Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

3
votes
0answers
54 views

DRIVELOCK password [closed]

I changed my computer user name and password. When I logged in it was still OK. But when I restarted again it did not accept my password, it says wrong password or incorrect. Then the IT department ...
0
votes
2answers
285 views

Website sent me my new password (after reset) in clear text [duplicate]

I was resetting my password on a website and the website emailed me a new password in plain text rather than giving me a reset link to change the password myself. I logged back in and changed the ...
1
vote
3answers
90 views

Is using my phone number as a pin for a phone a security risk?

I just did a factory reset on my smartphone to see if it might fix issues with battery life. I configured a phone number as the lock screen code so I have a code that's both long and easy to remember. ...
5
votes
3answers
401 views

2-Factor Authentication vs Security Questions

I have an account with a bank that has additional security option. When it does not recognize a device being used to access the account, it will either: Prompt with 1 of 3 security questions Send a ...
-4
votes
1answer
94 views

Time-based password change [closed]

I have created this script and it runs great, but important questions remain. Is this script useful and secure? Does it have any possible problem or weakness? root@010010:/# ls -la /root/...
5
votes
4answers
182 views

Does manipulating a random password significantly reduce its entropy?

Suppose I generate a password using a secure random number generator and all the available character classes. For example, c.hK=~}~$Nc!]vFp9CgE. Consider that this password may need to be used in an ...
1
vote
3answers
63 views

Hashing Algorithms Costs vs Sleep

I understand most of the concepts behind hashing password but this one still escapes me. I understand that you want the hash to take some time ( a couple milliseconds) so the attacker can't ...
3
votes
1answer
370 views

Is it safe to use a 4-digit PIN for Android system encryption?

I just encrypted my Android phone using the default menu. I was asked for a PIN code (4 digits). Do you think this is a good practice? Is there a limited number of attempts at decrypting the ...
9
votes
2answers
272 views

Is it possible to guess the length of a password by sniffing TLS packets?

In this answer, the author states that it is possible to tell the length of your password, by sniffing your TLS packets. Is this true, and how would this be done in practice?
7
votes
2answers
318 views

Password: ham,ham,ham,bacon,bacon,ham

Why do we bother with dice ware? Is rolling dice and looking up in a printed book (or using a digital analogue) a string of N random words any more secure than simply repeating a word or two N times? ...
6
votes
2answers
1k views

Docker containers, environment variables, and databases

Environment variables (set with -e) in Docker containers are available to every linked container. Consider a typical use case, a database. The official MySQL image gives this example command: docker ...
1
vote
2answers
128 views

Double hashing using a relatively new hash and a old, tested one

Note: I am relatively new to cryptography in general, so please point out if I make any misconception here. I heard that you should always use well known crypto/hash functions, that have already been ...
9
votes
2answers
736 views

How to store/encrypt fingerprint?

Storing password is a no brainer : use a password hasher. But.. How do you proceed to store fingerprints securely on your server? Meaning that even if your server and all it's data is stolen, someone ...
1
vote
4answers
125 views

Is there a security advantage towards hashing a password on the server? [duplicate]

I'm working on an authentification system. Now in this system the user logs in and sends a hashed password to the server. Is this enough or do I have to rehash the password again? So basically is ...
6
votes
2answers
2k views

How does the attacker to ransomware get the password?

I have been thinking about ransomware and as I see it the password seems like it should be a problem for the attacker. I can see it going down one of two ways. Either the password is included in the ...
4
votes
1answer
165 views

Protect password/authenticating during transit over (insecure) TCP socket for a game

Background I am designing a multi-player game with a single server that handles multiple worlds. Each player logs into the server initially before requesting which world to join. The server has a ...
1
vote
2answers
1k views

John the Ripper exclude incremental mode from another incremental mode

I want to crack an 8 characters password. First, I tried the incremental mode digits, but I did not find the password. So now I know it's not all digits password. I want to use lowernum incremental ...
5
votes
1answer
125 views

Fido: trusting user-agent

As I went through Fido specifications: the server (providing web app/services) need to trust user agent for local fido authentication and if needed can enforce certain policies" I am not sure ...
1
vote
2answers
171 views

Several hashing routines support client side work. Doesn't the hash just become a password equivalent?

