Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

27
votes
3answers
4k views

Can I share what password hash function I used in a public report?

I have developed a web site during an internship, using a database with accounts. I used the crypt() method from PHP, with a secured algorithm plus salt (found on the web with a lot of feedback). ...
4
votes
8answers
808 views

Does it take longer to brute force a password starting with z than one starting with a?

I was wondering about the following: If someone tries to get my password with Brute Force, will a password starting with "a" guessed faster than one starting with "z" ? In this case assume the ...
835
votes
23answers
166k views

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are ...
4
votes
1answer
129 views

What technologies does ChromeOS use to secure saved passwords?

I have read that Chrome will use the system's native credential tools to manage saved passwords (e.g. KeyChain on OSX, libsecret on Linux/GNOME etc). Does anyone know what tools are used on ChromeOS?
2
votes
1answer
114 views

PHP BLENC extension security concern

PHP BLENC is a extension that allows PHP developer encrypt their code, protect their ideas and avoid illegal copy. Although BLENC allow developer to define the main encryption key in source(in the ...
7
votes
2answers
2k views

When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?

When you take ownership of a TPM in Windows 7 you encounter a screen like this: Based on this document, it is my understanding that completing this dialog box somehow results in the generation of ...
26
votes
3answers
6k views

Security of LastPass together with YubiKey

I'm looking at password manager solutions and came across LastPass. I see that they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What ...
27
votes
4answers
13k views

Confused about (password) entropy

There seem to be many different 'kinds' of entropy. I've come across two different concepts: A) The XKCD example of correcthorsebatterystaple. It has 44 bits of entropy because four words randomly ...
1
vote
2answers
65 views

Password storage in 1password and other similar password storing applications

My understanding of memory in a computer is that it is stored in blocks that are over written only when the computer finds it convenient. so if a program asks to write in a certain block rather than ...
2
votes
1answer
74 views

What encryption is used by 1password?

I use a password storage application on my Mac called 1password. I was wondering if it encrypts the data it stores on my computer and decrypts it using a key made from my "one password" or if it has ...
5
votes
2answers
872 views

Why is whatsapp using 6 digit codes for verification?

My question is kind a simple. Why does whatsapp use 6 digit codes to verify the device? They could also use 5 or 7+ digits and or alphanumeric characters. Are there any reasons they chose exactly 6?
8
votes
3answers
302 views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of one-...
1
vote
2answers
145 views

Security concerns of running auto-login script on server-side?

I would like to fetch data from a website to do data analysis on a server. Username and password are required for login to the website. Therefore I will need to run an auto-login script on the server. ...
-2
votes
0answers
18 views

How to make a excel file that will lock after one year from the date of enterinf password [duplicate]

I want to make a excel file that will lock automatically after one year.and there will beca password which can open it for next one year. Is it possible to make such type of file??
8
votes
4answers
365 views

Is autocorrecting typos in passwords secure?

Technology Review's Why Autocorrect for Passwords is a Great Idea says: New research shows those frustrations could be avoided using the same approach used to fix typos in text messages and ...
1
vote
1answer
82 views

Multi hash security [duplicate]

Is md5(sha1(pass)) more secure than md5(pass)? For example in case of sqli when an attacker can't get our hashing schema, brute force or dictionary attack would be much less efficient. Am I right or ...
-5
votes
1answer
129 views

Where do webstites store the hashes? [closed]

I understand that lots of websites store passwords in hashes but where do they actually store the hashes? How can a website compare your hashed version of a password with theirs? Is it stored ...
4
votes
1answer
99 views

Is it possible to use parallelism when computing a key derivation function for a single password/key?

Suppose I have an AES-256 encrypted file, and I want to derive the key using PBKDF2 and a given salt with a large number of rounds (say 1 million), but I'm limited by user tolerance for UI lag when ...
1
vote
3answers
114 views

Is it secure to send a password recovery link for company application to an employee's personal email address?

I would like to automate the recovery of the password for the employees of a company. However, the problem is that not every employee has a corporate email account and some employees can't access ...
62
votes
5answers
5k views

Do 2FA sites leak info by confirming a correct password guess?

