to periodically change their passwords for certain applications or even at the office. I'd also wager that a large percentage of these people "change" their ...
0
votes
2answers
58 views

How to properly hash a key? big vs small digest

We have to roll (decommission) database access keys often, but it's important to know which key each system is using in order to avoid removing a key in use thus creating unavailability. We want each ...
4
votes
1answer
112 views

Spoofing an NTP server to allow bruteforce on any smartphone

We all know that smartphones (i'll take iPhone as an example) rely on SNTP/NTP servers to update a device's time and date. So, by creating an SNTP server that mimics Apple's server, we can actually ...
3
votes
1answer
68 views

Is it possible to remove the password on new generations of Lenovo X1?

I have lost the password for my setup. I set it up a few years ago and now I cannot recall it. The supervisor password is not stored in an EEPROM so the usual tricks do not work. I think it is in a ...
0
votes
2answers
2k views

How hard is it to hack into a webmail account with a strong 8 character password?

Assume the hacker starts with only your email address and he has high incentive to gain access. UPDATE: Also assume the password is unique (never used elsewhere) and it is NOT a guessable word like ...
3
votes
2answers
124 views

What scenario are 'extra' strong passwords and hashing algorithms actually protecting against?

Note: I completely understand the need for strong passwords & I understand that there is an issue of speed with hashing. I am just interested in better understanding the actual negative impact of ...
2
votes
0answers
33 views

The optimal settings of Winrtgen GIU

I'm working with Winrtgen GIU on windows, but I can't fix the right settings to create a rainbow table for a: password length=1-7 Charset=alpha numeric all space What are the ideal values to put in ...
3
votes
5answers
637 views

Why can passwords be used to encrypt data, but are less strong for authentication?

Encryption software is often password based. Even if the adversary gets your computer they can't get the data without knowing the password, and bruteforcing is infeasible. Websites use passwords to ...
3
votes
1answer
559 views

Recover password from .pfx file

I have an old Windows SmartClient application that is published with a signed certificate (a .pfx file). We want to extend the expiration date to more than one year. I've used a program called ...
24
votes
5answers
1k views

Would turning a Diceware phrase into a sentence decrease its security?

Diceware passphrase lengths are on the rise - up to six or seven words now. The old adage that passphrases are easier to remember may be true for shorter phrases, but six truly random words can be ...
0
votes
1answer
306 views

How long will it take to break a salted password?

Let's say that I have a system where all passwords must be 8 characters long and each character can be any 32 different values. All my passwords are hashed with a salt. I can test 64 passwords per ...
81
votes
10answers
10k views

Is there a threshold for a password so long it doesn't get any more secure or even becomes insecure?

I always hear "A long password is good, a longer password is better". But is there such a thing as a "Password is so long it is becoming unsafe" or "Password is long enough, making it longer won't ...
6
votes
1answer
3k views

What is “NAND mirroring”, the alleged technique that the FBI will use to crack the San Bernardino shooter's iPhone?

According to Ars Technica, Jonathan Zdziarski, a leading independent Apple iOS security researcher and forensics expert, has a theory about the FBI's newly discovered potential route into the ...
4
votes
1answer
102 views

Is it possible to use parallelism when computing a key derivation function for a single password/key?

Suppose I have an AES-256 encrypted file, and I want to derive the key using PBKDF2 and a given salt with a large number of rounds (say 1 million), but I'm limited by user tolerance for UI lag when ...
46
votes
7answers
9k views

How are GPUs used in brute force attacks?

I have read that GPUs can be used in brute force attacks? But how can this be done and is there a need for any other hardware devices (hard disks for instance)? Note: I'm more interested in web ...
3
votes
3answers
152 views

password cracking: time vs cost

I often see people refer to arguments like: A (hashed) password will be cracked in 1.000 years if you use a normal desktop computer, but if you use 100.000 computers (botnet) it will be cracked in ...