Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
2answers
123 views

Store password in Public Domain using files and md5sum

Whenever I check integrity of a file using md5sum, I get a string of alphanumeric characters to compare and verify if it was downloaded correctly. Couldn't the concatenation of several of those ...
2
votes
1answer
188 views

Would it be possible to add additional files to a password protected zip 2.0 file

I don't have the ability to determine/recover the master password for a production system that uses zip 2 archives. However, I need to be able to add new files to existing encrypted archives. There ...
33
votes
4answers
6k views

How does a hacker know how many times a password was hashed?

I've been reading a lot of questions about security and hash functions on this site and others. I am not an expert, just a curious mind and in my understanding the more iterations used to hash a ...
20
votes
3answers
4k views

Is a password in the clipboard vulnerable to attacks?

I see situations where you may have to input the same password more than once. You may type it in a text editor and copy it to clipboard, to paste it two or more times. In what scenarios this could ...
8
votes
3answers
418 views

Forgot password and revealing whether account exists

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...
-1
votes
3answers
120 views

Best way to securely send passwords from an application to a user operated server

I have the following situation: A user sets up a server that will have to receive login details. Other users then create accounts and login to this server. All this happens only over LAN. I'm ...
1
vote
0answers
86 views

Impact if password is visible on interceptor in case even we deployed HTTPS [closed]

Our application is on HTTPS but password is visible on interceptor while when we check it via Wireshark it's encrypted. Is there any risk in it? And what kind of impact it can have?. We provided the ...
0
votes
1answer
45 views

Is there any problem using empty salts with PBDKF for this purpose?

The aim is to generate a secure key for symmetric encryption. I have a master password, from which I want to generate the key for symmetric encryption, in order to encrypt other passwords. The idea ...
1
vote
3answers
433 views

Can a shim (a.k.a. polyfill) be installed in IE, FF, or Chrome without user knowledge, and can it read passwords entered by user on a login page?

The questions here are about shims in the 3 most commonly used browsers. A shim (also known as polyfill) is a piece of code (often JavaScript or Flash) implemented to augment the native API in a web ...
4
votes
0answers
212 views

Modern alternative for passwords [closed]

Today - I saw a question about passwords usage in cars. Have we developed anything besides passwords for IT? Is there are any other solution out there for my ...
3
votes
1answer
225 views

Writing your own John the Ripper module

I have a script in C, which is able to determine the password of certain data. It uses HMAC and RC4 algorithms to encrypt the given password and then compares that later to the given data. If they ...
4
votes
3answers
589 views

Password security with short passwords

I know that a long password is a good password. However, some sites require short passwords e.g. exactly 8 characters long. Under those limitations, what is a good method of creating and memorizing a ...
0
votes
2answers
115 views

How much stronger does a paragraph/sentence based password becomes with random characters added?

I was reading some questions on here regarding the correct horse battery staple method, and the conclusion was that, assuming any words in the list of most common English words, every word adds about ...
5
votes
2answers
296 views

How do you know if the bios has been compromised?

To secure my PC I have setup a BIOS password, preventing any access from a live-cd. Recently I've noticed that when the BIOS asks for my password, I just have to press Enter to boot. It doesn't work ...
29
votes
5answers
4k views

Password strength of random words and brainflayer

I have read from multiple sources that it might be better to have a password composed of several random words since this is easier to remember than a random sequence of characters. For example this ...
20
votes
4answers
5k views

Would allowing shorter passwords sometimes be more secure?

Does the act of requiring certain criteria for passwords make them easier to brute-force? It's always seemed to me that when websites limit the use of "insecure" passwords, it might make it easier ...
1
vote
2answers
198 views

Different password for each login - based on some variable

This might sound a silly question, but I was thinking this as and extra option(which is not required) mainly for advanced users, who want to protect their accounts even more. Lets consider that other ...
0
votes
1answer
278 views

Why enter again (or at the very least confirm) my email address when I click “Forgot password”?

