Tagged Questions
15
votes
6answers
854 views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
20
votes
2answers
1k views
Does versioning an encrypted file make it less secure?
Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices.
The kdb file in itself would be encrypted, but ...
5
votes
4answers
247 views
Do honeywords add any real security?
This paper proposes the concept of honeywords for detecting if a password database has been compromised.
As far as I understand it works like this:
You save n password hashes for each user, one that ...
11
votes
1answer
220 views
“Please Enter Nth Character” without HSM
This question has been asked a few times, but always in the format
"How does examplewebsite.com implement their 'please enter xth yth and zth characters of your password' function?"
And the ...
2
votes
1answer
99 views
User Authentication API
I'm developing a web API for a user database that will be used to verify a given username / password combination is valid.
I'm just looking for comments / criticism on the following method that I'm ...
2
votes
1answer
458 views
How long it will take to crack a RAR password?
I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we ...
5
votes
1answer
117 views
When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?
When you take ownership of a TPM in Windows 7 you encounter a screen like this:
Based on this document, it is my understanding that completing this dialog box somehow results in the generation of ...
-3
votes
2answers
295 views
Is pixel based image encryption secure?
I have encrypted an image using pixel encryption method. I just used a bmp image for that. What I did is, I retrieved each pixel value from the image and obtained the value of red, green and blue ...
3
votes
2answers
189 views
File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?
I've been using this command to encrypt files for a while now:
openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc
Then I type in a password.
Can someone tell me, roughly speaking, ...
4
votes
1answer
151 views
Saved passwords (use case)
I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together.
Both the data and the password are encrypted ...
-4
votes
1answer
143 views
Secure Web application Password vault/manager [duplicate]
I would like to build an open source online password vault which allows users to securely store their passwords, like Keepass or roboform, but where a user can access their passwords through a ...
4
votes
3answers
377 views
Encrypting user data using password and forgot my password
I am planning to do a web application which stores a lot of personal stuff (info, photos...). And to give users a sense of protection, I want to encrypt the data before storing it to the database.
...
4
votes
3answers
208 views
Completely mimimise the possibility of my web hosting account being hacked
I've just moved web hosting providers and I want a fresh, secure start. To a certain extent, I don't mind what I have to do I'm just fed up my account being hacked or infected. I just wondered how to ...
2
votes
1answer
472 views
Security of bcrypt/sha256 key used with AES to encrypt a file
I'm looking to encrypt files using secure hashing and encryption algorithms in Python. Having used bcrypt in the past, I decided to use it for my passphrase calculator, then pass the output through ...
1
vote
3answers
163 views
Is it a good idea to have a “master” password?
Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
4
votes
2answers
829 views
openssl: recover key and IV by passphrase
A large amount of files were encrypted by
openssl enc -aes-256-cbc -pass pass:MYPASSWORD
Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
2
votes
1answer
133 views
Accessing encrypted data with multiple users
I'm building a web based, LDAP authenticated password manager for internal use.
We don't want to store the passwords in plain-text in the database, and we want multiple users to be able to access the ...
0
votes
1answer
133 views
Storing Private Keys Generated on Server with specific User's Password Securely
I am currently building a system (PHP Web Application Framework) that creates an RSA Key Pair for a user to allow other users to send secure information from one to another. The public key is ...
1
vote
4answers
146 views
Secure login feature with low CPU power
I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
3
votes
3answers
625 views
Choosing a session ID algorithm for a client-server relationship
I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
2
votes
6answers
271 views
Does shuffling a hashed password increase its security?
I am making a web app and I'm now stuck on making the login secure. I'm thinking of adding a salt to a user-inputted password and then hash it. (md5 or sha for example)
and then I will reshuffle the ...
6
votes
3answers
208 views
How much added security do I really get with a longer key size?
Imagine I have a cipher which supports keys of 128, 192 or 256 bits. Suppose that there are no vulnerabilities in the cipher regardless of key length. I'm going to use it to encrypt something, and ...
2
votes
1answer
119 views
Password checking in the context of symmetric encryption
It is my understanding that block ciphers like AES don't have any built-in mechanisms to verify data integrity upon decryption, although some modes of operation might provide that.
I played around ...
2
votes
1answer
107 views
Security of re-encryption with a list of pre-computed password based keys
I have a problem where an encrypted file stored on a server needs to be decrypted through a precomputed list of passwords that are used one time only - OTP applied to encryption basically. The file is ...
4
votes
3answers
789 views
What key does Linux use when storing user passwords?
Linux typically stores user names and password hashes in /etc/passwd or /etc/shadow.
Now lets say I have an old CentOS distro and I want to attempt to recover a user's password (it's in a legal, ...
1
vote
3answers
589 views
How to secure data before returning Macbook Air?
I am returning my MacBook Air to Apple and want to know the best way to ensure my data is not recoverable from the flash storage. I currently have Filevault 2 enabled, however before I enabled it I ...
-1
votes
3answers
173 views
find password and iv of an encoded string knowing the decoded string
If I would know the clear and encoded versions of a string could I somehow find the password and.or iv that wore used to encode it?
Encoding done with open_ssl aes-128-cbc.
0
votes
1answer
154 views
How key_derivation and key_verification functions are implemented of a 7-zip archive's encryption mechanism?
