Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

4
votes
3answers
602 views

Why not hashing and salting passwords?

When I was implementing my webapp, I decided to hash and salt users' passwords in order to protect them, even though I knew that there will never be a lot of them ... if any. Of course, I'm not saying ...
3
votes
3answers
413 views

Rainbow Tables: What is the Reduction Used for?

This is a follow up from this answer. The answer is very good, and it put me to thinking and doing some research. I have found another good explanation on this site. At some point, the author says: ...
1
vote
4answers
481 views

Authenticate user without knowing their password

I'm working on a project where each each user will have a public/private RSA key-pair. Users will be able to send encrypted messages to each other using the each target user's public key so that only ...
0
votes
1answer
151 views

Rainbowtable - Start with plain text [duplicate]

I know how to use rainbow tables. I've already read the other questions this topic here. Well but there is still one question left. As an attacker, I usually have a hash value of a password and ...
3
votes
4answers
10k views

A low tech yet secure way to keep track of passwords?

I use LastPass and love it. My girlfriend creates her own long, complex, unique, and thus difficult to remember passwords for every site. She frequently forgets them and has to rest the password. ...
7
votes
6answers
312 views

City Government Emailing User Name and Password

My city has online billing for utilities. When you set up an account they email your user name and password to you. You can't change your password without them emailing it to you again. Isn't this ...
6
votes
2answers
1k views

Does bcrypt compare the hashes in “length-constant” time?

I saw this function slowEquals() while reading Salted Password Hashing - Doing it Right, which uses a byte-level xor comparison to avoid timing attacks. I was wondering whether this is what Bcrypt ...
0
votes
2answers
242 views

Encryption method and other security concerns for a simple password manager [closed]

I thought I would learn a little bit of cryptography programming by making myself a simple password manager program that I can potentially even use to keep track of my passwords. The idea is that my ...
0
votes
1answer
238 views

company is sending md5 string via GET['password'] dangerous?

So, this big, reknown company (you all heard off) is sending md5 encrypted strings (with GET key: password) over HTTP. I accidentally came over it since I wanted to use jnlp on a non-windows ...
-1
votes
1answer
134 views

Password sending through network [duplicate]

In case of no TLS/SSL available, why can't I use the hash of the password (SHA512) as the key to encrypt the password (with out any salt) to send through the network ? MITM attacks I can understand, ...
4
votes
5answers
653 views

Use the hash of the password to encrypted password

I have a app which transmit the password in clear text. I was planning to use the hash of the password (SHA-512) as the key for encrypting the plain text password. Then send the encrypted text to the ...
3
votes
3answers
54k views

Wordlists on Kali Linux?

I notice that in /usr/share/wordlists in Kali Linux (former Backtrack) there are some lists. Are they used to bruteforce something? Is there specific list for specific kind of attacks?
1
vote
2answers
306 views

Do I need to salt PBKDF2 when it's used for AES encryption

If I'm using PBKDF2 to stretch a password into a suitable key for use in encryption with AES, should I be using a random salt (for PBKDF2, not the AES IV)?
1
vote
3answers
281 views

How to check if our clients were compromised by security breaches in other web applications?

Every now and then a known website is hacked, such as what happened to Adobe or Cupid Media. In such incidents user data is leaked, including usernames, encrypted (and sometimes plain text!) ...
1
vote
3answers
197 views

S/MIME doesn't protect against a stolen password, right?

We're setting up S/MIME so that we can send encrypted emails. However, I have a bit of a stupid (and maybe obvious) question... If someone steals a password for either the sender or the receiver, ...
2
votes
2answers
605 views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
13
votes
4answers
3k views

How secure is NOPASSWD in passwordless sudo mode?

On all our boxes we have ssh access via keys. All keys are password protected. At this moment the sudo mode is not passwordless. Because the number of VMs are growing in our setup, we investigate the ...
2
votes
0answers
64 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
3
votes
1answer
10k views

Where to download a list of email accounts hacked from Adobe? [closed]

Adobe announced they had been hacked and millions of user accounts and passwords compromised. These sites allow a search on email address to see if it was compromised: https://lastpass.com/adobe/ ...
4
votes
4answers
403 views

usernames and passwords

I was thinking about usernames and passwords and I was wondering how secure it would be to instead of the server having a list of usernames and accompanying hash of the passwords, just have a list of ...
3
votes
4answers
587 views

Should user's password strength be assessed at client or at server side?

Now most of big website like Google mail, Twitter, Facebook have a feature that assesses password strength (check number of digit, alphabet, special characters, or check the similarity over already ...
5
votes
5answers
324 views

Would this idea for a password be secure? [duplicate]

I was thinking about password security this morning. Mainly, about the recent adobe hack releasing thousands of passwords. The current problem with existing passwords is that you have three options: ...
-1
votes
3answers
319 views

help me about salting passwords

Eve has just discovered and decrypted the file that associates each userid with its 32-bit random salt value, and she has also discovered and decrypted the password file, which contains the ...
0
votes
1answer
104 views

Is MS-CHAPv2 incompatible with securely stored passwords?

I have a directory service that can speak a number of protocols and is used for user authentication. Currently user credentials are stored using Bcrypt to protect them in case of a compromised ...
8
votes
6answers
977 views

Is it useful to protect hashed password with encryption?

Imagine that I am hashing the users' passwords with a random, long enough, salt, using key stretching, and a secure hash. Would it be more secure to finally encrypt the hash with a symmetric key?
4
votes
1answer
812 views

OWASP Recommendation on Client-Side Password Hashing

The OWASP Application Security FAQ recommends the use of JavaScript to produce a salted hash of the password client-side with JavaScript prior to sending it to the server. Is this something truly ...
50
votes
9answers
48k views

How safe are password managers like LastPass?

