Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

4
votes
1answer
104 views

Is it acceptable to generate salts with a hash of the username?

Salts are supposed to be unique and randomly generated for each user when storing passwords. Is there a reason why we can't generate these salts with a cryptographic hash function using the username ...
1
vote
2answers
96 views

What is more secure: single long hash, or combination of two shorter?

Fictitious scenario: User accesses a restricted data (available online) identified by random string (supported by captcha to make brute-forcing more difficult). So data is not protected by a ...
5
votes
4answers
2k views

SHA-512 unix passwords. How secure are those hashes, really?

I came across this very alarming sounding thread which indicates a GPU with about half the compute capacity of the GPU currently powering the monitor I type this on is capable of 11.5k c/s. I'm not ...
5
votes
5answers
905 views

Is it a good idea to use an input by the user as SALT?

I have read many Q&As here on IT Security about password hashing and salting. I am building a simple registration form for our community website which will be used by our members to create their ...
-3
votes
3answers
1k views

What's the use of making users use digits, uppercase-lowercase combination password if the passwords are hashed?

Some websites, even the StackOverflow asks for atleast 1 digit, 1 uppercase character in the password. Does this really matter when the developer uses a password-hash algorithm to store the passwords ...
-1
votes
2answers
319 views

Looking for safe, simple way to store passwords with PHP 5.2.17 [duplicate]

I've found many posts on StackOverflow and other sites using Google, but since security is always changing, and what was safe a few months ago not me anymore... I felt the need to ask on here. ...
2
votes
2answers
173 views

Eye-Tracking, Public Access Points and Password Protection [closed]

Could entering sensitive keyboard input in public places with camera systems equipped with a robust AI possibly leak keystrokes via eye-tracking technology -- assuming the typist is using the ...
-2
votes
1answer
131 views

Can Cain&Able Crack SSL? [closed]

I have been messing around with Cain and Able and used APR on another computer (also mine) to get a hashed version of my username and password for my yahoo e-mail account, but I seem to be lost as to ...
4
votes
1answer
134 views

Is this cross-site password model secure?

I'm looking for a way of securely having passwords for different pages. Say I generate this password: ild23rfsfdfg%*#fArg34t34657%537@asd7oak2094^*q2k2k@Kk3j4tn453Q5# Then, for each site, I change ...
15
votes
7answers
940 views

Taking password letters not whole one, is this secure? [duplicate]

I found a site which is taking password letters from their users not the whole password. Is this secure? Or do they have saved password as salted hash (MD5)?
10
votes
2answers
1k views

Password auditing

Most password policies require the password to be at least 8 characters long and contain symbols from at least 3 classes (lower case letters, upper case letters, numbers, other). Problem is, that a ...
32
votes
3answers
2k views

Am I wrong to believe that passwords should never be recoverable (one way hash)?

I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
1
vote
2answers
288 views

Why is unshadowing needed?

john /etc/shadow look like working, because john will use many-many CPU for it. But why is unshadowing needed? Why isn't it enough to use "john /etc/shadow"? Because of the salting? Can someone ...
4
votes
2answers
540 views

Would a massive blacklist of guessable passwords be useful? [duplicate]

Suggestions to make a good password all focus on creating a string that a computer (or more likely, a network of computers with multiple GPUs) can not guess. Putting a password meter for when users ...
3
votes
3answers
676 views

How can salted, hashed password storage be combined with a plaintext, nonce and hash based authentication?

My understanding is as follows: To securely store a password (e.g. in a database), you use a hashing algorithm designed for this purpose (designed to be slow, e.g. bcrypt), and you use a unique salt ...
63
votes
7answers
8k views

Touch Screen Password Guessing by Fingerprint Trace

After eating some garlic bread at a friend's who is not security-aware, she managed to quickly determine the PIN code to unlock the screen of my Samsung SIII. She figured this out by simply holding ...
0
votes
1answer
575 views

How do I generate a blowfish password hash in Ubuntu?

