Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
0answers
25 views

Length-constant password comparison in scrypt? [duplicate]

E.g.: XORing the candidate against stored then comparing against 0. Do I need to worry? (my question is much in the same style as this question: Does bcrypt compare the hashes in ...
1
vote
1answer
117 views

Cracking encrypted SQB databases

I've recovered a .SQB SQL database backup file from a backup server and do not have the password. As I do not have the password available to me, I'm looking to determine what type of encryption is ...
18
votes
5answers
15k views

Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?

Justin Schuh defended Google's reasoning in the wake of this post detailing the "discovery" (sic) that passwords saved in the Chrome password manager can be viewed in plaintext. Let me just directly ...
4
votes
1answer
212 views

API to change passwords?

After I learned last week that the login data of some of my accounts was leaked, I had to change my passwords for more than 30 sites. That was tedious! As luck would have it, some days later we ...
1
vote
1answer
124 views

Hashing password for secure storage (generating salt)

I wanted to check if the following means of generating a hash for storage of a password was secure. I have an username and password combo. In order to generate a secure hash, I am doing the ...
6
votes
1answer
325 views

What happens if biometric data is stolen?

As we move toward a future where fingerprints might possibly replace passwords, I see one issue. While passwords can be stolen, they can be changed by the owner after being notified of the security ...
1
vote
1answer
1k views

What to do with .hash files when cracking WPA2

So, I'd say I'm one level above n00b. I've gotten to the point where I have accomplished a WPA Handshake (and saved the output as xxx-01.cap). I have also downloaded these hash tables (if that is the ...
0
votes
1answer
56 views

CNN Money Portfolio and Heartbleed [duplicate]

Is/was CNN Money Portfolio ever vulnerable to heartbleed? It states 256 bit SSL bank level encryption on the website..
5
votes
2answers
424 views

TPM- Symmetric key storage

I understand that the TPM can be used to store an unlimited number of keys. However I am left with a few questions: Presuming the TPM is connected on the LPC what protects the data travelling across ...
21
votes
4answers
9k views

Should I change all my passwords due to heartbleed [duplicate]

Should I change all of my online passwords due to the heartbleed bug? Edit: I found a list of vulnerable sites on GitHub and checked all my critical sites. Everything I was really concerned with ...
3
votes
1answer
7k views

Is it safe to sign in to Google with password from desktop app like BlueStacks? [closed]

BlueStacks is an android simulator for desktop. After installation it will ask you to login with your Google account to download and install android app from play-store. My question is "Is it safe to ...
1
vote
0answers
881 views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
0
votes
2answers
156 views

If bruteforcing a password goes aaa, AAA, aab, AAB, etc, all the way to ZZZ, wouldn't ZZZZZZ be the most secure password?

I'm only taking about security against bruteforce attacks. I assume that most crackers start at a and go up to zzzzzzz for as long as instructed (so it could be zzzzzzzzzzz if told so in the ...
0
votes
1answer
206 views

The Problem with Changing All Passwords for HeartBleed [duplicate]

One thing that's been bugging me in relation to the discovery of the Heartbleed OpenSSL flaw is the recommendation that everyone should run to their computers in a panic and change all of their ...
34
votes
8answers
3k views

Why improvising your own Hash function out of existing hash functions is so bad

I'm afraid I'll have tomatoes thrown at me for asking this old question, but here goes. After reading that cooking up your own password hash out of existing hashing functions is dangerous over and ...
3
votes
3answers
711 views

Encrypting passwords?

I am planning on creating a text file to store my passwords, so I only need to remember 1 password (at the moment, I have about 20 long/complex passwords in my mind, and am worried that I might forget ...
4
votes
1answer
323 views

Password Managers: encrypted database vs hashing strategy

I'm considering moving to a password-management strategy based on supergenpass or something similar. This is an alternative to other password managers where instead of having a database of passwords ...
8
votes
3answers
1k views

Is it safe to generate passwords online?

I usually generate strong passwords using various online tools. Some time ago I mentioned it to friend of mine and he looked at me as if my life was one big fail. Is it really so unsafe to generate ...
1
vote
1answer
249 views

I login to Stackoverflow (vulnerable) with Google (not vulnerable). Do I need to change my password? [duplicate]

According to this heartbleed mass test, Stack Overflow is vulnerable whereas google is not. I use my Google ID to logon to Stack Overflow (and some other sites). Do I need to change my password? In ...
16
votes
2answers
574 views

Bank accepts different password to the one that I set

I'm not particularly well versed in IT security so please bear with me. I recently discovered that my bank's online system will accept passwords that consist of the correct password, and a string of ...
0
votes
1answer
66 views

Handling passwords in wicket

I have a form which contains a password field. In swing the getPassword() method returns a character array. After the password has been processed by my web application the array can be wiped to ...
0
votes
1answer
74 views

Is there an anti virus that protects processes from being injected code to?

As title says, is there an av that does that? And if not, is there any other program that protects processes like lsass in windows, apart from protected process utility in win8.1?
1
vote
0answers
172 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
2
votes
1answer
210 views

Is there an equation to calculate the number of instances of a series of characters exist in a given key space?

If I'm using 16-18 character-length passwords with 94 different possible values-per-character (lower alphas, upper alphas, numbers, and special characters), is there an equation I can use to calculate ...
1
vote
0answers
93 views

Lock Windows to a specific app

Is it possible, using some program or application, to lock Windows 7 so only a specific app can be used, for example Word, until a password is entered? Thanks!
2
votes
1answer
153 views

How was the Xbox One password verification compromised?

