Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
1answer
273 views

Question about a “Password Space” definition

I am currently reading the "Green Book" (http://csrc.nist.gov/publications/secpubs//rainbow/std002.txt) of the "Rainbow Series" and have a question on chapter "C.4 Password Space". From this ...
0
votes
2answers
152 views

Using the same base string for a password in several different logins [duplicate]

It is clear to me that using the same password for different websites is a bad idea because if an attacker manages to get a hold of your password, then he can gain access to the other websites in ...
0
votes
3answers
129 views

Best way to store passwords for a LAN tool?

I am making an app in Python for linux as a front end to the router (to automate some tasks). But I need to log in to the router before I can do any operations on it and since it uses a http-auth I ...
2
votes
1answer
112 views

Does it make sense to use two factor authentication with password protected wp-admin folder?

I've finished building my wordpress website and now, I'm concerned about the security of the website. To improve security, I'm using Google two factor authentication plugin while also ...
0
votes
1answer
203 views

Why is there a “show password” functionality in some login forms? [duplicate]

I've noticed that on a lot of login forms in websites and applications that there is a "show password" check box. Why? I myself have seen some hacks that an attacker could hack the input password box. ...
1
vote
3answers
445 views

Cracking passwords after a pattern with John

So I am trying to find out how easy it is to crack a password using some great Linux tools. We all know about John as a password cracker and how great it is. But how about specifying a pattern. ...
3
votes
1answer
128 views

Should an administrator be able to turn off TFA for a user

We use Google Authenticator and SMS for two factor authentication. Should we allow the administrators of the site to turn off TFA for users? Google Auth uses SMS as backup option but SMS does not ...
1
vote
0answers
29 views

How is password character validation in 3D secure is implemented? [duplicate]

We have a website which stores hashed passwords in the database. During logins we hash the password entered by user and compare two hashes. This is quite standard so far. Our client which is in ...
32
votes
7answers
2k views

How do I educate others about social engineering?

One of my friends used to boast about how long his passwords are. One day, I decided to play a prank and social-engineered it out of him. I was pretty surprised as to how effortless the entire ...
3
votes
1answer
1k views

Salt usage for Spring security?

I use the Spring security for Java web applications and I have written an authentication provider which is working without salt and now I want to either add salt or alternatively use the built-in ...
4
votes
1answer
159 views

Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks?

Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks? Reading the "What Are the Oracle Database Built-in Password Protections?" from ...
4
votes
1answer
95 views

Would siloing passwords into their own locked down schema improve security?

First off, I don't know how hackers get at an entire password table and steal them. I don't know if the owners of the website are to blame or what, but I am wondering if it involves logging into the ...
2
votes
0answers
243 views

What kind of attacks can be performed off a local network? [closed]

I have been working with programs like Kali Linux, Cain, etc., and I have noticed that for the most part the biggest password stealing attacks must be performed on the same network as the victim (for ...
1
vote
1answer
99 views

When is it appropriate to challenge with a secret word?

Lets say a secret word is say, the name of your first pet. Mother's maiden name is also a common one. When does it make sense to challenge the user with this? Or, what actions should be secured by a ...
1
vote
1answer
93 views

storing username/email and password with a hash of the hash of the email/password? [duplicate]

Quite the simple discussion this one (one would assume): If I'd hash the email and password, and then hash the hashes, whould this be considered safe enough or would this just be a waste considering ...
0
votes
2answers
168 views

Password management [duplicate]

I am work in small company. I am Java Developer and Sysadmin of remote servers. I have problem with store password from several servers. How to best way to manage passwords in company?
6
votes
2answers
522 views

Stolen Laptop - Next steps

My laptop (modded 2007 Macbook Pro) was stolen 2 days ago when I didn't pay attention to my backpack in a tourist spot in Europe and while I'm quite certain they won't have much use for it (the apple ...
5
votes
4answers
632 views

Can't brute force password cracking somehow be throttled?

Online articles mention the importance of a strong password and suggest that hacking tools allows bad guys to attempt millions of passwords per second. I am wondering why OSes and websites and such ...
5
votes
2answers
572 views

TPM- Symmetric key storage

I understand that the TPM can be used to store an unlimited number of keys. However I am left with a few questions: Presuming the TPM is connected on the LPC what protects the data travelling across ...
0
votes
2answers
225 views

How to retrieve the admin's password of a webapp?

I'm doing a pentesting example on a web app and I have dumped all the database. I have a table with the users in plaintext and the passwords hashed. I have to find the admin's password (I know that ...
1
vote
3answers
292 views

Should I trust my bank after this [closed]

I have just discovered that I can login to my bank with passwords that is not mine. Example: My password is "1234" but I am authorized with all possible post characters. For example "12345" or ...
16
votes
5answers
990 views

At what length does a password stop making sense?

I'm going to recommend that our users start using a password manager and start creating strong random passwords. Though I don't know what size of a password to recommend. Is it possible for a ...
-3
votes
2answers
294 views

Inform someone about a hacked account [closed]

I'm not a hacker but recently I was able to get someone's email password. I want to teach him a lesson to be careful when using internet and to pay attention to his passwords but I have some problems: ...
4
votes
3answers
703 views

Why not hashing and salting passwords?

When I was implementing my webapp, I decided to hash and salt users' passwords in order to protect them, even though I knew that there will never be a lot of them ... if any. Of course, I'm not saying ...
3
votes
3answers
606 views

Rainbow Tables: What is the Reduction Used for?

