Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

2
votes
6answers
4k views

Hardware USB Key to Reset Any Windows Password

This tool requires physical access of course, and there are many things you can do once you have physical access, but this peaked my curiosity. The tool in question: ...
-2
votes
1answer
42 views

client side and server side hash password [duplicate]

Another question about client or server side password hashing, I know. After reading many other post about this topic I'm still a little confused and not completely sure what is the best, because I ...
-3
votes
2answers
53 views

Time it takes to crack a password on site like yahoo [on hold]

I have a question. If you were using a password brute force/dictionary attack utility on a site like yahoo or another site, how long would it take to crack a password like Jah13Wootiang if Wootiang is ...
20
votes
3answers
2k views

For an HTTPS web application, is it worthwhile to encrypt the password before POSTing it, to keep a MITM attacker from harversting it?

Our application has recently gone through penetration testing. The test found one critical security breach, which is essentially: The problem: Attacker sets up a WiFi spot. User enters our site ...
2
votes
1answer
62 views

Temporarily save failed logins password hashes for using against brute force attack

My question is about online brute force attacks, that try to authenticate in the website. 1) For the first case if the requests are coming from the same ip, I think this are relatively easy as after ...
5
votes
3answers
122 views

How secure is this method to remember security questions?

So I found an interesting method of remembering those pesky security questions. Basically, the guy takes a hash of the question (IE what is your mother's maiden name?) and then appends his own ...
1
vote
1answer
58 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
0
votes
1answer
73 views

Should a Mobile app able to check what password is locally saved via a user facing feature?

I'm working at a company who is currently working to secure their mobile app (iOS native) by adding check points to security sensitive screens on the device (data is stored in the iOS keychain). User ...
-3
votes
1answer
28 views

Which encryption technique should be used for users name and passwords in my notebook [duplicate]

i writing all my passwords and users names on my notebook emails,amazons,facebook. and i have really Nosy little's brothers that will probably look at my notebook when i am not around, which ...
28
votes
4answers
2k views

What is the point in having arbitrary username requirements?

I've looked around on Security.SE, but couldn't find much related to the following problem: I recently signed up for Chase Quick Pay as my method of being paid by a part-time job. I've heard of ...
2
votes
0answers
67 views

Is there a way to identify the location of a person trying to intrude your wifi network? my wifi router is picking up his attempts

Aug 30 20:28:09 dropbear[6799]: Child connection from ::ffff:5.10.69.82:38463 Aug 30 20:28:11 dropbear[6799]: login attempt for nonexistent user from ::ffff:5.10.69.82:38463 Aug 30 20:28:12 ...
1
vote
1answer
886 views

How to crack SHA512 hexdigest passwords with John the Ripper?

I've been playing with John The Ripper (JtR) to try to crack/audit a salted password that was hashed with SHA-512, with 20 interactions according to the source (for the curious, this is a Rails app, ...
1
vote
1answer
132 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
3
votes
7answers
169 views

Is providing a website password over the phone any less secure than other identifying information?

I've been dealing with two separate banks for completing a 401k rollover (I do not have any other accounts with either of the two banks), and I've encountered something with both that I've never seen ...
-3
votes
7answers
700 views

Are passwords made up from concatenating a few foreign words better than shorter random characters? [duplicate]

Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example: "pussiMeansCatInEskimo" "caballoMeansHorse" "CatIsGatto" "SalopeMeansBitch" ...
0
votes
0answers
43 views

15 Chars long PWD NTLM with John the Ripper [closed]

I do not find any resource that explains clearly the behavior explained below. I am using John the Ripper to test password guessing, and am attempting to discover two passwords that I already have in ...
2
votes
3answers
160 views

What risks am I taking with a weak password on a laptop?

I'm setting up a Mac laptop for my wife. Mine has a ridiculously strong password, but she finds this annoying. If I give her a (relatively) weak password for convenience, what risks am I taking? A ...
24
votes
6answers
2k views

Are there secure alternatives to single-use password reset links?

We currently have what I believe to be a pretty standard scheme for dealing with password resets. Our reset links are single-use links: They expire immediately after they've been visited, even if the ...
3
votes
2answers
188 views

Are weak passwords acceptable for internal development?

We have a number of internal development environments that use weak passwords in the Auth and SQL components; particularly using passwords such as "password" or "Password1". These are obviously ...
3
votes
2answers
161 views

Can the human brain generate cryptographically secure random numbers?

A security conscious friend of mine was attempting to generate entropy using random dice rolls to generate a random password, and I became curious about the security of random number generators and ...
1
vote
2answers
106 views

Brute force alphanumeric password using JohnTheRipper

I recently recovered a zip archive with some files I need access to, but I can't remember the password. All I can remember is that the password was short (around 3-4 characters), and contained only ...
-3
votes
2answers
59 views

Memory Stick security [closed]

My friend is computer savvy. He gave me a memory stick with some videos to view. If I plug this into my laptop, can he access my computer and its passwords through a backdoor?
1
vote
4answers
158 views

Should BCRYPT be used for client-side password hashing

I am concerned about the use of bcrypt for client-side password generation. I am developing a password generation function to be used client-side, similar to PwdHash and PasswordMaker. Much has been ...
-3
votes
2answers
63 views

A Graphical Two-Step Authentication System [duplicate]

Changes made to system proposed in Two-factor authentication Without Mobile Phone: In previous system, shoulder surfing would reveal the user’s pre-decided image. In the current system, end image ...
0
votes
0answers
19 views

Keychain, rights to open it and save a copy [migrated]

I begin to use Keychain for Mac OS Mavericks. If I understand the only way to secure the Keychain passwords is to put a password to open the computer, there is no password or security system to ...
0
votes
3answers
97 views

How secure are sentence passwords? [duplicate]

Lately I've been doing the trend of using passwords that are sentences, at least on sites that have a reasonable maximum character length and allow spaces. So for example the most basic variation is ...
7
votes
11answers
2k views

How to easily remember lots of different passwords?