So, we have this article: http://www.engadget.com/2014/04/04/xbox-live-five-year-old-hacker/ Apparently, using nothing but spaces the local account (with an obviously saved password... I hope) was ...
6
votes
4answers
442 views

Relationship of password strength and key strength

I have just started educating myself about cryptography, and while it is mostly making sense, a few things are still eluding me. One being: In systems that take a user's pass-word/-phrase in order to ...
2
votes
1answer
71 views

Safety while ciphering data

Say I wanted to encrypt some sensitive information with a symmetric algorithm using a program on a computer. Is it possible that a hacker could retrieve the data,salt, iteration, cipher, keysize while ...
1
vote
2answers
179 views

How could police identify digital contraband and charge someone if it's encrypted with keys?

For example, say I am transferring heavily-encrypted DVD/Blu-ray movies/game copies over the internet. However, I am using double or (+) encryption with keys required to decrypt the file using an ...
1
vote
1answer
277 views

Is using MD5 in NTLMv2 protocol to store Windows passwords is secure?

I read that Windows (probably not new OSs but say, Windows Server 2008) stores passwords using Hashes using NTLMv2 protocol which uses MD5 hash function. My questions: MD5 is known to be insecure ...
-3
votes
1answer
66 views

How many possible symbols and punctuations in a password? [closed]

I want to compute the possible combinations of a password consists of 8 digits of: alphabetical letters (26), numbers (0-9), symbols and punctuations. In order to compute this, I have to know the ...
1
vote
2answers
2k views

How many bits of entropy should I aim at for my password? [closed]

I mainly use 2 passwords: 1 is a 4 word full lowercase passphrase of 18 letters long which I use wherever possible. The other is basically 3 words and a digit with the first word in full uppercase and ...
1
vote
2answers
144 views

How can I analyze password recovery tokens?

All websites that support authenticated user interactions have a password recovery feature. Usually they will email the password reset link through which you can easily recover your account by typing ...
0
votes
2answers
304 views

Registration Password

Is it best to create an application that allows a user to sign up with username and email at the beginning and password once you click the generated email sent to you or should the password entering ...
27
votes
3answers
3k views

Is there any advantage to splitting a password?

I've been reading about the LANMAN (LM) hash and I'm curious about a particular part of the algorithm. The LM hash is computed as follows: The user’s ASCII password is converted to uppercase. ...
33
votes
8answers
2k views

Who is responsible for the strength of user's passwords?

Who is responsible for a user's password's strength? Is it us (developers, architects, etc.) or the user? As a web developer, I've frequently wondered whether I should enforce the minimal password ...
1
vote
0answers
58 views

Does whosthere.exe of pth toolkit have to run with administrative rights?

To see the users that are connected to the machine and they're pass hashes with Whosthere.exe, do I have to run it as an administrator?
0
votes
1answer
57 views

How does LM hash deal with passwords that are between 8 and 13 chars

If its 14 then it splits it to 7&7, but how about 13 characters? 7&6? How does it work?
23
votes
5answers
3k views

Do non-keyboard characters make my password less susceptible to brute forcing?

I can put characters in my password for which there are no keys on a keyboard. On Windows, Alt+#### (with the numpad) inserts the character for whatever code you type in. When I put this in a ...
5
votes
3answers
917 views

How often should I reset my salt?

I'm thinking of implementing a salt recycling scheme on my user credentials database. The motivation behind this decision is that even if the attacker manages to get his hands on the database and has ...
1
vote
2answers
206 views

Storing database password in application

Let's say my application connects to my database. This requires me to have the username and database in my config as follows: postgresql://scott:tiger@localhost/mydatabase I have an automated ...
2
votes
2answers
10k views

Excel 2007 Encryption Strength

With a strong password of 10+ characters, mixed case, etc... Is the encryption of a Excel 2007 document secure enough to create reasonably strong defense against a brute force attack? What encryption ...
3
votes
2answers
23k views

Remove Password Protection from XLS Document

Similar to what is listed here, http://datapigtechnologies.com/blog/index.php/hack-into-a-protected-excel-2007-or-2010-workbook/, is there a way to remove the password from an XLS (Excel 2003) ...
-1
votes
4answers
254 views

How do big companies and wealthy people secure their information? And how can I secure mine?

I've recently had some success and traffic increase with an online business I own and due to that someone has hacked my domain email and twitter accounts. My bank password is the same and I just ...
11
votes
6answers
7k views

Are services like “LastPass” less secure, as they have all my passwords protected by a single password?

If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security?
2
votes
4answers
592 views

How does a system authenticate a user using a hash function, after it has been salted?

I don't really understand how salting works. I read the Wikipedia article, but I still don't understand how can a system authenticate a salted hash? Let's say a user chooses a password. It's randomly ...
3
votes
4answers
406 views

True?: “Nearly all encrypted passwords are stored with the last character in clear text”?

[S]ome passwords are gleaned by hacking into computers where intruders can find stored passwords. Those are stored in encrypted form, but there's software that can attack the encryption. Nearly ...
3
votes
4answers
327 views

When and where do I hash a password?

Say I have a client and a server. I want the user with the client to login to the server with a username and password combination. To login, they have to enter the right password which (when hashed) ...
6
votes
5answers
960 views

Is storing plaintext passwords for email accounts any less bad? [duplicate]

I recently found out that the company I use for shared hosting stores passwords for email accounts in plaintext (they mentioned this to me incidentally, while troubleshooting another issue). They're a ...
10
votes
3answers
608 views

How can I promote good password practices in an organization that doesn't currently care about that?

I work with an organization that uses some very poor practices such as using default user accounts, default passwords (or passwords the same as user accounts), sharing password information between ...