I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long. How safe are password ...
4
votes
3answers
1k views

symetric key encryption vs hashing

This is a fascinating document: top 100 passwords from adobe breach I have a question about one part of it: However, thanks to Adobe choosing symmetric key encryption over hashing, selecting ...
32
votes
2answers
2k views

Why does Google cripple the 2FA Google Authenticator PAM module?

If you enable 2FA for Google Apps the shared secret is 160 bits. The google_authenticator PAM module on the other hand seems to use 80 bits for the shared secret. According to RFC 4226: R6 - The ...
1
vote
2answers
248 views

In what sense is Knock to Unlock safer than a password?

I've recently seen a youtube video, which is advertising an iphone app which will unlock your mac computer by knocking on your iphone. The ad is claiming that it is faster and safer than typing your ...
-3
votes
2answers
518 views

How to secure a login.php file? [closed]

I have a hand built website, and am triying to build a cms/admin-panel, and my username and password, are not stored in a database, but, in a two setup file like seen below. index.php <?php ...
3
votes
2answers
71 views

Is honeywords different from k-anonymity?

Ari Juels and Ron Rivest propose a technqiue to strengthen password files called honeywords . Basically for each valid password they insert fake passwords (honeywords) and if somebody tries to ...
5
votes
2answers
312 views

Can I trust large companies like Google not to store failed password attempts?

Let's say, for example, that I accidentally entered my Microsoft account password instead of my Google account password when logging in to some Google web service. After getting an error message, I ...
0
votes
2answers
182 views

Why do some websites increase the number of characters in the password field when logging in?

Why do some websites (especially banking sites) display more characters in the password field than were actually typed? This is sometimes apparent just after clicking the login button.
6
votes
2answers
264 views

Password hint storage, analysis

What are the security implications of asking users to provide password hints? What are best practices for storing user hints? What research has been done on using user-supplied password hints to ...
1
vote
6answers
242 views

Does including the username in a password make it less secure?

Many registration forms prevent you from choosing a password that includes your username. Is it a reasonable restriction from security standpoint? I can see that if your username is "foobar" and ...
9
votes
3answers
4k views

Is HTTPS and Basic Authentication secure enough for banking webservices (RESTful)?

I have been reading about SSL/TLS for the last few days and looks like it has never been practically cracked. Given SSL/TLS is used for all communications between client application and the server, ...
3
votes
4answers
509 views

How to tell if a site is securely storing passwords? [closed]

A site I frequent has a policy to make you change your password every 90 days. That's a cool policy, but I stumbled upon an old xkcd and facepalmed myself, because lots of doxing happens on this site. ...
8
votes
3answers
17k views

How secure is WD MyPassport lock

I have a WD My Passport hard drive. There is an option that allows you to lock your hard drive with a password. How secure is this lock? They don't give details about the encryption algorith or the ...
4
votes
1answer
5k views

Vulnerability of Chrome's “Login Data” file after being orphaned from the host system

Suppose someone were to knick a "Login Data" file from a Windows computer's Google Chrome profile. They don't know the machine's user account password, but they may have some ideas as to what it ...
3
votes
1answer
217 views

How Secure Rooted or Jailbroken Devices are?

I am just wondering, but how can I harden the security of jailbroken or rooted devices? I understand that SD Card can be still accessible, but how could potential adversaries compromise for example ...
4
votes
1answer
667 views

How is the iCloud keychain protected from unauthorized access?

With OS X Mavericks and iOS 7.0.3, Apple has introduced a new feature called iCloud keychain. During setup, you can choose an iCloud Security Code. This code is used when you want to grant access to ...
7
votes
2answers
988 views

Are the SS64.com password generators a good approach?

There are two password generators on ss64.com: The standard one The strong one How they work I made standalone versions of them, plus copy of the original HTML/Javascript versions, if you want to ...
0
votes
3answers
239 views

Storing passwords and other data for coworkers

At the moment we are encrypting our server passwords and other important data internal via PGP. Every coworker has got his/her own private key/pass combination set up on their workstation. The problem ...
1
vote
3answers
263 views

How safe is it to provide my administrator account password for a 3rd party software: EasyUS Todo Backup?

I've been recently searching for a backup solution for my Windows desktop. That's when I came across this free software called EasyUS Todo Backup. (I know it's a mouthful but English doesn't seem to ...
4
votes
2answers
228 views

Would re-salting passwords regularly in-/decrease security?

What are the (dis)advantages of re-salting a user's password regularly, e.g. weekly (or at their next login once week since the last re-salting)? The basic idea would be that users who regularly log ...
10
votes
5answers
777 views

Altering passwords before storing

Assume that I'm using bcrypt with a unique salt (or some other best practice) to hash user passwords before storing them in my database. Is there any security advantage to be gained by ...
6
votes
4answers
2k views

Security of the KWallet password encrypting application?

According to http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis/ , the KWallet password management system is quite weak, it uses key splitting, Blowfish 56, and no salt. The key ...
4
votes
3answers
616 views

Tokenless REST API security concerns

I'm designing an API in PHP/MySQL that, by its design, will not store a user's password in the database and thus does not generate authorization tokens for the client to hold. The reason for this is ...
3
votes
1answer
157 views

S/Key as an alternative to UNIX passwords

There is this password system called S/Key I saw on the Internet. Can someone give me a brief description about S/Key and how it works? Can S/Key be an alternative solution to the UNIX password ...