Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

2
votes
2answers
117 views

Is this login authentication safe?

I have been thinking of a way to authenticate users so as to pick out the users using cracked versions of my game from the people who have actually bought it. I came up with this idea: The client ...
2
votes
1answer
1k views

Should we block all plaintext authentication and require authentication over an encrypted channel?

Should we configure our servers to require the authentication happen over an encrypted channel and block all methods of unencrypted, plaintext authentication over? I recently configured my servers to ...
6
votes
3answers
519 views

Is it proper to be prompted that I entered an old password

I changed my Facebook password a few days ago. Today, I entered the old password chronically, and saw the prompt: Sorry! You Entered An Old Password And even shows the date&time when I ...
5
votes
2answers
3k views

Help understanding basic user authentication with salts and hashing

I for some reason am not understanding how to execute a secure authentication between client and server for a user. I've read many resources, and I understand how to use the hashing and salting tools, ...
3
votes
2answers
16k views

Remove Password Protection from XLS Document

Similar to what is listed here, http://datapigtechnologies.com/blog/index.php/hack-into-a-protected-excel-2007-or-2010-workbook/, is there a way to remove the password from an XLS (Excel 2003) ...
5
votes
2answers
490 views

Requiring regular password change but storing previous paswords?

My bank requires me to change my password regularly but then they can detect if my password was used before. They probably store the old password (possibly hashed) in order to detect it. I think this ...
6
votes
2answers
924 views

Production ready bcrypt implementation for .NET

Which, if any, .NET / C# bcrypt implementations are considered suitable for production environments? I have seen CryptSharp and BCrypt.Net mentioned in answers to other questions but without any ...
0
votes
1answer
95 views

What is a preferred method of security-conscious creation of login cookies [duplicate]

Possible Duplicate: Is it safe to store the password hash in a cookie and use it for “remember-me” login? I am working on a webapp that uses localStorage alone ...
3
votes
1answer
103 views

Password hashing on a load balancing setup

I've been doing some research into password hashing implementations and would like to know if it's feasible to have two servers hash passwords to the same database? I've come across the Bcrypt.net ...
4
votes
2answers
178 views

Did I miss anything when checking for passwords?

I was provided with a "challenge" forensics image of 2MB in size (floppy); they provide the disk image and want you to uncover as many passwords as you can find. I downloaded the image and dd'd it to ...
17
votes
6answers
1k views

Hash function change

I have user account passwords stored in a database using an unsafe (old) cryptographic hash function. What is the best/usual approach to changing password hash function? Only two ideas come to my ...
4
votes
1answer
383 views

Should password hashes be encrypted or HMACed?

Assume I am hashing user passwords with PBKDF2, bcrypt, scrypt, or some other secure key derivation function. Are there: tangible security benefits, precedents, and respected research for ...
3
votes
1answer
368 views

How strong are google's Application-specific passwords? [duplicate]

Possible Duplicate: Google Account: implications of using application-specific passwords In 2-step verification of google accounts, we need to use the Application-specific passwords ...
4
votes
2answers
241 views

How to prove a password guessing theory from Matt Bishop's book “Introduction to Computer Security”

First, this is not a homework problem. This is a problem from Matt Bishop's book "Introduction to Computer Security" which was used as one of the textbooks for a Computer Security class I took last ...
1
vote
4answers
519 views

Security implications of using a OAuth-enabled password manager

I've resisted the idea of password managers for a long time. Bringing together passwords for all your online accounts in one place that is only protected by difficult-to-remember master password ...
2
votes
3answers
131 views

How to make an outbound request to users to update their passwords?

Clearly it works best if the request to update a password happens as a response to an inbound request to access a known system, but how do you make an outbound request to users to update their ...
2
votes
1answer
6k views

Why it does not matter whether you type HEX or ASCII as WEP WiFi password?

I know that I can pass password in HEX as a keyphrase to WiFi network using WEP encryption as well as ASCII. But somehow you cannot get the ASCII when you only know HEX value. Can anyone explain the ...
2
votes
0answers
75 views

How can a service shorten a password if it is not stored in plaintext? [duplicate]

Possible Duplicate: How can Microsoft validate a shorter password on Microsoft accounts (MSDN)? My Microsoft password was 18 characters long and when I updated to Outlook.com it started to ...
6
votes
3answers
332 views

How can Microsoft validate a shorter password on Microsoft accounts (MSDN)?

I recently ran across this when logging into MSDN. (I saw this screen after typing my initial credentials.) I have a 20+ digit password, however there's apparently a new requirement for Microsoft ...
2
votes
1answer
129 views

IKEv2 in remote access scenarios

Can someone explain why, in remote access scenarios, IKEv2 EAP password-based user auth combined with IKEv2 PUBKEY gateway auth is preferable over mixed IKEv2 PSK/PUBKEY auth using the same password ...
2
votes
2answers
3k views

Is it safe to store password in PHP session?

I need to do some encryptions in the private zone of my website and I want to bcrypt the user's password. Is it safe to store the password in the session when user does the login, so that I can use ...
3
votes
2answers
328 views

From password to key

Can you explain this passage from Wikipedia? When a password (or passphrase) is used as an encryption key, well-designed cryptosystems first run it through a key derivation function which adds a ...
2
votes
2answers
157 views

Bad planning causing weak passwords

The athletic department at my university has a facebook page and on it they said "the first 500 people to register for this event will get free t-shirts". When registering one has to create an account ...
5
votes
4answers
1k views

Password Vault - Enterprise

I want to be clear from the get-go that I am NOT looking for a user password management solution. My organization already uses AD for that. What I am looking for is a password vault. Up until now, ...
3
votes
1answer
621 views

Why do some large companies still store passwords in plain text/decrypt-able format? [closed]

In the last couple of weeks I've come across two fairly large companies who seem to not have stringent password security: Tesco - they store passwords in an "encrypted" format, yet they can decrypt ...
4
votes
2answers
239 views

What steps can you take to make offline cracking of SRP harder?

