Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

52
votes
9answers
8k views

I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?

Without even thinking about it, I typed my password into the Google search bar, but I didn't press enter. Since autocomplete is on, does that mean my password has been logged or indexed somewhere? ...
0
votes
3answers
30 views

How secure is it to use passwords consisting of one common part and one site specific prefix? [duplicate]

One of the greatest problems with passwords is having to remember different passwords for different sites. Some people use password managers, others use the password reset link every time they want to ...
50
votes
11answers
5k views

Could keystroke timing improve security on a password?

When I was young, and had just started out in my software-development career 20 years ago, I wrote a little bit of code on my Amiga that took a password, but also recorded (within some threshold), the ...
0
votes
0answers
36 views

How to safely pass password reset token from http get request to html page?

I am working on implementing my own custom password reset that sends an email where the user is taking to a page to reset their password. So far I have generated a unique token that gets put in an ...
4
votes
0answers
63 views

What are the recommended scrypt cost factors for 2016?

I've been trying to look for the answer, but the latest one I found was outdated by three years. So what are the recommended scrypt cost factors for 2016?
4
votes
1answer
76 views

How secure is my system for a password reset?

I am using my custom Parse Server with Heroku which I am pretty sure (99%) that it is decently secure using things like oAuth2 and 1 way hashed passwords. The problem is I am trying to implement my ...
4
votes
1answer
81 views

Spoofing an NTP server to allow bruteforce on any smartphone

We all know that smartphones (i'll take iPhone as an example) rely on SNTP/NTP servers to update a device's time and date. So, by creating an SNTP server that mimics Apple's server, we can actually ...
0
votes
0answers
37 views

Does an account with a !! /etc/shadow entry have to still expire?

Currently where I work, our password policy is set at 84 days. This is set in our login.defs on all of our Linux machines. We have policies that are set around PCI DSS 3.1 and the like, this goes for ...
3
votes
0answers
41 views

Is it possible to remove the password on new generations of Lenovo X1?

I have lost the password for my setup. I set it up a few years ago and now I cannot recall it. The supervisor password is not stored in an EEPROM so the usual tricks do not work. I think it is in a ...
-1
votes
1answer
82 views

CRC-96(ZIP) decryption

Is there a way to decrypt CRC-96 encrypted string? I am testing a web application which stores the password in the database in CRC-96 encrypted format.
-1
votes
0answers
57 views

Is it more secure to always download app/update iOS via iTunes in PC/Mac instead of in iPhone directly?

Is it more secure to always download ipa and then sync iPhone/download update by iTunes instead of downloading them in iPhone directly? Because I think it allows me to never enter my apple account ...
-5
votes
1answer
70 views

What is AES 256 bit encryption? [on hold]

I was looking through some apps to store my passwords in on the App Store when I found one that boasted an "AES 256 bit encryption system". Now that sounds all very good and well, but that doesn't ...
2
votes
1answer
128 views

Enter the password outside the password field

If I press Tab twice after enter my username, I will type my password somewhere outside the password field. Are there any chances for somebody to catch my password when I enter it outside the ...
23
votes
4answers
2k views

Should I be worried if I accidentally entered my password in a username field?

Occasionally I will fail to hit Tab properly when entering a username/password combination. This results in me submitting username "myUsername$ecretPa$$word" along with a blank password. I always ...
6
votes
4answers
1k views

Does quick denial tell that you passwords are stored in plain text?

Say you are using a website and incorrectly enter your password. The website then "instantly" pops ups with an "incorrect username/password" message. Would it be safe to infer that the website is ...
1
vote
1answer
47 views

Powershell and cached credentials

In my environment we have powershell remoting off- I get around this using 2 hop scripts, packages(exe -no creds are stored in code- local privs only), and iwmi. I never pass creds to the endpoint, ...
0
votes
1answer
79 views

Passwords processed on server side? [duplicate]

So while I was working on my personal project something struk me. When somebody creates an account on any web service/social media they provide their desired username and password,this is then ...
10
votes
7answers
20k views

Is a longer WiFi password more secure?

Today I had to type the same password to connect to a WPA2-secured WiFi network several times, and got really annoyed with the length of the password. Especially since it is just a phrase repeated ...
36
votes
4answers
4k views

Avast AV could read Firefox saved passwords

My friend uses Firefox's built-in password manager feature to save passwords for sites. Later, after installing Avast Free Antivirus there was a feature called Passwords on the Avast UI. When accessed ...
0
votes
1answer
154 views

How long will it take to break a salted password?

Let's say that I have a system where all passwords must be 8 characters long and each character can be any 32 different values. All my passwords are hashed with a salt. I can test 64 passwords per ...
3
votes
1answer
91 views

How to detect mimikatz usage on LAN

My boss is has made it clear that we need better ways of detecting mimikatz usage on the network- and I would agree. In place already for detection is suricata/ET PRO rule set on a couple of taps. ...
59
votes
8answers
6k views

Is it OK to tell your password to your company's sysadmin?

I'm working in a small company (20 employees) as a senior software engineer. After having problems with my email, our newly employed IT administrator asked me to write my user password to someone in ...
0
votes
1answer
57 views

How to conceal a computer in operation with a separate logon password?

Goal: Disallow physical people near the computer to see its operations. No password to start the computer. But, I'd like to conceal the screen after startup and all programs loaded. Because of the ...
58
votes
9answers
16k views

Generic error message for wrong password or username - is this really helpful?

It is really common (and I would say it is some kind of security basic) to not show on the login page if the username or the password was wrong when a user tries to log in. One should show a generic ...
1
vote
2answers
80 views

memorable word and answers to security questions when resetting password?

