Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

4
votes
2answers
201 views

Does adding a random character to a pseudo-randomly generated password improve entropy significantly?

I'm asking a practical question. I was taught computers are bad at generating random data. Does this mean password generators, such as the one built into Keepass, suck? If yes, then would it help for ...
0
votes
2answers
131 views

How much more secure would using alt codes in a password make it? [duplicate]

My friend and I were talking about how fast computers could potentially brute force a password these days. I came up with the idea of using letters from a foreign alphabet to use in your password, ...
0
votes
1answer
112 views

Why does healthcare.gov exclude some special characters from passwords?

The site does not allow the following characters: = ?<> ( ) ‘ " / \ & It also limits maximum password length to 20 characters. This makes me suspicious that they might be being stored in ...
1
vote
1answer
55 views

What is a viable time-frame for links that expire? [closed]

Links that expire can be found anywhere from Email Verification to Password Reset procedures, I understand in most cases this is considered "security theater", but wanted to know what a viable time-...
0
votes
0answers
244 views

Best way to store a password in a text file

We have a WebLogic server (WLS_APP) with a lot of web applications, we also have an Oracle Service Bus (WLS_OSB) with a lot of services deployed on it. We have these services aggregated in proxy ...
1
vote
2answers
105 views

Email used to log in but doesn't have to be unique. Issues?

I've moved onto a project where they are implementing a system whereby a user's email address can be used multiple times by different people - i.e. users can sign up as many times as they want with an ...
1
vote
0answers
48 views

Key stretching approaches

I've seen that a number of key stretching algorithms and they involved increasing the number of operations needed to compute the key(i.e. the number of rounds within a hash function). But, I wonder if ...
2
votes
2answers
7k views

Securing passwords for REST Authentication

I'm developing a REST application using the Spring Framework, as as part of the requirements, we have to secure the different functions of the system to different user roles (pretty standard stuff). ...
10
votes
11answers
4k views

How to easily remember lots of different passwords?

I know that you shouldn’t use the same password on every site. But, when you log into several dozen sites, keeping track of all the passwords can be pretty hard. What system do you recommend that won’...
1
vote
0answers
77 views

Customized approach to protect plaintext passwords/usernames in database table?

I'm in the process of building an app to let users sign up, connect their many email accounts (like Gmail) to the site, and allow email-related activities... like sending an email (please don't ask or ...
4
votes
2answers
665 views

Should I password protect all my archives from cloud?

I am a student and I didn't care a lot about my passwords strength and my files until now. Now I am thinking about having a backup for all my files in cloud. Questions: Should I password protect ...
4
votes
4answers
4k views

Passphrase - what is it exactly?

Well, according to Wikipedia, this is a passphrase; A passphrase is a sequence of words or other text used to control access to a computer system, program or data. A passphrase is similar to a ...
3
votes
1answer
2k views

Correct way to generate password salts in PHP 5.3 on Linux given my constraints?

In examining our database storage of hashed passwords with salts, I note a high rate of salt collisions, i.e., there are far too many cases where two table rows have the same salt stored. One ...
2
votes
3answers
1k views

Strategy for updating stored passwords to more secure hash? [duplicate]

I know that we cannot update our hashed passwords without having the plain text password to re-hash. When a member logs in with login/password, we have the plain text, so that gives us an opportunity ...
5
votes
1answer
2k views

How can a system verify an online password using a phone keypad?

I phoned into a financial company's website, and it prompted me to key in my password on the phone keypad, converting the alphabetic characters to the corresponding digit, and special symbols to '*'. ...
9
votes
2answers
747 views

How to store/encrypt fingerprint?

Storing password is a no brainer : use a password hasher. But.. How do you proceed to store fingerprints securely on your server? Meaning that even if your server and all it's data is stolen, someone ...
3
votes
4answers
2k views

If a thief has the phone in their possession, how can Password Recovery be implemented securely?

Standard password recovery involves sending a password reset mechanism to the user; either to email, sms or telephone call. However, if a phone has been stolen the thief has full access to these ...
4
votes
3answers
259 views

Passwords propagation, Password Trend and Word Generator in Human Mind

Some passwords like "123456", "admin" are outrageously popular, so are the leet transformations and concatenation of digits. The users seem to pick up the password suggestions or just copy the ...
16
votes
4answers
365 views

Are malicious relying parties able to abuse OpenID logins?

if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me? Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
3
votes
1answer
2k views

How to authenticate in a website with public/private keys?

I've been reading how the SSH public/private key works and realized how handy they are (taking the secure out of the equation). And started to wonder why websites do not implement the same thing? ...
0
votes
0answers
32 views

Password storing using hashing only, encryption plus hash [duplicate]

I want to hash password before storing to database. I am not able to understand which approach will be suitable.For examples Hash plain password directly with SHA-1, SHA-256 etc and then store in DB. ...
0
votes
0answers
319 views

Breaking EncFS given .encfs6.xml

I forgot the password of a EncFS folder (created, went to vacation, forgot). But I remember how the password was created (e.g. was a sequence of 4 dictionary words). So I decided to try to find the ...
0
votes
1answer
131 views

Ignoring collision and (second) pre-image resistance, what makes a cryptographic hash function strong?

With regards to resistance against dictionary and brute-force attacks to "crack" hashes containing passwords, what determines the resistance of a cryptographic hash function? Since collision ...
2
votes
2answers
190 views

Why can't a rainbow table attack identify and trash the salt?

Here's my understanding of a salted / hashed authentication scheme: string plaintextPass = Request.Form["password"]; string salt = UserRecordFromDb.Salt; string toHash = salt + plaintextPass; string ...
4
votes
2answers
2k views

What's the purpose of $LoginKey from the Ashley Madison leak?

