Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

2
votes
2answers
7k views

Is it possible to brute force all 8 character passwords in an offline attack?

This article states: Brute-force techniques trying every possible combination of letters, numbers, and special characters had also succeeded at cracking all passwords of eight or fewer characters. ...
2
votes
1answer
722 views

How secure is automatic authentication in Skype?

How secure is checking the automatic authentication option in Skype client? What if I sign in with Microsoft account instead of Skype id? What if both accounts are merged? Is there any documentation ...
1
vote
2answers
244 views

Authorization in offline application

I'm working on a machine which needs to store usernames and passwords for the various operators, technicians, and engineers that may be using and configuring it. It is important that some functions be ...
9
votes
4answers
547 views

How can I be secure with a global salt?

If I understood the basic of password hashing and storing, what we need are: a "strong" salt a "real" random salt a unique salt per password a password hashing function with a high CPU cost We ...
1
vote
3answers
353 views

Is Password Complexity required at all

For a web-site I'm using what I hope is the most secure password storage scheme I can find, which boils down to having a salt and hashed password stored in a database of contacts:- Byte[] ...
1
vote
1answer
2k views

Brute force password cracking with a GPU

How are GPU's provisioned for password cracking? Do all, if not most cracking programs have special GPU aware software or do they just function at the basic driver or API level of the device? Can it ...
0
votes
3answers
546 views

Authenticating users to Web Apps without sending password — can anyone suggest improvements?

I have been interested in implementing authentication method for a web app that is run in modern browsers, without having to send the password over the wire. Can anyone suggest improvements or even ...
-5
votes
2answers
3k views

I know the WPA-PSK secured wifi password, If I use the wifi, will I be caught? [closed]

I hacked the WPA-PSK secured wifi password from one of the wifi network. If they track their DHCP Client IP, will I be caught? If yes, how? By my computer name or IP address or MAC Address?
10
votes
3answers
441 views

has scrypt withstood the test of time?

I've always heard that scrypt was better than bcrpyt... because of memory causing GPU a very difficult time to crack. However, the notion always was that scrypt hadn't been tested, it was kind of a ...
1
vote
1answer
2k views

John the ripper passwd file format with salt not working

I'm trying test password strength in one of our e-commerce sites. I'm using john the ripper to brute-force a password file. The algorithm used by PHP is: $hash = md5($salt . $pass) No other ...
4
votes
2answers
5k views

Utilman.exe command prompt hack prevention?

This trick to hack windows and reset passwords(or create new logins)has been around for ages and still works on windows 7 and windows 8. Is there any way to disable the key combination that brings up ...
-1
votes
2answers
9k views

Recover Windows Server 2003 admin password through restricted user

OK, so here goes after a lot of trial and error: background: My client recently took over another firm. However, apparently the administrator passwords to the server (along with some other non-IT ...
3
votes
1answer
542 views

Is it really true that Google knows most of the worlds wifi passwords

Computer World is reporting that Android devices phoning home have given Google a database with almost every wifi password in the world to it. Is this groundless hysteria, or a genuine concern? If ...
15
votes
12answers
2k views

Should I know my users passwords so I can check they can logon? [duplicate]

I have an issue with support for a system and I don't know what approach to take. It boils down to the question: Should I know my users passwords so that I can check with certainty that a ...
11
votes
4answers
2k views

How can I make sure password hashing is secure on computers while not being prohibitively slow on mobile devices?

I'm new to cryptography and its implementations. I'm designing an Android app where an user enters a password to retrieve some encrypted data. After some research on possible solutions I ended up with ...
9
votes
2answers
630 views

Does it make sense to choose a longer password than the output of a hash?

Let's take MD5 for example: It outputs a 128-bit hash. Does it make sense (in theory) to choose an input (password) which is itself longer than 128-bit? Does it increase the probability of a ...
32
votes
10answers
4k views

Is there any point in using 'strong' passwords?

