Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

5
votes
4answers
455 views

Best way to store/retrieve sensitive key files?

We have our web servers running in AWS EC2. We have about 30 API Keys/passwords/etc (sensitive data) which is set in the environment for our app to use. Whenever we deploy, we start a new server ...
9
votes
1answer
395 views

Any problems with scrypt yet?

In the question Do any security experts recommend bcrypt for password storage? Thomas Pornin recommends the hashing function scrypt but saying it is "too new to be recommended on a general basis". ...
64
votes
12answers
14k views

What to do about websites that store plain text passwords

I recently received an email from a popular graduate job web site (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
456
votes
14answers
77k views

What technical reasons are there to have low maximum password lengths?

I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites where I actually care ...
2
votes
3answers
195 views

How does a hash which contains algorithm to choose can be secure?

I was thinking about creating my own hash+salt function, something like sha1(password + md5(login)), then I read here (part 4) that creating it's own hash+salt function is a bad idea, because if the ...
1
vote
3answers
79 views

Password help with coding! [duplicate]

So, I'm terrible with any sort of coding, and I need help with generating a series of possible passwords. I've forgotten the combination of a password I put in for an email - I know the password, just ...
25
votes
10answers
6k views

Best password strength checker

In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or ...
3
votes
1answer
76 views

How to securely derive a second password specific to an user

I'm giving each of my users an unique Blocktrail wallet that is protected by two API keys (which the server knows) and one passphrase (unique to each wallet). I want the wallet's passphrase to be ...
5
votes
7answers
5k views

Pronounceable Password Generator

I am currently looking for a password generator which produces pronounceable passwords. I have used this random password generator a few years ago to generate a 42 characters long password and found ...
1
vote
3answers
192 views

How do I allow only app to view/download files from server?

I have an Android app that uploads and downloads pictures from my dedicated server. However, before I go live, I want to know if there is some way I can secure the server to allow only my app to ...
7
votes
0answers
111 views

Which format of secret would be the most efficient for human memory? [closed]

I am talking about something-you-know identification factor. Examples of those formats are passwords, passphrases, pin-s, picture passwords ( ...
2
votes
2answers
198 views

Password Manager use and safety [duplicate]

I just recently read an article advocating the use of password managers, and while I understand why someone might think using these programs might be a good idea, it's my understanding that these ...
13
votes
5answers
3k views

Is this idea for a password manager secure? If so, why doesn't anybody use it? [closed]

I've been thinking of a problem with usual password managers: although they do provide better security than manually using passwords, there's a central database that can get lost, get compromised, ...
7
votes
2answers
2k views

Is it bad practice to ask only for individual characters of a password? [duplicate]

Some financial websites that I use use passwords in a peculiar way. Instead of asking me the whole password string, they only ask me to enter e.g. "3rd, 5th and 8th character of your password", i.e. a ...
0
votes
2answers
100 views

Random characters and letters form obsfuscation

I know that this question has been asked many times, but would JavaScript encryption work if I just added 100 random numbers and letters to the password? That would be hard to reverse engineer, ...
5
votes
1answer
437 views

Security of Yahoo's new authentication: On-demand password

Yahoo is trying to remove passwords from authentication and use on-demand password authentication system instead. I wonder how this new system will be secure? Even if somebody steal your mobile can ...
2
votes
4answers
108 views

Is it safe to use my personal password as my password in work related accounts?

For example I have this complex personal password cary1bondoc21cary2bondoc as my password and because I am forgetful I also want to used that in work related accounts like company email, etc. Is there ...
4
votes
5answers
314 views

How many combinations does a specific password policy allow?

Recently I was arguing about password policies. Assume you have a policy which requires 10 characters and additionally at least one letter, one number and one special character. My companion was ...
6
votes
1answer
327 views

What are the pros and cons of using sha256 to hash a password before passing it to bcrypt?

My apologies if this has already been asked. I recently became aware of the fact that bcrypt truncates passwords to 72 characters. Practically speaking my intuition is that this does not pose any ...
19
votes
4answers
4k views

Should I implement incorrect password delay in a website or a webservice?

With arguments expressed in this answer, there is a few seconds delay between user enters an incorrect password and when he/she actually learns, that password was incorrect. This security solution is ...
5
votes
2answers
156 views

Possible way to extract sudo password from running system via the clipboard

I use to copy and paste my sudo password from a KeePass file so I guess the plain text user password will be saved in RAM at some point when I use it, for example, to accept an update. Is that right? ...
1
vote
3answers
174 views

Sensitive issue regarding windows 8 password [closed]

Although I know this sort of request probably isn't exactly what stackoverflow is for, I am desperately seeking help. One of my best friends recently passed away and his parents asked me if I knew a ...
2
votes
3answers
148 views

Use the same password on different (very secure) sites?

I understand that one should not use the same password everywhere, as stated here for instance. Using the same password on several non-valuable sites may be considered acceptable: we simply do not ...
5
votes
5answers
2k views

Salted password + hash - is it really useful? [duplicate]

I am new to the topic and wanted to know the concept of having salted hashes before going down to the technical details. From what I have understand password - plaintext hash password - plaintext ...
7
votes
8answers
762 views

Password reset with lost email functionality

I have searched and viewed most of the other questions and answers about implementing forgot password functionality on a website. However, we have a unique situation. When a user registers an account ...
5
votes
2answers
251 views

Does adding a non-entropic part to a password makes it less secure?

