Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

-1
votes
0answers
32 views

Unauthorized Password Access [duplicate]

I have a website with no. of paid videos. Suppose, In future many of users will be purchase videos from my website and if any user distribute his password in his college and anywhere. So, my question ...
-3
votes
1answer
54 views

Making my password secure [on hold]

I don't understand much about this topic and I am not highly involved with it in any way. I want to improve my password because I had my account stolen once (still a mystery has to how) but I was ...
3
votes
1answer
58 views

Can I Prevent Internet Explorer from Storing Login Requests in Memory?

Using Internet Explorer 11 I have been able to login to HTTPS web applications by providing a username and password and then subsequently logout. Whilst the browser process is running I can then dump ...
1
vote
3answers
55 views

Verify password hashed with nonce when the password is already hashed on the server?

I found this picture in the Wikipedia nonce article: To avoid sending the password in clear text and prevent replay attacks, the password is hashed together with one random number from the server ...
1
vote
3answers
134 views

why not use hashed password as password [duplicate]

Why dont we use our mobile phone tho hash a password and then enter the hash on a website as the password ? This way the password for the website would be much more complex. Would this even increase ...
1
vote
1answer
39 views

What password based key derivation does PKCS #12 use?

I would like to make a note that I have read all of rfc 7292. I am trying to decrypt encrypted private key in a pkcs#12 pfx file. The private key is enveloped within pkcs#8 shrouded key bag. The ...
0
votes
0answers
23 views

Generate Custom Brute Force Dictionary from Partial Knowledge of Password [on hold]

I'm trying to create a wordlist to brute force an old TrueCrypt volume I found. I have a hazy memory of what the password is, and I'm confident I can brute force it if I can get together a password ...
0
votes
5answers
269 views

What is the safest way to store passwords in a company for the case when the CISO leaves?

What is the best and safest way to store passwords in a company to ensure nothing is lost when the CISO leaves. I know this might be subjective and there isn't THE best way. But I'm curious about your ...
67
votes
11answers
13k views

Will typing my password twice make it more secure? Or typing each character twice?

If I type my password twice (like: PwdThingPwdThing), OR type every character twice (like: PPwwddTThhiinngg) will that make it substantially more secure than it already is? Assume that it is already ...
-5
votes
3answers
71 views

how to know the way in which password was encrypted [closed]

i have a encrypted password basically hashed i don't know what it is some thing like 11dfb34b27f539a5e785b68e529fd470 and i know the password i.e., the plain text but i want to know the way that how ...
1
vote
2answers
65 views

Isn't oAuth weaker than traditional passwords

I understand the need for oauth for programmatic access to apis, etc. whereas passwords are used for more human-level authentication. However when we store passwords, we (hopefully) salt + hash them. ...
41
votes
7answers
5k views

Are partially typed passwords a potential security risk?

I just sat down at my work computer and began to unlock it by typing in my password, I got 6 of the 8 characters in and decided I wanted coffee and walked away to get it. I came back, realized I left ...
5
votes
1answer
94 views

Does eliminating the possibility of repeat words make Diceware passwords significantly less secure?

I read about Diceware passphrases and whipped up a little program to generate passwords in that style. I do this by taking the list of dictionary words to create passwords and "ordering them" by a ...
4
votes
6answers
239 views

How to choose a good (and easy to use) WiFi password?

Over the last few months I have had to enter WiFi passwords into smart phones, TVs, printers, etc. None of these have real keyboard and they make it hard to enter long passwords or passwords that ...
0
votes
3answers
62 views

How to use password salt the right way [duplicate]

I understand the basic idea of password salts. You generate a 'random' string of data prepend this data to a user password store password and salt (salt maybe even in 'clear' form) Like in the ...
6
votes
1answer
260 views

Who in UK I can report to if I know company is storing my password in plain text?

I live in UK, some time ago I wanted to login to my electric company account to check the bill and such, and I had forgotten my password - long story short I got my account locked and had to call ...
96
votes
14answers
18k views

Why did customer services say using symbols in a password is insecure?

