Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
1answer
37 views

How are “worst passwords” lists made?

I don't understand how it's possible to create a list of the worst passwords used if they're (allegedly) encrypted? Are they collected anonymously before saving in the database especially for this ...
10
votes
2answers
515 views

Password hashes history to prevent user to keep same passwords again and again

I am developing an application in PHP and it uses bcrypt encryption to store passwords. I want to keep the history of hashes whenever the user changes the password. By doing this I want to stop the ...
3
votes
2answers
87 views

ProtonMail security concerns

This TED talk brought me here. First of all, to those who created ProtonMail: Nice job!!. Regardless of what people say, it's definitely a big step forward from tradition options like Hotmail, Gmail ...
1
vote
1answer
153 views

Building a password recovery algorithm [on hold]

goals The password recovery procedure shouldn't significantly weaken the system's security policy. ie, Attacking this algorithm should be at least as difficult as attacking the login algorithm. ...
25
votes
4answers
5k views

If a web site shows me what my password was changed to, is it stored as plain text?

I just changed the password on a school-related web site. After completing the change successfully, the next page showed what the password was changed to. Can I conclude from this that the password ...
0
votes
2answers
76 views

Need some docs that say we shouldn't upper the string when saving it as a password [on hold]

I'm trying to find on the Internet some manual, guide or policy secure about applications should not convert lower string to upper string to store as password I mean, don't make ...
1
vote
1answer
42 views

How is password information stored and used on Android accounts?

How difficult would it be for someone who stole your device to gain access to the username and password information stored under the Settings -> More -> Accounts section of an Android device? ...
0
votes
1answer
83 views

What kind of backdoor can be made after hacking wi-fi? [closed]

I'm interested to know if A hacks B's wifi password, what can A do to gain persistent access to the router even after B changes the wifi password? Secondly, how can we detect the backdoor and patch ...
2
votes
1answer
24 views

Password security when connecting to ldap with rails application

How do you store a username/password securely in a rails app when using it for many ldap searches? The connection in the app requires ldap_bind_authenticate(Net::LDAP.new, username, password) ...
17
votes
6answers
2k views

What does “random” mean in the context of password creation?

Disclaimer: as you will see from my question I'm a total outsider in this subject, just very curious. I was wondering how easy it would be to crack a password-protected RAR5 file, and I found many ...
1
vote
1answer
56 views

Password sharing with spouse or mate (bulk-change shared passwords (via cloud service))? [closed]

I've read on New Scientist magazine that in 80% of all cases when people in a relationship share a place where they live one of the spouses knows the other's password, thus making the question I am ...
1
vote
3answers
114 views

Trouble understand login vulnerabilities

I'm testing my own web page with the following vulnerabilities. #1: Form escapes ' to \' So if a user tries to enter the following information: username: 'or'1=1 password: m username will ...
0
votes
1answer
37 views

Framework behind password reset mechanism

I have always seen those "Forgot password" links from web sites that requires some form of user login. Can I get a deeper understanding of how this works? What tools/framework do I need to use because ...
1
vote
1answer
74 views

What is the safest way to encrypt a password that can be decrypted at a later time?

In a web app I'm building, I need to use Apple's AutoIngestion tool for iTunes Connect. In this tool it seems the only way to use it is to send a password in plain text. What would be the best ...
4
votes
3answers
280 views

SSH Public Key Authentication vs Username/password for API Access

I have a linux device that will be making periodic call to an API server, say everytime the system boots up. Everytime then it should authenticate itself and then do its thing. I can either store the ...
2
votes
0answers
21 views

sample/starter code to test for TRUSTe password requirements [closed]

Considering its a requirement for Truste certification I figure that the code to test for a password meeting Truste's password strength requirements has been written more than a few times. I was ...
2
votes
2answers
44 views

Does changing the default number of iterations in KeePass (or other encryption applications) increase security?

