Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

-1
votes
1answer
30 views

Keeping passphrase away from telepahic interception

Assuming that someone is able to intercept telepathically thoughts and words in my mind, what mechanism will allow me to authenticate securely? A solution that does not yield to physical search or ...
-2
votes
0answers
14 views

Dictionary File Generator for download

I have seen in many different sites people searching by a good dictionary file or a good generator, I myself did that last week and didn't find good alternatives, so decided to code my own generator ...
-4
votes
1answer
77 views

Can a dedicated server provider access my data without knowing root password?

Is it possible for a service provider to access my data without knowing the root password? Is there a way to change the root password without ejecting the disk somehow? Update: I'm wondering whether ...
0
votes
3answers
50 views

How can I protect my WiFi if I have two routers?

I have a main desktop computer in my basement. It is connected to a modem box that my ISP gave me, which is also wireless. They also recommended a stronger wireless router, from Linksys, that would ...
3
votes
3answers
113 views

What can be done to secure passwords that might be stored in plain text or hashed inside a git repository?

I've heard a lot lately about coders being really bad at security. For one they store passwords and sensitive information inside Git repos which are often not secured well enough. Someone then comes ...
1
vote
1answer
56 views

Is Auth0 Passwordless Authentication secure?

I see this advertised Medium post about building a React application with passwordless authentication through Auth0. from the link, here is the explanation of how it works: Passwordless ...
0
votes
2answers
55 views

How come a controlledly generated password is more secure than a purely randomly generated one [duplicate]

In a software like keepassx, to generate passwords, there's usually the option to tick some boxes. For instance, a box that makes sure that at least 1 character from every lists of characters has been ...
0
votes
2answers
58 views

How can password mangers be secure? [duplicate]

I have been recommended to use a password manager, but I don't understand how it can be secure. Any passwords it saves have to either be stored in strings or encoded in a way that is easy enough to ...
4
votes
1answer
51 views

How does “password / keyboard-input protection” work?

I do own Kaspersky Internet Security (KIS) and BestCrypt Volume Encryption (BCVE) (unrelatedly) and both offer some mechanism (KIS) to "protect my passwords while I enter them". Kaspersky primarily ...
1
vote
1answer
55 views

Are UEFI vulnerable to the same password bypass techniques as BIOS?

I'm trying to understand if the old school ways of bypassing a BIOS password (flip the BIOS jumper or remove the CMOS battery) still affect (some or all) modern UEFI? If not, what protections do ...
0
votes
2answers
65 views

Security of picking unique passwords for users [duplicate]

I am learning more about security in web design so I can build more robust sites. As I see it password security is one of the main concerns, if a database is hacked then chances are passwords will be ...
3
votes
2answers
185 views

Does typing something in Notepad but not saving it leave any trace?

Sometimes, if I'm having trouble typing a long password, I'll open up Notepad, type it in their (so I can make sure what I'm typing is correct), and the copy+paste it into the form, and then close the ...
0
votes
1answer
41 views

I follow several common account security practices, how can I further ensure my information isn't compromised? [closed]

let me preface this: I am no Information Security expert. I apologize if I use any terms in a confusing and/or incorrect way. Recently, a recent YouTuber I am fond of was "hacked". It was less of a "...
2
votes
0answers
28 views

TapLink's architecture [on hold]

Can anyone describe how Taplink's proposed architecture would look like? I heard a very high-level pitch but found no detailed technical explanation. This is a proposed architecture to harden ...
-3
votes
2answers
108 views

Combination of Word and Notepad characters in passwords to Secret Agent [closed]

I have been trying to help a UK bank with its Secret Agent encryption program. I keep telling them they have problems with passwords as they use a variety of Notepad and Word, and if different ...
3
votes
1answer
90 views

Implementing an autologin link in an email [duplicate]

So I'm working on a PHP application called Magento and I would like to implement a link which will be sent in an email to customers that will automatically log them in. I know it is critical in terms ...
3
votes
0answers
21 views

Security concerns for long-lasting single use access tokens with secondary identity verification?

