Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

1
vote
1answer
100 views

HMAC password reset link and replay attacks

I like the look of this technique for sending password reset links: https://neosmart.net/blog/2015/using-hmac-signatures-to-avoid-database-writes/ (TLDR: don't store token in database. Send password ...
1
vote
1answer
101 views

Recover 7zip password with partial password matching [duplicate]

I encrypted some files using 7z with AES-256 + file name encryption. The compression level was Ultra, method: LZMA. The password I regularly use is 16 digits. Now the file is not opening. I guess one ...
0
votes
0answers
87 views

Why do websites limit what special characters you use in a password? [duplicate]

Bank of America, to give just one example, only lets you use certain special characters in your password - # and ( and ), but not $. (This is not a complete list, they allow more than that, but it's ...
19
votes
7answers
7k views

Are password reset links that don't expire a security risk?

I am currently working on a password reset flow. We have decided to go with a password reset link being emailed to the user's registered email and allowing them to follow that and input a new ...
32
votes
3answers
6k views

Is using the username encrypted with the password as key a good password storage scheme?

On web applications I build I don't hash the passwords. Instead I symmetrically encrypt the username using the user's password and store the result in the password field. I use RijndaelManaged on ...
4
votes
2answers
186 views

Does adding a random character to a pseudo-randomly generated password improve entropy significantly?

I'm asking a practical question. I was taught computers are bad at generating random data. Does this mean password generators, such as the one built into Keepass, suck? If yes, then would it help for ...
0
votes
2answers
121 views

How much more secure would using alt codes in a password make it? [duplicate]

My friend and I were talking about how fast computers could potentially brute force a password these days. I came up with the idea of using letters from a foreign alphabet to use in your password, ...
0
votes
1answer
110 views

Why does healthcare.gov exclude some special characters from passwords?

The site does not allow the following characters: = ?<> ( ) ‘ " / \ & It also limits maximum password length to 20 characters. This makes me suspicious that they might be being stored in ...
1
vote
1answer
55 views

What is a viable time-frame for links that expire? [closed]

Links that expire can be found anywhere from Email Verification to Password Reset procedures, I understand in most cases this is considered "security theater", but wanted to know what a viable ...
0
votes
0answers
230 views

Best way to store a password in a text file

We have a WebLogic server (WLS_APP) with a lot of web applications, we also have an Oracle Service Bus (WLS_OSB) with a lot of services deployed on it. We have these services aggregated in proxy ...
1
vote
2answers
104 views

Email used to log in but doesn't have to be unique. Issues?

I've moved onto a project where they are implementing a system whereby a user's email address can be used multiple times by different people - i.e. users can sign up as many times as they want with an ...
1
vote
0answers
45 views

Key stretching approaches

I've seen that a number of key stretching algorithms and they involved increasing the number of operations needed to compute the key(i.e. the number of rounds within a hash function). But, I wonder if ...
2
votes
2answers
6k views

Securing passwords for REST Authentication

I'm developing a REST application using the Spring Framework, as as part of the requirements, we have to secure the different functions of the system to different user roles (pretty standard stuff). ...
20
votes
4answers
19k views

Possible to use both private key and password authentication for ssh login?

It seems that they are mutually exclusive, as disabling one gives me the other, and vice versa. Two-factor auth for my ssh servers sounds really nice, so is there any way to accomplish this?
9
votes
11answers
4k views

How to easily remember lots of different passwords?

I know that you shouldn’t use the same password on every site. But, when you log into several dozen sites, keeping track of all the passwords can be pretty hard. What system do you recommend that ...
1
vote
0answers
74 views

Customized approach to protect plaintext passwords/usernames in database table?

I'm in the process of building an app to let users sign up, connect their many email accounts (like Gmail) to the site, and allow email-related activities... like sending an email (please don't ask or ...
4
votes
2answers
642 views

Should I password protect all my archives from cloud?

I am a student and I didn't care a lot about my passwords strength and my files until now. Now I am thinking about having a backup for all my files in cloud. Questions: Should I password protect ...
4
votes
4answers
3k views

Passphrase - what is it exactly?

Well, according to Wikipedia, this is a passphrase; A passphrase is a sequence of words or other text used to control access to a computer system, program or data. A passphrase is similar to a ...
3
votes
1answer
2k views

Correct way to generate password salts in PHP 5.3 on Linux given my constraints?

In examining our database storage of hashed passwords with salts, I note a high rate of salt collisions, i.e., there are far too many cases where two table rows have the same salt stored. One ...
15
votes
2answers
2k views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
2
votes
3answers
1k views

Strategy for updating stored passwords to more secure hash? [duplicate]

I know that we cannot update our hashed passwords without having the plain text password to re-hash. When a member logs in with login/password, we have the plain text, so that gives us an opportunity ...
11
votes
3answers
3k views

Additional security of keyfile on top of a master password for KeePass

I use KeePass + Dropbox to manage and synchronize my passwords across my devices. This system works really great and I trust KeePass' security model. However my biggest remaining concern is the ...
5
votes
1answer
2k views

How can a system verify an online password using a phone keypad?

I phoned into a financial company's website, and it prompted me to key in my password on the phone keypad, converting the alphabetic characters to the corresponding digit, and special symbols to '*'. ...
9
votes
2answers
624 views

How to store/encrypt fingerprint?

Storing password is a no brainer : use a password hasher. But.. How do you proceed to store fingerprints securely on your server? Meaning that even if your server and all it's data is stolen, someone ...
3
votes
4answers
2k views

If a thief has the phone in their possession, how can Password Recovery be implemented securely?

