Questions tagged [passwords]

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

Filter by
Sorted by
Tagged with
1 vote
1 answer
578 views

False Positive of Cleartext Submission in (CWE-319) in Burp?

In a recent execution of a spider, Burp reported cleartext submission of a password CWE-319, but the evidence in the report is merely the preceding GET request of a non-existant page, redirected via ...
varontron's user avatar
  • 113
32 votes
3 answers
12k views

Should I assign my various passwords to my keyboard's macro keys?

I had an idea to assign my keyboard's macro keys to various passwords so I can just hit the key and it will paste in (the passwords are long and random so I won't remember them). This is on a home ...
MCMastery's user avatar
  • 486
0 votes
0 answers
104 views

What type of encryption or hasing is used? [duplicate]

How to determine what type encryption or hashing is used for the following or 6760bb6a0b7468ac3549670e86450c07f424b3b021b983e820eb701b481d5f75 and how to decode it?
Karthik's user avatar
1 vote
2 answers
266 views

wordpress remote user authentication

I am having multiple wordpress sites with multiple users working on those. Therefore I would like to centeralize the user management, by having one authentication server, storing the username, ...
Tom's user avatar
  • 474
3 votes
0 answers
126 views

Any data on how many users change passwords after a breach notifcation?

Does anyone know of any study or any data whatsoever which might indicate how many users actually change their passwords after they have been notified that their credentials appeared in a breach?
john doe's user avatar
  • 708
0 votes
1 answer
223 views

Can Avast check my WI-FI password for strength?

I've been greeted by this popup this morning: Can Avast actually check my WI-FI password for strength? Or is it just "marketing scare" so that I upgrade to the paid version instead of using the free ...
Pips's user avatar
  • 105
1 vote
0 answers
93 views

Can the cost factor be changed of Windows' credential cache?

I'm having a hard time finding relevant documentation from Microsoft (or any third party, for that matter) about any registry key that may change the cost factor of cached credentials. One can ...
Luc's user avatar
  • 32.9k
36 votes
8 answers
8k views

Is it a mistake to use a password that has previously been used (by anyone ever)?

A few months ago, kutschkem answered a question about HIBP with this: Let's say every person on earth has used ~1000 passwords so far. That makes approximately 10 trillion passwords, which is ~243 if ...
Michael come lately's user avatar
2 votes
0 answers
84 views

Credential Storage for Partner/Vendor Accounts

We work with many other companies to do data exchange. As an example, we might work with COMPANY A to send them sensitive data over SFTP. This would be done by them giving us an SFTP Host/Account/...
David Borough's user avatar
2 votes
0 answers
116 views

How do biometric password managers work?

Many password managers for mobile offer the option to unlock the password vault with a fingerprint instead of a password. If you never type in your master password, how is it possible to decrypt the ...
jan's user avatar
  • 513
3 votes
1 answer
508 views

Password seal by paper or by password manager?

At my current company, the IT Risk team decided to ensure root passwords of about 90 systems by the following conventional method: The length of each password must be 16 characters, where they input ...
sanba06c's user avatar
  • 123
5 votes
1 answer
425 views

Password strength when used with 2FA

We have two factor authentication, with passwords and one time code received on SMS. Now normally I know you could restrict users to create passwords with min 8 character length, lower and caps ...
george's user avatar
  • 51
10 votes
4 answers
6k views

How can I check password strength client-side?

I have a website and my users will be using their selected password to encrypt their RSA private key using JavaScript client-side. How should I be making sure they are using a strong password without ...
mark820850's user avatar
0 votes
3 answers
319 views

Providing password review results to auditors

The IT Security department is getting audited and the auditor had approached our IT Security team and requests to see results of the password review process, which compares existing database of ...
MadMaxx's user avatar
0 votes
1 answer
2k views

What are the steps of hashing and steps of verifying password using salt and key? [duplicate]

What are the steps of hashing password during registration and login to an application using salt and key? Are the following steps considered correct if applied to an application?: 1- During ...
JuniorDeveloper's user avatar
1 vote
0 answers
132 views

Hosting password compromised [closed]

Last Monday I received two emails from my hoster: 10h42: Connection notification 10h42: Confirm your notification I didn't login that day, so I knew something was wrong. I immediately logged in, ...
COil's user avatar
  • 129
-1 votes
1 answer
319 views

during login to a system is it better to compare the registered encrypted password with the inserted password after encrypting it or the opposite?

