Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

1
vote
2answers
455 views

What is the safest way to store a password in a single file?

I've been reading about it. This article helped me a lot. But the more I read the more complicated it seems. For example: Is it better to use bcrypt, or PBKDF2, sha2 or something else for the salt? ...
2
votes
4answers
1k views

Yahoo Email Keeps Getting Phished

I keep getting spam emails from myself (and I am sending them to others as well) on my Yahoo Mail account. I have already went through two password changes which I thought were secure. My very last ...
4
votes
1answer
238 views

Need to ephemerally store third-party password

One particular web service that I am writing interfaces with an API. Each API call requires the user's username and password to be sent, no state is maintained. Ideally, when using my web service the ...
5
votes
2answers
866 views

When, exactly, should old password reset tokens be deleted?

I'm trying to figure out best practices for working with password reset tokens. Say a user initiates the password reset process and the are emailed the reset token and we store a hashed copy in the ...
3
votes
2answers
2k views

File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?

I've been using this command to encrypt files for a while now: openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc Then I type in a password. Can someone tell me, roughly speaking, ...
-2
votes
5answers
352 views

Is this password hashing method secure?

I have made a custom hashing method to help make my users' passwords more secure if the database will be leaked. The encryption method is like this: A method takes an input of 1 character, gets the ...
2
votes
4answers
579 views

How password hashing is useful in MITM attack?

Even though I read a lot about hashing and how passwords are protected, I am still confused about it. If passwords are hashed at client side, it will be useless because it can be sniffed and used by ...
6
votes
2answers
802 views

Production ready bcrypt implementation for .NET

Which, if any, .NET / C# bcrypt implementations are considered suitable for production environments? I have seen CryptSharp and BCrypt.Net mentioned in answers to other questions but without any ...
7
votes
2answers
447 views

How to proceed if a new hash algorithm for passwords is introduced?

I have an e-mail address at a certain institution. A few days ago they sent me an e-mail (in German), which I'd like to paraphrase without revealing the institution: Dear Madams and Sirs, a ...
0
votes
1answer
188 views

What type of attack should be used in order to pass this authentication

I am practicing the Astalavista Wargames and i came across this challenge. The question is: Bob wrote a piece of software but the password verification doesn't seem to work. You must find a way to log ...
4
votes
2answers
250 views

Passphrase using same word several times

I used a trivial 3-letter dictionary word five times in a row (smth similar to pwdpwdpwdpwdpwd), and am surprised to find my self in the list of hacked accounts in a penetration test using a ...
2
votes
3answers
111 views

Is password authentication worse that signed messaging if done over SSL?

Let there is a public API: HTTP-based via SSL there are no browsers, just connections between custom written programs The first authentication scheme that came to my mind was... client signs their ...
22
votes
11answers
2k views

Is it safe to use a weak password as long as I have two-factor authentication?

I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
6
votes
3answers
5k views

Why is Chrome asking for the application-specific password and my account's password every time?

I enabled Google's two-factor authentication and found it ironic that Google Chrome Sync requires #1 You account password, and #2 an application-specific password. First of all, don't applications ...
3
votes
1answer
294 views

How genuine are password entropy calculations?

I apologise for perhaps the confusing title, I'll try and elaborate a little better. Many discussions I see surrounding password entropy focus on the specific context of the range of choices ...
9
votes
2answers
784 views

What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?

I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
3
votes
3answers
1k views

Can the salt for PBKDF2 be a hash of the user-entered password?

I want to derive a key from a password in a client application that will be used as a master key that decrypts a data key. As far as I understand the salt should be private knowledge. Would it be ...
5
votes
1answer
356 views

How does SRP prevent man-in-middle attacks?

SRP is designed to resist both active and passive attacks, how does SRP prevent man-in-middle and packet modification attacks?
-1
votes
1answer
103 views

What makes EAP-SRP-256 better than SRP? [closed]

What is the advantage of the EAP-SRP protocol? Is it only used in wireless?
4
votes
4answers
4k views

How secure is Windows Auto-Logon?

Obviously, if auto-logon is enabled, anyone who can gain physical access to the PC can use the PC. That's not the question. The question is, when I enable auto-logon for my Windows 7 box, will there ...
3
votes
2answers
604 views

SASL Authentication Protocol with No Cleartext passwords

As you know, LDAP supports three authentication mechanisms: anonymous, simple and SASL. The first one is only suitable for particular cases, and therefore I'm not going to talk about that. The ...
2
votes
1answer
171 views

How vulnerable are passphrases with grammatical structure?

Imagine I create a passphrase using random dictionary words but a common grammatical structure (eg: article, noun, verb, adjective, noun). Given a pretty small dictionary of 5000 words, how vulnerable ...
9
votes
4answers
479 views

Are there state-of-the-art techniques or theory specifically for attacking passphrases over passwords?

With passphrases becoming more and more common based on length being more important than complexity, I'm assuming there must be some work going on involving techniques aimed specifically at cracking / ...
18
votes
4answers
6k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first ...
2
votes
1answer
301 views

Pure SRP authentication without TLS

IF using a SRP for client/server application authentication without TLS. Will it be vulnerable to man-in-middle attack, since if using SRP, the public info doesn't really useful to calculate the ...
-4
votes
2answers
365 views

Good Practice: Storing Passwords in general

I've got a totally theoretical question to you on today - what is the "best" practice for storing passwords? [Best in terms of security and performance] Usually, especially PHP-Developers tend to ...
8
votes
6answers
758 views

Does repeating one word to form a password result in a similar pattern in its encrypted format?

