Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

1
vote
1answer
62 views

What should I do when I need to store passwords for usage in 3rd party softwrae?

I have a desktop WPF application which authenticates with Dynamics CRM 2011. I ask for the username and password of the user and use them to connect to Dynamics CRM 2011 using ...
0
votes
2answers
75 views

Which hashing algorithm is ideal for use on the web? [duplicate]

I am new here, and have poked around the site looking for an overview of which hash algorithm to use on the web and why. It seems to be the consensus that SHA-256 or other SHA-2 family algorithms are ...
22
votes
3answers
7k views

How can I create a password that says “SALT ME!” when hashed?

How can I create a password, which when directly hashed (without any salt) with md5 will return a string containing the 8 characters "SALT ME!". The hope is that a naive developer browsing through his ...
0
votes
2answers
135 views

How different should passwords be?

It seems to be generally accepted the same password should not be used for different sites or devices. How different should passwords be? For example +_^gum<JW1 and +_^gum<JW2 are very similar. ...
1
vote
1answer
38 views

How do you manage credentials to multiple remote systems?

We are a vendor that provides software to the healthcare industry, and our application is locally hosted on customer infrastructure. As such, we are provided with VPN access in order to be able to ...
0
votes
0answers
21 views

Length-constant password comparison in scrypt? [duplicate]

E.g.: XORing the candidate against stored then comparing against 0. Do I need to worry? (my question is much in the same style as this question: Does bcrypt compare the hashes in ...
1
vote
1answer
55 views

NTLM/LM Hashes on Domain Controller

I've noticed that when extracting password hashes from a domain controller (using Elcomsoft proactive password auditor) sometimes I'll get LM and NTLM hashes and other times I'll only get NTLM hashes. ...
1
vote
1answer
55 views

Cracking encrypted SQB databases

I've recovered a .SQB SQL database backup file from a backup server and do not have the password. As I do not have the password available to me, I'm looking to determine what type of encryption is ...
1
vote
1answer
52 views

Hashing password for secure storage (generating salt)

I wanted to check if the following means of generating a hash for storage of a password was secure. I have an username and password combo. In order to generate a secure hash, I am doing the ...
0
votes
1answer
40 views

CNN Money Portfolio and Heartbleed [duplicate]

Is/was CNN Money Portfolio ever vulnerable to heartbleed? It states 256 bit SSL bank level encryption on the website..
1
vote
1answer
66 views

What to do with .hash files when cracking WPA2

So, I'd say I'm one level above n00b. I've gotten to the point where I have accomplished a WPA Handshake (and saved the output as xxx-01.cap). I have also downloaded these hash tables (if that is the ...
5
votes
1answer
85 views

What happens if biometric data is stolen?

As we move toward a future where fingerprints might possibly replace passwords, I see one issue. While passwords can be stolen, they can be changed by the owner after being notified of the security ...
3
votes
0answers
120 views

Decrypt Passwords based on using a user's password

I am creating a database to store our client's information at work (a heritage center specializing in DNA based genealogy). Once the results of a test come back, we have people that use the ...
1
vote
1answer
24 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
1
vote
1answer
39 views

Is it safe to sign in to Google with password from desktop app like BlueStacks? [closed]

BlueStacks is an android simulator for desktop. After installation it will ask you to login with your Google account to download and install android app from play-store. My question is "Is it safe to ...
0
votes
0answers
58 views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
2
votes
2answers
105 views

Chinese or “pinyin” wordlists for dictionary attacks

Background: I am currently trying to crack a salted md5 hash which I have recovered from an embedded device running busybox and manufactured in china. I have tried john the ripper using all of the ...
0
votes
2answers
107 views

If bruteforcing a password goes aaa, AAA, aab, AAB, etc, all the way to ZZZ, wouldn't ZZZZZZ be the most secure password?

I'm only taking about security against bruteforce attacks. I assume that most crackers start at a and go up to zzzzzzz for as long as instructed (so it could be zzzzzzzzzzz if told so in the ...
0
votes
1answer
45 views

Securing passwords for REST Authentication

first post on sec so go easy. I'm developing a REST application using the Spring Framework, as as part of the requirements, we have to secure the different functions of the system to different user ...
3
votes
3answers
510 views

Encrypting passwords?

I am planning on creating a text file to store my passwords, so I only need to remember 1 password (at the moment, I have about 20 long/complex passwords in my mind, and am worried that I might forget ...
3
votes
1answer
106 views

Password Managers: encrypted database vs hashing strategy

I'm considering moving to a password-management strategy based on supergenpass or something similar. This is an alternative to other password managers where instead of having a database of passwords ...
1
vote
1answer
189 views

I login to Stackoverflow (vulnerable) with Google (not vulnerable). Do I need to change my password? [duplicate]

According to this heartbleed mass test, Stack Overflow is vulnerable whereas google is not. I use my Google ID to logon to Stack Overflow (and some other sites). Do I need to change my password? In ...
3
votes
1answer
116 views

API to change passwords?

After I learned last week that the login data of some of my accounts was leaked, I had to change my passwords for more than 30 sites. That was tedious! As luck would have it, some days later we ...
2
votes
1answer
33 views

Windows Scheduled Task passwords

When you create a Scheduled Task in Windows, it gives you the option of running the task as a different user, including saving the password. How secure is the password that is stored?
0
votes
1answer
187 views

The Problem with Changing All Passwords for HeartBleed [duplicate]

One thing that's been bugging me in relation to the discovery of the Heartbleed OpenSSL flaw is the recommendation that everyone should run to their computers in a panic and change all of their ...
0
votes
1answer
36 views

Is there an anti virus that protects processes from being injected code to?

