Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
376
votes
21answers
59k views
XKCD #936: Short complex password, or long dictionary passphrase?
How accurate is this XKCD comic from August 10, 2011?
XKCD 936: Password Strength
I've always been an advocate of long rather than complex passwords, but most security people (at least the ones ...
215
votes
13answers
37k views
What technical reasons are there to have low maximum password lengths?
I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites I actually care about ...
204
votes
9answers
21k views
Is my developer's home-brew password security right or wrong, and why?
Our developer, let's call him 'Dave', insists on using a home-brew script for hashing passwords. See Dave's proposal below.
We have already researched and adopted an industry standard protocol using ...
202
votes
16answers
20k views
How does changing your password every 90 days increase security?
Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
175
votes
4answers
43k views
Do any security experts recommend bcrypt for password storage?
On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
172
votes
13answers
28k views
Are passwords stored in memory safe?
I just realized that, in any language, when you save a password in a variable, it is stored as plain text in the memory.
I think the OS does its job and forbids processes from accessing each other's ...
140
votes
18answers
7k views
Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field
Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
125
votes
7answers
9k views
How to store salt?
Nowadays, if we expect to store user password securely, we need at least do the following thing
$pwd=hash(hash($password) + salt)
then store $pwd in your system instead of the real password. I have ...
123
votes
11answers
15k views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the ...
61
votes
13answers
5k views
VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?
I work for a company which has ~16,000 employees. Periodically, our VP of IT sends out a newsletter with "tech-tips" and misc IT stuff. The topic of this week's newsletter was "password security". ...
54
votes
13answers
7k views
Why do sites implement locking after 3 failed password attempts?
I know the reasoning behind not letting infinite password attempts -- brute force attempts is not a meatspace weakness, but a problem with computer security -- but where did they get the number 3 ...
52
votes
7answers
3k views
Touch Screen Password Guessing by Fingerprint Trace
After having some garlic bread at a friend's who is not security-aware, she managed to figure out the PIN code to unlock the screen of my Samsung SIII.
The way she figured this out was by simply ...
51
votes
19answers
5k views
How can I avoid my password being harvested by key loggers from internet cafes?
During traveling, especially in poor countries, sometimes you are going to need to use the internet at an internet cafe and you really can't be sure whether anyone has installed anything to listen to ...
48
votes
12answers
2k views
How do you log in from an unsecured computer?
Suppose that you are on a cybercafe, at a friend's home or at your work office, and you need to log in on a site, but you feel that the the computer can not be trusted (e.g. your friend isn't ...
45
votes
11answers
6k views
How reliable is a password strength checker?
I've tested the tool from Microsoft available here which tests password strength and rates them. For a password such as "i am going to have lunch tonight", the tool rates it's strength as "BEST" and ...
41
votes
5answers
5k views
Is sending password to user email secure?
How secure is sending passwords through email to a user, since email isn't secured by HTTPS.
What is the best way to secure it? Should i use encryption?
41
votes
5answers
11k views
Certificate based authentication vs Username and Password authentication
What are the advantages and drawbacks of the certificate based authentication over username and password authentication?
I know some, but I would appreciate a structured and detailed answer.
UPDATE
...
37
votes
4answers
12k views
Password Hashing add salt + pepper or is salt enough?
Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding.
...
35
votes
6answers
2k views
A client wants to tell me his home laptop's password. Must I push him towards a more-complex alternative?
I'm an IT consultant in Canada. One client has known me for a few years. He wants me to do some work on his kids' laptop again. I'll need to log into his kids' Windows user account. (I'm guessing that ...
35
votes
4answers
5k views
Recommended # of iterations when using PKBDF2-SHA256?
I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
35
votes
8answers
23k views
Where can I find good dictionaries for dictionary attacks?
I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?
I've found some through Google, but I’m interested in hearing about where you get your ...
35
votes
5answers
2k views
Do security questions subvert passwords?
Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
33
votes
7answers
2k views
“Real” Salt and “Fake” Salt
During a Q&A period at DEFCON this year, one member of the audience mentioned that we're using "fake salt" when concatenating a random value and a password before hashing. He defined "real salt" ...
32
votes
11answers
3k views
What to do about websites that store plain text passwords
I recently received an email from a popular graduate job web site (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
31
votes
41answers
4k views
What is your way to create good passwords that can actually be remembered?
What are the methodologies which can be used to generate "human" good quality password?
They have to ensure a good strength and also easy to remember for a human being.
31
votes
6answers
1k views
Is it OK to tell or give your password to an admin?
I'm working in a small company (20 employees) as a senior software engineer.
After some email problems, our newly employed IT administrator asked me for the password to our hosting company to see why ...
30
votes
8answers
1k views
Why do password strength requirements exist?
