Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
24
votes
8answers
2k views
Are password-protected ZIP files secure?
Following my answer. If I can list contents of password-protected ZIP file, check the file types of each stored file and even replace it with another one, without actually knowing the password, then ...
-4
votes
1answer
64 views
How can I crack ArrayOS password [closed]
I have some Array Load Balance device that the user password hash like:
user "array" "XXXXXXXXXVkjTX9a1kYtNo".
How can I crack the password or find out the algorithm of the hash?
47
votes
7answers
2k views
Touch Screen Password Guessing by Fingerprint Trace
After having some garlic bread at a friend's who is not security-aware, she managed to figure out the PIN code to unlock the screen of my Samsung SIII.
The way she figured this out was by simply ...
-2
votes
1answer
139 views
Unsolicited Password Request from Facebook
Today I have received 3 emails to my three different addresses, one with Google, one with MSN, and one with my company. All emails were sent from password+kjdmiikvhppi at facebookmail.com email ...
7
votes
3answers
162 views
Plain Text Password Reset Vulnerability
If I receive an email with a plain text generated password (in response to a password reset request), is this a vulnerability? The password expires after one use, in other words the user has to change ...
-1
votes
0answers
49 views
Which is the most popular one time password based authentication scheme? [closed]
Which is the most commonly used (popular) one time password based authentication scheme?
14
votes
6answers
721 views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
2
votes
2answers
33 views
Does glibc2 version of the crypt function still use DES for alternative hashing methods?
I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted ...
0
votes
3answers
335 views
What about fuzzy passwords? For “correct” entry within a margin of error?
I'm wondering if a fuzzy password system would be in any way beneficial to users, or worth implementing.
The idea would be that a certain margin of error is acceptable for allowing the user to log ...
0
votes
1answer
66 views
Password storing in Google Chrome content scripts
I am planning to store the login credentials in Google Chrome content scripts. The content scripts will then use these credentials to login to a website when I open it in Chrome.
I wanted to ...
138
votes
18answers
7k views
Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field
Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
0
votes
2answers
110 views
Bruteforce Passphrase of Dictionary Words
Consider the all lowercase passphrase:
"lazy fox haggles treaty"
Assume all four words are in a dictionary of 2000.
Bruteforcing word combinations, how long does it take to crack this password at ...
20
votes
2answers
977 views
Does versioning an encrypted file make it less secure?
Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices.
The kdb file in itself would be encrypted, but ...
44
votes
11answers
6k views
How reliable is a password strength checker?
I've tested the tool from Microsoft available here which tests password strength and rates them. For a password such as "i am going to have lunch tonight", the tool rates it's strength as "BEST" and ...
3
votes
3answers
361 views
Can password-protected zip files be broken without brute force?
You have a zip file that you created with 7z to password-protect it with AES 128. Can a smart adversary extract the data only through brute force, or is the file vulnerable to other attacks - such as, ...
0
votes
5answers
224 views
Pronounceable Password Generator
I am currently looking for a password generator which produces pronounceable passwords. I have used this random password generator a few years ago to generate a 42 characters long password and found ...
-1
votes
0answers
52 views
If someone know my IP address? [duplicate]
With my IP address. What can they do exactly? Can they spy on every move I make, Like I post here or about my another ID or if i create new e-mail or face book? is it possible to find out all of my ...
8
votes
3answers
1k views
Hacking computers, scifi or reality
I was watching The Girl with the Dragon Tattoo, and this female hacker was really good at hacking. My question is, how is it possible for her to crack passwords besides the brute force approach? I ...
3
votes
2answers
94 views
Protecting Password Hashes with Store Procedures?
I was thinking about the recent (seemingly weekly) security breaches we've seen where millions of password hashes have been leaked and I was wondering how one might secure their site against a ...
22
votes
7answers
3k views
Is salting a hash really as secure as common knowledge implies?
(I did search on this topic, but I found no complete question/answer that addressed it, or even good portions of questions that might be relevant.)
I'm implementing a salt function for user passwords ...
24
votes
10answers
2k views
Intel How Strong is Your Password page, good advice?
I came across this Intel How Strong is Your Password? page which estimates how strong your password is.
It has some advice on choosing better passwords including that you should use multiple ...
10
votes
5answers
295 views
What is the best way to hand out passwords to a widely spread diverse employee base?
I have a problem I need to solve - specifically, how to hand out passwords to people in a variety of locations, and with a wide variety of access.
I've thought of some options, but there are ...
-3
votes
0answers
71 views
My Evaluation on the Recent Honeywords Paper [closed]
I just read the paper "Honeywords: Making Password-Cracking Detectable" and have some thoughts about the reality and viability - as well as weaknesses of this approach.
My initial take is that this ...
-3
votes
1answer
52 views
Good Password Length [duplicate]
If you are looking to be careful and your passwords include all the types of characters, what is the ideal password length?
5
votes
2answers
87 views
Password list generation
I've found during a lot of recent pen-tests that companies will use passwords like
c0mp4ny@b(
for a company called "company abc"
Is there any quick and easy way to generate a list of passwords ...
2
votes
4answers
168 views
When salting and hashing passwords, any advantage to including password length?
