Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

4
votes
3answers
1k views

How can salted, hashed password storage be combined with a plaintext, nonce and hash based authentication?

My understanding is as follows: To securely store a password (e.g. in a database), you use a hashing algorithm designed for this purpose (designed to be slow, e.g. bcrypt), and you use a unique salt ...
2
votes
1answer
948 views

How do I generate a blowfish password hash in Ubuntu?

What's the command line to generate a blowfish password hash? I can't seem to figure this out at all. Apache's htpasswd only supports bcrypt, and openssl passwd doesn't even do blowfish hahes (but it ...
6
votes
3answers
399 views

Should password be cleared after unsuccessful logon attempt?

Lets assume following workflows a) On a device with keyboard: I type my username and password Press enter [realization] I made a typo Password field is cleared: not a big deal, I can type ...
16
votes
7answers
1k views

Taking password letters not whole one, is this secure? [duplicate]

I found a site which is taking password letters from their users not the whole password. Is this secure? Or do they have saved password as salted hash (MD5)?
4
votes
3answers
452 views

Encrypted files storage. How to simplify the password management scheme?

It's probably dublicate but I can't figure out the correct keywords for search. You can help by just telling me those words, I'm rather good with Google :) I want to develop somewhat like file ...
30
votes
3answers
2k views

Is there a security reason for a site to limit the number of times a user can change their password?

Is there a security reason to disallow a user to change their password as frequently as they want? I have found this security policy in a site and I am not sure why it is enforcing it. One reason I ...
4
votes
4answers
433 views

Is a short sudo password ok?

On a server I control, I have disabled password logins (public key only), but still need to enter my password to access sudo. This is becoming cumbersome, as I use a long, automatically generated ...
2
votes
3answers
714 views

Should I take care when entering incorrect passwords in untrustworthy websites?

I have the problem that I usually use 4 passwords that I use quite often. I use the first two strong passwords for very important services (e.g. Email, PayPal,..), and the other two not so strong for ...
9
votes
4answers
1k views

How dangerous is it to store password in plain text on sites like GitHub?

I have a few private repositories set up on GitHub for some of the projects I am working on for my company. These applications connect to databases and I have database authentication credentials ...
6
votes
2answers
623 views

Detecting Pass-the-Hash

I was wondering what you guys are doing to detect attacks like Pass-The-Hash within your network. I've read about Breachbox ...
-3
votes
1answer
1k views

Retrieve Admin Password from router [closed]

There is a way to retrieve a router admin password without hard reset? I'm loggen on LAN and know username and local ip address... TKS
3
votes
3answers
257 views

Are there implementations of password hashing algorithms for major frameworks that utilizes specialized hardware like GPUs/FPGAs?

It is common knowledge that password cracking attempts can greatly benefit from specialized hardware such as large clusters of GPUs or FPGAs. Are there any implementations of the commonly recommended ...
2
votes
1answer
1k views

What are realistic rates for brute force hashing?

I'm trying to gauge password strength assuming that the attacker has a hash of my password. Can anyone cite some realistic contemporary rates at which someone could perform various hashes? I know most ...
0
votes
1answer
409 views

How to encrypt files without giving the user access? [duplicate]

I don't know if I should ask this question on security.SE or stackoverflow, so please move my post if necessary. I want to store my (C#) application data in a way that the user cannot read or modify ...
2
votes
5answers
312 views

Is accepting old passwords a bad policy?

This question is inspired by an experience I had today with online banking, as follows. One year ago I opened an online deposit account. (Without naming the bank, I will say the company is currently a ...
8
votes
3answers
384 views

Does setting a user password on Windows XP help protect against remote exploits compared to no password?

In a typical home user situation with a PC connected to the internet via a router, suppose we are not concerned with protecting the machine from people with physical access. Does setting a password on ...
4
votes
2answers
527 views

Is there a risk in sending the username in a password reset email?

We're using a CMS that has a password reset function that works according to best practices out of the box. Passwords are stored as salted hashes Forgot Password works like this: User enters ...
4
votes
2answers
307 views

How can I create a secure password?

I know the standard tricks, create a long password, numbers, symbols, capital letters, etc. My questions is how do I judge password security. I heard different tricks to make secure passwords. For ...
-2
votes
1answer
841 views

LophtCrack version 6.0.12 is not auditing my Administrator password [closed]

I am using LophtCrack on my Windows 8 OS. I was testing my password strength and the problem I am seeing it is not working. It doesn't reveal my Admin password, I've run the process for half an hour. ...
-1
votes
1answer
327 views

After salting my passwords, are they protected against dictionary attacks? [duplicate]

I use sha1() to hash my users passwords, but recently a friend told me that if someone get the hash then they could use dictionary attack and he recommended using salts. I implemented a random salt ...
7
votes
1answer
1k views

Working out how to decrypt encrypted string when knowing the plain text

I have access to a system which I have been asked to create a data export routine for. However, the address details are encrypted and the original sourcecode/password are lost. However, I am able to ...
-1
votes
1answer
250 views

How can I encrypt my router admin page login session? [closed]

I login to my router using the web connection but the session is not encrypted, is there a third party way to encrypt the web session so no one on my network can sniff the password?
1
vote
0answers
51 views

How can I recover the password of a TrueCrypt vlume? [duplicate]

I am trying to recover the password of a trucrypt volume. It is composed by a combination of 4 words (one invented). I remember 3 of them but not their order. Do you know any tools that cold help me ...
1
vote
1answer
1k views

Why do websites limit password length? [duplicate]

I just made a new account with some eGov service (Belgian government). I use LastPass (which generates long, random strings for each site), But the system told me that the maximum allowed length was ...
3
votes
2answers
298 views

Server checking client's password without ever coming into possession of it

tl;dr: I am wondering what the best way is to check a password when the client does not trust the server. I know of two common ways servers can check if a user's password is correct: The server ...
1
vote
2answers
142 views

How to manage company passwords when employing temporary freelancers?