In most, if not all, web forms for logging into a site, you have your forgot password link. When clicking the link, you get a new form (usually in a new page) either empty (!) or prefilled with the ...
1
vote
1answer
75 views

Gnome-keyring iteration count location

I know that Gnome-keyring hashes the master password between 1000 and 2000 times. It picks a random number. I would like to ask where it saves this number, what is the location of that file? As far as ...
0
votes
0answers
53 views

Trying to figure out the hashtype of this digest-auth htpasswd file

Simple question for y'all as i'm having some trouble identifying the hash type of this from a http digest file that I have setup for rutorrent on a apache2 server. Here's an example of what it looks ...
0
votes
1answer
76 views

Use PIN or Password [duplicate]

Which one is better, using PIN or password ? I want my app using PIN number to user login and register. Does not matter if I use PIN number only for user login and registration in my web application ? ...
3
votes
0answers
53 views

DRIVELOCK password [closed]

I changed my computer user name and password. When I logged in it was still OK. But when I restarted again it did not accept my password, it says wrong password or incorrect. Then the IT department ...
1
vote
1answer
299 views

Using Tor browser to use YouTube and account security

YouTube is not available in my country, but I want to make an account on YouTube and use it. I'm not interested in protecting my identity. It is fine if anyone can monitor it. The thing I'm interested ...
4
votes
1answer
160 views

Protect password/authenticating during transit over (insecure) TCP socket for a game

Background I am designing a multi-player game with a single server that handles multiple worlds. Each player logs into the server initially before requesting which world to join. The server has a ...
1
vote
3answers
62 views

Hashing Algorithms Costs vs Sleep

I understand most of the concepts behind hashing password but this one still escapes me. I understand that you want the hash to take some time ( a couple milliseconds) so the attacker can't ...
16
votes
5answers
3k views

The AES Crypt implementation hashes a password 8192 times to generate the key. Is this necessary?

I'm considering encrypting some small files (hundreds of kb apiece) using the AES Crypt reference implementation. Looking at the source, it seems that the encryption key is derived from the IV and the ...
1
vote
3answers
90 views

Is using my phone number as a pin for a phone a security risk?

I just did a factory reset on my smartphone to see if it might fix issues with battery life. I configured a phone number as the lock screen code so I have a code that's both long and easy to remember. ...
5
votes
3answers
315 views

2-Factor Authentication vs Security Questions

I have an account with a bank that has additional security option. When it does not recognize a device being used to access the account, it will either: Prompt with 1 of 3 security questions Send a ...
5
votes
4answers
181 views

Does manipulating a random password significantly reduce its entropy?

Suppose I generate a password using a secure random number generator and all the available character classes. For example, c.hK=~}~$Nc!]vFp9CgE. Consider that this password may need to be used in an ...
-4
votes
1answer
94 views

Time-based password change [closed]

I have created this script and it runs great, but important questions remain. Is this script useful and secure? Does it have any possible problem or weakness? root@010010:/# ls -la ...
3
votes
1answer
348 views

Is it safe to use a 4-digit PIN for Android system encryption?

I just encrypted my Android phone using the default menu. I was asked for a PIN code (4 digits). Do you think this is a good practice? Is there a limited number of attempts at decrypting the ...
9
votes
2answers
269 views

Is it possible to guess the length of a password by sniffing TLS packets?

In this answer, the author states that it is possible to tell the length of your password, by sniffing your TLS packets. Is this true, and how would this be done in practice?
7
votes
2answers
309 views

Password: ham,ham,ham,bacon,bacon,ham

Why do we bother with dice ware? Is rolling dice and looking up in a printed book (or using a digital analogue) a string of N random words any more secure than simply repeating a word or two N times? ...
1
vote
2answers
128 views

Double hashing using a relatively new hash and a old, tested one

Note: I am relatively new to cryptography in general, so please point out if I make any misconception here. I heard that you should always use well known crypto/hash functions, that have already been ...
1
vote
4answers
124 views

Is there a security advantage towards hashing a password on the server? [duplicate]

I'm working on an authentification system. Now in this system the user logs in and sends a hashed password to the server. Is this enough or do I have to rehash the password again? So basically is ...
6
votes
7answers
4k views

How can I best manage root passwords for many servers?

