Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
2answers
18 views

Passwords: Symbols and length > 20 disallowed

I'm going through a bunch of accounts at the moment changing my passwords, some of them are looking a little weak and i've reused them, but i keep coming across websites that don't allow you to use ...
20
votes
11answers
3k views

One liner to create passwords in linux?

How do you create a readable password using bash with one line? What if i'm looking for 128 bits of entropy? EDIT By readable I mean the 94 readable ascii characters (without space). It can use less ...
1
vote
2answers
52 views

Facebook security

I check my security settings (from my Facebook acc.) from time to time, and sometimes I see there are IP addresses which logged into my account but don't belong to me. When I look in the web who is ...
3
votes
6answers
6k views

Hardware USB Key to Reset Any Windows Password

This tool requires physical access of course, and there are many things you can do once you have physical access, but this peaked my curiosity. The tool in question: ...
2
votes
1answer
722 views

How secure is automatic authentication in Skype?

How secure is checking the automatic authentication option in Skype client? What if I sign in with Microsoft account instead of Skype id? What if both accounts are merged? Is there any documentation ...
5
votes
3answers
222 views

When form submission fails, password field gets blanked, why is that the case?

I've recently asked a question about blanking the password fields in UX for usability purposes, but It seems all the sites use this approach for security reasons. Why is it insecure to post back the ...
41
votes
6answers
3k views

Is the option to jump to blanks in password fields a security risk?

Using Ctrl + ← / →, it's a common behavior across different operating systems to jump from word to word (or from blank to blank) in text input fields. Now I've discovered that this also applies on ...
-1
votes
3answers
112 views

Gmail, Yahoo, Hotmail , and so on; How do they check the content of an attached password-protected archived file like Winrar?

How is it possible that mailing systems like Gmail, Yahoo, and Hotmail are able to check the content of an attached password-protected archived file like WINRAR, if the password cannot be guessed, ...
316
votes
12answers
51k views

What technical reasons are there to have low maximum password lengths?

I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites I actually care about ...
-1
votes
2answers
9k views

Recover Windows Server 2003 admin password through restricted user

OK, so here goes after a lot of trial and error: background: My client recently took over another firm. However, apparently the administrator passwords to the server (along with some other non-IT ...
3
votes
3answers
204 views

Method to integrate Touch ID in iOS apps

With the recent announcement of Touch ID APIs for third party apps, I am wondering how can we leverage this feature to perform secure transaction ? I am looking for a method to use Touch ID in my ...
12
votes
6answers
2k views

What is the simplest safe way to convey a password to another person? [duplicate]

What is the easiest way for two people – neither of whom are computer specialists and cannot meet in person – to send a password for an encrypted file that is attached to an email? The two simplest ...
1
vote
4answers
75 views

Password recovery flow - Send Password recovery to any email?

I am building a new MVC app. Considering this "forgot password" flow: 1)You enter an email. 2)You press "send recovery password". 3)An email awaits in the inbox, pressing the link in it brings you to ...
2
votes
1answer
60 views

How to handle legacy website account login credentials

I have a lot (>1000) of credentials for website logins in my Chrome's password safe. Some of them are quite old (> 10 years) and have weak (dictionary) passwords. Some of the accounts have low value ...
1
vote
0answers
52 views

Database row level encryption scheme

I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
0
votes
3answers
105 views

One Less Password

I just came across this: https://blog.webmaker.org/one-less-password Basically a technique for eliminating passwords as the primary authentication mechanism for connecting to a website by replacing ...
1
vote
2answers
42 views

Would it better to enforce more complex passwords or passphrases? [duplicate]

I have read in different places that passphrases offer better security and are more user friendly however, I have also read contradictory information thats says longer passwords are not really more ...
-8
votes
1answer
83 views

I need help on how to hack into a scammer computer via IP/DNS [closed]

I really need your help in this one. Today I got scammed by a "trader" for 100$, but I managed to get his IP, reverse DNS and Hostname but I am unskilled in hacking. I need help here, I just want to ...
3
votes
2answers
2k views

How does Authy's 2FA work, if it doesn't connect to the server?

I thought I knew how two-factor authentication works: I enter the password. Server generates a random number (token) and sends it to me via SMS. I enter this token. Server checks that the token I ...
3
votes
0answers
57 views

Is it possible to retrieve SSH v2 credentials in a username/password authentication scheme?

I'm currently analysing a compromised network(root access has been gained to a workstation and logs show that it has been used for port scanning and service brute forcing attacks on the remaining ...
1
vote
1answer
146 views

How to safely use a Key Derivation Function to secure private data - need guidance

I have some secure data created in my client app which I wish to store on the server as backup for the user. The user already has a password to authenticate with the server. The password is never ...
12
votes
4answers
3k views

Is an 80 bit password good enough for all practical purposes?

I know that asking how many bits of entropy comprise a strong password is rather like asking the length of a piece of string. But assuming the NSA is not on to you, and that it is hardly worthwhile ...
5
votes
1answer
390 views

Chinese or “pinyin” wordlists for dictionary attacks

Background: I am currently trying to crack a salted md5 hash which I have recovered from an embedded device running busybox and manufactured in china. I have tried john the ripper using all of the ...
-2
votes
3answers
101 views

My friend hashes passwords with SHA512 algorithm without salt. How do I convince him that he needs to add salt?