I am from a marketing firm which now has a development team, which i am part of. We have been tasked with finding a few freelancers who can come in and work when either me and the other developer is ...
7
votes
3answers
625 views

Can cloud based password managing services be trusted?

I'm a big time user of cloud based password managing services like LastPass. But in the light of recent revelations like various government backdoors in popular sites, programs like prism, etc. I'm ...
7
votes
3answers
1k views

What are the security implications of using TOTP for single factor authentication?

(Note: I am not actually planning to do this. This question is strictly theoretical.) TOTP is commonly used as the second factor in Two Factor Authentication. It is an open standard with available ...
-4
votes
1answer
535 views

Feasibility of brute-force on online password [closed]

I am familiar with how offline brute-force attacks work. But for online accounts, assuming no social engineering, how feasible is it to brute-force attack a password? For example, is this dependent ...
47
votes
8answers
3k views

I'm an IT consultant. Should I discourage a client from telling me his password?

I'm an IT consultant. One client has known me for a few years. He wants me to do some work on his kids' laptop again. I'll need to log into his kids' Windows user account. (I'm guessing that multiple ...
2
votes
2answers
2k views

What exactly is 'single' mode in John the Ripper doing?

I'm testing out John the Ripper (1.7.9 Jumbo 7) on a file containing MD5 hashes without any usernames. I've been experimenting with different rules and configurations – I am currently using a wordlist ...
2
votes
2answers
10k views

Where is my password stored on Linux? [duplicate]

Is there a specific location where the passwords are stored ? Is it depending on which version is used ? Are they salted ?
4
votes
4answers
255 views

Composition of passwords

Passwords (passphrases) that are taken from known texts (books etc.) are commonly considered to be weak, but what if they are employed in combination with random stuffs, i.e. in forms of AX, XA or ...
7
votes
3answers
1k views

Can I spoof IP addresses when attempting to brute force a login?

I am testing my website with hydra brute-force software. But accessing my apache conf remote server file, it seems that an attacker can't log-in more a limited number of times per seconds. Does hydra ...
6
votes
1answer
6k views

Where is my password stored on Windows 7?

Is there a specific location where the passwords are stored ? Are they salted ?
2
votes
2answers
2k views

Is user password in ubuntu 13.04 in plain text?

Is it stored in plain text or not? Where can I find the file that contains the username and password for my accounts in Ubuntu 13.04?
6
votes
3answers
6k views

Is it safe to store password in HTML5 sessionStorage?

I am trying to improve the user experience on registration by not requiring the user to retype their password if validation on other fields fail. There are a few ways to implement this, example using ...
3
votes
0answers
246 views

Similar passwords can't be used again. A sign of unhashed password storage? [duplicate]

In my school everyone must change their password every six months. The new passwords cannot be the exact same as the old one, this make sense, however many of my peers often complain that they need ...
5
votes
2answers
171 views

Is it common for a One-Time-Password system to become unsynchronized?

One-Time Passwords look like they can play a helpful role in a layered-security system, yet their use, especially paper-based TANs seem like clients could be vulnerable to getting out of sync with the ...
0
votes
2answers
1k views

Why store the password salt instead of generating it? [duplicate]

So, reading through this article: http://crackstation.net/hashing-security.htm it says that storing the salt is fine in plain text because it renders the lookup/rainbow tables ineffective. I get that, ...
6
votes
5answers
764 views

Is including a secret GUID in an URL Security Through Obscurity?

I know that this question is a little bit on the side of Opinion/Discussion, but I think there's a provable answer to it. I think the common view of "Security Through Obscurity" is that the security ...
4
votes
3answers
390 views

Is it worth padding passwords?

I'm using phpass (bcrypt) to hash the password and SSL when it's transmitted, and using PDO (with PHP) to stop injections, is it worth padding the password, so that if the user enters "123456" as the ...
14
votes
7answers
2k views

Why should I hash passwords?

I've read that every good web application should hash passwords. I found many articles about hashing. So I started implementing hashing on my website and then I asked myself why should I do it? When a ...
5
votes
1answer
6k views

Recover Server 2008 R2 Domain Admin Password

So I did the ultimate silly thing: I lost my domain admin password for my Server 2008 R2 box. Sure, I could just re-install but that's going to be a huge pain. I tried rebooting with the Windows ...
3
votes
2answers
6k views

Can I properly make password-protected 7z archives secure?

After reading the question and answers of this and this, I left with an overall impression from the last one that zips were considered not safe and insecure way of sharing data. I still think ...
11
votes
5answers
873 views

Is there any good reason not to salt/hash passwords you store?

Two organisations I frequently deal with (including my bank) ask me my password to authenticate myself with them... well... they ask for "random" characters from my password. As I understand it, this ...
18
votes
3answers
11k views

Router password vs MAC filtering?

I just bought a Galaxy S4, and it didn't connect to the WIFI in my house (I have a 14$ router). After a bit of testing, I've decided to leave my connection open without a password, but added the ...
7
votes
2answers
2k views

How do I block LinkedIn from extracting data from Microsoft Exchange Server?

LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click ...
4
votes
1answer
390 views

WPA2 audit tool

For the purposes of my own research, I have a very modest budget to set up a modest WPA2 brute-forcer supported by GPU(s). I've done some homework: Brute-Force GPU Password Crackers How to setup ...
2
votes
1answer
1k views

Brute-Force GPU Password Crackers

Brute-force password cracker programs which claim GPU support include John the Ripper, ighashgpu, oclHashcat, and others. oclHashcat appears one of the more popular, but I am not sure which AMD/ATI ...