Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

1
vote
2answers
391 views

What impact do the frequency of password resets have on password reuse?

Wondering if there's any research behind the most common password reset cycle I've seen of 90-days, and if there's any research that gives any insight into how to optimize password resets to reduce ...
1
vote
3answers
118 views

Is it possible to have a high confidence that a password is not being reused?

Have a few thoughts on the topic, but the general gist is if a user inputs a new password, is it possible to have a high confidence that a password is not being reused elsewhere? By elsewhere, I mean ...
2
votes
1answer
123 views

Should a Mobile app able to check what password is locally saved via a user facing feature?

I'm working at a company who is currently working to secure their mobile app (iOS native) by adding check points to security sensitive screens on the device (data is stored in the iOS keychain). User ...
180
votes
7answers
38k views

Why would you not permit Q or Z in passwords?

Jetblue's password requirements specify that, among other stringent requirements: Cannot contain a Q or Z I can't fathom a logical reason for this, unless it were say, extremely common for the ...
4
votes
0answers
838 views

A Google owned IP address accessed my outlook account [closed]

Today I got a warning from Microsoft saying that there was unusual activity on my account. Diving deeper I saw that there was a successful sign in from a Google owned IP address (according to ARIN). ...
3
votes
2answers
530 views

MySQL ENCRYPT salt is not random?

I know there's little reason to still use ENCRYPT() nowadays, what with bcrypt being almost ubiquitous and MySQL providing better hashes such as SHA1. But while dabbling with ENCRYPT() on MySQL ...
2
votes
1answer
2k views

Hydra bruteforce and JSON

I am having problems with Hydra and a JSON payload. The login request (intercepted with Fiddler), is the following: POST http://architectureservice.test.com/api/v1/login HTTP/1.1 Host: ...
3
votes
1answer
245 views

How does “Google password monitoring” work?

Google Apps has a feature to monitor users' password strength and notify administrator about it. Google help says: View the length of each user's password along with a graph showing its relative ...
3
votes
2answers
3k views

Is it a good idea to store Email addresses as hash only?

I am currently building a web service at http://write-math.com similar to http://detexify.kirelabs.org/ that should help users to get LaTeX code from drawn formulae. It is part of my bachelors thesis ...
1
vote
3answers
98 views

Is it ok to use the same password for many services with two-factor authentication?

Let's say that I've a relatively strong password, but I don't want to use many different passwords for each different service, and let's say that those services provide two-factor authentication using ...
9
votes
3answers
1k views

Logging “password with counter” use

When prompted to update their passwords after they've become stale (whether that's after 30, 60, 90 days — whatever is implemented by policy), many users simply increment the number that they may have ...
44
votes
3answers
8k views

Paypal sent an email addressing me with one of my old passwords as my name

I got this email from service@intl.paypal.com, with the title: Your account has been limited until we hear from you. I think this is a scam / spoof email because I don't see any notification in my ...
0
votes
2answers
660 views

Are passwords safe to send through POST, without SSL in a iOS app?

Is it safe to post passwords to my web server in this manner? NSURL *url=[NSURL URLWithString:@"http://mywebsite/test/register.php"]; NSData *postData = [post dataUsingEncoding:NSASCIIStringEncoding ...
4
votes
1answer
290 views

Hashed passwords for NTLM authentication

I understood that Windows users' password hashes can be exported very easily. Right? So my question is: If I can have the hashes of other user accounts (e.g. local users on my Windows machine), isn't ...
9
votes
1answer
600 views

How to stop password recovery attempts on accounts?

I am using social networking services such as My Banking GMail PayPal Facebook Twitter Google+ LinkedIn All of these services text messages me a six digit code to login from anywhere, even a ...
0
votes
1answer
219 views

Multi user symmetric key encryption

I realize SIMILAR questions have been asked before but I'm looking for certain specifics I can't seem to find elsewhere. The following question closely resembles mine but falls short for me on ...
6
votes
1answer
245 views

How important is a mysql password for localhost?

We can assume that if an attacker gained access to a web server running mysql that they would be capable of reading the scripts to determine the mysql password. If mysql only responds on localhost, ...
9
votes
6answers
2k views

Should I hash a password if it is randomly generated

The best practice is we should hash a user password using algorithms such as bcrpyt to protect the user, however, given the following conditions, is hashing in the backend still matters? the ...
0
votes
4answers
313 views

Password Hashing Without a Unique Salt

I have a question about password hashing. This is not a question about the the BEST POSSIBLE method of hashing passwords, but rather a more utilitarian question about what is sufficient to hash a ...
1
vote
3answers
118 views

Issuing password information by phone [duplicate]

We have a confidential portal for clients. Historically they have been identified face to face in person and handed a unique token number that is associated with their email address and allows them ...
0
votes
1answer
63 views

Is it safe to use the Keccak Algorithm to create the Key for a Serpent cipher?

I like to store some configuration but would encrypt them with the Serpent cipher. Is it safe to do this? When not, what is a better solution?
1
vote
2answers
131 views

Forced to use using 2-Step Authentication to keep online profiles safe?

I am starting to see a majority of services, websites, and social networks offering the 2-step Authentication like crazy now to protect their users. Also, after reading how the Twitter Account N was ...
2
votes
1answer
154 views

encfs and passwords

I notice that encfs fails to mount a filesystem when a wrong password is entered. However, this capability of detecting whether a password is right or wrong can allow brute-force attacks to be ...
2
votes
1answer
721 views

How do application specific passwords work in Google accounts? [duplicate]

I turned on 2-step verification and had to setup an application specific password for Outlook. I noticed the password generated is actually weaker than the one I had before turning on 2-step ...
1
vote
1answer
262 views

how to use hash passwords to retrieve keys from keystore or access database

How do I hash the password for a keystore? How do I then use the hash to retrieve something from keystore? Similarly, how do I use a hashed password for accessing the database? I have encrypted the ...
1
vote
3answers
139 views

cleartext passphrase for keystore

How is passphrase for a keystore to be stored? we have all passwords encrypted and the key to encrypt is stored in keystore , so how is the passphrase for the keystore to be stored? in clear text? if ...
2
votes
2answers
302 views

Is it important to use a slow hash in htpasswd?