Today I discovered something incredibly stupid - my friend hashes user passwords with sha512 algorithm without a salt. I immediately raised this issue to him but he said he wants to see anyone crack a ...
11
votes
6answers
583 views

Security of carrying passwords on person

While in college I decided to have a randomly generated 16 character password. I used parts of that password in various sites. However, one of the sites was compromised so I had to change my password. ...
282
votes
20answers
47k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
2
votes
1answer
189 views

Is there more risk in changing administrator password locally vs from a centralized location?

I'm working on a mechanism to better handle group policy passwords in response to MS14-025. We formerly used this mechanism for setting the local admin account passwords on our workstations (primarily ...
1
vote
4answers
394 views

Authenticate user without knowing their password

I'm working on a project where each each user will have a public/private RSA key-pair. Users will be able to send encrypted messages to each other using the each target user's public key so that only ...
1
vote
1answer
1k views

Due to which reason might a windows 7 password been reset to empty?

A user reports on monday he cannot access his windows 7 account anymore due to a "wrong password", which perfectly worked on friday. It turns out the password has been reset to empty for that account. ...
0
votes
1answer
43 views

Securely map random string to a custom charset

I'm writing a Python script to generate custom passwords based on a HMAC. I want the passwords to support various websites requirements so I want to map the HMAC output (ex: hex format) to an array of ...
5
votes
4answers
515 views

How can hackers guess passwords (using dictionary attack or brute force) without being locked out?

Nowadays almost every website you want to register in; is asking you to create a complicated password...But why cant we use simple passwords? I am just wondering because in case of multiple wrong ...
0
votes
1answer
93 views

Can any App Store app access all of my passwords?

Whilst researching another question, I've noticed that on OS X 10.9.4 there are many instances of Library/Keychains/login.keychain from ~ within the Data folder of what looks like apps from Apple App ...
1
vote
2answers
82 views

How to implement password reset functionality without becoming susceptible to cross-domain referer leakage?

I have typically implemented password reset functionality by sending a link that included something like this: http://example.com/pwreset?id=userId&resetToken=superSecretResetToken On my pwreset ...
3
votes
4answers
8k views

A low tech yet secure way to keep track of passwords?

I use LastPass and love it. My girlfriend creates her own long, complex, unique, and thus difficult to remember passwords for every site. She frequently forgets them and has to rest the password. ...
0
votes
3answers
116 views

Can you have Secure encryption with a backdoor, and still be secure?

Is it possible to have an encryption algorithm/implementation that has a "backdoor", that also wouldn't introduce flaws into the encryption? For instance, if you have a master password, once that ...
3
votes
1answer
123 views

Windows system password hashed - see which hash is used

How can I know / see if my windows is using NTML, LM, NTML2 for its user account passwords? What is the standard today, in windows systems?
2
votes
1answer
157 views

Storing a user's password in a retrievable manner

I currently store my users passwords as PBKDF2 hashes, for the authentication part of my web application. Each user also has their own private key and public key (also stored in their user profile in ...
12
votes
5answers
3k views

What is a good practical (and sane) way to manage all your passwords for online sites?

I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords. This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
61
votes
4answers
12k views

Recommended # of iterations when using PKBDF2-SHA256?

I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
0
votes
0answers
69 views

Hydra sometimes fails against my own router known password

Hydra sometimes fails against my own router known password. Sometimes confirms it was found, and sometimes returns unusual error code (empty). What does this means? dione@saturno:~/misc$ hydra -l ...
5
votes
5answers
22k views

How to generete dictionary for brute force attack?

I need to crack my own password. Advantage is that I know possible characters and maximum length. What I need is to create dictionary for brute force attack. Dictionary should contain all the combos ...
0
votes
0answers
131 views

John the Ripper - Calculating brute force time to crack password

I'm using incremental mode (brute force) mode in John the Ripper to crack Linux MD5 passwords. I'm trying to calculate the time it will take to run through all combinations of 12 passwords (with 12 ...
7
votes
7answers
1k views

Facebook account keeps getting hacked, can't seem to figure out why or how?

One of my mate, she has a lot of friends on Facebook, uses it for marketing. Her account keeps getting broken into. Her password gets reset and/or gets locked for changing resetting password too many ...
0
votes
1answer
227 views

How compromised should I assume my computer is?

I had turned ssh on a while ago to do some remote work. I was just looking over some netstat info when I noticed someone had established an ssh session with me D: I turned ssh off immediately and ...
3
votes
3answers
184 views

Is it ok for software to store passwords locally in plain-text?

There are already plenty of questions about what to do when websites store plain-text passwords. But this one is a little different. I use a piece of open-source (see below) software for playing ...
23
votes
2answers
3k views

Passwords in plaintext?

I'm doing some research on the App of my telephone operator. I started Burp Suite on my Mac in proxy mode, I opened up the App on my iPhone and started to sniff some traffic. I pressed the "login" ...
3
votes
3answers
474 views

Accepting other similar passwords when storing a salted, hashed password

If a website stores passwords as a salted hash, is it reasonable to accept similar passwords as correct? For example, given the password stackexchange, does it dramatically decrease security if the ...
3
votes
3answers
115 views

Where are the user credentials stored when remember password is selected?

Provided a user has chosen the remember me option while logged in last time into a web application,how does the web application server identifies the user next time when he logs in? The credentials ...
5
votes
3answers
234 views

Calculating password hashes in the browser?

I just finally got into Keybase and was surprised to see this in the sign-up page: Shouldn't password stretching and hashing be done on the serverside, as we normally don't trust a client?
0
votes
3answers
203 views

Are windows users passwords easier to crack than linux?

If i set the same password in both linux and Windows, is it easier for a hacker to break the windows password? If so why and how can i create a windows password in the same security level as Linux?