If i use a single word to form a password by repeating it like the examples below: securesecuresecuresecuresecuresecure SeCuReSeCuReSeCuReSeCuReSeCuReSeCuReSeCuRe ...
3
votes
2answers
1k views

Why doesn't Microsoft implement salt on users passwords in Windows?

Pretty straightforward - So we use rainbow tables to get passwords of users out of hashes. So why won't Microsoft implement salt on the passwords in Windows to be hash(password+salt)? Won't this ...
1
vote
0answers
38 views

Database hash for password field [duplicate]

I'm using a mysql database and am looking for a cryptographic hash method for a password with salt added to it. What would be the best hash method for this problem?
4
votes
4answers
502 views

Insecure to require numbers in passwords?

Earlier, I went to a site that required a number and special character, and it got me thinking – wouldn't that make the password easier to brute force? If you assume most passwords have around 12 ...
2
votes
1answer
777 views

Using John the Ripper to crack SHA hash w/ partial knowledge

Group, I have a SHA1 hash that I would like to brute-force. I have knowledge of several characters before and after the password (ie, if the hash is derived from "xxxpasswordyyy", I know both xxx and ...
3
votes
4answers
207 views

Securing opensource web application

I have an open source website. I need to add an admin section to the website which is accessible to only one person. To make it secure, I was thinking about providing a login page which checks if the ...
4
votes
1answer
232 views

Saved passwords (use case)

I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together. Both the data and the password are encrypted ...
-4
votes
1answer
378 views

Secure Web application Password vault/manager [duplicate]

I would like to build an open source online password vault which allows users to securely store their passwords, like Keepass or roboform, but where a user can access their passwords through a ...
8
votes
2answers
377 views

Banning specific passwords?

There have been a couple of questions about enforcing good passwords, so I thought I'd add my own: In addition to enforcing a minimum Shannon entropy, would it generally be a good practice to ...
3
votes
2answers
190 views

Fixing the high-bit problem in PHP's crypt() implementation

I'm working on a site that has to have compatibility with older versions of PHP, which suffer from a high-bit issue in the Blowfish crypt() implementation. Essentially, non-ASCII characters are not ...
3
votes
2answers
2k views

Salted hashes vs HMAC?

Most of discussions involving access credentials include references to "hashing salted passwords". Is this another way to referring to the HMAC algorithm or a totally different operation? Different or ...
8
votes
3answers
1k views

Encrypting user data using password and forgot my password

I am planning to do a web application which stores a lot of personal stuff (info, photos...). And to give users a sense of protection, I want to encrypt the data before storing it to the database. ...
8
votes
3answers
273 views

If multi factor authentication is enabled, how should that affect self-service password reset?

Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required) ...
9
votes
3answers
1k views

How can I mitigate the threat that DPAPick poses to my DPAPI protected data?

The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications). DPAPick was presented at BlackHat ...
1
vote
2answers
2k views

Is there a way to find out how long it takes John the Ripper to crack a particular password?

I am looking to test/demonstrate things like: when the supplied wordlist contains "abc123" and pw="abc123" then John cracks the pw in 1/2 a second... but if word list does not contain "abc123" John ...
8
votes
5answers
178 views

Citations for inadvisability of globally unique password

I am looking for an authoritative source to back up my position in a disagreement over password policy. I am having a disagreement with a client about the user identification/authentication process ...
3
votes
5answers
850 views

what are good requirements for a password

I'm making a website and I'm deciding on the password policy. What does make a good password? I really have no idea. I guess passwords should be at least 6 characters long. EDIT: are there any ...
1
vote
1answer
195 views

What are my options for securely printing an OTP Scratchcard?

I want to print and distribute several One Time Passwords (OTPs) that can't be easily disclosed to a 3rd party in transit. (think the physical version of a TLS session for private secrets) To me ...
5
votes
3answers
384 views

Use of rainbow tables with the NY Times hack?

The NY Times recently published a story about how they were hacked during a four month period. The hacks allegedly were carried out by part of the Chinese military. One part of the story that ...
0
votes
3answers
168 views

What day-to-day activities can compromise a person's information security [closed]

Recently a car was stopped next to me at the traffic lights. The driver had his phone connected to the car's bluetooth and the conversation could be heard by me crystal clear in the next car - the ...
5
votes
3answers
917 views

Is using the same password for multiple TrueCrypted volumes safe?

I want to use TrueCrypt for encrypting multiple disk volumes. Assume I use the default cryptographic algoritm (AES) and hash algorithm (RIPEMD-160) and that nobody can get my passwords through ...
8
votes
3answers
726 views

Generating random passwords by clicking randomly on the keyboard?

How secure is it to generate random strings/passwords manually for different purposes by just clicking randomly on the keyboard ? I usually need random strings for salts and for passwords, and I ...
17
votes
5answers
1k views

From a security standpoint should users be asked to confirm their password when registering?

Is it advisable to have users re-type their password to confirm it's correct? On User Experience the general consensus seems to be no but I'm wondering if this has security ramifications? EDIT: my ...
5
votes
3answers
291 views

Mutual authentication for humans

Is there any way for two people to securely authenticate each other without access to any special software (like PGP)? For example, when speaking over the phone or by sending SMSes to each other or ...