Context We have a situation where we are allowing our users to login using either using Username & password + Memorable word OR Username & Password + answer to Security questions depending on ...
-4
votes
1answer
465 views

Why don't we do dual password instead of forgot password?

You can see the link "Forgot Password?" nearby almost all login form. Since passwords are completely protected from outside access, I come up with this question. I accept that the forgot password ...
-6
votes
1answer
98 views

How come I can log in on a random webcam with the password “admin”? [closed]

I used http://shodan.io to look for internet-connected webcams. I found one (in Russia), and I managed to succesfully log in to it using admin as the username and admin as the password. How can this ...
4
votes
1answer
72 views

texting password reset link instead of a code

An increasingly common process for assisting with password resets is the application texting a code/token to the user’s verified mobile phone. We have a client which would like to eliminate the need ...
2
votes
1answer
141 views

What are the security features of the Microsoft PasswordVault class?

There doesn't seem to be much information on the PasswordVault but it seems to provide for local encryption of credentials. There are references to it in this source code and this blog. The reason ...
4
votes
4answers
113 views

Sending server-generated password by email

I'm implementing a system where our users need to enter a special (permanent) password to authorise a transaction. The password is separate to their login credentials, and they can only enter this ...
-1
votes
0answers
10 views

Queries on config.php and ArtifactResolutionService.php - SimpleSAMLPHP [migrated]

We are using SimpleSAMLPHP for SSO. In config.php file, datastore type is configured to be phpsession by default. Since this cant be used, next option is memcache. As we dont make use of memcache, ...
7
votes
8answers
1k views

How easy is it to find a password in a huge text file?

Say that my password is PASSWORD1 I have a 10MB jumbled text file. I hide my password in two parts in the text, between > and < so I can find it myself. Then I put the 2 parts together and add the ...
26
votes
5answers
3k views

How can I choose a strong password that is easy use on a smartphone?

Typing on a smartphone is tedious. Special characters are the hardest; lowercase letters are generally the easiest. But even a long all-letter passphrase like "correct horse battery staple" is ...
10
votes
2answers
927 views

Is there more to password hashing?

You have a plain text password and salt. The plain text password is assumed to be securely random and only known by the user and the salt is no secret and not necessarily unique but stored alongside ...
3
votes
3answers
79 views

What are the demerits of a derived salt for password storage?

The general method used for storing passwords securely involves generating a salt, feeding the salt and password to the password hashing function, and then storing the salt and the output of the ...
12
votes
8answers
2k views

Facebook account keeps getting hacked, can't seem to figure out why or how?

One of my friends, she has a lot of friends on Facebook, and uses it for marketing. Her account keeps getting broken into. Her password gets reset and/or gets locked for changing resetting password ...
4
votes
2answers
166 views

How do I protect my passwords from WebBrowserPassView?

I just got shocked with what can be achieved with WebBrowserPassView. It basically shows every password I've saved in my browser (Chrome). I guess other users on my PC could get my passwords that ...
3
votes
1answer
73 views

Creating accounts on sites with no security?

I'm sort of confused about security on some sites. Here on stackexchange.com, for example, seem to have no security normaly, but as you log in or create an account, it uses keyexchange and an ...
127
votes
7answers
18k views

Internet courtship: Why would a hacker buy me poker chips?

Believe me, I never expected to ever write a title like that on a Stack Exchange site either! Yesterday evening I got a call from my mother. She is quite tech savvy and generally knows her way around ...
-1
votes
0answers
41 views

Best practices for encrypting passwords on a server [duplicate]

I have a web application where users can optionally choose to link their accounts with a third-party service provider to enable some additional features. Unfortunately, the third-party webservice API ...
3
votes
1answer
600 views

Cracking a 6-character alphanumeric password Windows dialog box

To put this problem in context, I have a touch monitor screen whose firmware program is protected by a password. The firmware program is downloaded over RS232 via a Windows utility program provided ...
1
vote
1answer
98 views

How to handle password storage for my project?

We have NFC cards to keep track of presence, students scan their card to a terminal at the beginning of every lesson, we want to extend the cards usage to filter out who can access the Raspberry Pi's ...
2
votes
1answer
85 views

Email code authentication

I'd like to replace passwords with a temporary code that's emailed to the user. The login flow would go like this: User enters their email address. "If that email belongs to a user, a code will be ...
4
votes
1answer
88 views

Safely store passwords in specific scenario

I have a specific network environment. Its a DTN(Delay Tolerant Network) network without continous connectivity, situated on the sea, where nodes are ships. There is also a server that is a part of ...
116
votes
6answers
44k views

Password Hashing add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
3
votes
1answer
3k views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a ...
4
votes
1answer
86 views

What technologies does ChromeOS use to secure saved passwords?

I have read that Chrome will use the system's native credential tools to manage saved passwords (e.g. KeyChain on OSX, libsecret on Linux/GNOME etc). Does anyone know what tools are used on ChromeOS? ...
2
votes
4answers
288 views

MySQL user passwords in PHP

How do I prevent exposing MySQL usernames and passwords in PHP code when establishing a connection?
1
vote
1answer
82 views

PHP BLENC extension security concern

PHP BLENC is a extension that allows PHP developer encrypt their code, protect their ideas and avoid illegal copy. Although BLENC allow developer to define the main encryption key in source(in the ...
26
votes
5answers
4k views

How does storing hash passwords work? [duplicate]

In usual network applications, that employ password hashing, is the user password hashed on client side before sending it to the server, or is it sent without hashing as encryption of plain text ...