What's the command line to generate a blowfish password hash? I can't seem to figure this out at all. Apache's htpasswd only supports bcrypt, and openssl passwd doesn't even do blowfish hahes (but it ...
6
votes
3answers
271 views

Should password be cleared after unsuccessful logon attempt?

Lets assume following workflows a) On a device with keyboard: I type my username and password Press enter [realization] I made a typo Password field is cleared: not a big deal, I can type ...
4
votes
3answers
358 views

Encrypted files storage. How to simplify the password management scheme?

It's probably dublicate but I can't figure out the correct keywords for search. You can help by just telling me those words, I'm rather good with Google :) I want to develop somewhat like file ...
28
votes
3answers
2k views

Is there a security reason for a site to limit the number of times a user can change their password?

Is there a security reason to disallow a user to change their password as frequently as they want? I have found this security policy in a site and I am not sure why it is enforcing it. One reason I ...
45
votes
7answers
3k views

Is it OK to tell your password to your company's sysadmin?

I'm working in a small company (20 employees) as a senior software engineer. After having problems with my email, our newly employed IT administrator asked me to write my user password to someone in ...
-2
votes
1answer
611 views

LophtCrack version 6.0.12 is not auditing my Administrator password [closed]

I am using LophtCrack on my Windows 8 OS. I was testing my password strength and the problem I am seeing it is not working. It doesn't reveal my Admin password, I've run the process for half an hour. ...
3
votes
3answers
1k views

Avoiding Brute Force Attacks in a Web Based Login Form

My login form uses Ajax so it doesn't need to reload if the password is wrong. A PHP script process the request and creates the session if the credentials are right. My idea is to have the PHP script ...
8
votes
4answers
735 views

How dangerous is it to store password in plain text on sites like GitHub?

I have a few private repositories set up on GitHub for some of the projects I am working on for my company. These applications connect to databases and I have database authentication credentials ...
9
votes
2answers
3k views

Is it safe to store the password hash in a cookie and use it for “remember-me” login?

I want to store an encrypted string of the password hash in a cookie and use the hash to lookup the user and log them in (if they want to be remembered). Is this safe? The password is one-way hashed ...
-3
votes
1answer
386 views

Retrieve Admin Password from router [closed]

There is a way to retrieve a router admin password without hard reset? I'm loggen on LAN and know username and local ip address... TKS
3
votes
3answers
176 views

Are there implementations of password hashing algorithms for major frameworks that utilizes specialized hardware like GPUs/FPGAs?

It is common knowledge that password cracking attempts can greatly benefit from specialized hardware such as large clusters of GPUs or FPGAs. Are there any implementations of the commonly recommended ...
2
votes
1answer
637 views

What are realistic rates for brute force hashing?

I'm trying to gauge password strength assuming that the attacker has a hash of my password. Can anyone cite some realistic contemporary rates at which someone could perform various hashes? I know most ...
10
votes
2answers
875 views

Can a Firefox add-on or plug-in access the user's websites' saved passwords in decrypted mode?

Going deeper into the previous question on Firefox plugins and add-ons malware risks: Could a Firefox add-on potentially decode and capture the encrypted websites' passwords saved in the browser?
6
votes
2answers
1k views

How do I block LinkedIn from extracting data from Microsoft Exchange Server?

LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click ...
0
votes
1answer
305 views

How to encrypt files without giving the user access? [duplicate]

I don't know if I should ask this question on security.SE or stackoverflow, so please move my post if necessary. I want to store my (C#) application data in a way that the user cannot read or modify ...
2
votes
1answer
3k views

How can I decrypt traffic on a WEP encrypted network?

Let's say that I am connected to a WEP Access Point and I want to sniff all wireless traffic inside that network. How can I decrypt the traffic even though I don't have the cryptographic key? I found ...
2
votes
5answers
285 views

Is accepting old passwords a bad policy?