Inspired by this question about the difficulty of cracking a KeePass database, I'm wondering if changing the default number of iterations in an encryption application (e.g., KeePass) increases ...
2
votes
1answer
66 views

What is a key-hardened hash?

I've seen the term 'key hardened hash' used to describe a recommended way to tighten up password hashing. What does this mean? Can it just mean to use a pepper?
3
votes
2answers
93 views

Obscure username input on login forms?

Not (necessarily) a duplicate of: Should both user ID and Password be masked for online banking? Definitely not a duplicate of: Should usernames be kept secret? I can sense your finger on the "mark ...
-2
votes
4answers
95 views

Getting password cracking time and byte storage from bruteforce?

I am stuck with this question, you can see it in the picture I have included below. PARTS (a and b) I know a-z will be 26^8, A-Z will be 26^8 guesses, and 0-9 will be 10^8 guesses. But I can't relate ...
0
votes
1answer
129 views

What can hacker do, if he knows my SALTED password?

for example, in any website (WORDPRESS or etc..) they store passwords in database, using SALT mehtod (as i know)... for example: $P$dfwegfwegewgIT03.wewefefweg if hacker got this password and ...
50
votes
5answers
8k views

Is sending passwords through cellphone text messages secure?

Both the sender and the receiver deleted the text after it was sent, but is it still possible that it exists somewhere and that someone can get to it?
1
vote
3answers
75 views

Password reset question answer complexity

I need to implement a password reset feature for a system that will be controlled by a security question and answer pair. The problem is that I can't guarantee I'll have a valid e-mail address or cell ...
0
votes
1answer
70 views

Different password for each login - based on some variable

This might sound a silly question, but I was thinking this as and extra option(which is not required) mainly for advanced users, who want to protect their accounts even more. Lets consider that other ...
3
votes
2answers
103 views

Is there any point in using two step authentication if you have strong passwords?

If you are in the habit of using strong passwords (randomly generated by password manager) is there any point in using two step authentication? Assuming that 99% of the time that when you enter a ...
3
votes
2answers
63 views

Why would you decouple your resource and login servers?

As described on this link, OAuth specifies that a login server and a resource server should be decoupled. The idea is that if one of your resource servers gets hacked, no password data is lost. All ...
5
votes
2answers
101 views

Share root access without sharing password

I am looking for a way to share admin privileges on some hosts without providing the admin password. From his link, I was thinking of using a primary host from which every user can sudo -u user to ...
1
vote
3answers
424 views

Who should I give my password to [duplicate]

I've got a dilemma, should I give my password to my local IT help desk (I am seeing them face to face, and I know that they work for the same company as myself). They want to perform a routine ...
0
votes
1answer
43 views

MD5 before PBKDF2 on legacy software

I am mantaining a legacy software that uses MD5 in the following way: The client asks for a 16 byte salt when authenticating an account. The server generates a 16 byte salt, links it to the account ...
-3
votes
0answers
14 views

Php's password_hash encoding for HTTP basic authentication [migrated]

My problem: I need, basic authentication over HTTP (client can't afford HTTPS). So I don't worry if communication is not encrypted. I just want to prevent some user from sniffing and using the ...
2
votes
1answer
83 views

Secure database password stored in an env variable

I need to somewhere store my DB password on my production environment to access the DB. At the moment the prod system is deployed in the cloud, so is the DB. The password, the username and some other ...
2
votes
2answers
150 views

Is plain text over https really a good idea? [duplicate]

Sending plain text passwords over https is quite secure, the traffic is encrypted, making eavesdropping virtually impossible. However, once on the server side, it is still plain text. Of course, ...
6
votes
3answers
212 views

Image file as password alternative

I seek guidance on interesting issue. Recently I've been searching for password alternatives, not because of the security, but to be more user-friendly. In one of my projects user receives 128 bits ...
1
vote
2answers
119 views

Is SpiderOak truly “zero-knowledge”?