I have an application that has a user type that "returns as needed" over the course of 22 days to complete action items. The application handles sensitive/confidential information, but > 90% of users ...
2
votes
3answers
117 views

Email login accepts incorrect password if everything is correct except the last digit

A quick question - wondering whether this is an accepted security practice or why this would be possible. I use a Shaw.ca email (a Canadian service provider) and I accidentally mistyped my password. I ...
1
vote
0answers
50 views

Create reduction functions in rainbow tables

I have been trying to understand rainbow tables lately and one part is giving me trouble to understand here. Let's say I want to generate a table where the chains are 100 000 hash/plaintext long. I ...
3
votes
2answers
89 views

password requirements vs password storage options

Could the following password requirements be enforced, without keeping a plaintext/encrypted copy of the current password? The ######## password requirements are as follows: * Passwords must be ...
0
votes
1answer
51 views

Setoolkit - credential harvester, only display the first character of the password

I'm launching a spear phishing campaign and my client has specifically asked me to only harvest the first character of the password, is there a way to do so? Basically instead of showing the whole ...
3
votes
2answers
74 views

Would a Password Using All Possible Unicode Code Points Cause Problems in Traditional Hashing Algorithms, such as Bcrypt?

I've been toying around with this idea, but hypothetically, if you had a password manager that would use any possible renderable (e.g. not control characters such as BEL, NUL, DEL, etc., or surrogate ...
51
votes
7answers
9k views

Is it possible to determine password strength without knowing the password?

I have just got some report of a penetration test and one of the recommendations was to strengthen passwords. I however realized that no passwords were provided for the testers, and I wanted to find ...
1
vote
3answers
78 views

Why does Google require re-authentication before being able to start the password change process?

When a user wants to change the password for an account most web applications present a form where the user needs to enter the new password and the old password. So far I thought that I understood the ...
5
votes
1answer
110 views

Is Google's objective to kill passwords justified?

Google's Trust API has already been tested out in “several very large financial institutions” in June. It apparently uses a combination of multiple weaker indicators such as biometric indicators as ...
-4
votes
1answer
83 views

Does combining two encrypted strings secures password? [duplicate]

For example, a person having password 123456. it's MD5 is e10adc3949ba59abbe56e057f20f883e and SHA1 is 7c4a8d09ca3762af61e59520943dc26494f8941b and after joining both hashes. Which comes to be ...
0
votes
2answers
118 views

Why is it a problem to store strong passwords as unsalted hashes?

My users all have strong (80-bit true entropy) passwords. How do I know that? Because my imaginary website randomly generates the passwords for them (client-side). In that context, could you explain ...
1
vote
2answers
93 views

Can masked passwords on iOS UIs be read?

If someone had physical access to my iPhone, could they see the stored passwords for my WiFi or email that are represented as black circles and not actually the password itself, e.g. under my mail ...
17
votes
6answers
3k views

What extra security does a 2-step website login process with a PIN provide?

I am currently working on a web application with a significant security risk attached to its function. We're using Microsoft Identity Framework to handle user logins, with the system forcing strong ...
4
votes
1answer
131 views

Why, after a certain character limit, are larger passwords labeled as “weak” on some sites?

On many sites we see an indicator if our password is weak, or strong, to give us a good indication to go with that password, or not. I've been noticing on some sites, that after x amount of ...
0
votes
3answers
70 views

Are there any security advantages to forcing a password-character limit on reset, but allowing unlimited character in password-login?

I was resetting a password a few moments ago, and I was given a character limit of around 10 characters to make a secure password with. After resetting the password, I went to enter my password, and ...
1
vote
1answer
55 views

Do these packages indicate nefarious activities?

Being security paranoid, I could help but notice that in my autoremove list that there were two packages I did not immediately recognise and was immediately suspicious of: The first one was ...
5
votes
3answers
635 views

Is sending a password encrypted or as SHA1 any safer than clear text?