Isnt Secure Remote Password Protocol (SRP) pretty much client side hashing? Argon2 the winner of the PHC also allows for client side hashing. How do these systems avoid the plaintext equivalence ...
6
votes
6answers
4k views

Ransom attacks - can I protect myself by encrypting all my files? [duplicate]

If I encrypt all my files can I get "attacked" by ransom attacks? Because my files are already encrypted, they cannot access them, so I should be safe or am I wrong? Also, if someone could tell me ...
4
votes
5answers
488 views

Not storing the salt? Is that an option?

Please read as I did many searches and believe this is NOT a duplicate question. For your reference, I've read these articles and other questions already: How do you overcome the problem of the ...
6
votes
1answer
146 views

How long does 2-factor authentication codes have to be?

I've noticed that from a (personal) UX point of view, 4 numbers which my online banking uses seems to be a sweet spot in terms of holding it in my head from looking at my phone to typing it it. But ...
3
votes
1answer
229 views

Writing your own John the Ripper module

I have a script in C, which is able to determine the password of certain data. It uses HMAC and RC4 algorithms to encrypt the given password and then compares that later to the given data. If they ...
5
votes
1answer
99 views

Unique Touchscreen Authentication Schemes

I am working on a new software application that will have access to millions of patient medical records. I want this to be secure. The initial thought process was to simply use a standard username ...
3
votes
2answers
238 views

Am I encrypting and storing an array of user-details correctly?

I came up with a user-details-storing procedure that was, in the beginning, based on actual security-literature – but then I just kept writing without really doing all the cross-checking I should have ...
2
votes
2answers
530 views

Practical steps for encrypting an encryption key for data stored in MySQL

So I'm working on my first project where user data is stored as encrypted using the user's password as (part of) the key. I have read many similar things about best practices, but the details seems to ...
1
vote
3answers
81 views

Password help with coding! [duplicate]

So, I'm terrible with any sort of coding, and I need help with generating a series of possible passwords. I've forgotten the combination of a password I put in for an email - I know the password, just ...
2
votes
3answers
197 views

How does a hash which contains algorithm to choose can be secure?

I was thinking about creating my own hash+salt function, something like sha1(password + md5(login)), then I read here (part 4) that creating it's own hash+salt function is a bad idea, because if the ...
7
votes
0answers
112 views

Which format of secret would be the most efficient for human memory? [closed]

I am talking about something-you-know identification factor. Examples of those formats are passwords, passphrases, pin-s, picture passwords ( http://blogs.msdn.com/b/b8/archive/2011/12/16/signing-in-...
2
votes
2answers
204 views

Password Manager use and safety [duplicate]

I just recently read an article advocating the use of password managers, and while I understand why someone might think using these programs might be a good idea, it's my understanding that these ...
0
votes
3answers
126 views

Random characters and letters form obsfuscation

I know that this question has been asked many times, but would JavaScript encryption work if I just added 100 random numbers and letters to the password? That would be hard to reverse engineer, ...
1
vote
3answers
196 views

How do I allow only app to view/download files from server?

I have an Android app that uploads and downloads pictures from my dedicated server. However, before I go live, I want to know if there is some way I can secure the server to allow only my app to ...
5
votes
1answer
452 views

Security of Yahoo's new authentication: On-demand password

Yahoo is trying to remove passwords from authentication and use on-demand password authentication system instead. I wonder how this new system will be secure? Even if somebody steal your mobile can ...
2
votes
4answers
109 views

Is it safe to use my personal password as my password in work related accounts?