Lets say I have two racks with about 40 nix servers in them. I don't want to set all of the root user passwords all the same do I? If not how do you manage and keep up with all of the passwords? Is ...
1
vote
2answers
969 views

John the Ripper exclude incremental mode from another incremental mode

I want to crack an 8 characters password. First, I tried the incremental mode digits, but I did not find the password. So now I know it's not all digits password. I want to use lowernum incremental ...
4
votes
5answers
443 views

Not storing the salt? Is that an option?

Please read as I did many searches and believe this is NOT a duplicate question. For your reference, I've read these articles and other questions already: How do you overcome the problem of the ...
6
votes
2answers
2k views

How does the attacker to ransomware get the password?

I have been thinking about ransomware and as I see it the password seems like it should be a problem for the attacker. I can see it going down one of two ways. Either the password is included in the ...
6
votes
6answers
3k views

Ransom attacks - can I protect myself by encrypting all my files? [duplicate]

If I encrypt all my files can I get "attacked" by ransom attacks? Because my files are already encrypted, they cannot access them, so I should be safe or am I wrong? Also, if someone could tell me ...
8
votes
2answers
5k views

Practices for storing username/password in Web applications

I have read the following question: Storing password in Java application but I don't find the answers useful for my case. So here is my question somehow related to that. I have a Java Web application ...
11
votes
3answers
997 views

Calculating how secure my password is

I generally use GnuPG for encrypting my files and as far as I know its strength ultimately depends on the passphrase I use. So, I would like to know: how can I mathematically calculate how secure my ...
4
votes
1answer
833 views

How is the iCloud keychain protected from unauthorized access?

With OS X Mavericks and iOS 7.0.3, Apple has introduced a new feature called iCloud keychain. During setup, you can choose an iCloud Security Code. This code is used when you want to grant access to ...
1
vote
2answers
166 views

Several hashing routines support client side work. Doesn't the hash just become a password equivalent?

Isnt Secure Remote Password Protocol (SRP) pretty much client side hashing? Argon2 the winner of the PHC also allows for client side hashing. How do these systems avoid the plaintext equivalence ...
3
votes
1answer
153 views

How to implement application-specific passwords using strong hashes?

I am implementing a service where application-specific passwords seem a good choice to improve security. A question on why and when they might make sense has already been discussed here Google ...
6
votes
1answer
142 views

How long does 2-factor authentication codes have to be?

I've noticed that from a (personal) UX point of view, 4 numbers which my online banking uses seems to be a sweet spot in terms of holding it in my head from looking at my phone to typing it it. But ...
4
votes
2answers
1k views

Secure database password stored in an env variable

I need to somewhere store my DB password on my production environment to access the DB. At the moment the prod system is deployed in the cloud, so is the DB. The password, the username and some other ...
5
votes
1answer
98 views

Unique Touchscreen Authentication Schemes

I am working on a new software application that will have access to millions of patient medical records. I want this to be secure. The initial thought process was to simply use a standard username ...
5
votes
4answers
455 views

Best way to store/retrieve sensitive key files?

We have our web servers running in AWS EC2. We have about 30 API Keys/passwords/etc (sensitive data) which is set in the environment for our app to use. Whenever we deploy, we start a new server ...
9
votes
1answer
395 views

Any problems with scrypt yet?

In the question Do any security experts recommend bcrypt for password storage? Thomas Pornin recommends the hashing function scrypt but saying it is "too new to be recommended on a general basis". ...