Let's say I'm setting up a new account on a website. Should I bother using a strong password? My reasoning is this: Password strength is a rough measure of how long it would take to brute-force my ...
1
vote
2answers
994 views

Finding out whether a website uses unsalted MD5 for password hashing

I'm working on a project where websites are analyzed and rated according to password security (factors like min/max password length, alphabet size and more are then calculated into a score). A great ...
5
votes
5answers
22k views

How to generete dictionary for brute force attack?

I need to crack my own password. Advantage is that I know possible characters and maximum length. What I need is to create dictionary for brute force attack. Dictionary should contain all the combos ...
1
vote
1answer
389 views

Which is a safe way to record Firefox passwords in Gnome Seahorse Keyring?

Here is a question that I asked on "AskUbuntu" and I've been suggested to ask it here: Searching for answers about ways to record Firefox passwords in Gnome Seahorse Keyring vault, I found severals ...
2
votes
2answers
1k views

Explain real world symmetric key encryption

I'm new to cryptography. While reading about symmetric key encryption, it was mentioned that it requires secret key exchange so that 2 parties can decrypt the ciphertext. Now, using some encryption ...
4
votes
1answer
178 views

How can I report a security flaw - such as using plaintext passwords - and get a positive outcome? [duplicate]

I seem to find myself doing this a lot. Maybe there's something about colleges and universities contracting out to bad webdev firms, but I've emailed 3 different firms to complain about them holding ...
6
votes
3answers
217 views

Would secure storing of past used/generated passwords be a good idea?

Let's assume an organisation that generates ~100 Passwords a week; these Passwords are 32-Characters long and randomly generated. The consultants that need passwords generated use a Password-generator ...
1
vote
2answers
213 views

How can I generate a unique SALT for multiple apps sharing one user database?

Let's say that I have one Database, and several separate web applications that share the database. If hashes are to be unique and generated on the server-side, how can I ensure that I am generating a ...
1
vote
1answer
210 views

How much information can be obtained from observing someone type their password?

Seems like it wouldn't be too hard to determine if someone is using all lowercase, special characters, or even the length of their password. In fact, the length might be discovered from audio only. ...
4
votes
2answers
530 views

What is the purpose of a Pepper?

I've been trying to find out exactly what a pepper is. The only things I could accurately determine are that a Pepper: Is theoretically unique from site to site and hard-coded in the site's source ...
18
votes
1answer
832 views

Does a maximum length of password mean non-hashed storage?

When a system requires a password between say 6 and 20 characters in length, does it mean the password is stored without using a hashing function, and that the mysql-field (or similar) is 20 ...
12
votes
6answers
2k views

Do salts have to be random, or just unique and unknown?

First of all, my motive is to avoid storing the salt in the database as plain text. As far as this question is concerned, the salt is not stored in the database. After discussion in comments and in ...
3
votes
4answers
631 views

How should a webmaster manage all her passwords and keys?

I have several private keys that I use to ssh into AWS, dreamhost, github, etc. I have passphrases for all of these private keys that are too complex to remember. I have mysql passwords that my ...
8
votes
2answers
429 views

Ideal way to store unhashed passwords

I'm dealing with a 3rd party vendor that clearly does not understand security - to access their API from my back-end I have to supply the end user's ID/user/password for the 3rd party service with ...
1
vote
2answers
488 views

Is the following password-generator secure?

i use the following password-generator (python) and would like to ask if the generated passwords (usually 32 characters and more) are random enough. def pwgen(l=32): from random import Random ...
1
vote
3answers
518 views

Password Security and ocl-Hashcat-plus

I recently read the Ars Technical Article about new features in ocl-Hashcat-plus. In light of questions like: Long Passwords: How are they more secure? and XKCD #936: Short complex password, or ...
24
votes
8answers
2k views

Why is password hashing considered so important?

