Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
1answer
143 views

Save password on user-side for autologin

If a user wants to login to a system/server, it's recommended to have the hashed&salted password saved in a database, along with its salt. So the user wants to login, types in the password, ...
1
vote
1answer
76 views

What is the point of hosting database externally?

Following the breach of avast:forum.avast.com they decided to host the database externally@id.avast.com. My question is, what is the point of hosting the database externally since when you get remote ...
3
votes
4answers
288 views

Storing Old Password History and Information

Google, Facebook, Twitter, and several other services still knows the older passwords which we used on our accounts. At times, I can not reuse the same password as I have. Then with Google, if I type ...
1
vote
2answers
151 views

Remember Me vs Remember Email

From what I have noticed, there is very few services that offer the Remember Email over Remember Me or Sign-in Automatically. These options really do make the life easier for the end-user of ...
134
votes
9answers
26k views

Is “the oft-cited XKCD scheme […] no longer good advice”?

I was stumbling around and happened onto this essay by Bruce Schneier claiming that the XKCD password scheme was effectively dead. Modern password crackers combine different words from their ...
2
votes
4answers
571 views

password generating algorithm

I read the question about the relevancy of the xkcd password creation algorithm. Would it be more secure if you used a string of common words with a function that only you knew that would rearrange ...
1
vote
1answer
93 views

how to rememeber passwords securely?

Imagine you have a private RSA-key on your computer encrypted (through PBKDF2, AES-CTR, HMAC256) with a password, now if the user would like to tick "Remember Password", what is the most secure way to ...
59
votes
9answers
57k views

How safe are password managers like LastPass?

I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long. How safe are password ...
3
votes
1answer
199 views

Windows Scheduled Task passwords

When you create a Scheduled Task in Windows, it gives you the option of running the task as a different user, including saving the password. How secure is the password that is stored?
2
votes
4answers
619 views

Password protect an excel file for a period of time?

I'm trying to find a way to password protect an Excel file (.xlsm) beyond the built-in password encryption options. Ideally: Enter the password File works for a week(/other period of time) After a ...
2
votes
1answer
133 views

How could someone change a root password without modifying `chage -l root` date?

How could someone change the root password without changing chage -l root Last password change date? I know it was changed because it does not match the value in Keepass. I noticed when I tried to use ...
3
votes
3answers
3k views

Email hacking myth

I never believed that some one can actually hack an email that easy. If someone hacks an email it means he actually hacked the server and he will gain access to many emails not to mine only. Anyway ...
5
votes
1answer
4k views

Password length limits in history of operating systems and popular web sites

I heard that many years ago for example passwords on linux systems were limited to 8 characters. Or rather, you could type in more than 8 characters, but only the first 8 characters mattered. ...
2
votes
2answers
5k views

NTLM/LM Hashes on Domain Controller

I've noticed that when extracting password hashes from a domain controller (using Elcomsoft proactive password auditor) sometimes I'll get LM and NTLM hashes and other times I'll only get NTLM hashes. ...
0
votes
2answers
347 views

Automated software hackers use to try passwords

Because of the eBay hacking, I had to go and look for other accounts that I have used the same password to change the passwords on those site as well. (I know that it's very bad to have same passwords ...
2
votes
2answers
193 views

Password reset system code system vs long hash

I'm building a password reset system at the moment and I've come across a dilema. Currently we have a system which creates a long md5 has (16 characters) and emails a link to a customer which they ...
2
votes
2answers
233 views

What happens after setting up HDD password?

I am wondering what happens when I set HDD password in my laptop (Samsung with ssd). I mean a given case. I have been having working system without any password. Then one day I decide to set up HDD ...
3
votes
3answers
1k views

Client-side hashing of password before sending it from login form [duplicate]

I have just realized, that my web application is sending unencrypted passwords from login form. It's just like that -- I've analysed, that string sent by user from login form is hashed with MD5 (which ...
3
votes
3answers
744 views

Is this a secure way of storing passwords? [duplicate]

So a couple years ago when I was learning basic back-end web development, I found a tutorial for creating a basic log in system. I haven't done much modification to the code since, but I have the ...
-1
votes
2answers
131 views

How does salting increase security? [duplicate]

I'm currently going through a course on software security. I've recently been introduced to the idea of password salting, where a random value is concatenated to a password prior to being hashed and ...
4
votes
3answers
1k views

What should I do if I type my password in the address bar, or type password in google search?

When someone accidentally types his or her password in one of the following three locations and presses enter, what should they do? username text box address bar Google search What do you suggest, ...
71
votes
8answers
9k views

Convincing my manager to use salts

My manager says we don't need to salt our passwords because people are not likely to use the same password because they all have different native languages, in addition to the websites they are active ...
31
votes
5answers
8k views

Why are brute-force password-cracking attacks not automatically detected and thwarted?

Why doesn't software automatically detect password-cracking attacks, and thwart them? Long version: Suppose that someone tries a brute-force password-cracking attack on some program XYZ that ...
9
votes
4answers
1k views

Are efforts being made to bring about password standards?

Rather than adopting a universal standard, many websites develop their own guidelines for how passwords should be constructed. When you consider the number of passwords the average person today has ...
11
votes
7answers
961 views

Aren't password managers still incredibly risky?

I understand the utility in having one application remember a bunch of long, randomized passwords, but all you'd need is one well-placed phishing scam or a keylogger and they get all the keys to the ...
11
votes
4answers
3k views

Authenticating without a database

I've been inspired by a question over on Code Review, which boils down to: What is the proper way to authenticate a user without a database? Would it be the exact same process if you stored ...
77
votes
8answers
11k views

Why not allow spaces in a password?

