Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

19
votes
6answers
2k views

Why do some sites prevent users from reusing their old passwords?

I have always wondered why it is that bad to reuse old passwords; it should not be the end of the world if we happen to use an old password that we previously used. After all, I believe most of the ...
6
votes
1answer
1k views

Why does Microsoft limit password length? [duplicate]

Possible Duplicate: Should I have a maximum password length? According to a recent TNW article: Microsoft doesn’t like long passwords. In fact, the software giant not only won’t let ...
4
votes
1answer
237 views

How will security need to be changed if we can crack password hashes in quasi-polynomial time?

If we suppose that we have access to some form of generalized password hacking/cracking that can somehow find an $n$-bit password in time $O(n^{\log n})$, is there need for alarm? This question ...
6
votes
5answers
4k views

How can I avoid putting the database password in a perl script?

I have a cronned perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
2
votes
1answer
501 views

Can I check if a work colleague logged into my user account on a shared computer?

I think that someone at work has logged onto my user account when I'm not in work and moved some files from my desk top to my work in progress. Can this happen? They may know my user name as this is ...
2
votes
1answer
164 views

What authentication threat data exists?

I recently read an article that said there was not much data on which authentication threat vectors were actually being exploited in the real world. Eg what percent of password theft was by ...
3
votes
3answers
1k views

sniff SSH password on the server

Is it possible on the server to log the password encoded by the remote user inside a log. I want to make a honeypot to see the type of user/password used.
6
votes
5answers
531 views

Creating multiple secure and easy to remember passwords

I have recently developed a new web application which our clients log into using a username and password. As we're just rolling out this system, we'll be setting the usernames and passwords ourselves, ...
0
votes
1answer
250 views

How key_derivation and key_verification functions are implemented of a 7-zip archive's encryption mechanism?

I am curious about how password recovery works for password protected files. And I want to know the exact flow of the 7-zip encryption mechanism :) !! 7-zip uses the AES-256 encryption algorithm in ...
3
votes
1answer
259 views

DPAPI offline attack by cracking windows password?

I'm thinking of using DPAPI to protect configuration file information in my program. After doing some reading on it, it looks like it uses the user's Windows password as part of the encryption ...
20
votes
4answers
6k views

How secure is Windows 8's Picture Password login?

The final Windows 8 build has been released to manufacturing. One of the new features of Windows 8 is "Picture Password", where the end user logs on to Windows by clicking a specific pattern on the ...
1
vote
2answers
138 views

Is there a term for a “Master + extension” style password scheme?

I personally have (and preach) a password system using a "root" password shared amongst many passwords, plus a unique password component. So for Gmail my password might be correcthorsebatterystaple + ...
3
votes
2answers
2k views

Password recovery tool over telnet or http basic auth

In my feeble attempt to secure my router, I disabled the service login and either changed the "admin" login and the password, or changed only the password for the "admin" login Normally, I would ...
4
votes
8answers
896 views

Is this a good way to store passwords in a Web Application?

I've been tasked with finding a better way to store passwords and came up with this Algorithm. My understanding of Crypto is not strong enough but can someone check this please? Inputs: Username ...
7
votes
1answer
1k views

Store user passwords in NoSQL database?

I am currently coding the backend of a website and I have not come across an article where this is discussed. I want to store all my application data in MongoDB but I'd like to split out my sensitive ...
1
vote
1answer
116 views

tools automating logins/hashes grabbing

Lets assume I have access to the windows machine. I want to grab raw info about logins/hashes from both system and installed apps, dump and analyze it later. I could manually dump things like SAM ...
4
votes
2answers
499 views

Best practice for password-protecting a secret key

What approaches are generally accepted for generating a password-protected symmetric key? My intuition is to generate and store a random string of appropriate length as the password-protected key, ...
9
votes
2answers
2k views

Estimating the size of a rainbow table

What are rainbow tables and how are they used? Gives a very precise answer about what rainbow tables are and how they are used. I had always confused hash-tables and rainbow tables. My question is ...
12
votes
2answers
5k views

Facebook API : App Secret - possible misuse

I've recently find out that by simple quick look into compiled code of one of our applications, you can get both App ID (API Key) and App Secret for Facebook API I suppose that we should really keep ...
6
votes
3answers
575 views

How does KeePass master key derivation increase security?

I don't understand how KeePass key derivation increases the security of the password db at all. First I'll try to explain what I understood from the key derivation described here. I'll use some pseudo ...
10
votes
2answers
4k views

Bypassing the BIOS password

Are there any reliable methods that allow an attacker to bypass a BIOS password, or alter BIOS settings without entering the password? A few ideas come to mind: The old battery trick (remove ...
4
votes
3answers
593 views

Tracking stolen laptop which has a login password

I have been reading about solutions that track your computer in case of missing. Since I'm using Ubuntu 12.04, the best option would be prey for me, but I'm open to other suggestions. The question is ...
3
votes
0answers
96 views

How should I manage my passwords? [duplicate]

Possible Duplicate: What is a good practical (and sane) way to manage all your passwords for online sites? So even if I come up with memorable passwords like "correct horse battery staple," ...
2
votes
2answers
120 views

Is this login authentication safe?

I have been thinking of a way to authenticate users so as to pick out the users using cracked versions of my game from the people who have actually bought it. I came up with this idea: The client ...
2
votes
1answer
1k views

Should we block all plaintext authentication and require authentication over an encrypted channel?

