Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

4
votes
3answers
363 views

Is it worth padding passwords?

I'm using phpass (bcrypt) to hash the password and SSL when it's transmitted, and using PDO (with PHP) to stop injections, is it worth padding the password, so that if the user enters "123456" as the ...
14
votes
7answers
2k views

Why should I hash passwords?

I've read that every good web application should hash passwords. I found many articles about hashing. So I started implementing hashing on my website and then I asked myself why should I do it? When a ...
5
votes
1answer
6k views

Recover Server 2008 R2 Domain Admin Password

So I did the ultimate silly thing: I lost my domain admin password for my Server 2008 R2 box. Sure, I could just re-install but that's going to be a huge pain. I tried rebooting with the Windows ...
3
votes
2answers
6k views

Can I properly make password-protected 7z archives secure?

After reading the question and answers of this and this, I left with an overall impression from the last one that zips were considered not safe and insecure way of sharing data. I still think ...
11
votes
5answers
845 views

Is there any good reason not to salt/hash passwords you store?

Two organisations I frequently deal with (including my bank) ask me my password to authenticate myself with them... well... they ask for "random" characters from my password. As I understand it, this ...
18
votes
3answers
11k views

Router password vs MAC filtering?

I just bought a Galaxy S4, and it didn't connect to the WIFI in my house (I have a 14$ router). After a bit of testing, I've decided to leave my connection open without a password, but added the ...
7
votes
2answers
2k views

How do I block LinkedIn from extracting data from Microsoft Exchange Server?

LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click ...
4
votes
1answer
383 views

WPA2 audit tool

For the purposes of my own research, I have a very modest budget to set up a modest WPA2 brute-forcer supported by GPU(s). I've done some homework: Brute-Force GPU Password Crackers How to setup ...
2
votes
1answer
1k views

Brute-Force GPU Password Crackers

Brute-force password cracker programs which claim GPU support include John the Ripper, ighashgpu, oclHashcat, and others. oclHashcat appears one of the more popular, but I am not sure which AMD/ATI ...
-1
votes
2answers
591 views

Looking for safe, simple way to store passwords with PHP 5.2.17 [duplicate]

I've found many posts on StackOverflow and other sites using Google, but since security is always changing, and what was safe a few months ago not me anymore... I felt the need to ask on here. ...
-4
votes
1answer
140 views

How can I crack ArrayOS password [closed]

I have some Array Load Balance device that the user password hash like: user "array" "XXXXXXXXXVkjTX9a1kYtNo". How can I crack the password or find out the algorithm of the hash?
18
votes
6answers
2k views

How to avoid scripts with hardcoded password? [duplicate]

I have some scripts on Ubuntu Linux machine that logs in to a database server to run some maintenance daily. To login to the database, I need a password and right now it is hardcoded in the script. ...
3
votes
2answers
269 views

Does glibc2 version of the crypt function still use DES for alternative hashing methods?

I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted ...
67
votes
7answers
12k views

Touch Screen Password Guessing by Fingerprint Trace

After eating some garlic bread at a friend's who is not security-aware, she managed to quickly determine the PIN code to unlock the screen of my Samsung SIII. She figured this out by simply holding ...
8
votes
2answers
632 views

Plain Text Password Reset Vulnerability

If I receive an email with a plain text generated password (in response to a password reset request), is this a vulnerability? The password expires after one use, in other words the user has to change ...
1
vote
1answer
11k views

Unsolicited Password Request from Facebook

Today I have received 3 emails to my three different addresses, one with Google, one with MSN, and one with my company. All emails were sent from password+kjdmiikvhppi at facebookmail.com email ...
0
votes
2answers
446 views

Bruteforce Passphrase of Dictionary Words

Consider the all lowercase passphrase: "lazy fox haggles treaty" Assume all four words are in a dictionary of 2000. Bruteforcing word combinations, how long does it take to crack this password at ...
34
votes
7answers
7k views

Why isn't open WiFi encrypted?

As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
27
votes
2answers
1k views

Does versioning an encrypted file make it less secure?

Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices. The kdb file in itself would be encrypted, but ...
34
votes
11answers
23k views

Are password-protected ZIP files secure?

Following my answer. If I can list contents of password-protected ZIP file, check the file types of each stored file and even replace it with another one, without actually knowing the password, then ...
4
votes
2answers
426 views

Protecting Password Hashes with Store Procedures?

I was thinking about the recent (seemingly weekly) security breaches we've seen where millions of password hashes have been leaked and I was wondering how one might secure their site against a ...
1
vote
1answer
401 views

Password storing in Google Chrome content scripts

I am planning to store the login credentials in Google Chrome content scripts. The content scripts will then use these credentials to login to a website when I open it in Chrome. I wanted to ...
1
vote
6answers
3k views

Pronounceable Password Generator

I am currently looking for a password generator which produces pronounceable passwords. I have used this random password generator a few years ago to generate a 42 characters long password and found ...
23
votes
10answers
6k views

Intel How Strong is Your Password page, good advice?

