Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
3
votes
4answers
405 views
Is there any explanation (other than storing plaintext) for case-insensitive passwords?
I've come across a few organisations stating that passwords are case-insensitive. Obviously this is ridiculous, and a gigantic red flag from a security point of view.
Is there any explanation for why ...
4
votes
7answers
642 views
What is the best way to securely keep clear passwords?
I'm working on a web project that will connect to a database. For that, I will have to store the login/password of that database user in clear (encrypted in a symmetrical way) in order to be able to ...
3
votes
1answer
443 views
Bcrypt as a key derivation function?
I read a lot of entries at stack exchange about bcrypt and why it is supposed to be better than PBKDF2 in terms of password storage.
I'm asking now if bcrypt is better than PBKDF2 in terms of key ...
29
votes
7answers
7k views
How can crackers reconstruct 200k salted password hashes so fast?
I'm researching for a small talk about websecurity and I found one article about the formspring hack, which made me curious. They claim to have used SHA-256 + salt
We were able to immediately fix ...
3
votes
4answers
236 views
Is it secure to use similar password over different accounts?
I have a strong password which is a long, unfamiliar word phrase. I would like make other account use a password with similar level of complexity but I don't like to remember so many password over ...
2
votes
2answers
244 views
Seeking advice on how to build a box to brute force hashes? [closed]
I work in a startup security firm, and I need to build a GPU-based to brute force password/hashes, which can be used to validate password strength and test hashing algorithms. I expect some high ...
3
votes
3answers
184 views
When changing a password, does it have to be completely different?
When changing a password how important is it to have a significantly different one? For example is it bad to reverse the sequencing of the old password to make a new one or change a few numbers?
1
vote
2answers
83 views
is it appropriate to set restrictions on a user's password? [duplicate]
Possible Duplicate:
XKCD #936: Short complex password, or long dictionary passphrase?
Im developing a website and am curious as to the current trends in the nature of passwords. Is it good ...
4
votes
3answers
272 views
password complexity policy for non “English” passwords
In an internationalized application, what is the best practice for a policy on complexity of passwords? I am not having luck searching for the answer. Wikipedia lists these items for password ...
4
votes
3answers
360 views
Trying to understand password hashing
I am trying to get a grasp of password hashing. Back in the days it seemed so simple, just MD5(password + salt) and you are done. Then md5 was proven to have collisions so people started moving to ...
2
votes
4answers
203 views
If the attacker knows part of the password but not the length, does that help him in any way?
The idea behind this is that if knowing part of the password and not the length is useless, "passwords" can be easily stored in cleartext or paper since you would just add your own n characters ...
0
votes
0answers
202 views
What is the most secure way to recover password online? [duplicate]
Possible Duplicate:
Can anyone provide references for implementing web application self password reset mechanisms properly?
I have website which sends generated password to any person who ...
6
votes
5answers
791 views
Storing password hashes without a correlation to the user account
I read an interesting article about an alternative way to store password hashes ans was rather intrigued.
A better way to store password hashes?
The primary concept is having a large table full of ...
15
votes
4answers
1k views
Why is using salt more secure?
Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
9
votes
2answers
2k views
What are the most common password salting methods?
I learned that the Sun guys used the login name as salt for password hashing. Is this a common approach?
What are the most common salt values?
33
votes
7answers
2k views
“Real” Salt and “Fake” Salt
During a Q&A period at DEFCON this year, one member of the audience mentioned that we're using "fake salt" when concatenating a random value and a password before hashing. He defined "real salt" ...
8
votes
2answers
1k views
How big salt should be?
I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2).
Having that in mind, how big salt should I use?
Should it be ...
7
votes
1answer
617 views
Would it make sense to use Bcrypt and PBKDF2 together?
I've read various opinions about whether Bcrypt or PDBKF2 is a better key derivation hashing method. The answer seems to depend on a lot of complicated factors that are not easy to analyze. Would ...
8
votes
6answers
555 views
Does prepending a salt to the password instead of inserting it in the middle decrease security?
I read somewhere that adding a salt at the beginning of a password before hashing it is a bad idea. Instead, the article claimed it is much more secure to insert it somewhere in the middle of the ...
9
votes
3answers
777 views
What is a good enough salt for a SaltedHash?
Since I'm hashing all passwords with each their own salt, is there a benefit to the salt being really random, or would an incremental counter or a guid be good enough? Also, is there a benefit of ...
17
votes
4answers
1k views
What should be used as a salt?
I always hear that it is best to use salts on top of stored passwords, which then somehow gets concatenated and hashed afterwards. But I don't know what to use as a the salt. What would be a good ...
0
votes
1answer
263 views
website hacked and all its content erased despite the protections
i was hacked by a guy who erased everything. I spent the day to put everything in order, and i would like to find a solution for this : he erased all the files, and also changed the title for "www" in ...
5
votes
1answer
1k views
Does NIST really recommend PBKDF2 for password hashing?
We hesitated between BCrypt and PBKDF2 for password hashing. In many forums and blogs people say something like "In their Special Publication SP 800-132 NIST basically recommends using PBKDF2 for ...
1
vote
2answers
228 views
Hash, encryption of file… key? Need help [closed]
So my previous question was with some help on pcap files as I am doing a security course and we have a challenge to figure out what was going on in our network. Now one of the files I retrieved is an ...
19
votes
3answers
811 views
Am I wrong to believe that passwords should never be recoverable (one way hash)?
I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
-2
votes
3answers
132 views
Password security : complexity and length [duplicate]
Possible Duplicate:
XKCD #936: Short complex password, or long dictionary passphrase?