According to this site Ashley Madison was keeping an insecure hash stored in their database using MD5, in addition to the far more secure bcrypt hash. This group used the MD5 hashes to quickly crack ...
1
vote
2answers
1k views

Do cloud-based password managers invalidate even the most secure architecture?

Can an online password vault, like Lastpass, be defended through a security assessment that demonstrates the value they provide outweigh the risks of being a high value target? A valid answer would: ...
6
votes
4answers
2k views

Is GPG suitable as part of a password manager and generator?

I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
2
votes
4answers
2k views

HTML password fields

Imagine you are in a HTML page which offers you the password change service. Some websites bring the previous password in a password field, which you can't read. Is it possible to retrieve the ...
11
votes
5answers
2k views

Are case-insensitive passwords a bad idea?

I recently discovered a service where the password was not case sensitive. I understand basic principles of encryption and hashing so I am a bit worried, is this service storing my password in plain ...
2
votes
2answers
116 views

Is a random work factor an increase or decrease of security?

Assume you use a proven hashing algorithm, like bcrypt with a work factor of 10 or PBKDF2 with 10K iterations. Normally that's really secure already and would give enough security already for most ...
-3
votes
1answer
73 views

How do I get the password knowing part of it and the length [closed]

I'm new to all this, I'm trying to use Hash Suite to find a password with a word + 2 numbers. I know what the word is but not the numbers but I also know the length of the passwords ... What do I have ...
17
votes
7answers
2k views

Taking password letters not whole one, is this secure? [duplicate]

I found a site which is taking password letters from their users not the whole password. Is this secure? Or do they have saved password as salted hash (MD5)?
2
votes
2answers
182 views

Is encryption application credentials using certificate encryption good practice?

I'm working on a small web application. The web application needs access to a database, so the application needs access to a database username and password. The application runs in an environment ...
0
votes
3answers
188 views

securely storing passwords that can be retrieved

I'm trying to build a web application that can store passwords of other services like Facebook, Gmail ...etc. These passwords can be later retrieved and shown to the user. This has to be a web ...
2
votes
1answer
129 views

How does LastPass know that Microsoft.com uses the password for Live.com?

When I visit Microsoft.com, the LastPass dropdown lists my username/password for login.live.com. It does something similar for Playstation.com and several other sites. How does it know? Are these ...
0
votes
2answers
124 views

Store password in Public Domain using files and md5sum

Whenever I check integrity of a file using md5sum, I get a string of alphanumeric characters to compare and verify if it was downloaded correctly. Couldn't the concatenation of several of those ...
2
votes
1answer
188 views

Would it be possible to add additional files to a password protected zip 2.0 file

I don't have the ability to determine/recover the master password for a production system that uses zip 2 archives. However, I need to be able to add new files to existing encrypted archives. There ...
33
votes
4answers
6k views

How does a hacker know how many times a password was hashed?

I've been reading a lot of questions about security and hash functions on this site and others. I am not an expert, just a curious mind and in my understanding the more iterations used to hash a ...
21
votes
3answers
4k views

Is a password in the clipboard vulnerable to attacks?

I see situations where you may have to input the same password more than once. You may type it in a text editor and copy it to clipboard, to paste it two or more times. In what scenarios this could ...
8
votes
3answers
487 views

Forgot password and revealing whether account exists

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...
-1
votes
3answers
121 views

Best way to securely send passwords from an application to a user operated server

I have the following situation: A user sets up a server that will have to receive login details. Other users then create accounts and login to this server. All this happens only over LAN. I'm ...
1
vote
0answers
87 views

Impact if password is visible on interceptor in case even we deployed HTTPS [closed]

Our application is on HTTPS but password is visible on interceptor while when we check it via Wireshark it's encrypted. Is there any risk in it? And what kind of impact it can have?. We provided the ...
0
votes
1answer
46 views

Is there any problem using empty salts with PBDKF for this purpose?

The aim is to generate a secure key for symmetric encryption. I have a master password, from which I want to generate the key for symmetric encryption, in order to encrypt other passwords. The idea ...
1
vote
3answers
471 views

Can a shim (a.k.a. polyfill) be installed in IE, FF, or Chrome without user knowledge, and can it read passwords entered by user on a login page?

The questions here are about shims in the 3 most commonly used browsers. A shim (also known as polyfill) is a piece of code (often JavaScript or Flash) implemented to augment the native API in a web ...
4
votes
0answers
219 views

Modern alternative for passwords [closed]

Today - I saw a question about passwords usage in cars. Have we developed anything besides passwords for IT? Is there are any other solution out there for my common-folk-direct-to-business-client-...
3
votes
1answer
230 views

Writing your own John the Ripper module

I have a script in C, which is able to determine the password of certain data. It uses HMAC and RC4 algorithms to encrypt the given password and then compares that later to the given data. If they ...
4
votes
3answers
625 views

Password security with short passwords

I know that a long password is a good password. However, some sites require short passwords e.g. exactly 8 characters long. Under those limitations, what is a good method of creating and memorizing a ...
0
votes
2answers
117 views

How much stronger does a paragraph/sentence based password becomes with random characters added?

I was reading some questions on here regarding the correct horse battery staple method, and the conclusion was that, assuming any words in the list of most common English words, every word adds about ...
5
votes
2answers
330 views

How do you know if the bios has been compromised?

To secure my PC I have setup a BIOS password, preventing any access from a live-cd. Recently I've noticed that when the BIOS asks for my password, I just have to press Enter to boot. It doesn't work ...
29
votes
5answers
4k views

Password strength of random words and brainflayer

I have read from multiple sources that it might be better to have a password composed of several random words since this is easier to remember than a random sequence of characters. For example this ...