Passwords are a secret word or string used to protect a resource by preventing access except to those users who hold the password. Questions tagged [password] are likely to refer to the strength of passwords, entropy, protection schemes such as hashing, appropriateness of password length and ...
3
votes
2answers
63 views
Standards for encrypting passwords in configuration files?
My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they ...
0
votes
2answers
60 views
Can the salt for PBKDF2 be a hash of the user-entered password?
I want to derive a key from a password in a client application that will be used as a master key that decrypts a data key. As far as I understand the salt should be private knowledge. Would it be ...
0
votes
1answer
61 views
Recover Word file password [closed]
I have a Word (.doc) file that I created a long time ago I believe in a Windows XP. The problem is I don't remember the password anymore and need to access the file. What would you recommend I do? I ...
2
votes
1answer
87 views
Academic papers on GPU password cracking?
Are there any scientific papers or publications on GPU password cracking?
12
votes
5answers
214 views
Is there any security risk in storing hashed variations of passwords?
For example, if hypothetically an application requirement was to tell users when their password might have failed because caps-lock was turned on, and hypothetically there was no way for the ...
2
votes
1answer
27 views
How to download PHI PDF from a secure website to a secure, encrypted folder on Windows 7?
Objective: HIPAA compliance.
Here is the process:
Receive PDF File through secure website
Open the PDF (Which involves downloading to some folder)
No longer need PDF
The Question:
Is there any ...
2
votes
1answer
106 views
Is BCrypt enough when saving a password into a database?
In order to allow users to connect to my website, I encrypt their password using BCrypt since it is one of the slowest algorithms to decrypt (making a compromised database longer to be decrypted).
...
1
vote
1answer
213 views
How can I decrypt traffic on a WEP encrypted network?
Lets say that I am connected to a WEP Access Point and I want to sniff all wireless traffic inside that network. How can I decrypt the traffic even though I don't have the cryptographic key?
I found ...
0
votes
1answer
60 views
Stripping / appending characters from user password before hashing to conceal it forever?
I had this idea to permanently conceal user password by requiring minimum length then stripping certain characters. For example if the user password is secret123, the system will strip it down to ...
2
votes
2answers
104 views
Can key files be brute-forced like passwords?
Let's say you use a program like Truecrypt or Keepass which allows you to have a password + key file. I understand that passwords can be brute-forced/dictionary-attacked but is the same true for key ...
4
votes
2answers
102 views
Are more passwords breached via dictionary/bf attacks or via packet-sniffers/key-loggers?
This question has always intrigued me whenever the subject of passwords is brought up. Does anyone have direct experience or a reputable source to answer what percentage of password breaches are ...
4
votes
2answers
83 views
What are the risks of storing passwords in a GPG encrypted file?
I currently store my passwords in a text file encrypted using GPG -e (specifying my own public key). When I want to lookup a password I'll do something like
gpg -d passwords.gpg | grep ...
-1
votes
1answer
71 views
What time do dictionary attack take on salted passwords?
I was reading that the designers of UNIX password algorithm used a 12 bit salt to modify the E-table of the unix hashing function (the DES). Supposing i have a system with 2^(24) users?
Is that ever ...
-1
votes
1answer
40 views
Number of time steps in TOTP [closed]
I am implementing TOTP in JAVA.Formula for number of time steps is T = (Current Unix time - T0) ÷ X.I have taken Current Unix time:long unixTime = System.currentTimeMillis()/1000L(1335246034) and T0 ...
5
votes
3answers
104 views
When form submission fails, password field gets blanked, why is that the case?
I've recently asked a question about blanking the password fields in UX for usability purposes, but It seems all the sites use this approach for security reasons. Why is it insecure to post back the ...
1
vote
0answers
35 views
Lastpass - Can I just keep the previous autofills? [closed]
I just installed the Lastpass Firefox plugin, and it seems like a useful tool thus far. The only thing that drives me crazy is that I am used to the Firefox saved passwords where it will show the last ...
14
votes
4answers
772 views
Why is using salt more secure?
Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
-1
votes
4answers
109 views
pesudo random password
I post a question before about one password repeating to make it longer, now its a new way want to ask about, if take the word 'secure' and instead of repeating it put somenumbers between it, exp: ...
6
votes
4answers
226 views
Will passphrases always be secure?
In a world where most people used passphrases instead of passwords, wouldn't an attack that generates a random string of words (alternating between word delimiters) be similarly effective to a brute ...
6
votes
5answers
316 views
Does repeating one word to form a password result in a similar pattern in its encrypted format?
If i use a single word to form a password by repeating it like the examples below:
securesecuresecuresecuresecuresecure
SeCuReSeCuReSeCuReSeCuReSeCuReSeCuReSeCuRe
...
1
vote
2answers
97 views
Using a tabula recta to store passwords
Reading an answer to another question ("Is there a method of generating site-specific passwords which can be executed in my own head?") I came across this link, describing a way to use a physical ...
4
votes
3answers
147 views
Can ssh keyfile security be broken in a few hours if the file is exposed?
At this link there is a claim that if an RSA key has a strong passphrase security might be broken in a few hours if an attacker has the private key.
Is there something weak about the security of RSA ...
0
votes
1answer
78 views
Securing communication
The problem:
I have an open-source client (a Firefox add-on written in JavaScript) and a server containing somewhat sensible user information: username and user history (all from YouTube). The client ...
5
votes
3answers
234 views
Password in file .php
My connection.php file stores the credentials to connect to the database.
<?php
$objConnect = mysql_connect("localhost","username","password");
mysql_select_db("selectDB", $objConnect);
...
3
votes
3answers
181 views
Are Three attempts to block login a good idea?