In the aftermath of the Blizzard hack, what steps can I take to make offline cracking of SRP more difficult? My question assumes that your database is already gone and that you implemented SRP more ...
3
votes
4answers
614 views

SMS Authentication: random OTP or a cryptographic one

I'm adding two-factor authentication using SMS to enhance an existing login process. Since I'm not working with physical tokens, I was wondering what is considered the safest: Sending random 8 ...
5
votes
6answers
2k views

Does having a minimum number of digits improve password security?

Some password systems will enforce at least X of a type of character - a common one I see is 'minimum 3 numeric characters'. As far as I understand, simply allowing certain character classes, like ...
8
votes
4answers
4k views

HTTP Basic auth password storage more secure than Digest auth

If you are using SSL already, it appears Basic auth is the way to go since you can perform bcrypt with the password when you store it in the database, where as Digest auth only allows md5. As we know, ...
0
votes
1answer
154 views

How can I prevent my son accessing my PC? [duplicate]

Possible Duplicate: How can I prevent my kids from bypassing my computer restrictions based on Windows Vista? My 14 year-old son is using a Ctrl+Alt+Del procedure to get into my computer ...
8
votes
4answers
3k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
18
votes
4answers
5k views

Google Account: implications of using application-specific passwords

In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google ...
1
vote
3answers
262 views

For what do I hash user passwords with PDKDF2 when the user data is stored in the same database?

I'm hashing the passwors of my users with PDKDF2 right now. A user can gain access to his account with his password. When the user is logged in he can edit his personal information and do other stuff ...
10
votes
4answers
1k views

How secure is the SRP that Blizzard uses to protect passwords?

Blizzard very recently announced that their network was compromised, but they assure users in their statement that the password information that the attackers had access to was saved in a secure way: ...
1
vote
6answers
531 views

Why does the password field not show the entered text?

Why does the password field not show the entered text? When we enter password it shows ... or '*'. What are the security advantages of this?
7
votes
2answers
575 views

Replacement for One Time Passwords (OTP)

OTP may known as new generation of password security techniques, but I want to know does it still safe enough after several years of appearance or it will deprecate soon? & what would be the ...
3
votes
3answers
455 views

How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)

After the hack of Mat Honan I studied my own laundry list of accounts I have at the numerous web sites I use. There is one fact that stands out: Many of the websites severely restrict the size and ...
6
votes
8answers
1k views

Does truncating the cryptographic hash make it impossible to crack?

I store password hashes in their full value for example, $h = sha256('foo') outputs 64 characters: 2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae I store that directly in the ...
8
votes
4answers
585 views

Is storing answers to security questions in plain text bad form?

If the input for the security question is completely digital, should the answer to a security question be hashed (or at least encrypted) on the authentication server?
16
votes
4answers
4k views

Password resets - what practices should web services follow?

Many of you may have seen How Apple and Amazon Security Flaws Led to My Epic Hacking, where a Wired reporter's Amazon, Apple, Gmail, and Twitter accounts were successfully hacked. The hacker followed ...
3
votes
4answers
527 views

Can public keys be a security risk when performing password-less SSH logins?

Some companies use monitoring software such as nagios or icinga. In order to perform checks on the servers, they often need password-less SSH logins. The servers being checked put the public key of ...
2
votes
2answers
5k views

Sample challenge questions for use with self service password reset and validation

I'm building a secure password recovery feature similar to the one described here. During the final phase of the password recovery, the user is asked a recovery question to verify their identity. ...
1
vote
1answer
388 views

Securely tell the user his password in new WHM/Cpanel account creation?

I understand it's not safe to send passwords via email but when accounts are created via WHM/Cpanel, I have to let the user know what password I created for them. How can I relay the password safely?
8
votes
2answers
607 views

Is there more to password hashing?

You have a plain text password and salt. The plain text password is assumed to be securely random and only known by the user and the salt is no secret and not necessarily unique but stored alongside ...
2
votes
1answer
324 views

How can passwords be stolen from Yahoo?

I always understood that servers don't actually store user passwords. Instead, they store hashes of passwords and then they validate the user input by applying the hash function, then compare the ...
5
votes
3answers
352 views

Are there any regulations against financial companies storing passwords in plaintext?

A bank that I use stores my password in cleartext or perhaps using reverisible encryption, which is just as bad. I know this because when you click "Forgot your password?" (or similar) link, it ...
11
votes
2answers
3k views

With PBKDF2, what is an optimal Hash size in bytes? What about the size of the salt?

When creating a hash with PBKDF2, it allows the developer to choose the size of the hash. Is longer always better? Also, what about the size of the random salt? Should that be the same size as the ...
53
votes
5answers
13k views

Is sending password to user email secure?

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?
1
vote
3answers
290 views

Logic for generating Strong Password?

I try to encrypt password using MD5 but there are decoders for MD5. So I'm worried about encryption of password for big website. Is there any logical suggestion or step function to generate strong ...
11
votes
3answers
2k views

Why are passwords limited to 16 characters?

What is the reason that most websites limit to 16 characters? I would have thought the longer the password the more difficult it makes it for someone to crack it? Is it something to do with hash ...