Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

6
votes
5answers
2k views

How can one secure a password/key in source code [duplicate]

If there is a need for source code to have a password in it, how should this be secured? This is purely an example, but say there is an app that is using an API, and you don't want to expose ...
21
votes
4answers
2k views

What are spambots doing with unintelligible login attempts?

After constantly being under attack in phpBB, I created a new forum by hand, which successfully prevents spam bots from registering, and I get a report for every failed login attempt, telling me the ...
6
votes
1answer
203 views

Why does my bank bother asking basic personal questions to log in to online banking?

To log into my online banking, I have to answer a basic personal question such as "What is your mother's maiden name" or "What is your grandfather's middle name", as well as enter a one-time code from ...
-2
votes
1answer
169 views

How long does it take to break 128-bit key

Hmm, I was asking myself how to compute if we were given one day to try all possible keys for a 32-bit symmetric cypher, how long would it take us to break 128-bit key? My calculations suggest: ...
0
votes
2answers
235 views

How do you protect strings in code from users decompiling them and seeing them [duplicate]

For an example say we have an application such as a client based application which connects to an API using an api key. We are saying for this purpose there is no OAuth. How would a string or in this ...
1
vote
1answer
238 views

Why does Debian security guide recommend md5 hashed passwords?

I am reading the Debian Security How-To and came across a section that I found odd: it recommends to use md5 hashes for /etc/shadow passwords ...
1
vote
3answers
529 views

What is the correct way to make a password salt?

I've made the below function to make a completely random 64 character long hash function password_salt($password){ $salt = hash("sha512", mt_rand(1,100000) . strtotime("now") . $password . ...
9
votes
4answers
985 views

Is 2FA really necessary with long, high entropy passwords?

I was wondering if two factor authentication is really necessary if you are using high entropy, long, unique passwords for each site. From my experience 2fa just beefs up security a little more, by ...
0
votes
1answer
282 views

How could be my skype password stolen? [closed]

My skype password was recently changed. I've changed it back and found it in the internet on hacker's site. My password is pc-generated, like as2fZ12v. How did they manage to hack it, if I've never ...
-1
votes
1answer
218 views

Why don't we do dual password instead of forgot password?

You can see a link Forgot Password? nearby almost all login form. As I mentioned in question, Since passwords are completely protected from outside access unless owner reveal, I come up with this ...
3
votes
2answers
1k views

How weak is MD5 as a password hashing function ?

A professor told us today, that MD5 is weak. I understand his chain of thought but pointed out, that IMHO MD5 is a good way to go if you would use a long (even really long) dynamic salts and static ...
0
votes
2answers
144 views

What is truly unbreakable these days? [closed]

Just very curious, count my knowledge in cryptography, algorithms, and security in general as non-existent. Now I am aware that this might be a VERY broad question, but here it goes. What is the most ...
1
vote
1answer
1k views

Are post requests secure?

If a post request is sent from a client on a website without SSL, is the request secure? For example, I visit a site badsecurity.com, and I login using a password: Will this password be encrypted ...
1
vote
1answer
114 views

Is it a good idea to give users an additional password that they do not control?

It's a given that users will choose bad passwords. Why not help them out? Using a securely-random choice from a large dictionary, choose one or two words and tell the user to write them down. When ...
34
votes
9answers
8k views

How long should the password be?

The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
0
votes
2answers
86 views

How do you overcome the problem of the salt being public and known by the attacker? [duplicate]

I believe that when adding a salt to the password you need to store the values so you can compute the hash again. But, what does happen if the attacker get the salt? How is it possible to add value ...
1
vote
1answer
78 views

What is the best approach for securing log-in credentials on an HTML form?

I realize how basic this question is, but I have relied for years on mechanisms built into .NET to handle log in for me. These days, most of my work involves using client-side logic and calling API ...
6
votes
1answer
150 views

Is it okay to normalize unicode passwords with NFC/NFD?

I am currently designing a login for a web service. I will use a PBKDF2 implementation for hashing the passwords. However, I intend to allow unicode for passwords, as I will have international users, ...
8
votes
4answers
567 views

Why does password strength matter?

I understand from a cryptographic standpoint that you want a password to be as random as possible to resist brute force or dictionary attacks. That is fine- but in what circumstances can those ...
17
votes
8answers
12k views

Why do people still use/recommend MD5 if it is cracked since 1996?

It's still commonly recommended way of hashing passwords, even if it's insecurity had been proven in 1996 Therefore we suggest that in the future MD5 should no longer be implemented in ...
34
votes
15answers
5k views

Why do people think that this is bad way to hash passwords?

Well, please tell me, what's wrong with this code: $password = "hello"; $password = md5($password); for($i=1;$i<20;$i++){ $password = md5($password); } It's exactly the same as this one: ...
20
votes
10answers
4k views

Best password strength checker

In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or ...
8
votes
5answers
3k views

How to catch a gmail hacker/money-scammer? (in conversation with one right now!)

My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
21
votes
4answers
4k views

Is using SHA-512 for storing passwords tolerable?

I know that the best options to use for storing passwords are bcrypt/PBKDF2/scrypt. However, suppose you have to audit a system and it uses SHA-512 with salt. Is that "fine"? Or it is a vulnerability ...
3
votes
6answers
441 views

Methods for remembering passwords around the web

What's the least painful way to manage passwords for user accounts that you have on various sites? I see only 3 options: Password manager. Passwords can be different and strong, but the downside is ...
1
vote
0answers
69 views

Rainbow Tables: Why do we need to store the last value of a chain?