I am curious about how password recovery works for password protected files. And I want to know the exact flow of the 7-zip encryption mechanism :) !!
7-zip uses the AES-256 encryption algorithm in ...
3
votes
1answer
144 views
DPAPI offline attack by cracking windows password?
I'm thinking of using DPAPI to protect configuration file information in my program. After doing some reading on it, it looks like it uses the user's Windows password as part of the encryption ...
3
votes
2answers
5k views
Remove Password Protection from XLS Document
Similar to what is listed here, http://datapigtechnologies.com/blog/index.php/hack-into-a-protected-excel-2007-or-2010-workbook/, is there a way to remove the password from an XLS (Excel 2003) ...
4
votes
1answer
202 views
Should password hashes be encrypted or HMACed?
Assume I am hashing user passwords with PBKDF2, bcrypt, scrypt, or some other secure key derivation function.
Are there:
tangible security benefits,
precedents, and
respected research
for ...
2
votes
1answer
1k views
Why it does not matter whether you type HEX or ASCII as WEP WiFi password?
I know that I can pass password in HEX as a keyphrase to WiFi network using WEP encryption as well as ASCII. But somehow you cannot get the ASCII when you only know HEX value.
Can anyone explain the ...
0
votes
2answers
903 views
Is it safe to store password in PHP session?
I need to do some encryptions in the Private zone of my website and I want to use bcrypt with user's password.
Is it safe to store the password in the session when user does the login, so that I can ...
2
votes
3answers
345 views
Password Vault - Enterprise
I want to be clear from the get-go that I am NOT looking for a user password management solution. My organization already uses AD for that.
What I am looking for is a password vault. Up until now, ...
2
votes
4answers
212 views
Can public keys be a security risk when performing password-less SSH logins?
Some companies use monitoring software such as nagios or icinga. In order to perform checks on the servers, they often need password-less SSH logins.
The servers being checked put the public key of ...
41
votes
5answers
5k views
Is sending password to user email secure?
How secure is sending passwords through email to a user, since email isn't secured by HTTPS.
What is the best way to secure it? Should i use encryption?
1
vote
3answers
194 views
Logic for generating Strong Password?
I try to encrypt password using MD5 but there are decoders for MD5. So I'm worried about encryption of password for big website.
Is there any logical suggestion or step function to generate strong ...
2
votes
2answers
2k views
Excel 2007 Encryption Strength
With a strong password of 10+ characters, mixed case, etc... Is the encryption of a Excel 2007 document secure enough to create reasonably strong defense against a brute force attack?
What encryption ...
9
votes
5answers
629 views
Is it worth the effort to store FTP passwords encrypted?
I have a project to build a system that needs to push files to multiple third-party FTP servers. I have asked these third parties to provide a more secure interface; all have declined. So now I have ...
-2
votes
1answer
197 views
What encryption hash function I should use for password securing? [duplicate]
Possible Duplicate:
How to securely hash passwords?
What is the best encryption algorithm? MD5, SHA1, SHA2 or maybe something else? Can you explain me why?
1
vote
4answers
274 views
Are there vunerabilities with this authentication mechanism?
I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL. The goal here is to avoid sending any sensitive information across the wire.
I was ...
1
vote
2answers
228 views
Hash, encryption of file… key? Need help [closed]
So my previous question was with some help on pcap files as I am doing a security course and we have a challenge to figure out what was going on in our network. Now one of the files I retrieved is an ...
4
votes
4answers
586 views
Is encrypting a salt value with a password/plaintext a viable alternative to straight up hashing?
The basic problem, as far as I can tell, is that hashing's flaw is that the password is in the hash. Asymmetric encryption's flaw is that the password is encrypted and can be reversed.
The posts ...
1
vote
3answers
323 views
Linux mcrypt security
I just installed 'mcrypt'. When I try to encrypt some file with DES using the command 'mcrypt -a des myfile', I am prompted for a passphrase with a maximum character count of 512.
> mcrypt -a des ...
4
votes
3answers
149 views
Is using encryption the only viable option to thwart password sniffing?
I'm using HTTPS Everywhere on my browser to chose SSL versions of websites when available, but many sites don't offer a secure version. Is SSL the only viable option to thwart password/clear text ...
15
votes
2answers
2k views
Standards for encrypting passwords in configuration files?
My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they ...
2
votes
1answer
200 views
How to download PHI PDF from a secure website to a secure, encrypted folder on Windows 7?
Objective: HIPAA compliance.
Here is the process:
Receive PDF File through secure website
Open the PDF (Which involves downloading to some folder)
No longer need PDF
The Question:
Is there any ...
2
votes
1answer
1k views
How can I decrypt traffic on a WEP encrypted network?
Let's say that I am connected to a WEP Access Point and I want to sniff all wireless traffic inside that network. How can I decrypt the traffic even though I don't have the cryptographic key?
I found ...
2
votes
2answers
282 views
Can key files be brute-forced like passwords?
Let's say you use a program like Truecrypt or Keepass which allows you to have a password + key file. I understand that passwords can be brute-forced/dictionary-attacked but is the same true for key ...
19
votes
5answers
980 views
Is it alright to tell everyone your encryption information?
I have an account in an online banking system and they have the FAQ with something like this:
How secure is the <Online Banking System Name>?
Each page you view and any information ...