It seems to me that if an attacker can intercept my login request (sent with HTTP POST), then he can replay it later, no matter whether I try obfuscate it or not. What am I missing?
0
votes
4answers
98 views

How are salts safe in the database? [duplicate]

I have read many and many of this type of question on the security stack community before I asked this question, but one thing that made me mad about salts and saving it in database is this ... I will ...
0
votes
1answer
57 views

Should all web applications implement a security feature that stores historical passwords? [duplicate]

In addition to Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?. Facebook, and other companies, are storing historical passwords of ...
0
votes
2answers
96 views

Store passwords as integers

I just came up with this idea that I can store passwords as integers which take up 4 or 8 bytes as opposed to a hash that takes like 150 bytes or something. I wrote this function that converts a ...
2
votes
5answers
192 views

How secure is a password protected file?

I have a password-protected excel file that stores other personal passwords. Obviously there have been a number of ways to crack the password. community.spiceworks.com Where do you guys store ...
3
votes
2answers
97 views

Does a hash of a 32-bit integer make a better hash salt than the integer itself?

I have a scenario where I already have a table of resource passwords stored as unsalted 128-bit hashes. I'm unable to force owners to provide new passwords, so I'm trying to mitigate the situation by ...
-4
votes
0answers
47 views

Why would a website have a maximum character limit on passwords? [duplicate]

I was just about to sign up for a website but the maximum password length was 10 but I can't think of a rational reason as to why a site would implement it that way. Can you guys think of anything?
2
votes
2answers
675 views

Received an email about an “Etsy” Password Reset due to the “Linkedin Breach…” is this a phishing attempt?

I received an email today from Etsy saying they are resetting my password(from the source it looks like a mass reset of all users), due to there being some sort of Linkedin breach, that compromised ...
7
votes
2answers
438 views

Can viruses access passwords that have been saved by a browser?

Say I use Chrome on a new computer to log in to a website, and I select the option to have the browser remember the password. Then I download a straight-up smorgasbord of viruses of every kind. Can ...
2
votes
2answers
184 views

Is it better to choose less-vulnerable random password?

I have created a random password generator function (which can be found here if anyone wants a look), which will churn out passwords with a random mix of letters, numbers, and other characters. This ...
1
vote
1answer
75 views

How secure is the UNIX sha_crypt as a password storage algorithm? [duplicate]

So I have been working on password storage, especially on the algorithms to use (and to not use). Most people are recommending scrypt or PBKDF2 for valuable reasons, but I have not seen any talks ...
106
votes
5answers
14k views

What should I do about Gmail ad asking me for password?

I just got a pop-up after having logged on to Gmail. It said it was from https://googleads.g.doubleclick.net and asked for username and password. What should I do about this? Has anyone else seen ...
3
votes
1answer
67 views

What percent of publicly posted databases implemented password security?

I am trying to get some statistics on databases that were a part of data breaches, namely, I would like to be able to find out what percentages of publicly posted databases (from a data breach) had ...
4
votes
2answers
72 views

Is CHAP authentication still secure?

Assuming the use of the default hashing algorithm MD5, is CHAP authentication still secure? I appreciate that MD5 is considered broken in terms of collision resistance, but I also understand that in ...
5
votes
4answers
129 views

What are possible methods for calculating password entropy?

I noticed there are tons of questions and answers about password entropy on this forum, some even suggesting formulas for calculating it. None did answer my exact question. What are possible or ...
2
votes
2answers
71 views

Periodic password change needed when using 2-step verification?

I know that it's considered good online security hygiene to change one's login passwords every 6 months or so. Is that needed on sites with 2-step verification? Isn't the 2nd step what will keep my ...
-1
votes
2answers
77 views

Website says my new password can't be used because it is the same as an old one [duplicate]

What are the risks of storing (in hashes I guess) all the old passwords? Why would a company chose to not delete old passwords? Why not let users reuse old passwords?
7
votes
2answers
164 views

Is there any recommended approach for “upgrading” MD5 hashes to something secure? [duplicate]

I'm currently dealing with a couple of user accounts containing MD5 hashed passwords. These accounts got migrated from an old system into our current system which uses PBKDF2 for password hashing. I ...