I am using an online service that I recently had to reset my password because I forgot it. When I went to change password I wanted to use one with a symbol !@£$%^&*(). When I clicked "confirm ...
2
votes
0answers
115 views

Has password strength been an *actual* problem in a professional context? [closed]

Among the more security savvy community (very much including security.stackexchange) there is an ongoing discussion about the strength of different password policies. Examples include the ...
25
votes
10answers
7k views

Two passwords for one account

Would it be a good idea if you had one account which would require two different passwords ? For example your login details were: email: example@gmail.com password 1: P4$$w0rd1 password 2: ...
3
votes
1answer
92 views

Is a security question you just have to 'remember' a good idea?

I was setting my eBay security questions and one of the choices were: Now I've seen sites that allow you to "type your own question" and "type your own answer" but unless they forgot a text field, ...
94
votes
12answers
13k views

Explain Security to Employer

My employer wants/wanted to install a 3rd party app on my personal cell phone. One of the issues that we are still not seeing eye-to-eye with is regarding security. Here are some issues that concern ...
0
votes
0answers
45 views

stream cipher & e-banking

As I read on internet, I ran into these two question. Yet, I thought about it but still don’t know how to tackle it. May I have your help? (a) During an e-banking transfer the bank uses a stream ...
9
votes
3answers
208 views

How Should WiFi Passwords be securely stored on IOT (embedded) devices?

Some devices need to store and (re)use a password (not the hash) like your mobile phone using home wifi, SmartTV, etc; How should they store the password on their flash storage? So that a person who ...
1
vote
2answers
137 views

Best reasonable way to store a secret safely

I'm working on a software that need to store and use secrets. These secrets can be for example: a password to connect to a database a client secret for an OAuth 2.0 client_credentials grant. I ...
0
votes
1answer
67 views

Can anyone help me build a combo file suitable for my problem? [closed]

I have a router model C1000A company: CenturyLink Actiontec I bought it through eBay, my problem is that I can not connect to the Settings page because I do not have the admin password (the password ...
130
votes
16answers
17k views

Is the BBC’s advice on choosing a password sensible?

In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows. Step 1: Choose an artist (a recording artist I presume) Lets choose as an example ...
1
vote
2answers
79 views

Exclude passwords with repeating letters

It would cut down a lot of time of the brute force attack if some of those passwords like "aaaaaa" wouldn't appear. How can this be achieved in Hydra or some other brute force software?
1
vote
2answers
71 views

What is the real advantage of using a “more secure” algorithm like bcrypt for password hashing?

I read this article about password hashing using bcrypt as the recommended method. The advice is similar to what they're saying on hacker news about not using something like SHA2+salt. There are other ...
0
votes
1answer
77 views

How to manage all the unlock codes for thousands of mobile devices (iPads)?

I need to manage (assign, store, notify, etc.) the unlock code for thousands of mobile devices (iPads). How to manage optimally this unlock code? Maintenance users should be able to access the unlock ...
4
votes
4answers
464 views

Password hashing on frontend or backend? [duplicate]

I have a Java Server with Spring Boot and a JS Frontend in AngularJS. My teacher told me to use HTTPS for passwords, because I cannot hash them securely enough, that nobody can hack them. With ...
4
votes
1answer
76 views

Observable password inputs

An obvious problem with passwords is that if an observer sees a user enter it, then the user has lost the password secrecy. Some systems try to defend against this with dark screens or with shields ...
4
votes
0answers
39 views

Wordpress.org pages refresh when logging out of Gmail

I've noticed that when I change my Gmail account by logging out of one account and then logging into another, all open Wordpress.org pages refresh. Additionally, when I recently changed a password on ...
2
votes
3answers
87 views

Nmap http-brute - Supplying arguments for bruting via GET

I'm attempting to brute a site in my test lab with Nmap's http-brute nse, which has the URL structure https://192.168.101.6/api/auth?email=a@b.com&password=pass Unfortunately Nmap's official ...
1
vote
4answers
179 views

MySQL user passwords in PHP

How do I prevent exposing MySQL usernames and passwords in PHP code when establishing a connection?
4
votes
3answers
154 views

Can a password be the same as its hash?