"Your password can't contain spaces." is a message I see from some websites, including 1 . Why? (This question is very similar to Why Not Allow Special Characters In a Password? , but the answers ...
12
votes
4answers
1k views

Is it “standard” to SMS passwords?

When I get credentials for a new machine, my company will often send the login id in email, then SMS (or sometimes Skype msg) the password. This is obviously in order to separate the login and ...
1
vote
3answers
91 views

How to limit the need to type a long master passphrase to only once per login session?

I want to set up a password management system on a home machine running Debian, and for this I'm considering only non-proprietary, open source password-managers available through Debian1. I'd like to ...
2
votes
1answer
105 views

Credential In Windows [closed]

How can I view the Credentials stored in Windows? Is there any possible way to view the stored password? I can just export them..
22
votes
5answers
5k views

Password strength and banks 4 pin code?

Why is it that some security advisers recommend using an 8 character password with upper, lower, digits, and symbols while banks only use a 4 digit number pin for debit and 3 digit pin for credit ...
4
votes
3answers
1k views

How to store passwords securely in my server?

Disclaimer: I know I should use bcrypt to securely store user's passwords. Please, keep reading. I want to store credentials for several email services for each user. So if I log in with my username ...
23
votes
2answers
5k views

Does bcrypt have a maximum password length?

I was messing around with bcrypt today and noticed something: hashpw('testtdsdddddddddddddddddddddddddddddddddddddddddddddddsddddddddddddddddd', salt) Output: ...
1
vote
0answers
128 views

How to add user entries with password field in LDAP over HTTPS

I am new to this kind of stuff (HTTPS etc.) and pretty much confused on how to go ahead with this. An LDAP server (ApacheDS) at the back-end stores the user details. To add new users, the user ...
15
votes
4answers
277 views

Are malicious relying parties able to abuse OpenID logins?

if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me? Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
3
votes
2answers
285 views

What should I do when I need to store passwords for usage in 3rd party software?

I have a desktop WPF application which authenticates with Dynamics CRM 2011. I ask for the username and password of the user and use them to connect to Dynamics CRM 2011 using ...
1
vote
2answers
282 views

In what situations can a hacker try to break passwords millions of times? [duplicate]

I keep reading about situations where a hacker could "easily" brute force a password (most recent example) but I'm confused about when some has an opportunity to do this kind of thing. If it is a ...
1
vote
2answers
1k views

VPN over HTTPs for a web service only

I have a web service (PHP & MySQL on Ubuntu 12.04) running in a corporate intranet. I have also connected it to internet through a firewall letting incoming connections on HTTPs only (port 443). ...
20
votes
5answers
2k views

When hashing passwords, is it ok to use the hashed password as the salt?

I don't like this idea. But I can not come up with a technical argument against it. Can somebody explain it to me? The basic idea is: $passwd = 'foo'; $salt = hash($passwd); $finalHash = hash($passwd ...
2
votes
1answer
2k views

Cracking MD5 passwords with the same salt

How long would it take to crack passwords up to 10 letters long if you knew the hashes were MD5 with a salt (that you know)?
0
votes
1answer
203 views

Did somebody connect to my facebook account?

I have a problem. I'm not sure, but I think that somebody (in our home network) found out a password to my Facebook account and sometimes logs in. Is there a way to find out whether it is true? There ...
4
votes
2answers
244 views

Would re-salting passwords regularly in-/decrease security?

What are the (dis)advantages of re-salting a user's password regularly, e.g. weekly (or at their next login once week since the last re-salting)? The basic idea would be that users who regularly log ...
9
votes
1answer
572 views

How to stop password recovery attempts on accounts?

I am using social networking services such as My Banking GMail PayPal Facebook Twitter Google+ LinkedIn All of these services text messages me a six digit code to login from anywhere, even a ...
8
votes
3answers
4k views

How often do two users use the same password

If no two users use the same password, then in theory salting the password hash is not needed. How often, in practice, do two users have the same password?
3
votes
1answer
285 views

File Vault 1 password from memory dump

I have a osx 10.9 machine with a File Vault1 encrypted user partition. I would like to remove the encryption, but I don't remember the "master key" which is the only way to remove encryption ...
1
vote
1answer
196 views

Theoretical home grown password options, or what is it that SCrypt, BCrypt, PBKDF2 does that is so special?

I'm developing a personal web framework, nothing internetty, and probably not even anything that will ever go on my personal LAN. And looking for password advice people seem to only recommend those ...
2
votes
3answers
469 views

I want to roll my personal cloud hosted Password Manager using pass. How secure/insecure would this be?

I've come to the conclusion that I need to up my security. I currently have a dozen memorized passwords I use for every device and website. I'm against Keypass/Lastpass due to having to trust they ...
2
votes
2answers
125 views

Breach informing

I am a staff member of a large fanfic site, but not the head administrator with control over the site itself. Recently, we had a security breach and the databases were copied, which included the ...
44
votes
5answers
4k views

Is it safe to tell your users what kind of hashing algorithm you use?

For example, on the user registration page, is it safe to tell people "Your password will be stored as a one-way hash using the (whatever) algorithm."
4
votes
3answers
381 views

Is it good practice to SHA512 passwords prior to passing them to bcrypt?

I want to allow any-sized passwords to be allowed to be submitted. I currently use bcrypt as a key derivation function for passwords, however I have realized that it has a maximum input length of 72. ...