Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

-5
votes
4answers
106 views

Keeping passphrase away from telepathic interception [on hold]

Assuming that someone is able to telepathically intercept thoughts and words in my mind, what mechanism will allow me to authenticate securely? A solution that does not yield to physical search or ...
3
votes
1answer
1k views

How does VTP authentication prevent unauthorized access (Can the password be cracked given captured packets)

I know that when setting up VTP across switches in a network you should set a secret/password to prevent unauthorized requests. My question is I know that this uses an MD5 hash to ensure that ...
-3
votes
0answers
30 views

Dictionary File Generator for download [on hold]

I have seen in many different sites people searching by a good dictionary file or a good generator, I myself did that last week and didn't find good alternatives, so decided to code my own generator ...
4
votes
1answer
81 views

Are there problems with reusing strong passwords for private gpg keys

I am currently maintaining a few different identities each associated with different gpg keys (for personal, academic, professional correspondence etc., whether or not this is a good idea is probably ...
-4
votes
1answer
80 views

Can a dedicated server provider access my data without knowing root password?

Is it possible for a service provider to access my data without knowing the root password? Is there a way to change the root password without ejecting the disk somehow? Update: I'm wondering whether ...
3
votes
3answers
114 views

What can be done to secure passwords that might be stored in plain text or hashed inside a git repository?

I've heard a lot lately about coders being really bad at security. For one they store passwords and sensitive information inside Git repos which are often not secured well enough. Someone then comes ...
0
votes
3answers
51 views

How can I protect my WiFi if I have two routers?

I have a main desktop computer in my basement. It is connected to a modem box that my ISP gave me, which is also wireless. They also recommended a stronger wireless router, from Linksys, that would ...
4
votes
3answers
862 views

How to store passwords in a text file in USB securely?

I am planning on creating a text file to store my passwords, so I only need to remember 1 password (at the moment, I have about 20 long/complex passwords in my mind, and am worried that I might forget ...
2
votes
1answer
1k views

Password-less authentication in web apps - How safe it is?

I read a long time ago this article about how could work a Password-less Authentication System, which sounded to me like a great idea. I even built it in a small fun little application for fun. To ...
2
votes
0answers
31 views

TapLink's architecture [on hold]

Can anyone describe how Taplink's proposed architecture would look like? I heard a very high-level pitch but found no detailed technical explanation. This is a proposed architecture to harden ...
-3
votes
6answers
587 views

Is this password hashing method secure?

I have made a custom hashing method to help make my users' passwords more secure if the database will be leaked. The encryption method is like this: A method takes an input of 1 character, gets the ...
3
votes
2answers
97 views

Does a hash of a 32-bit integer make a better hash salt than the integer itself?

I have a scenario where I already have a table of resource passwords stored as unsalted 128-bit hashes. I'm unable to force owners to provide new passwords, so I'm trying to mitigate the situation by ...
1
vote
1answer
57 views

Is Auth0 Passwordless Authentication secure?

I see this advertised Medium post about building a React application with passwordless authentication through Auth0. from the link, here is the explanation of how it works: Passwordless ...
12
votes
5answers
2k views

What is the best way to transmit password hash over unreliable TLS?

I have TLS connection between my server and client. I have no certificate, so the connection is susceptible to the Man-in-the-middle attack. I fear that attacker could intercept the password hash ...
1
vote
0answers
50 views

Create reduction functions in rainbow tables

I have been trying to understand rainbow tables lately and one part is giving me trouble to understand here. Let's say I want to generate a table where the chains are 100 000 hash/plaintext long. I ...
7
votes
3answers
1k views

Known Password Lengths and security considerations [duplicate]

Many people wil often brag about the length of their password, like "yeah nobody is ever going to crack my password cause its 22 characters long." I was thinking, if you knew the exact length of their ...
4
votes
1answer
109 views

Web Based penetration test that uses MD5 for password

I'm trying to penetrate test a web based form (which is MikroTik's login form) with different tools for security measurement. I've tried THC-Hydra but problem is the password computed as MD5 first ...
1
vote
1answer
80 views

What is the right strategy for me to develop a paid public wifi?

I want to establish a paid public WiFi system. Here is my model of how it will work: I will install a public WiFi in my apartment. Using the WiFi system is paid but, voluntary. Those who pay me a ...
0
votes
2answers
56 views

How come a controlledly generated password is more secure than a purely randomly generated one [duplicate]

In a software like keepassx, to generate passwords, there's usually the option to tick some boxes. For instance, a box that makes sure that at least 1 character from every lists of characters has been ...
5
votes
3answers
26k views

What are the differences between dictionary attack and brute force attack?

Can someone explain the major differences between a Brute force attack and a Dictionary attack. Does the term rainbow table has any relation with these?
0
votes
2answers
58 views

How can password mangers be secure? [duplicate]

I have been recommended to use a password manager, but I don't understand how it can be secure. Any passwords it saves have to either be stored in strings or encoded in a way that is easy enough to ...
4
votes
1answer
51 views

How does “password / keyboard-input protection” work?

I do own Kaspersky Internet Security (KIS) and BestCrypt Volume Encryption (BCVE) (unrelatedly) and both offer some mechanism (KIS) to "protect my passwords while I enter them". Kaspersky primarily ...
5
votes
1answer
142 views

What technologies does ChromeOS use to secure saved passwords?

I have read that Chrome will use the system's native credential tools to manage saved passwords (e.g. KeyChain on OSX, libsecret on Linux/GNOME etc). Does anyone know what tools are used on ChromeOS?
1
vote
1answer
55 views

Are UEFI vulnerable to the same password bypass techniques as BIOS?

