Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
0answers
19 views

Full key space coverage when generating a rainbow table

Many rainbow tables available online have different tables for various character sets and lengths. Are tables like these usually completely exhaustive for those character sets/lengths? For such a ...
1
vote
2answers
32 views

Should a password ever be presented in plain text to a user (On a website)? Is this illegal under UK Data protections act? [on hold]

There is a website I use at work, external to our own. They have just presented with every employee with their plain text password and username via our internal website which requires our own logins. ...
-5
votes
0answers
38 views

Link to more active security sites? [on hold]

I have a BS/MS in Computer Science and have worked as a developer for 15 years. Currently I have been reading a lot about computer security. Serverfault and Stackoverflow seem to be the go to place ...
1
vote
1answer
29 views

Using a Cryptovariable with an API Designed for Human-Generated Passwords

I'm working with a vendor who provides an API with a user registration method clearly designed for human-generated passwords. We're calling the API in an offline server-to-server fashion, however, ...
-2
votes
0answers
19 views

How i can secure authentication with php? [on hold]

I have an identification with id and password , after the user enters the ID and password, then script php search in the database ( mysql) if the id and password exists in the table. Can you tell me ...
2
votes
3answers
98 views

Acceptably secure solution for users to log in with a short unique code only (no username)

I am creating a website whereby users are given an account by invitation only, and are sent a unique code by post. Users can then log in (at least the first time) by entering the code only. The goal ...
0
votes
0answers
45 views

Tools to create dictionary with word-combos? [on hold]

I'm studying to take a job as a pentester, and specifically how to crack wpa/wpa2 security. I've been able to use aircrack/airodump to capture a handshake, and I know at this point it's just a matter ...
4
votes
1answer
547 views

Is it a good idea to use two salts? [duplicate]

Is it a good idea to use two salts? This is implying that one would be unique to the user, and one would be unique to the server, using Bcrypt of course. So for example, if you're using Golang as ...
-2
votes
2answers
68 views

Password hashing and blowfish [duplicate]

What I'm about to say is probably going to make me look like an idiot but it's better to be wrong and learn than have unanswered questions. Ever since I started dealing with passwords I wondered what ...
0
votes
0answers
16 views

Best practise Managing Key Material Securely in Memory in android

I am aware of the issue of user entered pass phrases being left in memory if stored in Java Strings (due to String being immutable). Which takes me onto using char arrays. However, I am wondering if ...
87
votes
17answers
21k views

Is “password knocking” a good idea?

With port knocking, you have to "knock" on specific ports in defined order to expose a port on which service is running. How about password knocking? For example you have three passwords: A, B and C. ...
0
votes
1answer
83 views

Can Google's administrators be trusted with Google Authenticator? [duplicate]

Suppose there is an evil Google administrator who has full access to every server or network at Google. Will such a person be able to abuse the Google Authenticator technology to gain access to ...
2
votes
1answer
99 views

Is this a secure way to generate passwords at the command line?

Occasionally I need to generate a password while working at the Unix command line. I have the following alias in my zshrc: alias randpass='openssl rand -base64 32 | tr -d /=+ | cut -c -30' These ...
1
vote
2answers
47 views

Hashing password with salt [duplicate]

I read from wiki: The attacker has access to both the hashed password and the salt, so when running the dictionary attack, the attacker can simply use the known salt when attempting to crack the ...
3
votes
1answer
119 views

Best practices for passwords on registration?

I have a website which users register an account. On the registration field, the form fields are: Name Email Confirm email Username But there is no password field. When they hit submit, they are ...
1
vote
2answers
66 views

Is it safe to store a passphrase encrypted SSH key in git?

I have a bunch of servers that need to access somewhat sensitive data (passwords for ftps, api keys, etc). Currently I copy a plaintext file back-and-forth between the servers via ssh and encrypt all ...
27
votes
7answers
3k views

What is a good way to authenticate a user to a smart phone?