Surely we could just make it so a rainbow table says for each beginning of chain do 10k iterations and then we wouldn't have to store both values? Or does by doing it this way it stop collisions? ...
1
vote
3answers
246 views

How to check if our clients were compromised by security breaches in other web applications?

Every now and then a known website is hacked, such as what happened to Adobe or Cupid Media. In such incidents user data is leaked, including usernames, encrypted (and sometimes plain text!) ...
1
vote
1answer
254 views

Retrieve RAR Password through Extracted File

So I was wondering about something, but for the simplicity, consider this example: You have a file with n encrypted files in it, of which one is called 'Note.txt' You also happen to have another ...
1
vote
0answers
98 views

How should I authenticate my SPA frontend with my API since I´ve got no authentication process in the site?

We are designing a web site for selling financial products online. The following is a high level description of the components: Our frontend will be a SPA built with AngularJs. The frontend will ...
0
votes
3answers
229 views

Storing passwords and other data for coworkers

At the moment we are encrypting our server passwords and other important data internal via PGP. Every coworker has got his/her own private key/pass combination set up on their workstation. The problem ...
4
votes
5answers
230 views

Modes of Attack on Time-Bombed Password

I'm one of the co-founders of plaintextoffenders.com. We recently received a submission for which I'm not sure if there is a means of attack or not. The site in question is a hosting/VPS/etc. company. ...
0
votes
4answers
265 views

Is it bad practice to use the same password on different sites?

Is it considered bad practice to use the same password on separate sites, if so why? Even if the passwords to a site are compromised the attacker still doesn't know the user names or sites the same ...
58
votes
10answers
17k views

Bad practice to have a “god” password?

Is it bad security practice to have a password that will allow you to access any user account on a website for support purposes? The password would be stored in a secure manner and would be super ...
11
votes
6answers
25k views

Is howsecureismypassword.net safe to use?

Is it safe to enter my real passwords to test them? I mean, are the entered passwords being recorded/transmitted to someone else?
2
votes
3answers
146 views

Protecting wireless network

My wireless network protected under WPA-PSK/WPA2-PSK protocol. Is there a good reason to change the default user/password for the router management interface? What would it take for an hacker to ...
1
vote
1answer
78 views

Is it possible to hash bcrypt passwords more securely?

I'm wondering if it's possible to increase the work factor of an already encrypted bcrypt password. e.g. I have a password that was encrypted with a work factor of 5, is it possible to increase the ...
1
vote
2answers
109 views

Is it bad to use the same sequence of characters in each password?

A friend of mine purposed a method of making passwords where each has the same base and added to it is something indirectly related to the site or product being signed into. For example all passwords ...
2
votes
2answers
180 views

Appropriate way to encrypt passwords/financial info?

I am in the process of creating a file/files containing all of my logins/password info for various accounts. In the event of my untimely demise this file would be sent to the appropriate party(s). ...
8
votes
3answers
3k views

HMACSHA512 versus Rfc2898DeriveBytes for password hash

We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key The salt is 64 char randomly generated string. We allocated 2048 length on the database for the hashed base64 string ...
3
votes
3answers
133 views

How to simply and efficiently generate different keys from one password?

I saw here that using the same key to encrypt and mac (in that order) a message could eventually be unsafe. What is the best way to generate two different keys from the same password (using a PBKDF ...
3
votes
3answers
254 views

Could using a generated key from an online service be considered a risk?

With some colleagues we're having a debate regarding the randomkeygen.com website. I do think that there is a security risk using the generated keys of this (or any of this kind) website. Why ? ...
1
vote
0answers
101 views

How secure is a Python Pyro daemon for storing a password?

I am using the Pyro package to create a daemon which will, upon startup, prompt for a password, and then the daemon will store that password as long as it is running. Other scripts will then make a ...
10
votes
2answers
592 views

Password generation - too primitive?

A while ago (12 years old), I recognized my passwords weren't safe at all. Because I used the very same password everywhere, some grumpy admin could easily take over all my accounts (he got mail and ...
1
vote
0answers
58 views

How do I determine whether a Linux-based router still has the default password? [duplicate]

My goal is to check if the password used by admin is the default password. I work on a Linux-based router. I know the password is stored as a hashed value in /etc/passwd. In generic Linux machines, ...
2
votes
2answers
108 views

Will deferring password choice until after account activation improve security?

About one year ago, for about two months, lots of user accounts with unverified login email address started to pile-up. All addresses belonged to @yahoo.com. It appears (don't know for sure) some ...
-4
votes
2answers
325 views

in which format this code is encoded ? and how i decode it? [closed]

"jmHMRWncShQ%3D" this is my encoded text , i want to know that in which format , this text was encoded , and also want to know that how i decode these types of code ??? this password may be ...
4
votes
8answers
920 views

Is this a good way to store passwords in a Web Application?

I've been tasked with finding a better way to store passwords and came up with this Algorithm. My understanding of Crypto is not strong enough but can someone check this please? Inputs: Username ...
2
votes
2answers
678 views

Username and password stored under form data in Chrome Dev Tools

When I record the network tab in Chrome Developer Tools when logging in to my site I find that the username and password are stored in plaintext under form data. You can also find it in Safari, ...
0
votes
1answer
168 views

Is my hashing technique secure? [duplicate]

I am not sure if this is the best place to post this type of question. I have come up with function which, I believe, is a very secure method of hashing. (I could be completely wrong). Here's the ...
24
votes
4answers
9k views

Standards for encrypting passwords in configuration files?

My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they ...