Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
0
votes
0answers
29 views
WPA2 audit tool as of 2013? [closed]
For the purposes of my own research, I have a very modest budget to set up a modest WPA2 brute-forcer supported by GPU(s).
I've done some homework
Brute-Force GPU Password Crackers
How to setup ...
2
votes
1answer
75 views
Brute-Force GPU Password Crackers
Brute-force password cracker programs which claim GPU support include John the Ripper, ighashgpu, oclHashcat, and others. oclHashcat appears one of the more popular, but I am not sure which AMD/ATI ...
-2
votes
2answers
40 views
Looking for safe, simple way to store passwords with PHP 5.2.17 [duplicate]
I've found many posts on StackOverflow and other sites using Google, but since security is always changing, and what was safe a few months ago not me anymore... I felt the need to ask on here.
...
-4
votes
1answer
66 views
How can I crack ArrayOS password [closed]
I have some Array Load Balance device that the user password hash like:
user "array" "XXXXXXXXXVkjTX9a1kYtNo".
How can I crack the password or find out the algorithm of the hash?
-1
votes
0answers
51 views
Which is the most popular one time password based authentication scheme? [closed]
Which is the most commonly used (popular) one time password based authentication scheme?
2
votes
2answers
34 views
Does glibc2 version of the crypt function still use DES for alternative hashing methods?
I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted ...
52
votes
7answers
2k views
Touch Screen Password Guessing by Fingerprint Trace
After having some garlic bread at a friend's who is not security-aware, she managed to figure out the PIN code to unlock the screen of my Samsung SIII.
The way she figured this out was by simply ...
7
votes
3answers
172 views
Plain Text Password Reset Vulnerability
If I receive an email with a plain text generated password (in response to a password reset request), is this a vulnerability? The password expires after one use, in other words the user has to change ...
-2
votes
1answer
156 views
Unsolicited Password Request from Facebook
Today I have received 3 emails to my three different addresses, one with Google, one with MSN, and one with my company. All emails were sent from password+kjdmiikvhppi at facebookmail.com email ...
0
votes
2answers
131 views
Bruteforce Passphrase of Dictionary Words
Consider the all lowercase passphrase:
"lazy fox haggles treaty"
Assume all four words are in a dictionary of 2000.
Bruteforcing word combinations, how long does it take to crack this password at ...
15
votes
6answers
829 views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
20
votes
2answers
1k views
Does versioning an encrypted file make it less secure?
Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices.
The kdb file in itself would be encrypted, but ...
25
votes
8answers
2k views
Are password-protected ZIP files secure?
Following my answer. If I can list contents of password-protected ZIP file, check the file types of each stored file and even replace it with another one, without actually knowing the password, then ...
-1
votes
0answers
52 views
If someone know my IP address? [duplicate]
With my IP address. What can they do exactly? Can they spy on every move I make, Like I post here or about my another ID or if i create new e-mail or face book? is it possible to find out all of my ...
3
votes
2answers
100 views
Protecting Password Hashes with Store Procedures?
I was thinking about the recent (seemingly weekly) security breaches we've seen where millions of password hashes have been leaked and I was wondering how one might secure their site against a ...
0
votes
1answer
71 views
Password storing in Google Chrome content scripts
I am planning to store the login credentials in Google Chrome content scripts. The content scripts will then use these credentials to login to a website when I open it in Chrome.
I wanted to ...
0
votes
5answers
241 views
Pronounceable Password Generator
I am currently looking for a password generator which produces pronounceable passwords. I have used this random password generator a few years ago to generate a 42 characters long password and found ...
24
votes
10answers
3k views
Intel How Strong is Your Password page, good advice?
I came across this Intel How Strong is Your Password? page which estimates how strong your password is.
It has some advice on choosing better passwords including that you should use multiple ...
-3
votes
0answers
74 views
My Evaluation on the Recent Honeywords Paper [closed]
I just read the paper "Honeywords: Making Password-Cracking Detectable" and have some thoughts about the reality and viability - as well as weaknesses of this approach.
My initial take is that this ...
-3
votes
1answer
55 views
Good Password Length [duplicate]
If you are looking to be careful and your passwords include all the types of characters, what is the ideal password length?
5
votes
2answers
91 views
Password list generation
I've found during a lot of recent pen-tests that companies will use passwords like
c0mp4ny@b(
for a company called "company abc"
Is there any quick and easy way to generate a list of passwords ...
2
votes
4answers
170 views
When salting and hashing passwords, any advantage to including password length?
In this answer, Gilles says (emphasis mine):
There's no need to hide the salt from the attacker: it needs to be unique (and not derived from the password) but it doesn't need to be more secret ...
0
votes
1answer
100 views
Using JTR to crack Skype Passwords
The scenario: coworker's Skype somehow lost his auto-fill password. He doesn't remember it anymore, and the account is hooked up to an email address that no longer exists. He's never purchased any ...
22
votes
7answers
3k views
Is salting a hash really as secure as common knowledge implies?
(I did search on this topic, but I found no complete question/answer that addressed it, or even good portions of questions that might be relevant.)
I'm implementing a salt function for user passwords ...
5
votes
4answers
247 views
Do honeywords add any real security?
This paper proposes the concept of honeywords for detecting if a password database has been compromised.
As far as I understand it works like this:
You save n password hashes for each user, one that ...
1
vote
1answer
60 views
Simple and secure remote installation method that accepts input via a web page?
