Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
2answers
135 views

Simplest way of hashing a password with multiple different hash algorithms [closed]

I have a list of plaintext passwords that I would like to hash with various different hash algorithms (for educational purposes). As a minimum I would like to obtain hashes under MD5, SHA1, SHA256, ...
1
vote
1answer
183 views

Should I NOT choose a password of max allowable character length?

Q: Suppose an attacker knows the max allowable character length, n, for a website's passwords. Would it be smart for them to attack passwords of length n BEFORE length n - k (where k is small portion ...
12
votes
2answers
7k views

Bypassing the BIOS password

Are there any reliable methods that allow an attacker to bypass a BIOS password, or alter BIOS settings without entering the password? A few ideas come to mind: The old battery trick (remove ...
5
votes
2answers
874 views

Appropriate response to 2014 Russian Security Breach (CyberVor)

The report from Hold Security says that 1.2 billion sets of credentials are in the possession of this party. I have a feeling that this report may be a hoax or a partial hoax due to grammatical errors ...
2
votes
3answers
209 views

Should I implement my own local password hash?

Having a more-than-elementary knowledge of internet security, I've realized that some web applications and websites I use implement a less-than-ideal password policy. Some examples include: ...
1
vote
5answers
360 views

Why after a website password reset am I asked to login again?

I have noticed that every web site has the exact same behavior for their password reset pages. They send a link to your email using which you can reach the password reset page. On that page you enter ...
44
votes
38answers
8k views

What is your way to create good passwords that can actually be remembered?

What are the methodologies which can be used to generate "human" good quality password? They have to ensure a good strength and also easy to remember for a human being.
0
votes
2answers
107 views

Share passwords between developers [duplicate]

We have a project with 3 remote developers and myself, at the moment passwords (server logins, db passwords etc) are being shared via emails which are cc'ed to everyone, Is there a normal workflow ...
27
votes
5answers
6k views

Is Linux really that secure, with only root password denying external access?

While I was searching online for information about Linux security, the most typical explanation was: Linux is secure, because the root password is required to access the kernel and install new ...
0
votes
2answers
154 views

How to combine a key and a password in practice

Alice wants to encrypt her data. She is not comfortable with using only a password. While she prefers to use a properly random crypto key, she isn't confident she can protect the key file from theft ...
1
vote
0answers
28 views

Syncing service passwords during offline installations

Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of ...
0
votes
3answers
188 views

User Account Guessing [duplicate]

I'm doing some research on user account guessing, and wanted to ask a question about some "bad practices". My thought is generally this is a trade-off between great user functionality/UX and ...
27
votes
4answers
5k views

How secure are my passwords in the hands of Firefox using a Master Password?

I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
-1
votes
1answer
347 views

Cracking a 6-character alphanumeric password Windows dialog box

To put this problem in context, I have a touch monitor screen whose firmware program is protected by a password. The firmware program is downloaded over RS232 via a Windows utility program provided ...
187
votes
18answers
14k views

Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field

Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
13
votes
5answers
2k views

Can sites which check your password as you type pose a security risk?

Some sites that I use check my password as I type it into the login (not registration) form. So, for example, to begin with I might have: Username: sapi ✓ Password: passw × and by the time I've ...
1
vote
1answer
518 views

Server + Client certificate vs Server certificate + Client password

There are three different ways how TLS (1.2) can be used: server and client authenticate, only the server authenticates or neither authenticates. If neither server nor client authenticates using a ...
5
votes
2answers
3k views

openssl_digest vs hash vs hash_hmac? Difference between SALT & HMAC?

openssl_digest vs hash vs hash_hmac I want to use SHA512 for storing password. Which of the above methods are best to use? Why? What is the difference between SALT & HMAC? I just read ...
3
votes
3answers
749 views

Websites Forcing Weak Password Standards (Updated) [duplicate]

Please Note: I am not going to name the websites which have these horrible standards for their clients and users. I have had to change my passwords for my routine update just recently in the last ...
13
votes
3answers
2k views

Known characters in passwords?

I generate passwords for everything that requires security using the following method: ksoviero@ksoviero-Latitude-E7440:~$ head -c 16 /dev/urandom | base64 gorv/cp+lSiwiEfKck2dVg== 256^16 ...
1
vote
2answers
157 views

Password Cracking Mandarin Words English Character Set

I'll be looking to perform a domain password audit in which the user will be using english characters but may be 40% Mandarin speakers so I anticipate a large number of names, phrases, or words that ...
0
votes
1answer
763 views

security in banking app with 4 digit pin code and social security number

The new banking app (for norwegian bank Gjensidige bank) for my android handset allows me to log in using only my social security number, and a 4 digit pin code. The social security number in norway ...
4
votes
8answers
529 views

Does it take longer to brute force a password starting with z than one starting with a?

I was wondering about the following: If someone tries to get my password with Brute Force, will a password starting with "a" guessed faster than one starting with "z" ? In this case assume the ...
2
votes
1answer
344 views

PDF.zip file password forgotten and need to reset [duplicate]

I have an old PDF.zip file that is password secured. Naturally I can't remember it. Is there a way to change it or disable it?
148
votes
18answers
15k views

What is a good analogy to explain to a layman why passwords should be hashed?

Note: This is not an actual situation I'm currently in. Assume your boss is one of those old-fashioned computer-illiterate managers and wants to store the passwords in plaintext to simplify ...
1
vote
5answers
307 views

Secure login feature with low CPU power

I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
3
votes
2answers
362 views

Is it really “Time to add a word” if there are no tools to crack passphrases of 3 words and up?