In this answer, Gilles says (emphasis mine):
There's no need to hide the salt from the attacker: it needs to be unique (and not derived from the password) but it doesn't need to be more secret ...
0
votes
1answer
89 views
Using JTR to crack Skype Passwords
The scenario: coworker's Skype somehow lost his auto-fill password. He doesn't remember it anymore, and the account is hooked up to an email address that no longer exists. He's never purchased any ...
5
votes
4answers
246 views
Do honeywords add any real security?
This paper proposes the concept of honeywords for detecting if a password database has been compromised.
As far as I understand it works like this:
You save n password hashes for each user, one that ...
1
vote
1answer
55 views
Simple and secure remote installation method that accepts input via a web page?
When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner?
...
6
votes
6answers
284 views
Cleartext password in HTML
Is there any problem with outputing a user's password to the HTML in an hidden field (see use case below before flaming xD)?
The use case is a registration form with two steps. The user fills in the ...
31
votes
41answers
3k views
What is your way to create good passwords that can actually be remembered?
What are the methodologies which can be used to generate "human" good quality password?
They have to ensure a good strength and also easy to remember for a human being.
-8
votes
0answers
73 views
New work phone that belonged to someone else [closed]
I got a phone at work that belonged to someone else. I still get calls intended to for him, but is it possible that I am seeing his WhatsApp messages (I get messages and I don't recognize the sender) ...
24
votes
1answer
965 views
What's the risk if I accidently type my password into a username field (Windows logon)?
I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
13
votes
7answers
3k views
Why do people still use/recommend MD5 if it is cracked since 1996?
It's still commonly recommended way of hashing passwords, even if it's insecurity had been proven in 1996
Therefore we suggest that in the future MD5 should no longer be implemented in ...
4
votes
2answers
88 views
HMACSHA512 versus Rfc2898DeriveBytes for password hash
We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key
The salt is 64 char randomly generated string.
We allocated 2048 length on the database for the hashed base64 string ...
4
votes
1answer
76 views
Could a password hash that's prone to more collisions provide better overall security?
Website security breaches seem to be a common occurrence, giving the attacker password hashes that he can conduct a brute force attack against, often given him a list of passwords that will work on ...
4
votes
3answers
119 views
Do email clients reduce security?
I have recently taken a security course, and have learned a lot about, among other things, the way passwords are stored, etc.
Afterwards I was thinking about the way that passwords are stored for ...
0
votes
3answers
99 views
Why one time passwords using nested hash chain are not used?
I am wondering, why web sites do not use one-time passwords generated by hash chain. By that I mean that a client chooses a secret and after being salted, he applies some secure hash function F() on ...
3
votes
2answers
124 views
Masking password when typing vs hiding input when typing
There is a command-line application that interactively prompts you for your password to a third-party service. Whereas e.g. sudo completely hides your input as you type your password, this ...
1
vote
2answers
124 views
Avoiding Brute Force Attacks in a Web Based Login Form
My login form uses Ajax so it doesn't need to reload if the password is wrong. A PHP script process the request and creates the session if the credentials are right. My idea is to have the PHP script ...
9
votes
3answers
439 views
Do users of non-latin character languages suffer from spyware and trojans?
Do Chinese, Japanese, other languages that can't be represented in ASCII get their passwords stolen? I figure there can't be some sort of bruteforce attack software for them, right? Their characters ...
0
votes
2answers
76 views
Does hash solve passwords in parts?
From an answer this earlier question: Does adding dictionary words to passwords weaken them?
"...you have no way to recognize it as a password before testing it
(against a hash or an online ...
114
votes
11answers
14k views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the ...
10
votes
7answers
413 views
Does adding dictionary words to passwords weaken them?
This might sound like a stupid question, but hear me out. If I'm encrypting my financial information and sensitive data via a program like TrueCrypt, the strength of the password is going to matter a ...
4
votes
2answers
111 views
How often should passwords change?
I'm asking two very related questions
As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their ...
2
votes
1answer
107 views
Why are Lengthy Password Stronger Than Complex? [duplicate]
So all my life I've been listening to people tell me to make complex password: Upper / Lower / Numeric / Symbols. Recently though I've been reading / seeing that length above all seems to make for ...
3
votes
2answers
136 views
Web & insecure HTTP - Using RSA for encrypting passwords on the client side
I used client side password hashing in my register and login project.
Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in ...
3
votes
1answer
75 views
Are there any uses of having a non-deterministic salt value for hashes?
So I've been toying with the idea of having non-deterministic salt values for hashes.
Let me explain what I mean:
Basically, I applied some properties from Bitcoin including a "difficulty" (ie, ...
11
votes
4answers
1k views
Security of passphrase-protected private key
If an attacker obtains a private key that was created with no passphrase, he obviously gains access to everything protected with that key. How secure are private keys set up with a passphrase? If an ...
196
votes
9answers
20k views
Is my developer's home-brew password security right or wrong, and why?
Our developer, let's call him 'Dave', insists on using a home-brew script for hashing passwords. See Dave's proposal below.
We have already researched and adopted an industry standard protocol using ...