Password strength is now everything, and they force you to come up with passwords with digits, special characters, upper-case letters and whatnot. Apart from being a usability nightmare (even I as a ...
30
votes
3answers
1k views
Security Review - password_hash implementation for PHP
I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
29
votes
7answers
7k views
How can crackers reconstruct 200k salted password hashes so fast?
I'm researching for a small talk about websecurity and I found one article about the formspring hack, which made me curious. They claim to have used SHA-256 + salt
We were able to immediately fix ...
29
votes
8answers
3k views
Is it safe to use leakedin.org?
leakedin.org claims to offer a service checking if your LinkedIn password has been stolen and whether it has been cracked.
The website claims that it's pure Javascript, that is your password won't ...
28
votes
16answers
4k views
Why do people think that this is bad way to hash passwords?
Well, please tell me, what's wrong with this code:
$password = "hello";
$password = md5($password);
for($i=1;$i<20;$i++){
$password = md5($password);
}
It's exactly the same as this one:
...
27
votes
9answers
2k views
Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?
I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
26
votes
9answers
3k views
How long should the password be?
The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
26
votes
7answers
952 views
Who is responsible for the strength of user's passwords?
Who is responsible for a user's password's strength? Is it us (developers, architects, etc.) or the user?
As a web developer, I've frequently wondered whether I should enforce the minimal password ...
26
votes
4answers
1k views
If email is insecure, why do we use it for password resets?
I found myself telling a coworker today "Email is insecure, that's why we developed our secure report application."
But then it struck me, Why is email considered insecure? If it is so insecure, why ...
26
votes
5answers
2k views
Are GUIDs safe for one-time tokens?
I see a lot of sites use GUIDs for password resets, unsubscribe requests and other forms of unique identification.
Presumably they are appealing because they are easy to generate, unique, ...
25
votes
7answers
3k views
Is salting a hash really as secure as common knowledge implies?
(I did search on this topic, but I found no complete question/answer that addressed it, or even good portions of questions that might be relevant.)
I'm implementing a salt function for user passwords ...
25
votes
8answers
2k views
Why would salt not have prevented LinkedIn passwords from getting cracked?
In this interview posted on Krebs on Security, this question was asked and answered:
BK: I’ve heard people say, you know this probably would not have
happened if LinkedIn and others had salted ...
25
votes
8answers
3k views
Are password-protected ZIP files secure?
Following my answer. If I can list contents of password-protected ZIP file, check the file types of each stored file and even replace it with another one, without actually knowing the password, then ...
25
votes
5answers
3k views
How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?
I thought How can a system enforce a minimum number of changed characters... would answer my question, but it seems this is a different case.
When I sign on to my online banking account, I'm prompted ...
25
votes
1answer
1k views
What's the risk if I accidently type my password into a username field (Windows logon)?
I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
25
votes
2answers
2k views
Pre-hash password before applying bcrypt to avoid restricting password length
Good practice is not to unnecessarily restrict password length, so that appropriately-long passphrases (perhaps 35-45 chars for 6/7 dicewords) can be used. (See e.g. Should I have a maximum password ...
24
votes
10answers
3k views
Intel How Strong is Your Password page, good advice?
I came across this Intel How Strong is Your Password? page which estimates how strong your password is.
It has some advice on choosing better passwords including that you should use multiple ...
22
votes
12answers
1k views
How secure are passwords made of whole english sentences
I often read as an advice to build strong passwords, just to think about a sentence and then take the initial letters. For example take a nonsense sentence like "I watch Grey's Anatomy at 9.40" gives ...
22
votes
7answers
1k views
Is there a method of generating site-specific passwords which can be executed in my own head?
I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
22
votes
2answers
3k views
I just send username and password over https. Is this ok?
When a user's logging in to my site, they send their username and password to me over https. Besides the ssl, there's no special obfuscation of the password - it lives in memory in the browser in the ...
21
votes
8answers
1k views
Why improvising your own Hash function out of existing hash functions is so bad
I'm afraid I'll have tomatoes thrown at me for asking this old question, but here goes.
After reading that cooking up your own password hash out of existing hashing functions is dangerous over and ...
21
votes
5answers
1k views
Do spaces in a passphrase really add any more security/entropy?
I often see passphrase suggestions written as a sentence, with spaces. In that format are they more susceptible to a dictionary attack because each word is on it's own as opposed to a large unbroken ...
21
votes
5answers
770 views
Should passwords be revealed in error message?
I am having pet-peeve with PHP's PDO class. As you can see on the Warning note: it reveals database password by default if an exception was not caught (when display errors is on which is a probable ...
21
votes
2answers
1k views
Does versioning an encrypted file make it less secure?
Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices.
The kdb file in itself would be encrypted, but ...