After reading this article, I can see the benefits of password hashing as a second layer of defence, in the event of an intruder gaining access to a password database. What I still don't understand is ...
1
vote
6answers
355 views

How to keep website passwords safe among employees? [duplicate]

We're a website developer agency, and most of our websites are made using in Wordpress, Joomla or Drupal as a CMS. I'm having trouble to decide how we should manage our passwords, and I'm open for ...
2
votes
4answers
248 views

Why do some passwords not allow certain types of characters?

Is there any programing related reason why some password cannot have certain characters? If the idea in storing a password is to store it's hash, since a hashing function can take any input (ok at ...
29
votes
3answers
2k views

Changing picture as characters entered into password

When Lotus Notes asks for the password, it displays a screen with a picture that appears to change after a new character is entered after the fifth character. I have noticed the sequence of ...
4
votes
6answers
2k views

How can I best manage root passwords for many servers?

Lets say I have two racks with about 40 nix servers in them. I don't want to set all of the root user passwords all the same do I? If not how do you manage and keep up with all of the passwords? Is ...
3
votes
1answer
446 views

Store hash password and encrypted data with this password in db?

I'm currently developping a django application. I need to store user data. This data must be unavailable to any other user or admin I've created a dedicated user account system (no using dj auth). ...
5
votes
4answers
2k views

Is 1Password more secure than an AES encrypted text file?

Are there extra measures taken by 1Password and KeePass, that make them more secure than an AES-256 encrypted text file? The database formats they use seem needlessly complex for my own purposes.
2
votes
2answers
151 views

Slowing down repeated password attacks

I've been reading suggestions to use time-consuming formulas for checking passwords from login attempts, so that repeated attacks will be slowed down. Wouldn't it suffice to just sleep a bit in the ...
2
votes
2answers
187 views

Dual Authorization (Social Auth 2.0)

Can you see any obvious challenges to requiring 2+ users to confirm authentication requests using an association such as a friendship type of relationship. A practical application would be an ...
13
votes
5answers
9k views

Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?

Justin Schuh defended Google's reasoning in the wake of this post detailing the "discovery" (sic) that passwords saved in the Chrome password manager can be viewed in plaintext. Let me just directly ...
0
votes
1answer
73 views

How much space is needed? [closed]

How much memory is needed if I want to generate a dictionary of all possible combination of length 6 with a-z and 0-9 characters? Is it a good idea to go for cracking password if I know password ...
29
votes
5answers
2k views

What are the security implications of storing password blacklist?

I want to add a password blacklist that would prevent the 1000 most common passwords from being used in order to mitigate shallow dictionary attacks. Is there any negative implication of storing this ...
5
votes
1answer
464 views

What techniques do web services use to identify password theft?

I've noticed that some web services use a security scheme in which log-in attempts that have some unusual characteristics trigger extra authentication steps. For example when I try to login to my ...
0
votes
1answer
601 views

How long would it take to brute force the AES encryption?

I'm trying to write a secure code that can keep my site users passwords as safe as possible. Now I'm fairly new to encryption and would like some professional opinions and suggestions. As well as a ...
3
votes
3answers
202 views

Proper storage/use of salted passwords?

If a salt is not stored along with the hashed password in the database, is it possible that the password is salted? I ask because in a system I am working on there is only a password column, but when ...
0
votes
3answers
559 views

Why do you need to login after you change a password?

I can't recall a website that after resetting my password I was automatically logged in, I had to type the password again - which seems quite silly. From a security perspective, why do websites do ...
27
votes
4answers
3k views

Is it safe to show users why their password is not allowed?

/////////////////////////////// Updated Post Below //////////////////////////// This question has received a lot of hits, more than I ever thought it would have on such a basic topic. So, I ...
2
votes
3answers
268 views

Is there any reason I shouldn't use SHA1 of salt + website name + master password for my password in websites?

I considered writing a program to do the above for websites I only intend to use for short-term use.