So me and my friend were pondering why passwords have a max length (and found the answer here) and I had an odd thought.. could a password be the same as its hash? I realize that salted hashes are ...
1
vote
1answer
31 views

PHP BLENC extension security concern

PHP BLENC is a extension that allows PHP developer encrypt their code, protect their ideas and avoid illegal copy. Although BLENC allow developer to define the main encryption key in source(in the ...
2
votes
2answers
138 views

Is this password inside a file secure? A security paradox

Preamble: I have been a long time lurker but first time poster to the Information Security site, so please be gentle with me. The Situation: I ran into a situation where I needed to securely store a ...
0
votes
0answers
15 views

Receiving third-party credentials on AWS

In my previous question, I was trying to figure out how to store third-party passwords safely. Now it seems that they'll be sent to my AWS instance from another AWS instance. I imagine the transfer ...
3
votes
2answers
42 views

Is there any practical weakness to using MT19937 to generate passphrases?

Suppose I use MT19937 to choose random words out of (say) the Diceware word list. I know MT19937 is not considered a cryptographically secure PRNG, but Wikipedia suggests the weakness is rather ...
5
votes
3answers
147 views

Public Key Encryption instead of passwords

As an alternative to using passwords, customers could be provided with individual asymmetric-encryption key pairs (i.e. a private key with associated public key), which could be used to validate their ...
3
votes
2answers
111 views

Is there known statistics of passwords used during brute force password attacks?

I have been reading quite a bit about brute force attacks and I am wondering whether the passwords that are used in such attacks should be kept around so as to later prevent my users from having those ...
9
votes
7answers
2k views

How to securely counter users from adding a single digit to their old password upon creating a new one? [duplicate]

Let's say that in the password policy the password history is defined to remember the last 10 passwords. I understand password history exists so that if a password is recovered from a compromised ...
26
votes
2answers
3k views

Is it possible for my password to have more than one password combination?

Can my password have more than one password combination? I read up on physical combination locks (the lock you open with numbers) and I learned that a combination lock can have about 40 or more ...
2
votes
3answers
326 views

Why PHP password_hash does use blowfish intstead threefish?

I was wondering why PHP's hash_password function use blowfish instead of threefish. According to Bruce Schneider blowfish is outdated and He is recommending twofish or threefish. Is blowfish enough ...
84
votes
17answers
13k views

How to tell users that they shouldn't disclose their password over the phone to our help desk?

I work for a help desk, and we recently launched an online service where our members can log in. A problem we are having is that users who are calling us often ask us to confirm that the password ...
1
vote
1answer
39 views

Is Windows 10 [Password protection on wakeup] set to 'Required' relevant when machine is asleep?

I like to just hit the spacebar and have the machine ready without the extra fuss (many times a day.) No one untrusted has physical access to the machine, but it wakes up at ~3am and does updates and ...
-2
votes
1answer
52 views

How can you set a wireless router password that nobody (including yourself) knows? [closed]

Consider the following hypothetical situation: On a Macbook, A hacker can view the screen of your machine (and may have a keylogger installed). It is impossible to remove them even by reinstalling ...
1
vote
3answers
78 views

Parameters for PBKDF2 for password hashing

I use PBKDF2 with SHA-256 to store hashes of passwords. I use the following parameters: number of iterations desired = 1024 length of the salt in bytes = 16 length of the derived key ...
10
votes
1answer
641 views

Is disabling sudo password prompt a security risk?

I was reading the this question over on Ask Ubuntu and they suggest adding the following line to etc/sudoers so that you're not prompted to enter your password each time you run sudo %admin ...
5
votes
1answer
86 views

How to implement a password change policy when user's centralized password is in a lot of places?

I would like to implement password changing in an organization but they have the domain controller/LDAP passwords "all over the place". They have the passwords in a lot of places, for example, in ...