It's "time to add a word" says Arnold Reinhold, the creator of Diceware, in his blog (3/2014). He advices to use 6 word sentences (or 5 words with one extra character chosen and placed at random) from ...
1
vote
2answers
149 views

Database compromised and some passwords cracked

I run an MMORPG game and today while moving from one server to another, apache failed and listed some of the data on the server including a back-up of all the source code + database which a few people ...
1
vote
1answer
78 views

Importance of password strength with secure element?

Greetings SE security community. Background: I have a number of items like certificates, databases, and encrypted file systems that require private keys. In order to avoid having duplicates of these ...
2
votes
2answers
385 views

Does cPanel store my login password as plaintext

On attempt to change my cPanel password I was warned that: Your password could not be changed because the new password failed with the following reason : (is too similar to the old one), please try ...
1
vote
1answer
73 views

Running an Open Server (contents are visible)

I'm considering the possibility of running an Open Server, as I would call it, that is, a server where as much of its contents are publicly visible as possible. I would like to give read access to ...
15
votes
6answers
2k views

Are password complexity rules counterproductive?

In creating a login for this site I chose a nondictionary password that would be extremely hard to guess, but easy to remember. I was told that it did not meet complexity rules. After several ...
-1
votes
3answers
93 views

Can I safely use my own statistics to assess password strength on number of times a password is used?

Lets assume I want to give my hypothetic 10mio users userbase a good feedback on their password strength. Besides the classical entropy tests and top500 list of bad passwords, I might want it to be ...
7
votes
4answers
1k views

Should the password of a password protected channel be hashed?

Let's take a chat system, where any user can create a channel with a password protection. Thus, other users may only join using the channel password. This password is therefore known to every person ...
2
votes
1answer
122 views

Would it be possible to add additional files to a password protected zip 2.0 file

So the scenario is this: I don't have the ability to determine/recover the master password for a production system that uses zip 2 archives. However, I need to be able to add new files to existing ...
4
votes
1answer
652 views

PUT vs. POST for password update

I am writing a User Management system that has to include a change of password utility. We don't front end hash passwords (hopefully we will soon). As a result passwords are passed over https in the ...
1
vote
0answers
28 views

Is there a repository of credentials used in training materials/samples and SDKs?

Similar to a default password list for network appliances, it's conceivable that application layer passwords are default from training materials given to a developer. In fact, I have discovered ...
6
votes
1answer
4k views

Why use an authentication token instead of the username/password per request?

The author of http://stackoverflow.com/a/477578/14731 recommends: DO NOT STORE THE PERSISTENT LOGIN COOKIE (TOKEN) IN YOUR DATABASE, ONLY A HASH OF IT! [...] use strong salted hashing (bcrypt / ...
3
votes
2answers
813 views

How secure is the PwdHash algorithm and system?

I use the PwdHash service (http://crypto.stanford.edu/PwdHash/) and plugins for pretty much all of my passwords. I believe this is safer because: No service gets the same password as another, so if ...
3
votes
1answer
196 views

Is BSI’s process good? (Informing email address owners that their address/password (of unknown/different accounts) was stolen)

The German BSI (Federal Office for Information Security) claims to have got a list of 18 million email addresses and passwords – supposed to be the result of identity theft. They allow to check if ...
4
votes
1answer
100 views

How to help users manage password portfolios based on risks of compromise?

A framework for modeling password management risks and costs, and the beginnings of a good strategy for users to help them manage passwords for their often large portfolios of accounts is outlined in ...
2
votes
3answers
847 views

Time Memory Trade-Off Attacks

Given, we want to crack a password. With Time Memory Trade-Off Attacks one tries to find the right balance between time to compute hashes for all possible passwords. And the used memory to store all ...
1
vote
2answers
119 views

How Empathy - a messaging program, is storing my passwords

I am connected to my chat accounts via Empathy, a messaging program, and it has my password stored in it. I am really curious to know how it is storing the passwords, and if there is any they can ...
3
votes
1answer
100 views

How secure is choosing one out of N generated passwords?

I'm looking to generate some new passwords for myself that are easy to remember, but hard to crack. By choosing a generation algorithm and generating one random password with it, I can be relatively ...
2
votes
2answers
129 views

On password change in a web application, should it log users out

When a user is logged into a web-based application in multiple tabs, and changes their password should it automatically log them out of the other tabs? The use case is an account is compromised, the ...
37
votes
9answers
3k views

Why do password strength requirements exist?

Password strength is now everything, and they force you to come up with passwords with digits, special characters, upper-case letters and whatnot. Apart from being a usability nightmare (even I as a ...
0
votes
1answer
149 views

Save password on user-side for autologin

If a user wants to login to a system/server, it's recommended to have the hashed&salted password saved in a database, along with its salt. So the user wants to login, types in the password, ...
1
vote
1answer
76 views

What is the point of hosting database externally?

Following the breach of avast:forum.avast.com they decided to host the database externally@id.avast.com. My question is, what is the point of hosting the database externally since when you get remote ...
3
votes
4answers
327 views

Storing Old Password History and Information

Google, Facebook, Twitter, and several other services still knows the older passwords which we used on our accounts. At times, I can not reuse the same password as I have. Then with Google, if I type ...
1
vote
2answers
156 views

Remember Me vs Remember Email

From what I have noticed, there is very few services that offer the Remember Email over Remember Me or Sign-in Automatically. These options really do make the life easier for the end-user of ...