What would be a good way to authenticate a user to a smart phone? By good, I mean that it is both secure, and user-friendly. Passwords don't seem to be the best fit because a password needs to be ...
0
votes
1answer
36 views

MDM: Semi-Complex Password Implications [duplicate]

What would be the security implications if an organisation decided to impliment semi-complex passwords (one letter and one letter), and not fully complex. I'm thinking in terms of mobile devices and ...
4
votes
1answer
133 views

Is there a study on how many websites are saving passwords as plain text? [closed]

For a research paper about passwords, I am looking for a source that gives an actual estimation on how many websites save their user's passwords as plain text on their servers. Is there any study ...
1
vote
1answer
65 views

Cracking office documents and other hashes using clusters? [closed]

I'm trying to figure out how I should go about testing this I just got donated 18 older hp systems that have 4 gigs of ram, and intel core 2 duo processors I believe that they are the ones that came ...
3
votes
3answers
134 views

Is it good to not have keyboard-based sequences in our password generator?

If we have to write a password generator, is it a good idea to contain a "keyboard-based sequence" checker? So if the generated password is: asdf4%'Q!76342 Then this password will be rejected by ...
1
vote
2answers
96 views

Breaking mysql username and password form [closed]

I have two versions of a website. The first one has no security precautions against sql injections. So if I try something like: Username: hello_world Password: ' or ' 1=1 I'll be signed in as the ...
7
votes
1answer
186 views

Are these SSH passwords of hacked servers?

I have been seeing persistent SSH connection attempts on my computer from a familiar IP address. I got curious and decided to do some Googling on the IP address. Turns out that someone from Indonesia ...
2
votes
1answer
118 views

Security of Windows Screen Saver Password

How secure is the Windows screensaver password? Seeing that screen saver passwords are used in the corporate world, is there any way of bypassing the screen saver after it is already running? Could a ...
14
votes
6answers
2k views

What are the differences between an encryption seed and salt?

Today I had a hard time explaining the difference to a friend. I know seeds are used when generating "random" strings. And salts are used when providing different outcomes to a hash. What is a ...
1
vote
0answers
62 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
2
votes
1answer
57 views

HMACs that have the same key and message

im using HMACSHA256 to generate the hash of password and store it. the objective here is to just authenticate users, i.e - save their hashed passwords, and validate users whenever needed using the ...
2
votes
2answers
169 views

Combining SCRYPT + a short crc

I'm considering using SCRYPT for password storage. (I'm open to PBKDF2 as well, or bcrypt by itself). The issue is that I don't want this to become a potential point for a DDOS attack, given the ...
0
votes
2answers
226 views

Hashing request - What type of hash this?

I have a text which is hashed using several layers of hashing. The final hash looks like 2E55A1DD65AB839E62362DEF86D329D7. What type of hashing can it be? How can I find out what kind of hash sum I do ...
0
votes
0answers
19 views

Chrome/Youtube says incorrect certificate for host? [duplicate]

Why my Youtube always ask me: Incorrect certificate for host. The server presented a certificate that doesn't match built-in expectations. These expectations are included for certain, high-security ...
1
vote
3answers
77 views

How to compare passwords with duplicate password

On Steam, the gaming client, I have this habit of creating multiple "smurf" accounts. I have a randomly-generated, unique password, and I decided to use the same password for all of my multiple ...
0
votes
3answers
73 views

When to set security questions for a web application?

For enhanced security, we can use security questions and use them as a means for users to reset forgotten passwords or as an additional means for authenticating. When would we be the right time to ...
0
votes
2answers
53 views

How does RealVNC Enterprise Know My System Credential?

After the installation of RealVNC on a Windows computer, the default login username and password via VNC is the same as the system username and password. Can anyone tell me how RealVNC can access such ...
15
votes
3answers
3k views

Is it a bad idea to add random characters to user ID and password?