During login to a system, is it better to compare the registered encrypted password with the inserted password after encrypting it or compare the inserted password with the registered password after ...
user221232's user avatar
5 votes
2 answers
486 views

Which user authentication measures are used nowadays?

I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, ...
Vasu Deo.S's user avatar
4 votes
1 answer
2k views

How to configure .NET's PBKDF2 implementation (Rfc2898DeriveBytes) in 2019?

I want to use .NET's Rfc2898DeriveBytes functionality in order to store my passwords in a database. In order to use it, I still need to make several decisions which will influence the level of ...
Raphael Schmitz's user avatar
2 votes
1 answer
669 views

How to store a user's password in a database in 2019? [duplicate]

This question, but focused on .NET's given PBKDF2 implementation, has been asked here now. Situation I am currently updating a password storage mechanism for a website. My plan for storing a ...
Raphael Schmitz's user avatar
1 vote
1 answer
3k views

John the Ripper Custom Dynamic Hash Function Usage

I have created a custom dynamic hash function comprised of a series of different existing hash functions chained together. I'll spare you the exact details because it's for a class assignment. I've ...
Jack F.'s user avatar
  • 11
3 votes
1 answer
1k views

Can 2FA / MFA be secure & functional in a purely offline state (PWA)?

I'm building a Progressive Web App intended to be used primarily in an offline state. The user can "login" while disconnected, which verifies the password against a locally-stored hash and some other ...
CandidGoose's user avatar
0 votes
4 answers
496 views

Attacks on password-based encryption

Frequent attacks on password-based encryption are dictionary attacks with special hardware. I suspect that this is the only promising attack on the ciphertext. Is that correct? Another attack ...
BeloumiX's user avatar
  • 256
1 vote
1 answer
216 views

Password hashing with salt. Where do you leave the salt? [duplicate]

I want to hash a set of sensitive data using a hash+salt. I've done a little research and now I know that: The salt should be random. The salt should not be reused. Using hashing without salt makes ...
MichielDeRouter's user avatar
5 votes
2 answers
1k views

Is it true that argon2i is "preferred for password hashing and key derivation"?

I was looking at the wiki for the node-argon2 package in npm, when I came around this justification for using argon2i as the default mode: The variant of the hash function. Argon2 has several ...
SunshineToast's user avatar
2 votes
0 answers
137 views

Link for username & password dataset [closed]

I want to know links to download "username and password" dataset for my research. I want to create a big dataset of 100-200MB for my research.
sabuzima nayak's user avatar
1 vote
0 answers
113 views

Security of the native Password Autofill function in iOS 12

I have read Apple documents on the iOS 12 password autofill function for iPhones. But I could not find much information pertaining to where the passwords are stored and what vulnerabilities might ...
gethopr's user avatar
  • 41
1 vote
2 answers
282 views

PCI DSS compliance on storing email body in database which contains plain text password

I work in a PCI DSS certified environment, which (as many secure environments) require 'Strong Cryptography' when storing user passwords, as per requirement 8.2.1. We simply hash them using BCrpyt. ...
Hasan Can Saral's user avatar
4 votes
4 answers
9k views

Can you set up 2FA with a USB drive?

I want to set up two factor authentication for some of my online accounts. I don't want to install an app, and I don't like using my phone as the physical medium anyway, because it's more likely to ...
preferred_anon's user avatar
69 votes
3 answers
12k views

Got an email saying my password is weak, reason for concern?

I recently received an email from a well-known company stating that the password I use is weak and can be easily guessed. The email seems legit with no attempt to steal information, they only say "...
darnok's user avatar
  • 731
2 votes
2 answers
187 views

User passwords printed on paperwork at a dental office?

My dental office just printed my user-defined password (not a first or one-time password) to their portal on some checkout paperwork. I asked on Law.stackexchange and it doesn't sound like this is a ...
cf512's user avatar
  • 21
0 votes
3 answers
215 views

Will it be safer to use self sign CA and client certification in the company for a private website?

Our company have 10+ private websites and 20+ person and need to open a different one automatic when the developers are testing some functional. We do not want anyone outside the company to view the ...
bronze man's user avatar
2 votes
3 answers
212 views

Windows Account Password Resetting process for large network

I am working on large windows based network environment (Active Directory) and I have a requirement of implementing clear and secure password reset process for windows user. Especially management ...
Infra's user avatar
  • 655
2 votes
1 answer
208 views

Do Xfinity hotspots require passwords?