It's my understanding that the purpose of .htpasswd files is to restrict access to some files in the server filesystem. If an attacker gains access to it, he probably has access to everything else ...
-3
votes
3answers
206 views

Hashing credentials. Is hash(email+password) secure enough?

I am working on a client server application where to identify each user I was thinking of storing a single database entry: hash(email + password) In my opinion, this is enough to stop some known ...
2
votes
3answers
544 views

I want to roll my personal cloud hosted Password Manager using pass. How secure/insecure would this be?

I've come to the conclusion that I need to up my security. I currently have a dozen memorized passwords I use for every device and website. I'm against Keypass/Lastpass due to having to trust they ...
0
votes
1answer
140 views

What are the implications of an overly-restrictive password policy? [duplicate]

I came across an interesting password policy online recently: "Please be sure to enter a password that meets the following criteria: must be 8 characters long must not be based on dictionary words ...
2
votes
2answers
265 views

Wifi Sniffing Prevention

I share my wifi with my brother. Recently I came to know he is sniffing on my browsing. Is there a way I can prevent him from sniffing on my browsing? PS: I can't afford VPN.
1
vote
1answer
96 views

Amazon Turk - How secure is it? Strange behavior

I just had this really strange experience with Amazon Turk, where suddenly I was logged into someone else's account. I was logged into the company's Turk account, left my computer for a while, ...
2
votes
2answers
181 views

Does my brokerage/bank use poor password security measures?

I'm no expert. Could someone please tell me if I'm overreacting? After the Heartbleed news broke, I changed a lot of passwords. Here's what I discovered when changing the password on my all-in-one ...
3
votes
2answers
307 views

What should I do when I need to store passwords for usage in 3rd party software?

I have a desktop WPF application which authenticates with Dynamics CRM 2011. I ask for the username and password of the user and use them to connect to Dynamics CRM 2011 using ...
1
vote
2answers
668 views

Which hashing algorithm is ideal for use on the web? [duplicate]

I am new here, and have poked around the site looking for an overview of which hash algorithm to use on the web and why. It seems to be the consensus that SHA-256 or other SHA-2 family algorithms are ...
60
votes
3answers
19k views

How can I create a password that says “SALT ME!” when hashed?

How can I create a password, which when directly hashed (without any salt) with md5 will return a string containing the 8 characters "SALT ME!". The hope is that a naive developer browsing through his ...
0
votes
2answers
155 views

How different should passwords be?

It seems to be generally accepted the same password should not be used for different sites or devices. How different should passwords be? For example +_^gum<JW1 and +_^gum<JW2 are very similar. ...
1
vote
1answer
80 views

How do you manage credentials to multiple remote systems?

We are a vendor that provides software to the healthcare industry, and our application is locally hosted on customer infrastructure. As such, we are provided with VPN access in order to be able to ...
0
votes
0answers
25 views

Length-constant password comparison in scrypt? [duplicate]

E.g.: XORing the candidate against stored then comparing against 0. Do I need to worry? (my question is much in the same style as this question: Does bcrypt compare the hashes in ...
2
votes
2answers
5k views

NTLM/LM Hashes on Domain Controller

I've noticed that when extracting password hashes from a domain controller (using Elcomsoft proactive password auditor) sometimes I'll get LM and NTLM hashes and other times I'll only get NTLM hashes. ...
1
vote
1answer
131 views

Cracking encrypted SQB databases

I've recovered a .SQB SQL database backup file from a backup server and do not have the password. As I do not have the password available to me, I'm looking to determine what type of encryption is ...
1
vote
1answer
160 views

Hashing password for secure storage (generating salt)

I wanted to check if the following means of generating a hash for storage of a password was secure. I have an username and password combo. In order to generate a secure hash, I am doing the ...
0
votes
1answer
58 views

CNN Money Portfolio and Heartbleed [duplicate]

Is/was CNN Money Portfolio ever vulnerable to heartbleed? It states 256 bit SSL bank level encryption on the website..
1
vote
1answer
1k views

What to do with .hash files when cracking WPA2

So, I'd say I'm one level above n00b. I've gotten to the point where I have accomplished a WPA Handshake (and saved the output as xxx-01.cap). I have also downloaded these hash tables (if that is the ...
6
votes
1answer
484 views

What happens if biometric data is stolen?

As we move toward a future where fingerprints might possibly replace passwords, I see one issue. While passwords can be stolen, they can be changed by the owner after being notified of the security ...
3
votes
1answer
695 views

Decrypt Passwords based on using a user's password

I am creating a database to store our client's information at work (a heritage center specializing in DNA based genealogy). Once the results of a test come back, we have people that use the ...
2
votes
2answers
145 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
3
votes
1answer
10k views

Is it safe to sign in to Google with password from desktop app like BlueStacks? [closed]

BlueStacks is an android simulator for desktop. After installation it will ask you to login with your Google account to download and install android app from play-store. My question is "Is it safe to ...
1
vote
0answers
1k views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
5
votes
1answer
1k views

Chinese or “pinyin” wordlists for dictionary attacks

Background: I am currently trying to crack a salted md5 hash which I have recovered from an embedded device running busybox and manufactured in china. I have tried john the ripper using all of the ...