Suppose I'm encrypting a file via AES using a password of my choice, or creating a TrueCrypt volume using a password and no keyfiles. Which of the following two passwords would be more secure: ...
0
votes
1answer
114 views

Prevent brute force attacks on web publishing logins

Presumably, if someone tries to brute force into your website's control panel at your web host's site - they will be throttled/locked-out etc. But what about the web publishing logins (Web-Deploy, ...
6
votes
2answers
749 views

Passwordless login over email - security considerations

I'm proposing the use of a login system that sends a one-time login token (with high entropy) via email to the user. After using the token, the user receives another token via email and the previous ...
2
votes
1answer
144 views

Is it secure to set default value for password field?

I'm looking at an application where admins can "invite" users by email and invited users. Invited users then are sent a unique URL and are inserted into a MySQL database with status pending and an ...
1
vote
5answers
1k views

Why do we use passwords on sites? [duplicate]

I don't have passwords for my personal sites. To sign up a user pick their username and enter their email. There is a logout button if the user wishes to log out. To log in you enter your email and ...
5
votes
2answers
4k views

File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?

I've been using this command to encrypt files for a while now: openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc Then I type in a password. Can someone tell me, roughly speaking, ...
0
votes
2answers
191 views

Saving passwords in database

I have recently been studying a lot on writing secure code and choosing secure methods for saving passwords to a database. I'm wondering if it's secure to use ready made libraries or APIs to do this ...
6
votes
3answers
26k views

Windows 7 Password Hash Security

I recently came across a number of sources that suggest that cracking Windows user account passwords is easy by examining their password hashes. I understand that these hashes are stored in the SAM ...
95
votes
9answers
188k views

Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...
3
votes
2answers
165 views

Is there any history of a major attack using password reuse? [closed]

While everyone and their favorite webcomic seems to agree that password reuse is a major problem, some quick googling cannot seem to find any cases where it has been used on a large scale in an ...
2
votes
2answers
437 views

Is this password generator safe?

128-bit entropy is required http://nxtra.org/nxt-client/js/passphrasegenerator.js With all new browsers (Chrome, Firefox, IE 11) it uses crypto.getRandomValues which should be safe, but with IE 10 ...
5
votes
3answers
443 views

Am I in this particular case allowed, to store password in java program?

I have a Java-Server program running on Ubuntu-Server which gets every 5 minutes current location data of my android-smartphone (which I carry with me). My architecture is the following: My smartphone ...
-3
votes
1answer
426 views

What type of hash is this MD4(MD4(($pass)).(strtolower($username))) [closed]

Can I decrypt this hash? Domain Cached Credentials: MD4(MD4(($pass)).(strtolower($username)))
7
votes
2answers
574 views

*NIX shadow file password format

I'm trying to get shell access to a router and have managed to retrieve its /etc/shadow file: root:$1$$N76hdwGfg11g0KdKbtyh21:0:0:root:/root:/bin/bash I've tried to use john to crack it but ...
-4
votes
2answers
74 views

How does the password become 30,000 times stronger?

This google support page says: For example, an eight-character password with numbers, symbols and mixed-case letters is harder to guess because it has 30,000 times as many possible combinations ...
13
votes
3answers
13k views

Can password-protected zip files be broken without brute force?

You have a zip file that you created with 7z to password-protect it with AES 128. Can a smart adversary extract the data only through brute force, or is the file vulnerable to other attacks - such as, ...
0
votes
0answers
265 views

Windows Credentials - read password

What is the cipher used by windows Credential Manager to generate credentials backup files (*.crd)? With a backup file from Credential Manager and the password used to created that backup file is it ...
3
votes
1answer
192 views

Can OpenVPN monitor my passwords in my browser?

I want to know if I run OpenVPN when I want to log in to websites (like Gmail etc.....) is my username/password in danger? Can they monitor saved passwords in my browser or anything else? I'm new to ...
3
votes
1answer
1k views

How does a password authentication over a TCP protocol actually work?

When coming up with a password based login protocol, many solutions come in mind: User sends password in plain text. Compute hash on Server, compare to hash in database. - Bad because attacker can ...
2
votes
1answer
215 views

How much does knowing the zxcvbn password strength help an attacker?

On an answer to the question How critical is it to keep your password length secret?, Mike Ounsworth commented that by storing the zxcvbn-calculated entropy of a password you make it easier for an ...
5
votes
1answer
334 views

Where to store hashes, salts, keys in Desktop Applications

I am trying to figure out where or how i should store application secrets and keys inside a desktop application. For example a facebook app key or dropbox key and secret. So I've read that i should ...
2
votes
1answer
189 views

Is it insecure to provide a hash of an AES password?

I have made some software that encrypts and decrypts files using AES. I was wondering if it is safe to write a hash of the password to the file so that the program can check if a password is correct. ...
26
votes
1answer
3k views

Facebook password lowercase and uppercase

Recently I logged into my Facebook account and then noticed that my caps lock was on. So I tried to log in again with and without capslock on. I got in both times. Then I tried to log in with the ...
0
votes
1answer
969 views

Is a ZIP file password easy to break? [duplicate]

I thought that ZIP file passwords were a fairly decent protection. I came across this video, that seems to indicate otherwise. https://www.youtube.com/watch?v=SqRSNuJSm4o [12 minutes view time] ...
4
votes
2answers
270 views

Reset links in password expiration emails

Our organization is rolling out yearly password expiration to our 40,000+ users this fall and we have been socializing this change for some time now. However being such a large organization, our users ...