For example I have this complex personal password cary1bondoc21cary2bondoc as my password and because I am forgetful I also want to used that in work related accounts like company email, etc. Is there ...
19
votes
4answers
4k views

Should I implement incorrect password delay in a website or a webservice?

With arguments expressed in this answer, there is a few seconds delay between user enters an incorrect password and when he/she actually learns, that password was incorrect. This security solution is ...
2
votes
3answers
152 views

Use the same password on different (very secure) sites?

I understand that one should not use the same password everywhere, as stated here for instance. Using the same password on several non-valuable sites may be considered acceptable: we simply do not ...
5
votes
5answers
2k views

Salted password + hash - is it really useful? [duplicate]

I am new to the topic and wanted to know the concept of having salted hashes before going down to the technical details. From what I have understand password - plaintext hash password - plaintext ...
0
votes
1answer
122 views

Prevent brute force attacks on web publishing logins

Presumably, if someone tries to brute force into your website's control panel at your web host's site - they will be throttled/locked-out etc. But what about the web publishing logins (Web-Deploy, ...
17
votes
5answers
3k views

Is this idea for a password manager secure? If so, why doesn't anybody use it? [closed]

I've been thinking of a problem with usual password managers: although they do provide better security than manually using passwords, there's a central database that can get lost, get compromised, etc....
42
votes
13answers
13k views

Is it good practice to send passwords in separate emails, and why?

I have heard from different people and in different places that if I send an encrypted file to someone else, I should send them the password in a separate email; but why? If someone is sniffing, they ...
1
vote
5answers
1k views

Why do we use passwords on sites? [duplicate]

I don't have passwords for my personal sites. To sign up a user pick their username and enter their email. There is a logout button if the user wishes to log out. To log in you enter your email and ...
2
votes
1answer
145 views

Is it secure to set default value for password field?

I'm looking at an application where admins can "invite" users by email and invited users. Invited users then are sent a unique URL and are inserted into a MySQL database with status pending and an ...
0
votes
2answers
194 views

Saving passwords in database

I have recently been studying a lot on writing secure code and choosing secure methods for saving passwords to a database. I'm wondering if it's secure to use ready made libraries or APIs to do this ...
3
votes
2answers
198 views

Is there any history of a major attack using password reuse? [closed]

While everyone and their favorite webcomic seems to agree that password reuse is a major problem, some quick googling cannot seem to find any cases where it has been used on a large scale in an attack....
5
votes
3answers
445 views

Am I in this particular case allowed, to store password in java program?

I have a Java-Server program running on Ubuntu-Server which gets every 5 minutes current location data of my android-smartphone (which I carry with me). My architecture is the following: My smartphone ...
7
votes
2answers
589 views

*NIX shadow file password format

I'm trying to get shell access to a router and have managed to retrieve its /etc/shadow file: root:$1$$N76hdwGfg11g0KdKbtyh21:0:0:root:/root:/bin/bash I've tried to use john to crack it but couldn'...
1
vote
1answer
304 views

Using Tor browser to use YouTube and account security

YouTube is not available in my country, but I want to make an account on YouTube and use it. I'm not interested in protecting my identity. It is fine if anyone can monitor it. The thing I'm interested ...
-4
votes
2answers
76 views

How does the password become 30,000 times stronger?

This google support page says: For example, an eight-character password with numbers, symbols and mixed-case letters is harder to guess because it has 30,000 times as many possible combinations ...
84
votes
11answers
16k views

Password rules: Should I disallow “leetspeak” dictionary passwords like XKCD's Tr0ub4dor&3

TLDR: We already require two-factor authentication for some users. I'm hashing, salting, and doing things to encourage long passphrases. I'm not interested in the merits of password complexity rules ...
-3
votes
1answer
461 views

What type of hash is this MD4(MD4(($pass)).(strtolower($username))) [closed]

Can I decrypt this hash? Domain Cached Credentials: MD4(MD4(($pass)).(strtolower($username)))