I've read that there is many solutions available to crack passwords.
Reading these tips, I can ...
-2
votes
1answer
197 views
What encryption hash function I should use for password securing? [duplicate]
Possible Duplicate:
How to securely hash passwords?
What is the best encryption algorithm? MD5, SHA1, SHA2 or maybe something else? Can you explain me why?
1
vote
3answers
159 views
Does this kind of hashing exist?
Let's say you have two user defined strings, X, Y and you want to hash them into the hash Z. That is what most websites would do, X is the user's password and Y is the salt. It takes a lot of time to ...
11
votes
4answers
1k views
Looking for example of well-known app using unsalted hashes
Does anyone know of a well-known application that still uses unsalted hashes for password storage? I'm looking for an example for an upcoming lecture on Rainbow Tables, and I think it would add ...
5
votes
2answers
571 views
Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?
SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet.
I've read the information at it's Stanford University home page, the Wiki ...
168
votes
4answers
41k views
Do any security experts recommend bcrypt for password storage?
On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
9
votes
4answers
387 views
How should I tell an organisation that they are vulnerable when I wasn't given permission to check?
I was recently at a village hall (in the UK), some distance from where I live, for a party. I noticed that they had unsecured wi-fi with an SSID of NETGEAR. I assumed it was free wi-fi for users of ...
6
votes
3answers
319 views
Is it advisable to have a web browser remember login credentials?
I have a really long random password for my cellphone account and have it written down in a safe place. I only use it once a month and am considering having my browser remember it. Would there be any ...
0
votes
0answers
113 views
HDI interpret Ettercap “PASS” fields?
I'm running ettercap (with Moxie Marlinspike's sslstrip), and I can't interpret a huge amount of the username / password output I get. I get a huge amount of traffic through my network that looks like ...
1
vote
4answers
274 views
Are there vunerabilities with this authentication mechanism?
I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL. The goal here is to avoid sending any sensitive information across the wire.
I was ...
2
votes
1answer
1k views
How can I decrypt traffic on a WEP encrypted network?
Let's say that I am connected to a WEP Access Point and I want to sniff all wireless traffic inside that network. How can I decrypt the traffic even though I don't have the cryptographic key?
I found ...
1
vote
2answers
315 views
Long Passwords: How are they more secure? [duplicate]
Possible Duplicate:
XKCD #936: Short complex password, or long dictionary passphrase?
How are long passwords more secure? The only situation in which I can accept long passwords are more ...
4
votes
2answers
2k views
How expensive is it to guess a 15 character password, and should I be worried?
I'm currently using AES encryption (at home) on GNU/Linux (one of LUKS AES-256 variants with xts) and on Windows 7 (Truecrypt) with a 15 characters password (alphanumeric lowercase only plus _).
...
5
votes
5answers
1k views
What password cracking software is commonly used?
I am curious to know how secure my passwords are.
What password cracking software is commonly used?
Preferably open source.
EDIT: I am actually looking to crack my passwords used on services I ...
25
votes
2answers
2k views
Pre-hash password before applying bcrypt to avoid restricting password length
Good practice is not to unnecessarily restrict password length, so that appropriately-long passphrases (perhaps 35-45 chars for 6/7 dicewords) can be used. (See e.g. Should I have a maximum password ...
30
votes
8answers
1k views
Why do password strength requirements exist?
Password strength is now everything, and they force you to come up with passwords with digits, special characters, upper-case letters and whatnot. Apart from being a usability nightmare (even I as a ...
3
votes
4answers
489 views
Send new password by email is bad practice but what to do if user forgot his password?
According to http://plaintextoffenders.com/post/7006690494/whats-so-wrong-about-sending-a-new-password-in it's bad so what to do ?
Just ask him to set a new one ?
4
votes
4answers
8k views
Modern high quality password dictionary
Has anyone come across any good password dictionary lately? Some of the lists I found dated back to 90's! Some are simply too big that I doubt their quality. There appears to be some work by someone ...
2
votes
3answers
434 views
Why would you do a password audit
I was thinking last night after reading an article about pen testing and security audits, why would you get a list of all the passwords for the company you are auditing and put them through a piece of ...
3
votes
3answers
153 views
What pros and cons are there to a one-time random salt between client and server?
In researching on best practices in hashing passwords using a salt I came across a presentation on slideshare. The approach outlined is as follows
Client requests login page
Server-side code ...
5
votes
4answers
509 views
Password hashes should run md5 thousands of time: really?
I skimmed through How Companies Can Beef Up Password Security and I thought that several assertions were completely wrong, in particular:
Cryptographic hash (like md5) with salt are bad.
It isn't ...
3
votes
5answers
261 views
Tool to grab sensitive information from command lines
Of the information entered on the command line (command name and arguments) have to be considered public (everyone can access it using commands like ps).
Is there a known tool to automate this kind ...
18
votes
6answers
890 views
Online password managers
Can online password managers be used for storing and managing passwords? I mean from the security point of view. I understand that those systems can be different and some deserves more trust than the ...
0
votes
1answer
183 views
What's the idea behind requiring users to change password periodically? [duplicate]
Possible Duplicate:
How does changing your password every 90 days increase security?
Some sites require users to change their password every x days. For example, at least 3 online banking ...
3
votes
1answer
398 views
Reasonable (BruteForce) Attempts/Second Estimate?
I've read various articles on password strength and passwords vs pass phrases (including the one from XKCD and its thread here), but most of those articles seem to be focused on online passwords, and ...