In the company that I work there is a security rule:
If you enter your password 3 times wrong, your login will be blocked!
Then I have to go to mainframe program and re-register my new password. ...
5
votes
3answers
151 views
What are some good ways to verify user identity for password resets?
I'm wondering how others verify the identity of users they're resetting passwords for. We currently try to speak to a manager at work, but it frustrates end users and seems like we don't trust them. ...
12
votes
3answers
434 views
What can I do if my bank thinks my date of birth is “known only to me”?
My bank has recently replaced passwords with occasionally asking me information that is "known only to me". Such information includes my date of birth, postcode, and my mother’s maiden name.
...
9
votes
11answers
671 views
Best practice for password distribution
I am about to set up a new account on my Linux server for a user that lives in another state in the U.S.
I can't think of a good way to get them this user their password. There must be a standard ...
4
votes
5answers
255 views
Email forgotten password or send reset link, both just as insecure?
I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
3
votes
1answer
129 views
Why does Windows 7 require a password hint during setup?
Correct me if I am wrong, but I think Windows 7 is the only operating system out there that requires a hint for the first user created on the system (have not had a chance to check out Windows 8 ...
0
votes
1answer
91 views
How can wireless router password encrypts data using WEP and WPA
How does the password that we enter (to connect to a wireless network) encrypt the data on the wireless network?
Through my reading I am not sure if the password that we enter is the same as the ...
6
votes
4answers
342 views
What's the practical limit for rainbow-table based bruteforce?
Say we have a hash of a password. The password can be considered to be made of of totally random characters and has a fixed length of N. The hash is SHA1(password+salt), where the salt is of length M. ...
1
vote
2answers
143 views
What are stolen passwords used for?
Say there is a line of business application which has username/password datatable in the DB. Personal email address is not stored, and usernames are assigned by an administrator. Someone gains access ...
3
votes
2answers
128 views
Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?
SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet.
I've read the information at it's Stanford University home page, the Wiki ...
4
votes
1answer
190 views
How will security need to be changed if P=NP?
If we suppose that it is found that P=NP, how will security measures need to be changed?
I'd like to know the major security measures that are affected, and how they would need to be changed. We can ...
-1
votes
1answer
79 views
How Does VMWare Protect Passwords? [closed]
I am interested what features VMWare uses to protect passwords inside the virtual machine.
1
vote
1answer
142 views
Please explain Time-step in Time-Based One-Time Password Algorithm
I am studying about OTPs (One Time Passwords). I have gone through all the methods: HOTP (HMAC-based One Time Password), TOTP (Time-based One Time Password)
I have no issues with HOTP. But according ...
4
votes
5answers
529 views
Is a longer WiFi password more secure?
Today I had to type the same password to connect to a WPA2-secured WiFi network several times, and got really annoyed with the length of the password. Especially since it is just a phrase repeated ...
5
votes
5answers
153 views
What are all of the issues with storing a cleartext password?
I know, I know, cleartext passwords are terrible and you should always store a hash!
However, I'm interested in all of the issues with storing cleartext passwords so I can make a reasonably secure ...
6
votes
2answers
140 views
Should an admin user be able to edit passwords?
For your typical web app, should an admin superuser have the right to edit a user's password, or should only that user have the right? (Even with edit ability, the admin would never see the current ...
8
votes
3answers
342 views
How can I promote good password practices in an organization that doesn't currently care about that?
I work with an organization that uses some very poor practices such as using default user accounts, default passwords (or passwords the same as user accounts), sharing password information between ...
2
votes
3answers
186 views
What is the recomended algorithm to create a key from a password?
In my new secret document encryption utility, the key for symmetric encryption = the hash of a random salt and a user provided password.
It is necessary to have a slow hash function in order to ...
7
votes
5answers
308 views
Using a weak password on a truecrypt volume
I have put together a portable apps USB stick for when I need to use random site computers, I also threw truecrypt on with an encrypted volume for some word documents.
The password I am using is ...
3
votes
2answers
258 views
AES Encryption: choice of password
I'm currently using AES encryption (at home) on GNU/Linux (one of LUKS AES-256 variants with xts) and on Windows 7 (Truecrypt) with a 15 characters password (alfanumeric undercase only plus _).
...
3
votes
3answers
145 views
Password Scheme
I manage about 20+ Linux servers and I am considering using an md5 scheme similar to following to generate the admin passwords:
echo 'masterpassword' 'serverhostname' | md5sum
Which returns ...
1
vote
1answer
92 views
How to implement WSS UsernameToken when password on the server is salted and hashed?
I'm currently trying to write a web service for customer and requirement is to use WS Security. On their server side, they have passwords stored as SHA-1(salt+password).
According to WSS spec, ...
2
votes
11answers
477 views
Definitely safest password storage scheme?
I already asked this on StackOverflow but I was suggested this would be a better suited place and I found no way to "move" the question so I have to copy it.
Believe, I know, there are hundreds ...
2
votes
2answers
172 views
Efficient and simple way of securing home pc with hardware token
I am looking for a simple but reasonably safe way to secure my home pc (and laptop, nas, etc.) with a hardware token. I would like the system to be secure, but practical enough to be used on a day to ...
5
votes
3answers
176 views
Is it OK to use the same password for a Linux login and the SSH private key?
I want to remotely log in to my Linux server with SSH. Public/private key authentication is more secure than password authentication, so I have disabled password-based authentication for SSH on my ...
2
votes
5answers
235 views
“Double hashing” with 2 different hash functions
Is doing something like this
sha256(sha512(password+salt))
Less secure then just doing
sha256(password+salt)
I've heard it will increase collision chances.
I can think of 3 reasons to do this
...
