Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

1
vote
3answers
71 views

How does a hash which contains algorithm to choose can be secure?

I was thinking about creating my own hash+salt function, something like sha1(password + md5(login)), then I read here (part 4) that creating it's own hash+salt function is a bad idea, because if the ...
4
votes
7answers
3k views

Pronounceable Password Generator

I am currently looking for a password generator which produces pronounceable passwords. I have used this random password generator a few years ago to generate a 42 characters long password and found ...
1
vote
3answers
63 views

How do I allow only app to view/download files from server?

I have an Android app that uploads and downloads pictures from my dedicated server. However, before I go live, I want to know if there is some way I can secure the server to allow only my app to ...
75
votes
12answers
14k views

Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3

TLDR: We already require two-factor authentication for some users. I'm hashing, salting, and doing things to encourage long passphrases. I'm not interested in the merits of password complexity rules ...
6
votes
0answers
88 views

Which format of secret would be the most efficient for human memory? [on hold]

I am talking about something-you-know identification factor. Examples of those formats are passwords, passphrases, pin-s, picture passwords ( ...
1
vote
2answers
117 views

Password Manager use and safety [duplicate]

I just recently read an article advocating the use of password managers, and while I understand why someone might think using these programs might be a good idea, it's my understanding that these ...
11
votes
5answers
2k views

Is this idea for a password manager secure? If so, why doesn't anybody use it? [closed]

I've been thinking of a problem with usual password managers: although they do provide better security than manually using passwords, there's a central database that can get lost, get compromised, ...
353
votes
21answers
67k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
7
votes
2answers
1k views

Is it bad practice to ask only for individual characters of a password? [duplicate]

Some financial websites that I use use passwords in a peculiar way. Instead of asking me the whole password string, they only ask me to enter e.g. "3rd, 5th and 8th character of your password", i.e. a ...
0
votes
2answers
64 views

Random characters and letters form obsfuscation

I know that this question has been asked many times, but would JavaScript encryption work if I just added 100 random numbers and letters to the password? That would be hard to reverse engineer, ...
-5
votes
1answer
63 views

Is there a way to hack passwords in kali linux without wordlist [on hold]

I am 18 years old and i was searching for a way to hack passwords without a wordlist because it will take forever and may not work so i hope help . (I will not use this to damage anyone but just for ...
-7
votes
0answers
45 views

Ask.fm cracking using kali linux [on hold]

i was wandering if it is possible to hack my ask.fm account using kali linux cus i forgot my password and the email used in the account and i want to get it back ? Any help
4
votes
1answer
202 views

Security of Yahoo's new authentication: On-demand password

Yahoo is trying to remove passwords from authentication and use on-demand password authentication system instead. I wonder how this new system will be secure? Even if somebody steal your mobile can ...
1
vote
4answers
58 views

Is it safe to use my personal password as my password in work related accounts?

For example I have this complex personal password cary1bondoc21cary2bondoc as my password and because I am forgetful I also want to used that in work related accounts like company email, etc. Is there ...
-2
votes
0answers
105 views

Hacker using my wifi connection to try to log on? [on hold]

My Hotmail account was hacked, not so I couldn't use it, but I didn't know that it was being used. They got banking information and used it! I was overseas. My Hotmail account was opened by various IP ...
675
votes
22answers
135k views

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are ...
4
votes
5answers
213 views

How many combinations does a specific password policy allow?

Recently I was arguing about password policies. Assume you have a policy which requires 10 characters and additionally at least one letter, one number and one special character. My companion was ...
3
votes
1answer
86 views

Password security when connecting to ldap with rails application

How do you store a username/password securely in a rails app when using it for many ldap searches? The connection in the app requires ldap_bind_authenticate(Net::LDAP.new, username, password) ...
5
votes
1answer
182 views

What are the pros and cons of using sha256 to hash a password before passing it to bcrypt?

My apologies if this has already been asked. I recently became aware of the fact that bcrypt truncates passwords to 72 characters. Practically speaking my intuition is that this does not pose any ...
34
votes
11answers
6k views

Is it good practice to send passwords in separate emails, and why?

I have heard from different people and in different places that if I send an encrypted file to someone else, I should send them the password in a separate email; but why? If someone is sniffing, they ...
18
votes
4answers
4k views

Should I implement incorrect password delay in a website or a webservice?

With arguments expressed in this answer, there is a few seconds delay between user enters an incorrect password and when he/she actually learns, that password was incorrect. This security solution is ...
3
votes
1answer
131 views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a ...
1
vote
1answer
65 views

Gnome-keyring iteration count location

I know that Gnome-keyring hashes the master password between 1000 and 2000 times. It picks a random number. I would like to ask where it saves this number, what is the location of that file? As far as ...
10
votes
4answers
2k views

SSH key auth, but still need password for sudo?

SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive ...
5
votes
3answers
355 views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as last pass store passwords in plain text (or hash values that can then be decrypted with the master password) in memory after a user logs into the ...
5
votes
2answers
83 views

Possible way to extract sudo password from running system via the clipboard

I use to copy and paste my sudo password from a KeePass file so I guess the plain text user password will be saved in RAM at some point when I use it, for example, to accept an update. Is that right? ...
1
vote
3answers
82 views

Sensitive issue regarding windows 8 password [closed]

Although I know this sort of request probably isn't exactly what stackoverflow is for, I am desperately seeking help. One of my best friends recently passed away and his parents asked me if I knew a ...
2
votes
3answers
106 views

Use the same password on different (very secure) sites?

