Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

102
votes
5answers
14k views

What should I do about Gmail ad asking me for password?

I just got a pop-up after having logged on to Gmail. It said it was from https://googleads.g.doubleclick.net and asked for username and password. What should I do about this? Has anyone else seen ...
36
votes
2answers
6k views

Are there more modern password hashing methods than bcrypt and scrypt?

This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt. What I'm wondering is if there are any "...
-1
votes
4answers
44 views

How are salts safe in the database? [duplicate]

I have read many and many of this type of question on the security stack community before I asked this question, but one thing that made me mad about salts and saving it in database is this ... I will ...
10
votes
4answers
8k views

HMACSHA512 versus Rfc2898DeriveBytes for password hash

We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key The salt is 64 char randomly generated string. We allocated 2048 length on the database for the hashed base64 string ...
34
votes
4answers
21k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first bash:...
-1
votes
1answer
144 views

Why doesn't the OS give every application a secret password?

As far as I understand if Dropbox wants to automatically run in the background without asking the user for a password it has to store the password somewhere on the harddrive and has currently no way ...
7
votes
2answers
353 views

Can viruses access passwords that have been saved by a browser?

Say I use Chrome on a new computer to log in to a website, and I select the option to have the browser remember the password. Then I download a straight-up smorgasbord of viruses of every kind. Can ...
72
votes
13answers
6k views

VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?

I work for a company which has ~16,000 employees. Periodically, our VP of IT sends out a newsletter with "tech-tips" and misc IT stuff. The topic of this week's newsletter was "password security". ...
7
votes
3answers
1k views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as LastPass store passwords in plain text (or hash values that can then be decrypted with the master password) in memory after a user logs into the ...
6
votes
3answers
679 views

Is it OK to use the same password for a Linux login and the SSH private key?

I want to remotely log in to my Linux server with SSH. Public/private key authentication is more secure than password authentication, so I have disabled password-based authentication for SSH on my ...
4
votes
2answers
1k views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
18
votes
6answers
6k views

Managing website passwords for small team

I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
14
votes
8answers
8k views

Are services like “LastPass” less secure, as they have all my passwords protected by a single password?

If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security?
11
votes
3answers
3k views

Additional security of keyfile on top of a master password for KeePass

I use KeePass + Dropbox to manage and synchronize my passwords across my devices. This system works really great and I trust KeePass' security model. However my biggest remaining concern is the ...
3
votes
3answers
795 views

I want to roll my personal cloud hosted Password Manager using pass. How secure/insecure would this be?

I've come to the conclusion that I need to up my security. I currently have a dozen memorized passwords I use for every device and website. I'm against KeePass/Lastpass due to having to trust they ...
64
votes
13answers
9k views

Should I allow browsers to remember my passwords and synchronize them?

I wonder, how wise is it to allow Chrome and Firefox to a) remember the passwords b) synchronize them? My gut tells me that if it's not man in the middle who can intercept them, but Google and Mozilla ...
8
votes
4answers
243 views

What standards are there for mangaging high value passwords?

I am leading a small team at a start-up and I am facing a dilemma with high value passwords. I am the only one on the team who knows all the key passwords for production servers, databases ... etc. ...
0
votes
1answer
43 views

Should all web applications implement a security feature that stores historical passwords? [duplicate]

In addition to Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?. Facebook, and other companies, are storing historical passwords of ...
1
vote
2answers
76 views

Store passwords as integers

I just came up with this idea that I can store passwords as integers which take up 4 or 8 bytes as opposed to a hash that takes like 150 bytes or something. I wrote this function that converts a ...
1
vote
2answers
47 views

Does a hash of a 32-bit integer make a better hash salt than the integer itself?

I have a scenario where I already have a table of resource passwords stored as unsalted 128-bit hashes. I'm unable to force owners to provide new passwords, so I'm trying to mitigate the situation by ...
1
vote
2answers
89 views

How secure is a password protected file?

I have a password-protected excel file that stores other personal passwords. Obviously there have been a number of ways to crack the password. community.spiceworks.com Where do you guys store ...
1
vote
2answers
208 views

Received an email about an “Etsy” Password Reset due to the “Linkedin Breach…” is this a phishing attempt?

I received an email today from Etsy saying they are resetting my password(from the source it looks like a mass reset of all users), due to there being some sort of Linkedin breach, that compromised ...
-4
votes
0answers
47 views

Why would a website have a maximum character limit on passwords? [duplicate]

I was just about to sign up for a website but the maximum password length was 10 but I can't think of a rational reason as to why a site would implement it that way. Can you guys think of anything?
4
votes
1answer
76 views

Are there problems with reusing strong passwords for private gpg keys

I am currently maintaining a few different identities each associated with different gpg keys (for personal, academic, professional correspondence etc., whether or not this is a good idea is probably ...
4
votes
2answers
61 views

Is CHAP authentication still secure?

Assuming the use of the default hashing algorithm MD5, is CHAP authentication still secure? I appreciate that MD5 is considered broken in terms of collision resistance, but I also understand that in ...
0
votes
2answers
204 views

Is PIN affective security for credit cards considering it's not always needed?