Should we configure our servers to require the authentication happen over an encrypted channel and block all methods of unencrypted, plaintext authentication over? I recently configured my servers to ...
6
votes
3answers
538 views

Is it proper to be prompted that I entered an old password

I changed my Facebook password a few days ago. Today, I entered the old password chronically, and saw the prompt: Sorry! You Entered An Old Password And even shows the date&time when I ...
6
votes
2answers
3k views

Help understanding basic user authentication with salts and hashing

I for some reason am not understanding how to execute a secure authentication between client and server for a user. I've read many resources, and I understand how to use the hashing and salting tools, ...
3
votes
2answers
16k views

Remove Password Protection from XLS Document

Similar to what is listed here, http://datapigtechnologies.com/blog/index.php/hack-into-a-protected-excel-2007-or-2010-workbook/, is there a way to remove the password from an XLS (Excel 2003) ...
5
votes
2answers
498 views

Requiring regular password change but storing previous paswords?

My bank requires me to change my password regularly but then they can detect if my password was used before. They probably store the old password (possibly hashed) in order to detect it. I think this ...
6
votes
2answers
955 views

Production ready bcrypt implementation for .NET

Which, if any, .NET / C# bcrypt implementations are considered suitable for production environments? I have seen CryptSharp and BCrypt.Net mentioned in answers to other questions but without any ...
0
votes
1answer
97 views

What is a preferred method of security-conscious creation of login cookies [duplicate]

Possible Duplicate: Is it safe to store the password hash in a cookie and use it for “remember-me” login? I am working on a webapp that uses localStorage alone ...
3
votes
1answer
103 views

Password hashing on a load balancing setup

I've been doing some research into password hashing implementations and would like to know if it's feasible to have two servers hash passwords to the same database? I've come across the Bcrypt.net ...
4
votes
2answers
179 views

Did I miss anything when checking for passwords?

I was provided with a "challenge" forensics image of 2MB in size (floppy); they provide the disk image and want you to uncover as many passwords as you can find. I downloaded the image and dd'd it to ...
17
votes
6answers
1k views

Hash function change

I have user account passwords stored in a database using an unsafe (old) cryptographic hash function. What is the best/usual approach to changing password hash function? Only two ideas come to my ...
5
votes
1answer
390 views

Should password hashes be encrypted or HMACed?

Assume I am hashing user passwords with PBKDF2, bcrypt, scrypt, or some other secure key derivation function. Are there: tangible security benefits, precedents, and respected research for ...
3
votes
1answer
371 views

How strong are google's Application-specific passwords? [duplicate]

Possible Duplicate: Google Account: implications of using application-specific passwords In 2-step verification of google accounts, we need to use the Application-specific passwords ...
4
votes
2answers
242 views

How to prove a password guessing theory from Matt Bishop's book “Introduction to Computer Security”

First, this is not a homework problem. This is a problem from Matt Bishop's book "Introduction to Computer Security" which was used as one of the textbooks for a Computer Security class I took last ...
1
vote
4answers
529 views

Security implications of using a OAuth-enabled password manager

I've resisted the idea of password managers for a long time. Bringing together passwords for all your online accounts in one place that is only protected by difficult-to-remember master password ...
2
votes
3answers
131 views

How to make an outbound request to users to update their passwords?

Clearly it works best if the request to update a password happens as a response to an inbound request to access a known system, but how do you make an outbound request to users to update their ...
2
votes
1answer
6k views

Why it does not matter whether you type HEX or ASCII as WEP WiFi password?

I know that I can pass password in HEX as a keyphrase to WiFi network using WEP encryption as well as ASCII. But somehow you cannot get the ASCII when you only know HEX value. Can anyone explain the ...
2
votes
0answers
75 views

How can a service shorten a password if it is not stored in plaintext? [duplicate]

Possible Duplicate: How can Microsoft validate a shorter password on Microsoft accounts (MSDN)? My Microsoft password was 18 characters long and when I updated to Outlook.com it started to ...
6
votes
3answers
337 views

How can Microsoft validate a shorter password on Microsoft accounts (MSDN)?

I recently ran across this when logging into MSDN. (I saw this screen after typing my initial credentials.) I have a 20+ digit password, however there's apparently a new requirement for Microsoft ...
2
votes
1answer
131 views

IKEv2 in remote access scenarios

Can someone explain why, in remote access scenarios, IKEv2 EAP password-based user auth combined with IKEv2 PUBKEY gateway auth is preferable over mixed IKEv2 PSK/PUBKEY auth using the same password ...
3
votes
2answers
4k views

Is it safe to store password in PHP session?

I need to do some encryptions in the private zone of my website and I want to bcrypt the user's password. Is it safe to store the password in the session when user does the login, so that I can use ...
3
votes
2answers
332 views

From password to key

Can you explain this passage from Wikipedia? When a password (or passphrase) is used as an encryption key, well-designed cryptosystems first run it through a key derivation function which adds a ...
2
votes
2answers
157 views

Bad planning causing weak passwords

The athletic department at my university has a facebook page and on it they said "the first 500 people to register for this event will get free t-shirts". When registering one has to create an account ...
5
votes
4answers
1k views

Password Vault - Enterprise

I want to be clear from the get-go that I am NOT looking for a user password management solution. My organization already uses AD for that. What I am looking for is a password vault. Up until now, ...
3
votes
1answer
641 views

Why do some large companies still store passwords in plain text/decrypt-able format? [closed]

In the last couple of weeks I've come across two fairly large companies who seem to not have stringent password security: Tesco - they store passwords in an "encrypted" format, yet they can decrypt ...
4
votes
2answers
242 views

What steps can you take to make offline cracking of SRP harder?

In the aftermath of the Blizzard hack, what steps can I take to make offline cracking of SRP more difficult? My question assumes that your database is already gone and that you implemented SRP more ...
3
votes
4answers
630 views

SMS Authentication: random OTP or a cryptographic one

I'm adding two-factor authentication using SMS to enhance an existing login process. Since I'm not working with physical tokens, I was wondering what is considered the safest: Sending random 8 ...