As title says, is there an av that does that? And if not, is there any other program that protects processes like lsass in windows, apart from protected process utility in win8.1?
0
votes
1answer
28 views

Handling passwords in wicket

I have a form which contains a password field. In swing the getPassword() method returns a character array. After the password has been processed by my web application the array can be wiped to ...
1
vote
2answers
97 views

LastPass login security

If LastPass does not store your master password, then how can you login to use their web app? Surely you must type it in, it is sent over using SSL, and then salted/hashed on the server-side, and ...
20
votes
4answers
8k views

Should I change all my passwords due to heartbleed [duplicate]

Should I change all of my online passwords due to the heartbleed bug? Edit: I found a list of vulnerable sites on GitHub and checked all my critical sites. Everything I was really concerned with ...
1
vote
0answers
28 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
1answer
59 views

Is there an equation to calculate the number of instances of a series of characters exist in a given key space?

If I'm using 16-18 character-length passwords with 94 different possible values-per-character (lower alphas, upper alphas, numbers, and special characters), is there an equation I can use to calculate ...
41
votes
1answer
6k views

What should end-users do about Heartbleed?

What should one do about the Heartbleed OpenSSL exploit? mainly talks about what people running websites should do about Heartbleed. What should end-users of websites be doing? Do they need to ...
1
vote
0answers
44 views

Lock Windows to a specific app

Is it possible, using some program or application, to lock Windows 7 so only a specific app can be used, for example Word, until a password is entered? Thanks!
3
votes
0answers
82 views

Is BSI’s process good? (Informing email address owners that their address/password (of unknown/different accounts) was stolen)

The German BSI (Federal Office for Information Security) claims to have got a list of 18 million email addresses and passwords – supposed to be the result of identity theft. They allow to check if ...
2
votes
1answer
148 views

How was the Xbox One password verification compromised?

So, we have this article: http://www.engadget.com/2014/04/04/xbox-live-five-year-old-hacker/ Apparently, using nothing but spaces the local account (with an obviously saved password... I hope) was ...
2
votes
1answer
56 views

Safety while ciphering data

Say I wanted to encrypt some sensitive information with a symmetric algorithm using a program on a computer. Is it possible that a hacker could retrieve the data,salt, iteration, cipher, keysize while ...
1
vote
2answers
106 views

How could police identify digital contraband and charge someone if it's encrypted with keys?

For example, say I am transferring heavily-encrypted DVD/Blu-ray movies/game copies over the internet. However, I am using double or (+) encryption with keys required to decrypt the file using an ...
-3
votes
0answers
25 views

How many possible combinations in 8 character password? [migrated]

I need to calculate the possible combinations for 8 characters password. The password must contain at least one of the following: (lower case letters, upper case letters, digits, punctuations, special ...
-3
votes
1answer
29 views

How many possible symbols and punctuations in a password? [closed]

I want to compute the possible combinations of a password consists of 8 digits of: alphabetical letters (26), numbers (0-9), symbols and punctuations. In order to compute this, I have to know the ...
0
votes
1answer
72 views

Is using MD5 in NTLMv2 protocol to store Windows passwords is secure?

I read that Windows (probably not new OSs but say, Windows Server 2008) stores passwords using Hashes using NTLMv2 protocol which uses MD5 hash function. My questions: MD5 is known to be insecure ...
0
votes
2answers
82 views

How many bits of entropy should I aim at for my password? [closed]

I mainly use 2 passwords: 1 is a 4 word full lowercase passphrase of 18 letters long which I use wherever possible. The other is basically 3 words and a digit with the first word in full uppercase and ...
1
vote
2answers
93 views

How can I analyze password recovery tokens?

All websites that support authenticated user interactions have a password recovery feature. Usually they will email the password reset link through which you can easily recover your account by typing ...
0
votes
2answers
299 views

Registration Password

Is it best to create an application that allows a user to sign up with username and email at the beginning and password once you click the generated email sent to you or should the password entering ...
0
votes
1answer
45 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
1
vote
0answers
31 views

Does whosthere.exe of pth toolkit have to run with administrative rights?

To see the users that are connected to the machine and they're pass hashes with Whosthere.exe, do I have to run it as an administrator?
0
votes
1answer
39 views

How does LM hash deal with passwords that are between 8 and 13 chars

If its 14 then it splits it to 7&7, but how about 13 characters? 7&6? How does it work?
-1
votes
4answers
137 views

How do big companies and wealthy people secure their information? And how can I secure mine?

I've recently had some success and traffic increase with an online business I own and due to that someone has hacked my domain email and twitter accounts. My bank password is the same and I just ...
2
votes
4answers
206 views

How does a system authenticate a user using a hash function, after it has been salted?

I don't really understand how salting works. I read the Wikipedia article, but I still don't understand how can a system authenticate a salted hash? Let's say a user chooses a password. It's randomly ...
0
votes
1answer
92 views

What are common problems that reveal PHP code? [closed]

What is the best method for securing PHP scripts that contain database passwords? From what I've read, PHP can be revealed when an error occurs and is not caught. Is there any way to reveal PHP by ...
3
votes
4answers
289 views

True?: “Nearly all encrypted passwords are stored with the last character in clear text”?

[S]ome passwords are gleaned by hacking into computers where intruders can find stored passwords. Those are stored in encrypted form, but there's software that can attack the encryption. Nearly ...