This question asked about how having a PIN is safer than signing the receipt when doing a credit card transaction (personally the question makes no sense to me as it's just a scientific fact that a ...
0
votes
1answer
101 views

How to conceal a computer in operation with a separate logon password? [on hold]

Goal: Disallow people physically near the computer to see its operations. No password to start the computer. But, I'd like to conceal the screen after startup and all programs loaded. Because of the ...
7
votes
1answer
116 views

What are the recommended scrypt cost factors for 2016?

I've been trying to look for the answer, but the latest one I found was outdated by three years. So what are the recommended scrypt cost factors for 2016?
1
vote
1answer
148 views

Is Trillian application unsafe? (Got “Someone has your password” message from Google)

Trying to connect to GoogleTalk from the Trillian app for Android (a universal instant messenger app), I got denied even with the correct password. Then Google e-mailed me saying that my password is ...
1
vote
2answers
167 views

Is it better to choose less-vulnerable random password?

I have created a random password generator function (which can be found here if anyone wants a look), which will churn out passwords with a random mix of letters, numbers, and other characters. This ...
3
votes
1answer
60 views

What percent of publicly posted databases implemented password security?

I am trying to get some statistics on databases that were a part of data breaches, namely, I would like to be able to find out what percentages of publicly posted databases (from a data breach) had ...
3
votes
3answers
168 views

Are there risks associated with a strong password reuse for disk encryption?

I understand the risks of password reuse when we share the password with 3rd parties as perfectly discussed under this question: Is password reuse a problem if the password is very strong? However I ...
1
vote
0answers
55 views

Help - Web-form Bruteforcing with Python [migrated]

So, I have this Python script below. What it does, is it basically bruteforces a web-form (login) using itertools. It does what I want, I've got it to work perfectly etc., however I'd like to ask if ...
1
vote
1answer
58 views

How secure is the UNIX sha_crypt as a password storage algorithm? [duplicate]

So I have been working on password storage, especially on the algorithms to use (and to not use). Most people are recommending scrypt or PBKDF2 for valuable reasons, but I have not seen any talks ...
130
votes
7answers
18k views

Internet courtship: Why would a hacker buy me poker chips?

Believe me, I never expected to ever write a title like that on a Stack Exchange site either! Yesterday evening I got a call from my mother. She is quite tech savvy and generally knows her way around ...
-5
votes
0answers
34 views

What encryption does CyberRoam use for Registry entries? [closed]

I am unable to guess the type of encryption Windows Registry uses to store CyberRoam password, for example 1466151978000123000091000040000139000203000019 is some encrypted value for 6 digit password.
3
votes
3answers
180 views

Is it acceptable for customer service to ask for my PIN?

I tried to initiate an online chat with customer service of a company I am trying to do business with this weekend, but before they would answer any of my questions they requested that I give them the ...
22
votes
4answers
9k views

Google Account: implications of using application-specific passwords

In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google ...
3
votes
4answers
108 views

What are possible methods for calculating password entropy?

I noticed there are tons of questions and answers about password entropy on this forum, some even suggesting formulas for calculating it. None did answer my exact question. What are possible or ...
0
votes
3answers
126 views

Random characters and letters form obsfuscation

I know that this question has been asked many times, but would JavaScript encryption work if I just added 100 random numbers and letters to the password? That would be hard to reverse engineer, ...
21
votes
4answers
15k views

Router password vs MAC filtering?

I just bought a Galaxy S4, and it didn't connect to the WIFI in my house (I have a 14$ router). After a bit of testing, I've decided to leave my connection open without a password, but added the ...
1
vote
2answers
65 views

Periodic password change needed when using 2-step verification?

I know that it's considered good online security hygiene to change one's login passwords every 6 months or so. Is that needed on sites with 2-step verification? Isn't the 2nd step what will keep my ...
3
votes
1answer
73 views

Web Based penetration test that uses MD5 for password

I'm trying to penetrate test a web based form (which is MikroTik's login form) with different tools for security measurement. I've tried THC-Hydra but problem is the password computed as MD5 first ...
-1
votes
2answers
71 views

Website says my new password can't be used because it is the same as an old one [duplicate]

What are the risks of storing (in hashes I guess) all the old passwords? Why would a company chose to not delete old passwords? Why not let users reuse old passwords?
123
votes
6answers
46k views

Password Hashing add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
7
votes
2answers
160 views

Is there any recommended approach for “upgrading” MD5 hashes to something secure? [duplicate]

I'm currently dealing with a couple of user accounts containing MD5 hashed passwords. These accounts got migrated from an old system into our current system which uses PBKDF2 for password hashing. I ...
6
votes
1answer
83 views

Is there a way to know if a server is using ssh public key or password?

I am wondering is there a way for an attacker through finger printing to find out whether a server is using public-key versus password authentication method for establishing an SSH connection?
18
votes
6answers
3k views

What does “random” mean in the context of password creation?

Disclaimer: as you will see from my question I'm a total outsider in this subject, just very curious. I was wondering how easy it would be to crack a password-protected RAR5 file, and I found many ...
-5
votes
0answers
75 views

How can I decode hashed passwords? [duplicate]

I have access to a Microsoft SQL database where passwords are stored like this: bZB056KMVxCXa/D8zd3q/g== How can I decrypt this hash? I don't know which algorithm is used for this hash.
-2
votes
1answer
219 views

How can someone hack Twitter accounts so fast? [closed]

You may have heard the news about ISIS twitter accounts hacked in light of the Orlando shootings. I am wondering how can it happen so fast (just 2 days after the incident) and what kind of technique ...