Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
1answer
24 views

Is a random work factor an increase or decrease of security?

Assume you use a proven hashing algorithm, like bcrypt with a work factor of 10 or PBKDF2 with 10K iterations. Normally that's really secure already and would give enough security already for most ...
-3
votes
1answer
41 views

How do I get the password knowing part of it and the length [on hold]

I'm new to all this, I'm trying to use Hash Suite to find a password with a word + 2 numbers. I know what the word is but not the numbers but I also know the length of the passwords ... What do I have ...
2
votes
2answers
64 views

Is encryption application credentials using certificate encryption good practice?

I'm working on a small web application. The web application needs access to a database, so the application needs access to a database username and password. The application runs in an environment ...
1
vote
1answer
74 views

How does LastPass know that Microsoft.com uses the password for Live.com?

When I visit Microsoft.com, the LastPass dropdown lists my username/password for login.live.com. It does something similar for Playstation.com and several other sites. How does it know? Are these ...
0
votes
0answers
34 views

Breaking EncFS given .encfs6.xml

I forgot the password of a EncFS folder (created, went to vacation, forgot). But I remember how the password was created (e.g. was a sequence of 4 dictionary words). So I decided to try to find the ...
0
votes
2answers
74 views

Store password in Public Domain using files and md5sum

Whenever I check integrity of a file using md5sum, I get a string of alphanumeric characters to compare and verify if it was downloaded correctly. Couldn't the concatenation of several of those ...
5
votes
3answers
80 views

Forgot password and revealing whether account exists

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...
6
votes
6answers
49 views

Forgot password and revealing whether account exists [duplicate]

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...
1
vote
3answers
125 views

securely storing passwords that can be retrieved

I'm trying to build a web application that can store passwords of other services like Facebook, Gmail ...etc. These passwords can be later retrieved and shown to the user. This has to be a web ...
31
votes
4answers
5k views

How does a hacker know how many times a password was hashed?

I've been reading a lot of questions about security and hash functions on this site and others. I am not an expert, just a curious mind and in my understanding the more iterations used to hash a ...
-4
votes
0answers
70 views

Am I in troubles? [closed]

So I've done a job as a game developer and as payment I chose an origin game (which costs aroung 20 dollars). To that end I've created a new blank email account and a new origin account. Both of those ...
2
votes
0answers
75 views

Impact if password is visible on interceptor in case even we deployed HTTPS [closed]

Our application is on HTTPS but password is visible on interceptor while when we check it via Wireshark it's encrypted. Is there any risk in it? And what kind of impact it can have?. We provided the ...
0
votes
3answers
113 views

Best way to securely send passwords from an application to a user operated server

I have the following situation: A user sets up a server that will have to receive login details. Other users then create accounts and login to this server. All this happens only over LAN. I'm ...
0
votes
1answer
33 views

Is there any problem using empty salts with PBDKF for this purpose?

The aim is to generate a secure key for symmetric encryption. I have a master password, from which I want to generate the key for symmetric encryption, in order to encrypt other passwords. The idea ...
2
votes
3answers
412 views

Password security with short passwords

I know that a long password is a good password. However, some sites require short passwords e.g. exactly 8 characters long. Under those limitations, what is a good method of creating and memorizing a ...
2
votes
3answers
122 views

Can a shim (a.k.a. polyfill) be installed in IE, FF, or Chrome without user knowledge, and can it read passwords entered by user on a login page?

The questions here are about shims in the 3 most commonly used browsers. A shim (also known as polyfill) is a piece of code (often JavaScript or Flash) implemented to augment the native API in a web ...
0
votes
2answers
73 views

How much stronger does a paragraph/sentence based password becomes with random characters added?

I was reading some questions on here regarding the correct horse battery staple method, and the conclusion was that, assuming any words in the list of most common English words, every word adds about ...
5
votes
2answers
130 views

How do you know if the bios has been compromised?

To secure my PC I have setup a BIOS password, preventing any access from a live-cd. Recently I've noticed that when the BIOS asks for my password, I just have to press Enter to boot. It doesn't work ...
4
votes
0answers
166 views

Modern alternative for passwords [closed]

Today - I saw a question about passwords usage in cars. Have we developed anything besides passwords for IT? Is there are any other solution out there for my ...
0
votes
1answer
147 views

Why enter again (or at the very least confirm) my email address when I click “Forgot password”?

In most, if not all, web forms for logging into a site, you have your forgot password link. When clicking the link, you get a new form (usually in a new page) either empty (!) or prefilled with the ...
19
votes
4answers
4k views

Would allowing shorter passwords sometimes be more secure?

Does the act of requiring certain criteria for passwords make them easier to brute-force? It's always seemed to me that when websites limit the use of "insecure" passwords, it might make it easier ...
26
votes
5answers
4k views

Password strength of random words and brainflayer

I have read from multiple sources that it might be better to have a password composed of several random words since this is easier to remember than a random sequence of characters. For example this ...
0
votes
0answers
29 views

Trying to figure out the hashtype of this digest-auth htpasswd file

Simple question for y'all as i'm having some trouble identifying the hash type of this from a http digest file that I have setup for rutorrent on a apache2 server. Here's an example of what it looks ...
0
votes
1answer
43 views

Use PIN or Password [duplicate]

Which one is better, using PIN or password ? I want my app using PIN number to user login and register. Does not matter if I use PIN number only for user login and registration in my web application ? ...
3
votes
0answers
50 views

DRIVELOCK password [migrated]

I changed my computer user name and password. When I logged in it was still OK. But when I restarted again it did not accept my password, it says wrong password or incorrect. Then the IT department ...
1
vote
2answers
106 views

Website sent me my new password (after reset) in clear text [duplicate]

I was resetting my password on a website and the website emailed me a new password in plain text rather than giving me a reset link to change the password myself. I logged back in and changed the ...
0
votes
3answers
72 views

Is using my phone number as a pin for a phone a security risk?