Standard password recovery involves sending a password reset mechanism to the user; either to email, sms or telephone call. However, if a phone has been stolen the thief has full access to these ...
4
votes
3answers
257 views

Passwords propagation, Password Trend and Word Generator in Human Mind

Some passwords like "123456", "admin" are outrageously popular, so are the leet transformations and concatenation of digits. The users seem to pick up the password suggestions or just copy the ...
16
votes
4answers
363 views

Are malicious relying parties able to abuse OpenID logins?

if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me? Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
3
votes
1answer
1k views

How to authenticate in a website with public/private keys?

I've been reading how the SSH public/private key works and realized how handy they are (taking the secure out of the equation). And started to wonder why websites do not implement the same thing? ...
0
votes
0answers
32 views

Password storing using hashing only, encryption plus hash [duplicate]

I want to hash password before storing to database. I am not able to understand which approach will be suitable.For examples Hash plain password directly with SHA-1, SHA-256 etc and then store in DB. ...
0
votes
0answers
263 views

Breaking EncFS given .encfs6.xml

I forgot the password of a EncFS folder (created, went to vacation, forgot). But I remember how the password was created (e.g. was a sequence of 4 dictionary words). So I decided to try to find the ...
0
votes
1answer
123 views

Ignoring collision and (second) pre-image resistance, what makes a cryptographic hash function strong?

With regards to resistance against dictionary and brute-force attacks to "crack" hashes containing passwords, what determines the resistance of a cryptographic hash function? Since collision ...
2
votes
2answers
182 views

Why can't a rainbow table attack identify and trash the salt?

Here's my understanding of a salted / hashed authentication scheme: string plaintextPass = Request.Form["password"]; string salt = UserRecordFromDb.Salt; string toHash = salt + plaintextPass; string ...
4
votes
2answers
2k views

What's the purpose of $LoginKey from the Ashley Madison leak?

According to this site Ashley Madison was keeping an insecure hash stored in their database using MD5, in addition to the far more secure bcrypt hash. This group used the MD5 hashes to quickly crack ...
1
vote
2answers
1k views

Do cloud-based password managers invalidate even the most secure architecture?

Can an online password vault, like Lastpass, be defended through a security assessment that demonstrates the value they provide outweigh the risks of being a high value target? A valid answer would: ...
5
votes
2answers
1k views

Should email verification be followed by password-based login? Why?

[This is a duplicate, considered off-topic at http://stackoverflow.com/questions/26564992/should-email-verification-be-followed-by-password-based-login-why] A typical account creation process seems ...
6
votes
4answers
2k views

Is GPG suitable as part of a password manager and generator?

I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
2
votes
4answers
2k views

HTML password fields

Imagine you are in a HTML page which offers you the password change service. Some websites bring the previous password in a password field, which you can't read. Is it possible to retrieve the ...
10
votes
5answers
2k views

Are case-insensitive passwords a bad idea?

I recently discovered a service where the password was not case sensitive. I understand basic principles of encryption and hashing so I am a bit worried, is this service storing my password in plain ...
2
votes
2answers
109 views

Is a random work factor an increase or decrease of security?

Assume you use a proven hashing algorithm, like bcrypt with a work factor of 10 or PBKDF2 with 10K iterations. Normally that's really secure already and would give enough security already for most ...
-3
votes
1answer
68 views

How do I get the password knowing part of it and the length [closed]

I'm new to all this, I'm trying to use Hash Suite to find a password with a word + 2 numbers. I know what the word is but not the numbers but I also know the length of the passwords ... What do I have ...
17
votes
7answers
2k views

Taking password letters not whole one, is this secure? [duplicate]

I found a site which is taking password letters from their users not the whole password. Is this secure? Or do they have saved password as salted hash (MD5)?
2
votes
2answers
162 views

Is encryption application credentials using certificate encryption good practice?

I'm working on a small web application. The web application needs access to a database, so the application needs access to a database username and password. The application runs in an environment ...
0
votes
3answers
169 views

securely storing passwords that can be retrieved

I'm trying to build a web application that can store passwords of other services like Facebook, Gmail ...etc. These passwords can be later retrieved and shown to the user. This has to be a web ...
2
votes
1answer
122 views

How does LastPass know that Microsoft.com uses the password for Live.com?

When I visit Microsoft.com, the LastPass dropdown lists my username/password for login.live.com. It does something similar for Playstation.com and several other sites. How does it know? Are these ...
0
votes
2answers
121 views

Store password in Public Domain using files and md5sum

Whenever I check integrity of a file using md5sum, I get a string of alphanumeric characters to compare and verify if it was downloaded correctly. Couldn't the concatenation of several of those ...
2
votes
1answer
184 views

Would it be possible to add additional files to a password protected zip 2.0 file

I don't have the ability to determine/recover the master password for a production system that uses zip 2 archives. However, I need to be able to add new files to existing encrypted archives. There ...
33
votes
4answers
6k views

How does a hacker know how many times a password was hashed?

I've been reading a lot of questions about security and hash functions on this site and others. I am not an expert, just a curious mind and in my understanding the more iterations used to hash a ...
19
votes
3answers
4k views

Is a password in the clipboard vulnerable to attacks?

I see situations where you may have to input the same password more than once. You may type it in a text editor and copy it to clipboard, to paste it two or more times. In what scenarios this could ...
6
votes
6answers
113 views

Forgot password and revealing whether account exists [duplicate]

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...
7
votes
3answers
351 views

Forgot password and revealing whether account exists

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...