I know that you shouldn’t use the same password on every site. But, when you log into several dozen sites, keeping track of all the passwords can be pretty hard. What system do you recommend that ...
1
vote
1answer
654 views

How secure is automatic authentication in Skype?

How secure is checking the automatic authentication option in Skype client? What if I sign in with Microsoft account instead of Skype id? What if both accounts are merged? Is there any documentation ...
0
votes
1answer
42 views

What multiplier to use when calculating the average time to crack passwords with a given entropy?

Suppose that we have a process that generates passwords with entropy E. I'd like to compute the average time it would take for a brute-force attack to crack an MD5-hashed instance of such a password. ...
-5
votes
1answer
103 views

How to decrypt the encrypted data, in SHA256, of mysql database? [closed]

I have some data in column of table of mysql database in the encrypted form applied with SHA-256. How to decrypt that data using Java. I stuck at this since 4 days. Please spend 5 minutes of your ...
1
vote
4answers
203 views

Protecting Password in Code

I am writing a program in Processing (which is basically java), that (amongst other things) downloads files from a FTP Server. To connect to the Server the program needs the correct FTP-password, ...
1
vote
4answers
158 views

Authentication with an untrusted server

I asked a related question earlier, but I want to ask a broader version this time: To simplify things let's say I've developed an application that allows users to send messages in a chat room, and to ...
7
votes
6answers
2k views

Is denying login after incorrect attempts ineffective?

Generally denying login attempts after X amounts of incorrect attempts for Y amount of tries is a very basic way to prevent bruteforce attempts or malicious login attempts. Yet, surely doing this is ...
0
votes
2answers
337 views

Recover password or password hash from locked account

I have a locked administrator account. Other accounts are unlocked, but they have no rights. I want to get a password from the locked account, or maybe password hash, if possible.
2
votes
2answers
245 views

What are my options for securely printing an OTP Scratchcard?

I want to print and distribute several One Time Passwords (OTPs) that can't be easily disclosed to a 3rd party in transit. (think the physical version of a TLS session for private secrets) To me ...
2
votes
2answers
95 views

Method to integrate Touch ID in iOS apps

With the recent announcement of Touch ID APIs for third party apps, I am wondering how can we leverage this feature to perform secure transaction ? I am looking for a method to use Touch ID in my ...
0
votes
1answer
54 views

THC Hydra 16 Valid Passwords?

So when i do hydra -l Admin -P "rockyou.txt" -s 80 192.168.13.1 http-get / it doesnt work for me, it says all 16 passwords are valid, but none of them works, can anyone help me with this? I tried ...
0
votes
2answers
108 views

Where are passwords hashed? [duplicate]

The way I understand password security is that the user enters a password, which is then converted using a hash function. The website then compares it to the stored hash to see if it is correct. That ...
0
votes
1answer
106 views

Why doesn't the OS give every application a secret password?

As far as I understand if Dropbox wants to automatically run in the background without asking the user for a password it has to store the password somewhere on the harddrive and has currently no way ...
0
votes
4answers
79 views

How long does a passphrase have to be to be as secure as a random collection of letters, digits, punctuation, etc.?

If one uses a passphrase which is grammatical, such as "I put my keys under the doormat because they're safe there."... how many words (on average) must it contain to be as secure as a password with ~ ...
0
votes
1answer
136 views

Are all OSes vulnerable to local password reset attacks

It's not that difficult to reset the password of the administrator account in MSWindows when you have local physical access to the machine Same thing applies on any Linux distro, it's possible to ...
19
votes
4answers
3k views

The registration confirmation email contains my password: do they keep it in plaintext?

I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
272
votes
20answers
44k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
17
votes
4answers
855 views

Is it a bad idea for an information holder to e-mail a user their password?

A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...
-1
votes
3answers
74 views

What does one call the strategy of using “pre-password transforms” as passwords?

Suppose that instead of using, say, Google, let me in! as my Google password, I used some consistent transform of this string, say ZWE1NjMyNm? What search keywords would be helpful to search for ...
0
votes
2answers
71 views

Do dictionary attacks only use specific entries from a dictionary, or combinations of an entry?

If I wanted to crack a password, "cba", but the dictionary I was using only had abc in it, does a dictionary attack try all combinations of abc? abc, acb, bca, bac, cba, cab Or would cba have to be ...
6
votes
5answers
19k views

Modern high quality password dictionary

Has anyone come across any good password dictionary lately? Some of the lists I found dated back to 90's! Some are simply too big that I doubt their quality. There appears to be some work by someone ...
4
votes
5answers
582 views

When hashing passwords, is it okay to store the algorithm used right there in the database?

Since hashing password has become a hot topic recently, it is only natural to expect things to change and assume that some time down the road you might want to replace/tweak the algorithm used in your ...
1
vote
3answers
156 views

Resetting passwords howto

I am currently in the process of designing a registration form for the users to register accounts. The accounts will contain a lot of personal information, so I want to ensure highest possible ...
0
votes
3answers
76 views

How important it is to change password regularly? [duplicate]

A WWW-site guided me to change the password regularly. Should I believe what the say, if my current password is long enough random string?