I'm trying to understand if the old school ways of bypassing a BIOS password (flip the BIOS jumper or remove the CMOS battery) still affect (some or all) modern UEFI? If not, what protections do ...
-3
votes
2answers
112 views

Combination of Word and Notepad characters in passwords to Secret Agent [closed]

I have been trying to help a UK bank with its Secret Agent encryption program. I keep telling them they have problems with passwords as they use a variety of Notepad and Word, and if different ...
0
votes
2answers
65 views

Security of picking unique passwords for users [duplicate]

I am learning more about security in web design so I can build more robust sites. As I see it password security is one of the main concerns, if a database is hacked then chances are passwords will be ...
3
votes
2answers
189 views

Does typing something in Notepad but not saving it leave any trace?

Sometimes, if I'm having trouble typing a long password, I'll open up Notepad, type it in their (so I can make sure what I'm typing is correct), and the copy+paste it into the form, and then close the ...
7
votes
2answers
439 views

Can viruses access passwords that have been saved by a browser?

Say I use Chrome on a new computer to log in to a website, and I select the option to have the browser remember the password. Then I download a straight-up smorgasbord of viruses of every kind. Can ...
8
votes
3answers
1k views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as LastPass store passwords in plain text (or hash values that can then be decrypted with the master-password) in memory after a user logs into the ...
0
votes
1answer
163 views

Encrypt password with salt

Can anyone explain why formula 1 is safer than formula 2?I don't get it even I get the answer. According to 2, it says as s is in plaintext form, the attacker can decrypt the password by (y.s). Isn'...
32
votes
8answers
5k views

Why must I have a “strong” password for sites like this? [duplicate]

I don't share any personal information with StackExchange, I'm not really worried about anyone trying to hack my account and I can't see any incentive for them to do so, and yet the password strength ...
1
vote
1answer
1k views

How to pass credentials across applications securely?

To simplify the user experience , if we want to design a system such that the user login password for the desktop account itself can be shared with various applications like chat/email/skype etc. ...
91
votes
9answers
79k views

How safe are password managers like LastPass?

I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long. How safe are password ...
1
vote
2answers
1k views

Do cloud-based password managers invalidate even the most secure architecture?

Can an online password vault, like LastPass, be defended through a security assessment that demonstrates the value they provide outweighs the risks of being a high value target? A valid answer should:...
26
votes
5answers
4k views

How can I choose a strong password that is easy use on a smartphone?

Typing on a smartphone is tedious. Special characters are the hardest; lowercase letters are generally the easiest. But even a long all-letter passphrase like "correct horse battery staple" is ...
3
votes
1answer
90 views

Implementing an autologin link in an email [duplicate]

So I'm working on a PHP application called Magento and I would like to implement a link which will be sent in an email to customers that will automatically log them in. I know it is critical in terms ...
11
votes
3answers
1k views

ProtonMail security concerns

This TED talk brought me here. First of all, to those who created ProtonMail: Nice job!!. Regardless of what people say, it's definitely a big step forward from tradition options like Hotmail, Gmail ...
3
votes
0answers
21 views

Security concerns for long-lasting single use access tokens with secondary identity verification?

I have an application that has a user type that "returns as needed" over the course of 22 days to complete action items. The application handles sensitive/confidential information, but > 90% of users ...
1
vote
2answers
163 views

Security concerns of running auto-login script on server-side?

I would like to fetch data from a website to do data analysis on a server. Username and password are required for login to the website. Therefore I will need to run an auto-login script on the server. ...
2
votes
3answers
117 views

Email login accepts incorrect password if everything is correct except the last digit

A quick question - wondering whether this is an accepted security practice or why this would be possible. I use a Shaw.ca email (a Canadian service provider) and I accidentally mistyped my password. I ...
3
votes
2answers
90 views

password requirements vs password storage options

Could the following password requirements be enforced, without keeping a plaintext/encrypted copy of the current password? The ######## password requirements are as follows: * Passwords must be ...
23
votes
14answers
4k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this world)....
51
votes
7answers
9k views

Is it possible to determine password strength without knowing the password?

I have just got some report of a penetration test and one of the recommendations was to strengthen passwords. I however realized that no passwords were provided for the testers, and I wanted to find ...
18
votes
6answers
6k views

Managing website passwords for small team

I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
0
votes
1answer
52 views

Setoolkit - credential harvester, only display the first character of the password

I'm launching a spear phishing campaign and my client has specifically asked me to only harvest the first character of the password, is there a way to do so? Basically instead of showing the whole ...
16
votes
3answers
1k views

Does it make sense to choose a longer password than the output of a hash?

Let's take MD5 for example: It outputs a 128-bit hash. Does it make sense (in theory) to choose an input (password) which is itself longer than 128-bit? Does it increase the probability of a ...
0
votes
1answer
955 views

THC Hydra 16 Valid Passwords? [duplicate]

So when I do hydra -l Admin -P "rockyou.txt" -s 80 192.168.13.1 http-get / it doesn't work for me. It says all 16 passwords are valid, but none of them works. Can anyone help me with this? I tried ...
3
votes
2answers
75 views

Would a Password Using All Possible Unicode Code Points Cause Problems in Traditional Hashing Algorithms, such as Bcrypt?

I've been toying around with this idea, but hypothetically, if you had a password manager that would use any possible renderable (e.g. not control characters such as BEL, NUL, DEL, etc., or surrogate ...
21
votes
5answers
2k views

Why do some websites and programs restrict password characteristics?

There are some websites and even programs that I use that have ridiculous password restrictions. Lots of forums for instance restrict passwords to ~32 characters. Others enforce a restricted charset. ...
1
vote
3answers
78 views

Why does Google require re-authentication before being able to start the password change process?

When a user wants to change the password for an account most web applications present a form where the user needs to enter the new password and the old password. So far I thought that I understood the ...