There's a Xfinity hotspot(xfinitywifi)that I see on my phone that I occasionally use for reasons but lately it has been acting up so I contacted Xfinity customer support. They asked for some stuff ...
user220218's user avatar
1 vote
3 answers
427 views

If no one knows a password, is there a reason to change it?

Scenario: A high level access account on a single machine, where the account is created by the system/application with a secure password, without exposing the password to a human or to any other ...
James Jenkins's user avatar
0 votes
0 answers
63 views

How long shall a password be to resist a botnet brute force? [duplicate]

Imagine that I'm an evil genius, and I had the brilliant idea of creating a botnet for brute forcing passwords. Or I'm just the owner of the Echelon, and I have a farm of distributed servers around ...
Alberto Salvia Novella's user avatar
1 vote
2 answers
240 views

How can SubtleCrypto help in the process of sending a password via HTTPS?

I heard from someone that SubtleCrypto should be used in client-server communications to login and register, then he told me it would be useful even if someone took control in the middle of the HTTPS ...
Robert Mangini's user avatar
1 vote
1 answer
285 views

Will using CTR mode with unique IVs, but only one password for encrypting multiple files, leak data or keys?

I'm working on a project to encrypt many files with a single password. The steps I will employ to encrypt the files are: user will execute a command similar to tool --encrypt --recurse directories/...
Raz Varren's user avatar
4 votes
3 answers
514 views

As a website admin I could see encrypted passwords. Is this ok?

I am building a website that requires the users to login through username and password. I have the passwords encrypted in my database with bcrypt. On the back end, I receive the usernme and password ...
devamat's user avatar
  • 141
7 votes
2 answers
8k views

Putty store cleartext credentials in the Windows Registry; isn't that a very insecure approach?

I have been astonished when I've found that one of the most popular SSH client Putty stores cleartext credentials in Windows Registry: HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\ ...
T.Todua's user avatar
  • 2,727
0 votes
1 answer
321 views

How should we apply the salt to the password? [duplicate]

According to Wikipedia: A rainbow table is ineffective against one-way hashes that include large salts. For example, consider a password hash that is generated using the following function (where "|...
user avatar
3 votes
2 answers
283 views

Quantify security strength from entropy and lifetime

Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
gethopr's user avatar
  • 41
0 votes
0 answers
123 views

Securely distributing passwords and salts that will be derived by client programs

I am creating a client-server architecture running on top of the KCP protocol in Go. The package for KCP that I'm using is KCP-Go (https://github.com/xtaci/kcp-go). The package supports packet-level ...
Ethin Probst's user avatar
3 votes
1 answer
361 views

Can having certain restrictions/rules make passcodes less secure?

Say I have a phone whose security is corporately managed, and this management demands that I use a 6 digit passcode to lock the phone. So far, so reasonable. This gives an attacker a possibility of 1,...
Luke's user avatar
  • 163
4 votes
2 answers
2k views

Is it safe to leave MySQL root user without a password if it uses auth_socket?

Since MySQL 5.7, the root user is configured to use the auth_socket authentication plugin instead of a password. Is it safe to leave the root user that way (without a password)?
Emanuil Rusev's user avatar
6 votes
2 answers
13k views

How to store user credentials in browser securely?

I need help to authenticate users with user credentials. We are using Angular 5 as a front-end & need to store the user's email and password if the user checks on Remember Me. Then autofill user ...
Parth's user avatar
  • 163
1 vote
1 answer
239 views

Does digested passwords send over a non encrypted channel offers additional security over plain text passwords?

I am learning about WS-Security and trying to compare different options offered by UsernameToken as described in this document. AFAIK, a digested password is a hash of the plain text password along ...
tigrou's user avatar
  • 133
3 votes
4 answers
4k views

What is the best way to store a password on a system/server? [duplicate]

I will have an application server that needs to use credentials to authenticate to another service (email). What's the best way to securely store these credentials locally on the machine? Thanks in ...
Thomas Stringer's user avatar
0 votes
1 answer
212 views

Security concept for password management

At the moment, I am struggling on a question to which I have not found a good answer so far. I wan't to create a password manager, which will be used by a lot of people. Used languages: PHP / ...
spyro95's user avatar
0 votes
0 answers
142 views

What authentication systems have been involved in data breaches?

Recently, a Federal Judge ordered Marriott to reveal the forensics report for its data breach. I know the Courts have sided with businesses in the past to keep the forensic details of breaches from ...
gethopr's user avatar
  • 41

1
12 13
14
15 16
81