I understand that one should not use the same password everywhere, as stated here for instance. Using the same password on several non-valuable sites may be considered acceptable: we simply do not ...
5
votes
5answers
2k views

Salted password + hash - is it really useful? [duplicate]

I am new to the topic and wanted to know the concept of having salted hashes before going down to the technical details. From what I have understand password - plaintext hash password - plaintext ...
7
votes
8answers
633 views

Password reset with lost email functionality

I have searched and viewed most of the other questions and answers about implementing forgot password functionality on a website. However, we have a unique situation. When a user registers an account ...
1
vote
1answer
123 views

Storing server generated passwords

There are some applications that generate passwords for you. Consider a case where you sign in via Facebook, the application (let's call it NEWAPP) verifies your sign in on the server using FB tokens ...
4
votes
2answers
232 views

Does adding a non-entropic part to a password makes it less secure?

Suppose I'm encrypting a file via AES using a password of my choice, or creating a TrueCrypt volume using a password and no keyfiles. Which of the following two passwords would be more secure: ...
1
vote
1answer
60 views

Prevent brute force attacks on web publishing logins

Presumably, if someone tries to brute force into your website's control panel at your web host's site - they will be throttled/locked-out etc. But what about the web publishing logins (Web-Deploy, ...
1
vote
1answer
354 views

What happens if an attacker steals my phone's IMEI number?

I have some questions regarding IMEI numbers and data and identity theft. While searching online I have found many conflicting answers regarding this topic and would like some clarification if ...
2
votes
3answers
181 views

Passwords propagation, Password Trend and Word Generator in Human Mind

Some passwords like "123456", "admin" are outrageously popular, so are the leet transformations and concatenation of digits. The users seem to pick up the password suggestions or just copy the ...
2
votes
2answers
57 views

Justifying strong 1st factor in the context of multi factor authentication — beyond passwords

I am wondering if you need strong 1st factor (for theoretical correctness, please note it is the knowledge factor -- not necessarily a password, but definitely also includes strong passwords)? What ...
4
votes
2answers
446 views

Passwordless login over email - security considerations

I'm proposing the use of a login system that sends a one-time login token (with high entropy) via email to the user. After using the token, the user receives another token via email and the previous ...
1
vote
1answer
118 views

Windows Passwords

What are the security concerns of the following user account setups on a normal Windows 7/8/10 desktop machine compared to: Using a non-privileged account with a password and having an admin account ...
2
votes
1answer
97 views

Is it secure to set default value for password field?

I'm looking at an application where admins can "invite" users by email and invited users. Invited users then are sent a unique URL and are inserted into a MySQL database with status pending and an ...
0
votes
5answers
930 views

Why do we use passwords on sites? [duplicate]

I don't have passwords for my personal sites. To sign up a user pick their username and enter their email. There is a logout button if the user wishes to log out. To log in you enter your email and ...
4
votes
2answers
3k views

File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?

I've been using this command to encrypt files for a while now: openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc Then I type in a password. Can someone tell me, roughly speaking, ...
25
votes
4answers
4k views

What should be used as a salt?

I always hear that it is best to use salts on top of stored passwords, which then somehow gets concatenated and hashed afterwards. But I don't know what to use as a the salt. What would be a good ...
0
votes
2answers
109 views

Saving passwords in database

I have recently been studying a lot on writing secure code and choosing secure methods for saving passwords to a database. I'm wondering if it's secure to use ready made libraries or APIs to do this ...
6
votes
3answers
20k views

Windows 7 Password Hash Security

I recently came across a number of sources that suggest that cracking Windows user account passwords is easy by examining their password hashes. I understand that these hashes are stored in the SAM ...
79
votes
9answers
138k views

Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...
3
votes
2answers
117 views

Is there any history of a major attack using password reuse? [closed]

While everyone and their favorite webcomic seems to agree that password reuse is a major problem, some quick googling cannot seem to find any cases where it has been used on a large scale in an ...
3
votes
2answers
385 views

Is this password generator safe?

128-bit entropy is required http://nxtra.org/nxt-client/js/passphrasegenerator.js With all new browsers (Chrome, Firefox, IE 11) it uses crypto.getRandomValues which should be safe, but with IE 10 ...
6
votes
3answers
387 views

Am I in this particular case allowed, to store password in java program?

I have a Java-Server program running on Ubuntu-Server which gets every 5 minutes current location data of my android-smartphone (which I carry with me). My architecture is the following: My smartphone ...
-1
votes
1answer
72 views

Using Tor browser to use YouTube, account security is the problem

YouTube is not available in my country, but I want to make an account at YouTube and use it. I'm not interested in protecting my identity. It is fine if anyone can monitor it. The thing I'm interested ...
-3
votes
1answer
70 views

What type of hash is this MD4(MD4(($pass)).(strtolower($username))) [closed]

Can I decrypt this hash? Domain Cached Credentials: MD4(MD4(($pass)).(strtolower($username)))