Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
5answers
2k views

Pronounceable Password Generator

I am currently looking for a password generator which produces pronounceable passwords. I have used this random password generator a few years ago to generate a 42 characters long password and found ...
24
votes
10answers
5k views

Intel How Strong is Your Password page, good advice?

I came across this Intel How Strong is Your Password? page which estimates how strong your password is. It has some advice on choosing better passwords including that you should use multiple ...
-4
votes
1answer
1k views

Good Password Length [duplicate]

If you are looking to be careful and your passwords include all the types of characters, what is the ideal password length?
7
votes
3answers
396 views

Password list generation

I've found during a lot of recent pen-tests that companies will use passwords like c0mp4ny@b( for a company called "company abc" Is there any quick and easy way to generate a list of passwords ...
3
votes
4answers
361 views

When salting and hashing passwords, any advantage to including password length?

In this answer, Gilles says (emphasis mine): There's no need to hide the salt from the attacker: it needs to be unique (and not derived from the password) but it doesn't need to be more secret ...
0
votes
1answer
1k views

Using JTR to crack Skype Passwords

The scenario: coworker's Skype somehow lost his auto-fill password. He doesn't remember it anymore, and the account is hooked up to an email address that no longer exists. He's never purchased any ...
30
votes
7answers
8k views

Is salting a hash really as secure as common knowledge implies?

(I did search on this topic, but I found no complete question/answer that addressed it, or even good portions of questions that might be relevant.) I'm implementing a salt function for user passwords ...
8
votes
4answers
620 views

Do honeywords add any real security?

This paper proposes the concept of honeywords for detecting if a password database has been compromised. As far as I understand it works like this: You save n password hashes for each user, one that ...
1
vote
1answer
146 views

Simple and secure remote installation method that accepts input via a web page?

When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner? ...
7
votes
6answers
616 views

Cleartext password in HTML

Is there any problem with outputing a user's password to the HTML in an hidden field (see use case below before flaming xD)? The use case is a registration form with two steps. The user fills in the ...
4
votes
1answer
137 views

Could a password hash that's prone to more collisions provide better overall security?

Website security breaches seem to be a common occurrence, giving the attacker password hashes that he can conduct a brute force attack against, often given him a list of passwords that will work on ...
7
votes
3answers
3k views

HMACSHA512 versus Rfc2898DeriveBytes for password hash

We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key The salt is 64 char randomly generated string. We allocated 2048 length on the database for the hashed base64 string ...
-2
votes
3answers
1k views

How to effectively save database password inside desktop application?

Suppose we are in the field of desktop applications which need to store their data in a database. How do I store the password for this database avoiding the most obvious mistakes, which are: 1) hard ...
4
votes
3answers
154 views

Do email clients reduce security?

I have recently taken a security course, and have learned a lot about, among other things, the way passwords are stored, etc. Afterwards I was thinking about the way that passwords are stored for ...
60
votes
3answers
16k views

How does Google Authenticator work?

Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent. It works without any connectivity; it even works on plane mode. This ...
0
votes
3answers
409 views

Why one time passwords using nested hash chain are not used?

I am wondering, why web sites do not use one-time passwords generated by hash chain. By that I mean that a client chooses a secret and after being salted, he applies some secure hash function F() on ...
4
votes
2answers
305 views

Masking password when typing vs hiding input when typing

There is a command-line application that interactively prompts you for your password to a third-party service. Whereas e.g. sudo completely hides your input as you type your password, this ...
11
votes
3answers
715 views

Do users of non-latin character languages suffer from spyware and trojans?

Do Chinese, Japanese, other languages that can't be represented in ASCII get their passwords stolen? I figure there can't be some sort of bruteforce attack software for them, right? Their characters ...
3
votes
3answers
1k views

Avoiding Brute Force Attacks in a Web Based Login Form

My login form uses Ajax so it doesn't need to reload if the password is wrong. A PHP script process the request and creates the session if the credentials are right. My idea is to have the PHP script ...
0
votes
2answers
113 views

Does hash solve passwords in parts?

From an answer this earlier question: Does adding dictionary words to passwords weaken them? "...you have no way to recognize it as a password before testing it (against a hash or an online ...
1
vote
1answer
324 views

Why are Lengthy Password Stronger Than Complex? [duplicate]

So all my life I've been listening to people tell me to make complex password: Upper / Lower / Numeric / Symbols. Recently though I've been reading / seeing that length above all seems to make for ...
5
votes
2answers
662 views

How often should passwords change?

I'm asking two very related questions As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their ...
5
votes
2answers
939 views

Web & insecure HTTP - Using RSA for encrypting passwords on the client side

I used client side password hashing in my register and login project. Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in ...
3
votes
1answer
135 views

Are there any uses of having a non-deterministic salt value for hashes?

So I've been toying with the idea of having non-deterministic salt values for hashes. Let me explain what I mean: Basically, I applied some properties from Bitcoin including a "difficulty" (ie, ...
3
votes
1answer
260 views

How to determine hashes/second in password cryptanalysis

I'm working on my dissertation concerning cryptanalysis on password hashes. As part of my research, I aim to crack a number of passwords with John the Ripper and rainbowcrack-mt. I'd like to ...
24
votes
3answers
1k views

Does password-protecting a server's BIOS help in securing sensitive data?