I just did a factory reset on my smartphone to see if it might fix issues with battery life. I configured a phone number as the lock screen code so I have a code that's both long and easy to remember. ...
4
votes
3answers
85 views

2-Factor Authentication vs Security Questions

I have an account with a bank that has additional security option. When it does not recognize a device being used to access the account, it will either: Prompt with 1 of 3 security questions Send a ...
-5
votes
1answer
82 views

Time-based password change [closed]

I have created this script and it runs great, but important questions remain. Is this script useful and secure? Does it have any possible problem or weakness? root@010010:/# ls -la ...
3
votes
4answers
154 views

Does manipulating a random password significantly reduce its entropy?

Suppose I generate a password using a secure random number generator and all the available character classes. For example, c.hK=~}~$Nc!]vFp9CgE. Consider that this password may need to be used in an ...
1
vote
3answers
46 views

Hashing Algorithms Costs vs Sleep

I understand most of the concepts behind hashing password but this one still escapes me. I understand that you want the hash to take some time ( a couple milliseconds) so the attacker can't ...
2
votes
1answer
114 views

Is it safe to use a 4-digit PIN for Android system encryption?

I just encrypted my Android phone using the default menu. I was asked for a PIN code (4 digits). Do you think this is a good practice? Is there a limited number of attempts at decrypting the ...
9
votes
2answers
210 views

Is it possible to guess the length of a password by sniffing TLS packets?

In this answer, the author states that it is possible to tell the length of your password, by sniffing your TLS packets. Is this true, and how would this be done in practice?
5
votes
2answers
262 views

Password: ham,ham,ham,bacon,bacon,ham

Why do we bother with dice ware? Is rolling dice and looking up in a printed book (or using a digital analogue) a string of N random words any more secure than simply repeating a word or two N times? ...
2
votes
1answer
89 views

Docker containers, environment variables, and databases

Environment variables (set with -e) in Docker containers are available to every linked container. Consider a typical use case, a database. The official MySQL image gives this example command: docker ...
1
vote
2answers
109 views

Double hashing using a relatively new hash and a old, tested one

Note: I am relatively new to cryptography in general, so please point out if I make any misconception here. I heard that you should always use well known crypto/hash functions, that have already been ...
5
votes
1answer
167 views

How to store/encrypt fingerprint?

Storing password is a no brainer : use a password hasher. But.. How do you proceed to store fingerprints securely on your server? Meaning that even if your server and all it's data is stolen, someone ...
2
votes
4answers
93 views

Is there a security advantage towards hashing a password on the server? [duplicate]

I'm working on an authentification system. Now in this system the user logs in and sends a hashed password to the server. Is this enough or do I have to rehash the password again? So basically is ...
7
votes
2answers
2k views

How does the attacker to ransomware get the password?

I have been thinking about ransomware and as I see it the password seems like it should be a problem for the attacker. I can see it going down one of two ways. Either the password is included in the ...
4
votes
1answer
77 views

Protect password/authenticating during transit over (insecure) TCP socket for a game

Background I am designing a multi-player game with a single server that handles multiple worlds. Each player logs into the server initially before requesting which world to join. The server has a ...
1
vote
2answers
67 views

John the Ripper exclude incremental mode from another incremental mode

I want to crack an 8 characters password. First, I tried the incremental mode digits, but I did not find the password. So now I know it's not all digits password. I want to use lowernum incremental ...
1
vote
0answers
73 views

Fido: trusting user-agent

As I went through Fido specifications: the server (providing web app/services) need to trust user agent for local fido authentication and if needed can enforce certain policies" I am not sure ...
0
votes
2answers
71 views

Several hashing routines support client side work. Doesn't the hash just become a password equivalent?

Isnt Secure Remote Password Protocol (SRP) pretty much client side hashing? Argon2 the winner of the PHC also allows for client side hashing. How do these systems avoid the plaintext equivalence ...
-1
votes
0answers
32 views

Is it possible to phish a wifi password using a fake AP? [duplicate]

If I were to create a fake AP with password and give it an SSID like the real AP using a program like hostapd,then when clients connect to this fake AP , they will type the real password and send it ...
6
votes
6answers
2k views

Ransom attacks - can I protect myself by encrypting all my files?

If I encrypt all my files can I get "attacked" by ransom attacks? Because my files are already encrypted, they cannot access them, so I should be safe or am I wrong? Also, if someone could tell me ...
2
votes
5answers
232 views

Not storing the salt? Is that an option?

Please read as I did many searches and believe this is NOT a duplicate question. For your reference, I've read these articles and other questions already: How do you overcome the problem of the ...
5
votes
1answer
116 views

How long does 2-factor authentication codes have to be?

I've noticed that from a (personal) UX point of view, 4 numbers which my online banking uses seems to be a sweet spot in terms of holding it in my head from looking at my phone to typing it it. But ...
3
votes
1answer
124 views

Writing your own John the Ripper module

I have a script in C, which is able to determine the password of certain data. It uses HMAC and RC4 algorithms to encrypt the given password and then compares that later to the given data. If they ...
-1
votes
0answers
21 views

Site to report password security policy issues [duplicate]

I just got an email from a site after I created an account and they emailed me back my password. I was shocked as its a pretty big eCommerce vendor and they broke such a common sense security rule. ...
5
votes
1answer
61 views

Unique Touchscreen Authentication Schemes

I am working on a new software application that will have access to millions of patient medical records. I want this to be secure. The initial thought process was to simply use a standard username ...