I came across this Intel How Strong is Your Password? page which estimates how strong your password is. It has some advice on choosing better passwords including that you should use multiple ...
-3
votes
1answer
2k views

Good Password Length [duplicate]

If you are looking to be careful and your passwords include all the types of characters, what is the ideal password length?
7
votes
3answers
664 views

Password list generation

I've found during a lot of recent pen-tests that companies will use passwords like c0mp4ny@b( for a company called "company abc" Is there any quick and easy way to generate a list of passwords ...
3
votes
4answers
442 views

When salting and hashing passwords, any advantage to including password length?

In this answer, Gilles says (emphasis mine): There's no need to hide the salt from the attacker: it needs to be unique (and not derived from the password) but it doesn't need to be more secret ...
0
votes
1answer
2k views

Using JTR to crack Skype Passwords

The scenario: coworker's Skype somehow lost his auto-fill password. He doesn't remember it anymore, and the account is hooked up to an email address that no longer exists. He's never purchased any ...
31
votes
7answers
9k views

Is salting a hash really as secure as common knowledge implies?

(I did search on this topic, but I found no complete question/answer that addressed it, or even good portions of questions that might be relevant.) I'm implementing a salt function for user passwords ...
8
votes
4answers
698 views

Do honeywords add any real security?

This paper proposes the concept of honeywords for detecting if a password database has been compromised. As far as I understand it works like this: You save n password hashes for each user, one that ...
1
vote
1answer
154 views

Simple and secure remote installation method that accepts input via a web page?

When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner? ...
7
votes
6answers
724 views

Cleartext password in HTML

Is there any problem with outputing a user's password to the HTML in an hidden field (see use case below before flaming xD)? The use case is a registration form with two steps. The user fills in the ...
5
votes
1answer
155 views

Could a password hash that's prone to more collisions provide better overall security?

Website security breaches seem to be a common occurrence, giving the attacker password hashes that he can conduct a brute force attack against, often given him a list of passwords that will work on ...
8
votes
4answers
4k views

HMACSHA512 versus Rfc2898DeriveBytes for password hash

We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key The salt is 64 char randomly generated string. We allocated 2048 length on the database for the hashed base64 string ...
-2
votes
3answers
2k views

How to effectively save database password inside desktop application?

Suppose we are in the field of desktop applications which need to store their data in a database. How do I store the password for this database avoiding the most obvious mistakes, which are: 1) hard ...
4
votes
3answers
162 views

Do email clients reduce security?

I have recently taken a security course, and have learned a lot about, among other things, the way passwords are stored, etc. Afterwards I was thinking about the way that passwords are stored for ...
66
votes
3answers
21k views

How does Google Authenticator work?

Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent. It works without any connectivity; it even works on plane mode. This ...
0
votes
3answers
588 views

Why one time passwords using nested hash chain are not used?

I am wondering, why web sites do not use one-time passwords generated by hash chain. By that I mean that a client chooses a secret and after being salted, he applies some secure hash function F() on ...
5
votes
2answers
405 views

Masking password when typing vs hiding input when typing

There is a command-line application that interactively prompts you for your password to a third-party service. Whereas e.g. sudo completely hides your input as you type your password, this ...
11
votes
3answers
827 views

Do users of non-latin character languages suffer from spyware and trojans?

Do Chinese, Japanese, other languages that can't be represented in ASCII get their passwords stolen? I figure there can't be some sort of bruteforce attack software for them, right? Their characters ...
3
votes
3answers
2k views

Avoiding Brute Force Attacks in a Web Based Login Form

My login form uses Ajax so it doesn't need to reload if the password is wrong. A PHP script process the request and creates the session if the credentials are right. My idea is to have the PHP script ...
0
votes
2answers
122 views

Does hash solve passwords in parts?

From an answer this earlier question: Does adding dictionary words to passwords weaken them? "...you have no way to recognize it as a password before testing it (against a hash or an online ...
1
vote
1answer
390 views

Why are Lengthy Password Stronger Than Complex? [duplicate]

So all my life I've been listening to people tell me to make complex password: Upper / Lower / Numeric / Symbols. Recently though I've been reading / seeing that length above all seems to make for ...
5
votes
2answers
976 views

How often should passwords change?

I'm asking two very related questions As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their ...
5
votes
2answers
1k views

Web & insecure HTTP - Using RSA for encrypting passwords on the client side

I used client side password hashing in my register and login project. Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in ...
3
votes
1answer
152 views

Are there any uses of having a non-deterministic salt value for hashes?

So I've been toying with the idea of having non-deterministic salt values for hashes. Let me explain what I mean: Basically, I applied some properties from Bitcoin including a "difficulty" (ie, ...
3
votes
1answer
277 views

How to determine hashes/second in password cryptanalysis

I'm working on my dissertation concerning cryptanalysis on password hashes. As part of my research, I aim to crack a number of passwords with John the Ripper and rainbowcrack-mt. I'd like to ...
24
votes
3answers
2k views

Does password-protecting a server's BIOS help in securing sensitive data?

I'm running a server of which I protected the BIOS with a password. One doesn't have to enter this password before booting, but before entering the BIOS setup. I just did this from routine. However, ...
11
votes
1answer
442 views

“Please Enter Nth Character” without HSM

This question has been asked a few times, but always in the format "How does examplewebsite.com implement their 'please enter xth yth and zth characters of your password' function?" And the ...
2
votes
1answer
268 views

User Authentication API

I'm developing a web API for a user database that will be used to verify a given username / password combination is valid. I'm just looking for comments / criticism on the following method that I'm ...