When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner?
...
-8
votes
0answers
73 views
New work phone that belonged to someone else [closed]
I got a phone at work that belonged to someone else. I still get calls intended to for him, but is it possible that I am seeing his WhatsApp messages (I get messages and I don't recognize the sender) ...
6
votes
6answers
312 views
Cleartext password in HTML
Is there any problem with outputing a user's password to the HTML in an hidden field (see use case below before flaming xD)?
The use case is a registration form with two steps. The user fills in the ...
4
votes
1answer
80 views
Could a password hash that's prone to more collisions provide better overall security?
Website security breaches seem to be a common occurrence, giving the attacker password hashes that he can conduct a brute force attack against, often given him a list of passwords that will work on ...
4
votes
2answers
94 views
HMACSHA512 versus Rfc2898DeriveBytes for password hash
We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key
The salt is 64 char randomly generated string.
We allocated 2048 length on the database for the hashed base64 string ...
4
votes
3answers
120 views
Do email clients reduce security?
I have recently taken a security course, and have learned a lot about, among other things, the way passwords are stored, etc.
Afterwards I was thinking about the way that passwords are stored for ...
0
votes
3answers
104 views
Why one time passwords using nested hash chain are not used?
I am wondering, why web sites do not use one-time passwords generated by hash chain. By that I mean that a client chooses a secret and after being salted, he applies some secure hash function F() on ...
3
votes
2answers
129 views
Masking password when typing vs hiding input when typing
There is a command-line application that interactively prompts you for your password to a third-party service. Whereas e.g. sudo completely hides your input as you type your password, this ...
9
votes
3answers
464 views
Do users of non-latin character languages suffer from spyware and trojans?
Do Chinese, Japanese, other languages that can't be represented in ASCII get their passwords stolen? I figure there can't be some sort of bruteforce attack software for them, right? Their characters ...
1
vote
2answers
139 views
Avoiding Brute Force Attacks in a Web Based Login Form
My login form uses Ajax so it doesn't need to reload if the password is wrong. A PHP script process the request and creates the session if the credentials are right. My idea is to have the PHP script ...
0
votes
2answers
76 views
Does hash solve passwords in parts?
From an answer this earlier question: Does adding dictionary words to passwords weaken them?
"...you have no way to recognize it as a password before testing it
(against a hash or an online ...
2
votes
1answer
108 views
Why are Lengthy Password Stronger Than Complex? [duplicate]
So all my life I've been listening to people tell me to make complex password: Upper / Lower / Numeric / Symbols. Recently though I've been reading / seeing that length above all seems to make for ...
4
votes
2answers
112 views
How often should passwords change?
I'm asking two very related questions
As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their ...
3
votes
2answers
142 views
Web & insecure HTTP - Using RSA for encrypting passwords on the client side
I used client side password hashing in my register and login project.
Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in ...
3
votes
1answer
75 views
Are there any uses of having a non-deterministic salt value for hashes?
So I've been toying with the idea of having non-deterministic salt values for hashes.
Let me explain what I mean:
Basically, I applied some properties from Bitcoin including a "difficulty" (ie, ...
3
votes
1answer
138 views
How to determine hashes/second in password cryptanalysis
I'm working on my dissertation concerning cryptanalysis on password hashes. As part of my research, I aim to crack a number of passwords with John the Ripper and rainbowcrack-mt.
I'd like to ...
19
votes
3answers
636 views
Does password-protecting a server's BIOS help in securing sensitive data?
I'm running a server of which I protected the BIOS with a password. One doesn't have to enter this password before booting, but before entering the BIOS setup. I just did this from routine. However, ...
11
votes
1answer
219 views
“Please Enter Nth Character” without HSM
This question has been asked a few times, but always in the format
"How does examplewebsite.com implement their 'please enter xth yth and zth characters of your password' function?"
And the ...
2
votes
1answer
99 views
User Authentication API
I'm developing a web API for a user database that will be used to verify a given username / password combination is valid.
I'm just looking for comments / criticism on the following method that I'm ...
5
votes
3answers
2k views
With ASIC bitcoin miners, should SHA256 be considered insecure for password hashing?
I'm sure everyone here has seen the rise and further rise of bitcoin. The process used for mining bitcoin is basically "let's brute force an SHA256 hash that is less than this amount"
That being ...
11
votes
3answers
312 views
How to manage team passwords?
How do most teams handle the storage of passwords, in particular the required changes when team members leave ?
Right now, we use a centrally stored encrypted file but the thought of changing 100's ...
-2
votes
1answer
79 views
Why should I use the VPN? [closed]
Does a Virtual Private Network (VPN) provide an encrypted connection from outside networks or from ISPs to the internal network?
3
votes
1answer
105 views
Why regenerating a password's hash?
I've read http://alias.io/2010/01/store-passwords-safely-with-php-and-mysql/ on how to store passwords using PHP and MySQL, the secure way. Elbert says:
Use a cryptographically strong hashing ...
2
votes
5answers
541 views
Why have username AND password? [duplicate]
It seems most security mechanisms nowadays default to a username + password combination for authorization. I want to know why there are 2 "keys," if you will. Won't one credential suffice?
Put ...
5
votes
6answers
284 views
What's the most secure technique for authenticating user in a website?
I usually ask user for his username and password and run a query over database to return true or false, do you think it's secure enough? do you think it's better to add some steps to procedure?