This is a follow up from this answer. The answer is very good, and it put me to thinking and doing some research. I have found another good explanation on this site. At some point, the author says: ...
1
vote
5answers
721 views

Authenticate user without knowing their password

I'm working on a project where each each user will have a public/private RSA key-pair. Users will be able to send encrypted messages to each other using the each target user's public key so that only ...
0
votes
1answer
158 views

Rainbowtable - Start with plain text [duplicate]

I know how to use rainbow tables. I've already read the other questions this topic here. Well but there is still one question left. As an attacker, I usually have a hash value of a password and ...
3
votes
4answers
13k views

A low tech yet secure way to keep track of passwords?

I use LastPass and love it. My girlfriend creates her own long, complex, unique, and thus difficult to remember passwords for every site. She frequently forgets them and has to rest the password. ...
7
votes
6answers
315 views

City Government Emailing User Name and Password

My city has online billing for utilities. When you set up an account they email your user name and password to you. You can't change your password without them emailing it to you again. Isn't this ...
6
votes
2answers
1k views

Does bcrypt compare the hashes in “length-constant” time?

I saw this function slowEquals() while reading Salted Password Hashing - Doing it Right, which uses a byte-level xor comparison to avoid timing attacks. I was wondering whether this is what Bcrypt ...
0
votes
2answers
306 views

Encryption method and other security concerns for a simple password manager [closed]

I thought I would learn a little bit of cryptography programming by making myself a simple password manager program that I can potentially even use to keep track of my passwords. The idea is that my ...
0
votes
1answer
299 views

company is sending md5 string via GET['password'] dangerous?

So, this big, reknown company (you all heard off) is sending md5 encrypted strings (with GET key: password) over HTTP. I accidentally came over it since I wanted to use jnlp on a non-windows ...
-1
votes
1answer
201 views

Password sending through network [duplicate]

In case of no TLS/SSL available, why can't I use the hash of the password (SHA512) as the key to encrypt the password (with out any salt) to send through the network ? MITM attacks I can understand, ...
4
votes
5answers
775 views

Use the hash of the password to encrypted password

I have a app which transmit the password in clear text. I was planning to use the hash of the password (SHA-512) as the key for encrypting the plain text password. Then send the encrypted text to the ...
7
votes
3answers
87k views

Wordlists on Kali Linux?

I notice that in /usr/share/wordlists in Kali Linux (former Backtrack) there are some lists. Are they used to bruteforce something? Is there specific list for specific kind of attacks?
1
vote
2answers
447 views

Do I need to salt PBKDF2 when it's used for AES encryption

If I'm using PBKDF2 to stretch a password into a suitable key for use in encryption with AES, should I be using a random salt (for PBKDF2, not the AES IV)?
1
vote
3answers
341 views

How to check if our clients were compromised by security breaches in other web applications?

Every now and then a known website is hacked, such as what happened to Adobe or Cupid Media. In such incidents user data is leaked, including usernames, encrypted (and sometimes plain text!) ...
1
vote
3answers
239 views

S/MIME doesn't protect against a stolen password, right?

We're setting up S/MIME so that we can send encrypted emails. However, I have a bit of a stupid (and maybe obvious) question... If someone steals a password for either the sender or the receiver, ...
2
votes
2answers
739 views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
19
votes
4answers
5k views

How secure is NOPASSWD in passwordless sudo mode?

On all our boxes we have ssh access via keys. All keys are password protected. At this moment the sudo mode is not passwordless. Because the number of VMs are growing in our setup, we investigate the ...
2
votes
0answers
66 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
3
votes
1answer
10k views

Where to download a list of email accounts hacked from Adobe? [closed]

Adobe announced they had been hacked and millions of user accounts and passwords compromised. These sites allow a search on email address to see if it was compromised: https://lastpass.com/adobe/ ...
4
votes
4answers
406 views

usernames and passwords

I was thinking about usernames and passwords and I was wondering how secure it would be to instead of the server having a list of usernames and accompanying hash of the passwords, just have a list of ...
3
votes
4answers
865 views

Should user's password strength be assessed at client or at server side?

Now most of big website like Google mail, Twitter, Facebook have a feature that assesses password strength (check number of digit, alphabet, special characters, or check the similarity over already ...
5
votes
5answers
340 views

Would this idea for a password be secure? [duplicate]

I was thinking about password security this morning. Mainly, about the recent adobe hack releasing thousands of passwords. The current problem with existing passwords is that you have three options: ...
-1
votes
3answers
341 views

help me about salting passwords

Eve has just discovered and decrypted the file that associates each userid with its 32-bit random salt value, and she has also discovered and decrypted the password file, which contains the ...
0
votes
1answer
123 views

Is MS-CHAPv2 incompatible with securely stored passwords?

I have a directory service that can speak a number of protocols and is used for user authentication. Currently user credentials are stored using Bcrypt to protect them in case of a compromised ...
9
votes
6answers
1k views

Is it useful to protect hashed password with encryption?

Imagine that I am hashing the users' passwords with a random, long enough, salt, using key stretching, and a secure hash. Would it be more secure to finally encrypt the hash with a symmetric key?
4
votes
1answer
1k views

OWASP Recommendation on Client-Side Password Hashing

The OWASP Application Security FAQ recommends the use of JavaScript to produce a salted hash of the password client-side with JavaScript prior to sending it to the server. Is this something truly ...
61
votes
9answers
61k views

How safe are password managers like LastPass?

I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long. How safe are password ...