This question is inspired by an experience I had today with online banking, as follows. One year ago I opened an online deposit account. (Without naming the bank, I will say the company is currently a ...
8
votes
3answers
332 views

Does setting a user password on Windows XP help protect against remote exploits compared to no password?

In a typical home user situation with a PC connected to the internet via a router, suppose we are not concerned with protecting the machine from people with physical access. Does setting a password on ...
1
vote
3answers
115 views

How to protect against an attack where a person claims to be in a position of authority?

In an office if a person approaches an employee and claims to be a new IT staff and to give them access to their computer, what can prevent this kind of attack? I've worked a couple tech support jobs ...
2
votes
1answer
469 views

Can I check if a work colleague logged into my user account on a shared computer?

I think that someone at work has logged onto my user account when I'm not in work and moved some files from my desk top to my work in progress. Can this happen? They may know my user name as this is ...
3
votes
2answers
193 views

Server checking client's password without ever coming into possession of it

tl;dr: I am wondering what the best way is to check a password when the client does not trust the server. I know of two common ways servers can check if a user's password is correct: The server ...
4
votes
2answers
731 views

What are the security implications of using TOTP for single factor authentication?

(Note: I am not actually planning to do this. This question is strictly theoretical.) TOTP is commonly used as the second factor in Two Factor Authentication. It is an open standard with available ...
3
votes
2answers
227 views

How can I create a secure password?

I know the standard tricks, create a long password, numbers, symbols, capital letters, etc. My questions is how do I judge password security. I heard different tricks to make secure passwords. For ...
-1
votes
1answer
215 views

After salting my passwords, are they protected against dictionary attacks? [duplicate]

I use sha1() to hash my users passwords, but recently a friend told me that if someone get the hash then they could use dictionary attack and he recommended using salts. I implemented a random salt ...
7
votes
1answer
846 views

Working out how to decrypt encrypted string when knowing the plain text

I have access to a system which I have been asked to create a data export routine for. However, the address details are encrypted and the original sourcecode/password are lost. However, I am able to ...
-1
votes
1answer
180 views

How can I encrypt my router admin page login session? [closed]

I login to my router using the web connection but the session is not encrypted, is there a third party way to encrypt the web session so no one on my network can sniff the password?
1
vote
0answers
47 views

How can I recover the password of a TrueCrypt vlume? [duplicate]

I am trying to recover the password of a trucrypt volume. It is composed by a combination of 4 words (one invented). I remember 3 of them but not their order. Do you know any tools that cold help me ...
1
vote
2answers
114 views

How to manage company passwords when employing temporary freelancers?

I am from a marketing firm which now has a development team, which i am part of. We have been tasked with finding a few freelancers who can come in and work when either me and the other developer is ...
7
votes
3answers
555 views

Can cloud based password managing services be trusted?

I'm a big time user of cloud based password managing services like LastPass. But in the light of recent revelations like various government backdoors in popular sites, programs like prism, etc. I'm ...
53
votes
5answers
13k views

Is sending password to user email secure?

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?
-4
votes
1answer
438 views

Feasibility of brute-force on online password [closed]

I am familiar with how offline brute-force attacks work. But for online accounts, assuming no social engineering, how feasible is it to brute-force attack a password? For example, is this dependent ...
4
votes
4answers
234 views

Composition of passwords

Passwords (passphrases) that are taken from known texts (books etc.) are commonly considered to be weak, but what if they are employed in combination with random stuffs, i.e. in forms of AX, XA or ...
2
votes
2answers
936 views

What exactly is 'single' mode in John the Ripper doing?

I'm testing out John the Ripper (1.7.9 Jumbo 7) on a file containing MD5 hashes without any usernames. I've been experimenting with different rules and configurations – I am currently using a wordlist ...
0
votes
2answers
4k views

Where is my password stored on Linux? [duplicate]

Is there a specific location where the passwords are stored ? Is it depending on which version is used ? Are they salted ?