I've recently changed SpiderOak password on computer A. Because I have SpiderOak installed on computer B as well, I thought I will have to update the password on it so the application can connect to ...
86
votes
12answers
12k views

Technology that can survive a “Rubber-Hose attack”

In the documentary film Citizenfour, Edward Snowden says about documents: I'm comfortable in my technical ability to protect [documents]. I mean you could literally shoot me or torture me and ...
2
votes
1answer
123 views

Why do major sites(Facebook, Google, etc) still send passwords unhashed? [duplicate]

QUICK SUMMARY: It seems like modern websites, for security's sake, should all have the client hash their own passwords before sending them to the server, who will rehash them, in order to avoid ...
0
votes
0answers
14 views

Storing user password in Keystore [migrated]

I am working on an application in which I would like to create a keystore with a master password and store user passwords after hashing inside it. Is it possible to do so? I am working in Java, so I ...
1
vote
1answer
29 views

Why should I include a client_id in an OAUTHv2 password grant request?

Like little red riding hood, you don't know who is knocking on the door... Why even bother accepting a client_id in case of a API <-> Javascript-website or API <-> Android App password grant ...
0
votes
0answers
19 views

KeePassX and Dropbox [duplicate]

I am currently using KeePassX on Linux to allow me to have a different strong password for each website. With this program there comes two major inconveniences: I lose access to everything in the case ...
0
votes
1answer
89 views

Secure way to encrypt (not hash) passwords?

I'm building a system that for reasons I'll outline below, can't used hashed passwords, but I'd still like to encrypt them so that it's as hard as possible to crack them, in the (unlikely) event the ...
1
vote
2answers
48 views

Should a password ever be presented in plain text to a user (On a website)? Is this illegal under UK Data protections act? [closed]

There is a website I use at work, external to our own. They have just presented with every employee with their plain text password and username via our internal website which requires our own logins. ...
1
vote
1answer
39 views

Using a Cryptovariable with an API Designed for Human-Generated Passwords

I'm working with a vendor who provides an API with a user registration method clearly designed for human-generated passwords. We're calling the API in an offline server-to-server fashion, however, ...
2
votes
3answers
132 views

Acceptably secure solution for users to log in with a short unique code only (no username)

I am creating a website whereby users are given an account by invitation only, and are sent a unique code by post. Users can then log in (at least the first time) by entering the code only. The goal ...
4
votes
1answer
558 views

Is it a good idea to use two salts? [duplicate]

Is it a good idea to use two salts? This is implying that one would be unique to the user, and one would be unique to the server, using Bcrypt of course. So for example, if you're using Golang as ...
-2
votes
2answers
88 views

Password hashing and blowfish [duplicate]

What I'm about to say is probably going to make me look like an idiot but it's better to be wrong and learn than have unanswered questions. Ever since I started dealing with passwords I wondered what ...
0
votes
0answers
20 views

Best practise Managing Key Material Securely in Memory in android

I am aware of the issue of user entered pass phrases being left in memory if stored in Java Strings (due to String being immutable). Which takes me onto using char arrays. However, I am wondering if ...
92
votes
17answers
22k views

Is “password knocking” a good idea?

With port knocking, you have to "knock" on specific ports in defined order to expose a port on which service is running. How about password knocking? For example you have three passwords: A, B and C. ...
0
votes
1answer
97 views

Can Google's administrators be trusted with Google Authenticator? [duplicate]

Suppose there is an evil Google administrator who has full access to every server or network at Google. Will such a person be able to abuse the Google Authenticator technology to gain access to ...
2
votes
1answer
112 views

Is this a secure way to generate passwords at the command line?

Occasionally I need to generate a password while working at the Unix command line. I have the following alias in my zshrc: alias randpass='openssl rand -base64 32 | tr -d /=+ | cut -c -30' These ...
1
vote
2answers
56 views

Hashing password with salt [duplicate]

I read from wiki: The attacker has access to both the hashed password and the salt, so when running the dictionary attack, the attacker can simply use the known salt when attempting to crack the ...