I'm running a server of which I protected the BIOS with a password. One doesn't have to enter this password before booting, but before entering the BIOS setup. I just did this from routine. However, ...
11
votes
1answer
394 views

“Please Enter Nth Character” without HSM

This question has been asked a few times, but always in the format "How does examplewebsite.com implement their 'please enter xth yth and zth characters of your password' function?" And the ...
2
votes
1answer
225 views

User Authentication API

I'm developing a web API for a user database that will be used to verify a given username / password combination is valid. I'm just looking for comments / criticism on the following method that I'm ...
8
votes
3answers
10k views

With ASIC bitcoin miners, should SHA256 be considered insecure for password hashing?

I'm sure everyone here has seen the rise and further rise of bitcoin. The process used for mining bitcoin is basically "let's brute force an SHA256 hash that is less than this amount" That being ...
12
votes
3answers
630 views

How to manage team passwords?

How do most teams handle the storage of passwords, in particular the required changes when team members leave ? Right now, we use a centrally stored encrypted file but the thought of changing 100's ...
-2
votes
1answer
112 views

Why should I use the VPN? [closed]

Does a Virtual Private Network (VPN) provide an encrypted connection from outside networks or from ISPs to the internal network?
3
votes
1answer
173 views

Why regenerating a password's hash?

I've read http://alias.io/2010/01/store-passwords-safely-with-php-and-mysql/ on how to store passwords using PHP and MySQL, the secure way. Elbert says: Use a cryptographically strong hashing ...
2
votes
5answers
1k views

Why have username AND password? [duplicate]

It seems most security mechanisms nowadays default to a username + password combination for authorization. I want to know why there are 2 "keys," if you will. Won't one credential suffice? Put ...
5
votes
6answers
1k views

What's the most secure technique for authenticating user in a website?

I usually ask user for his username and password and run a query over database to return true or false, do you think it's secure enough? do you think it's better to add some steps to procedure?
6
votes
3answers
274 views

What is the value in asking for a second password for sensitive operations?

When a user has logged in to a system using their primary password, is there any value in asking for a distinct second password when performing sensitive functions? Does it provide any benefit over ...
3
votes
1answer
579 views

How does VTP authentication prevent unauthorized access (Can the password be cracked given captured packets)

I know that when setting up VTP across switches in a network you should set a secret/password to prevent unauthorized requests. My question is I know that this uses an MD5 hash to ensure that ...
0
votes
2answers
147 views

Does excluding username letters from passwords increase security?

Recently I was asked to change a password, along with a password policy which reqires you to use a digit, a special character and a letter, but forbids any letter from you log in name to be used for ...
14
votes
6answers
671 views

Is there additional security value in using passwords with words or phrases in non-English languages?

I was thinking about correct horse battery staple. I am not a native English speaker. In my language, the above could be written as: vqrno kon bateriq telbod OR вярно кон батерия телбод. Keep in ...
11
votes
4answers
1k views

Handling passwords in a web application

I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client ...
2
votes
0answers
43 views

Is it the default in billing systems to send out the users password by email? [duplicate]

I recently made a complaint to a company about them sending out passwords in plain-text via email upon registration knowing that it is a potential security risk. One of their employees responded with ...
14
votes
2answers
732 views

Password and Generated number - How does it work?

In my company, they don't allow accessing the company email or servers from outside the company network. To access the email from outside the network, you have to use: Username, password and a number ...
1
vote
1answer
337 views

Use brute force to mitigate brute force

Just an idea I had, and I am sure there is a lot of material about this subject, so I am looking for a pointer as to where I can find more information. My idea is this... When storing a password in ...
31
votes
8answers
3k views

Why improvising your own Hash function out of existing hash functions is so bad

I'm afraid I'll have tomatoes thrown at me for asking this old question, but here goes. After reading that cooking up your own password hash out of existing hashing functions is dangerous over and ...
20
votes
5answers
2k views

When hashing passwords, is it ok to use the hashed password as the salt?

I don't like this idea. But I can not come up with a technical argument against it. Can somebody explain it to me? The basic idea is: $passwd = 'foo'; $salt = hash($passwd); $finalHash = hash($passwd ...
7
votes
4answers
792 views

Why using random salts?

I read this blogpost on how to store passwords in a database, the secure way. Elbert tells us to do this: Generate a random salt and include something random and the username in it. Hash this. Hash ...
311
votes
12answers
49k views

What technical reasons are there to have low maximum password lengths?

I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites I actually care about ...
9
votes
3answers
1k views

Is a password in the clipboard vulnerable to attacks?

I see situations where you may have to input the same password more than once. You may type it in a text editor and copy it to clipboard, to paste it two or more times. In what scenarios this could ...
7
votes
3answers
4k views

Can password-protected zip files be broken without brute force?

You have a zip file that you created with 7z to password-protect it with AES 128. Can a smart adversary extract the data only through brute force, or is the file vulnerable to other attacks - such as, ...
2
votes
1answer
3k views

How long it will take to crack a RAR password?

I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we ...
1
vote
1answer
57 views

Parameters in output of password hashing function

A number of encryption functions include their tuning parameters in the output. For example, SCrypt, which I've been considering for an app I'm building, outputs in the following format: ...