Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
7
votes
4answers
524 views
If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?
In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the ...
4
votes
5answers
3k views
Is a longer WiFi password more secure?
Today I had to type the same password to connect to a WPA2-secured WiFi network several times, and got really annoyed with the length of the password. Especially since it is just a phrase repeated ...
2
votes
2answers
168 views
What are stolen passwords used for?
Say there is a line of business application which has username/password datatable in the DB. Personal email address is not stored, and usernames are assigned by an administrator. Someone gains access ...
2
votes
1answer
605 views
Please explain Time-step in Time-Based One-Time Password Algorithm
I am studying about OTPs (One Time Passwords). I have gone through all the methods: HOTP (HMAC-based One Time Password), TOTP (Time-based One Time Password)
I have no issues with HOTP. But according ...
6
votes
1answer
674 views
How will security need to be changed if P=NP?
If we suppose that it is found that P=NP, how will security measures need to be changed?
I'd like to know the major security measures that are affected, and how they would need to be changed. We can ...
-1
votes
1answer
143 views
How Does VMWare Protect Passwords? [closed]
I am interested what features VMWare uses to protect passwords inside the virtual machine.
5
votes
5answers
257 views
What are all of the issues with storing a cleartext password?
I know, I know, cleartext passwords are terrible and you should always store a hash!
However, I'm interested in all of the issues with storing cleartext passwords so I can make a reasonably secure ...
6
votes
2answers
248 views
Should an admin user be able to edit passwords?
For your typical web app, should an admin superuser have the right to edit a user's password, or should only that user have the right? (Even with edit ability, the admin would never see the current ...
27
votes
16answers
4k views
Why do people think that this is bad way to hash passwords?
Well, please tell me, what's wrong with this code:
$password = "hello";
$password = md5($password);
for($i=1;$i<20;$i++){
$password = md5($password);
}
It's exactly the same as this one:
...
8
votes
3answers
439 views
How can I promote good password practices in an organization that doesn't currently care about that?
I work with an organization that uses some very poor practices such as using default user accounts, default passwords (or passwords the same as user accounts), sharing password information between ...
2
votes
3answers
398 views
What is the recomended algorithm to create a key from a password?
In my new secret document encryption utility, the key for symmetric encryption = the hash of a random salt and a user provided password.
It is necessary to have a slow hash function in order to ...
8
votes
5answers
551 views
Using a weak password on a truecrypt volume
I have put together a portable apps USB stick for when I need to use random site computers, I also threw truecrypt on with an encrypted volume for some word documents.
The password I am using is ...
3
votes
2answers
638 views
How is WEP/WPA2 key derived?
When I was a kid, WEP had a 40 bit key. Later, they came out with a 128-bit key. But as we all know, WEP was so badly-designed that the RC4 key length didn't really matter much.
Ignoring this, my ...
3
votes
1answer
303 views
Non English password dictionaries
What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
3
votes
3answers
343 views
Password Scheme
I manage about 20+ Linux servers and I am considering using an md5 scheme similar to following to generate the admin passwords:
echo 'masterpassword' 'serverhostname' | md5sum
Which returns ...
1
vote
1answer
414 views
How to implement WSS UsernameToken when password on the server is salted and hashed?
I'm currently trying to write a web service for customer and requirement is to use WS Security. On their server side, they have passwords stored as SHA-1(salt+password).
According to WSS spec, ...
3
votes
2answers
433 views
Efficient and simple way of securing home pc with hardware token
I am looking for a simple but reasonably safe way to secure my home pc (and laptop, nas, etc.) with a hardware token. I would like the system to be secure, but practical enough to be used on a day to ...
8
votes
6answers
694 views
Cracking long Windows XP passwords
Completing an assignment for my Ethical Hacking unit at University at the moment and the first task I have is to crack some passwords.
Decided to use backtrack to crack some passwords from a Windows ...
6
votes
3answers
301 views
Is it OK to use the same password for a Linux login and the SSH private key?
I want to remotely log in to my Linux server with SSH. Public/private key authentication is more secure than password authentication, so I have disabled password-based authentication for SSH on my ...
7
votes
6answers
1k views
Is denying login after incorrect attempts ineffective?
Generally denying logon attempts after X amounts of incorrect attempts for Y amount of tries is a very basic way to prevent bruteforce attempts or malicous logon attempts.
Yet, surely doing this is ...
32
votes
11answers
3k views
What to do about websites that store plain text passwords
I recently received an email from a popular graduate job web site (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
4
votes
0answers
96 views
Dealing with systems that store/send passwords in plain-text [duplicate]
Possible Duplicate:
What to do about websites that store plain text passwords
When using a system as it was designed to be used, and the system provides proof that it is storing and/or ...
7
votes
2answers
311 views
Should user be allowed to save password in browser?
The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
9
votes
3answers
3k views
Security of passwords remembered by Windows
Does Windows XP or Windows 7 encrypt saved passwords?
I'm assuming that the user uses local password to logon.
The user then uses his own computer to connect to server in work and sets the "remember ...
3
votes
2answers
407 views
Why do some websites force users to come up with difficult passwords?
I can't understand why we commonly force users to come up with difficult to remember passwords.
* Your password must contain at least one number, one uppercase character, and one special ...
4
votes
3answers
933 views
Reverse-engineering one-time passwords for two-factor authentication systems
Given a one-time password generator that is time-based (such as Google Authenticator), how many instances of (time, PIN) pairs would one need to significantly weaken the algorithm to a point where one ...