I've heard people say again and again that you shouldn't implement your own security algorithm, and I'd like to ask you if I'm breaking this rule. I'm creating a traditional client-server application ...
2
votes
3answers
138 views

is it feasible to improve the entropy of XKCD #936 by using a larger dictionary?

XKCD #936 uses a limited subset of the English language, only 2000 words. I just looked it up, and the English language has over a million words, a sizeable subset of those having special characters, ...
2
votes
1answer
66 views

Crackstation “Secure Salted Password” Java example - is it really secure?

I'm making an auth service so I've been looking for some good Java/Groovy implementations of password + salt hashing. I've found this article on crackstation along with a code example and decided to ...
1
vote
1answer
25 views

Can a PKCS12 file be distributed over insecure channel?

Is the PKCS12 only as secure as the password protecting private keys ? Can I distribute the p12 file over an insecure channel ?
12
votes
5answers
2k views

What is the best way to transmit password hash over unreliable TLS?

I have TLS connection between my server and client. I have no certificate, so the connection is susceptible to the Man-in-the-middle attack. I fear that attacker could intercept the password hash ...
27
votes
5answers
3k views

Are passwords comprised of key sequences on a keyboard any less secure than the same characters but jumbled up?

Here are two passwords: 5678%^&*tyuiTYUI and 8^tyU75%*IuY6T&i Both have the same number of characters and in each the characters are identical, the only difference is that the first ...
1
vote
2answers
105 views

Will hashing passwords in my use case improve security and why?

I am developing an application the architecture of which is arranged as follows: Session host <---> Central relay server <---> Session client All communication between the initiating ...
2
votes
1answer
104 views

Is it a good idea to expire passwords after a time relative to their security?

If a user has to change their password ever so often, is it a good thing to check it against zxcvbn or similar library and assign a expiration date relative to the risk of the hash being cracked?
2
votes
2answers
134 views

Storing lots of passwords that different levels of employees need access to

I am wondering what other people do for storing passwords. Our current model at my employer is fundamentally flawed in my opinion, so I am trying to see what other people do so I can select the best ...
24
votes
6answers
6k views

Are passwords that are manually typed in really unrecoverable from memory or disk?

As part of an increase in the security measures for our company, we're moving to making sure all password logins (databases, servers, etc), are done through a password prompt and never using stored ...
1
vote
2answers
90 views

How to transform an hash into a usable password?

I was reading about PwdHash and it inspired me to create a little project where you input a master password and an easy to remember alias into a password hash, like bcrypt, and then you get an hash. ...
0
votes
0answers
32 views

I forgot my ZIP file password. How do I bypass the encryption? Which software would work? [duplicate]

Should I use brute-force attacks? Do they even work? What options do I have? I only remember short fragments of the password and it's definitely more than 7 characters long.
0
votes
2answers
51 views

Is authenticating via the database secure

Sorry for this probably noobish question. So far, I've read password comparison/verification is implicitly understood to be made on the application layer and not in the database. For example in PHP, ...
0
votes
1answer
73 views

Can I get rid of storing user secrets by using OpenID, and what do I need to store?

What information do you have to keep about a user to be an OpenID consumer? I want to use OpenID to let users register and authenticate on my system. So while I'm at it I want to not duplicate ...
2
votes
3answers
1k views

Store password locally. Where? How to pass it securely?

I'm developing an application. The user must enter his credentials which will be sent to the server. If the user opens the application a second time he shouldn't need to enter them again - credentials ...
1
vote
1answer
26 views

How can I defend against Heroku (or any PAAS) ID theft?

How can I defend against Heroku (or any PAAS) ID theft? Is it correct to assume that if someone obtained my Heroku credentials that they would have access to any data in my app, regardless of any ...
2
votes
1answer
51 views

Is it sensible to use application password bypassing two factor authentication? [duplicate]

I discovered that some applications (like Sylpheed) seems unable to support two factor authentication. Google has a feature called application passwords - a separate password that "grants complete ...