2
votes
1answer
376 views
Token Based Authentication & Pass-the-hash Attacks
Do token-based authentication solutions (such as RSA SecurID) mitigate tools like incognito and/or pass-the-hash tools?
5
votes
3answers
2k views
Regulations that specify password length?
I have read:
PCI DSS 1.2
SOX 404
AR 25-2
ISO 27001
But only PCI DSS specifies a minimum password length.
Are there any other regulations that dictate password lengths for any industry?
NIST ...
7
votes
5answers
378 views
Utility company does not hash passwords in the database
I had to use my utility company's online account information application and forgot the password. Going through the steps of resetting the password I was emailed the password in the open. I found this ...
18
votes
5answers
1k views
Is my bank storing my password in plain text?
My bank (and every bank I've come across) only ever asks for individual characters from my password when logging in. Is my bank storing my password in plain text?
21
votes
5answers
1k views
Do spaces in a passphrase really add any more security/entropy?
I often see passphrase suggestions written as a sentence, with spaces. In that format are they more susceptible to a dictionary attack because each word is on it's own as opposed to a large unbroken ...
3
votes
1answer
342 views
Best security algorith for storing passwords [duplicate]
Possible Duplicate:
Which password hashing method should I use?
I want the best cryptography algorithm for storing passwords in database, which one should I use and how can I implement ...
4
votes
2answers
817 views
openssl_digest vs hash vs hash_hmac? Difference between SALT & HMAC?
openssl_digest vs hash vs hash_hmac
I want to use SHA512 for storing password.
Which of the above methods are best to use? Why?
What is the difference between SALT & HMAC?
I just read ...
7
votes
1answer
219 views
Protecting emails in your database
It's common to encrypt passwords in the database, but I'm wondering what solutions are out there to protect emails in your database.
Not just from hacking, but from disgruntled employees or engineers ...
1
vote
1answer
1k views
What algorithm/encryption type does Gmail use for security?
In the wake of the recent database hacks, i.e. Sony, Gawker, etc.. where the hackers have access to the hashed usernames and passwords, i've been more keen in paying attention to the sites and ...
10
votes
3answers
3k views
Is a password protected PDF file safe for bank statement attachments?
My bank emails my monthly statement to me in a password protected PDF attachment. Is this a secure method of transmitting something as sensitive as bank statement?
2
votes
2answers
115 views
How can I protect a client's mirror of the server's database?
The scenario is as follows:
There are clients that users can access and work with.
These clients can be online or offline.
There is a central database on a server, holding all the authorization ...
3
votes
3answers
230 views
Is it safe or even common to cache bcrypt checks in-memory
In a web application that (as a side effect of implementing the password anti-pattern) stores passwords, one recommendation is to bcrypt to store them (or computationally expensive one-way salted ...
4
votes
1answer
159 views
Thoughts on creating unscalable conditions to brute force even small passwords?
I stumbled upon something called "scrypt" which claims to add fixed time/space complexity requirements into password-based key derivation.
Quoting from their page:
A simple password-based encryption ...
7
votes
1answer
2k views
Can a dictionary attack crack a Diceware passphrase?
Everyone knows the words used in Diceware passwords (all 6^5 = 7776 words are published) -- they're all common words.
Everyone seems to know that we're not supposed to use dictionary words for ...
4
votes
1answer
1k views
Rainbow tables, generation and lookup, preferably using GPU
1a) What software can I use to generate my own rainbow tables, preferably software that can utilize CUDA or ATI Stream?
One of the reasons I want to make my own, is that I want to use a specific ...
8
votes
8answers
842 views
Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?
I don't know why do we authenticate by prompting the user to enter both username and password.
In my mental model, prompting password only suffices.
The reason is as follows:
Assume there are x ...
2
votes
4answers
272 views
Store a password to avoid user interaction
I am creating a windows service that sends email to a user. It uses a Gmail account to send the email, so it needs a password to access the account. It also needs to do this automatically, without ...
2
votes
4answers
392 views
passphrases - lowercase and dictionary words
Amid all the discussion about password length vs. complexity (summarized by the famous xkcd strip and the followup dicussion) I am trying to make up my mind about passphrases made up with dictionnary ...
7
votes
4answers
391 views
Is using a flash drive as a base for security a safe thing to do?
I'm developing some software for schools. I've found severe flaws with the current popular school LAN protection that I feel needs fixing so I plan on releasing my own software. One the those ...
4
votes
1answer
549 views
Is a public known password protected Wifi more secure than one without a password?
When connecting to a public Wifi from a café for example, some don't use a password and some do. If they do use a password it is often publicly known to everybody around.
Does having a password on ...
6
votes
2answers
1k views
Is it safe to store the password hash in a cookie and use it for “remember-me” login?
I want to store an encrypted string of the password hash in a cookie and use the hash to lookup the user and log them in (if they want to be remembered).
Is this safe? The password is one-way hashed ...
4
votes
0answers
1k views
Hints for safe passwords that are easy to remember [duplicate]
Possible Duplicate:
What is your way to create good passwords that can actually be remembered?
What are good hints to create passwords that are both safe and comfortable? By comfortable I ...
3
votes
2answers
179 views
How does one make password easily forgettable?
Is there any phycological research that appears relevant to making passwords easily forgettable under adverse circumstances? Circumstances might include when under duress, after some duration of ...
2
votes
2answers
340 views
Can a survey website viewed in Firefox trick the user into sending stored passwords?
Firefox stores passwords (I am not referring to the Master Password feature) and I would like to know if a survey website can steal those passwords.
I was typing a URL and perhaps I mistyped it and ...