Here's my relatively layman's view of the issue. Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly. ...
17
votes
6answers
3k views

Correct terminology when describing password security to layman

I am writing a page for our website which describes the measures we take to keep our customer's information secure. On this page one section describes how we keep their passwords secure. We are ...
0
votes
0answers
13 views

Password Managers — Generating Passwords On The Fly a Safe Approach? [duplicate]

Most password managers store user credentials for individual services encrypted on their own back-end databases, so that your passwords are available on multiple devices. So, a DB compromise on these ...
1
vote
2answers
129 views

What are the recommended steps involved in creating an encrypted file format? [closed]

I'm developing a pretty standard program which lets users save their work in a custom file format and reopen it later. Now I'd like to add the capability to encrypt the file using a user-defined ...
5
votes
3answers
122 views

Why are low-entropy passwords considered OK in many cases?

When talking symmetric encryption, a 56 bit key is known to be so weak. If you use it for your encryption, you are considered a goner as you wont survive brute-force. When talking passwords however, ...
-1
votes
1answer
124 views

How does one securely create a MySQL database and user via the command line?

I'm making an app whose functionality includes creating a database and its user. This is accomplished like so: mysql -e "grant all on database.* to 'user'@'localhost' identified by '$PW';" $PW is ...
23
votes
8answers
4k views

Patterned password, based on site name [duplicate]

I'm considering implementing a pattern for my passwords, using the following ideas: Master password that I store nowhere An algorithm to mangle it based on the site I am accessing So for example I ...
4
votes
3answers
541 views

Is it a good idea to use non-Latin Unicode characters in a password?

I've heard many suggestions as to what makes a good password (hard to guess, not a dictionary word or permutation thereof, at least a certain length, etc.) so that it cannot be cracked in a realistic ...
17
votes
5answers
3k views

Is this idea for a password manager secure? If so, why doesn't anybody use it? [closed]

I've been thinking of a problem with usual password managers: although they do provide better security than manually using passwords, there's a central database that can get lost, get compromised, etc....
87
votes
12answers
12k views

Is a 6 digit numerical password secure enough for online banking?

My bank went through a major redesign of their customer online banking system recently. The way security is managed across the platform was also reviewed. The password I am able to set now to log in ...
20
votes
3answers
4k views

Why do password creation/login screens hide the typed password?

I realize that the concept behind obscuring a password on a screen is to prevent someone "shoulder surfing" behind a user and seeing the typed in password. As a fairly good typist I have no problems ...
-1
votes
2answers
104 views

Secure password generation for different websites [duplicate]

I came up with the idea to generate passwords for internet sites by the following shema: $masterpassword $hostname $TLD hashfunction($TDL.$masterpassword.$hostname) So the actual password is a ...
205
votes
17answers
18k views

Passwords being sent in clear text due to users' mistake in typing it in the username field

Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
3
votes
2answers
125 views

Are password generators secure?

Here's a scenario that I often encounter: Some user needs access to something on my network, but they don't have an existing account in AD. I create an AD account for them which I then use to allow ...
0
votes
2answers
88 views

Password security in a Snapchat photo

This is going to be an extremely stupid question, so forgive my ignorance. Let's say I took a Snapchat photo of one of my passwords written in plaintext (let's ignore for a moment the security ...
5
votes
3answers
145 views

Does salting your own password improve security? [duplicate]

Let's say you were to add a couple of extra characters to your password, unique to each site you visit. The password would be largely similar except for a few characters of salt, possibly taken from ...
0
votes
1answer
133 views

Encrypt password with salt

Can anyone explain why formula 1 is safer than formula 2?I don't get it even I get the answer. According to 2, it says as s is in plaintext form, the attacker can decrypt the password by (y.s). Isn'...
9
votes
5answers
6k views

what are good requirements for a password

I'm making a website and I'm deciding on the password policy. What does make a good password? I really have no idea. I guess passwords should be at least 6 characters long. EDIT: are there any ...
0
votes
1answer
32 views

Securely stored secondary password

I'm currently writing a portal site for Microsoft Dynamic CRM, the portal works like this: Each user has his own account to login to my portal. Each user is assigned a seperate CRM credential by ...
7
votes
2answers
203 views

Why does Mozilla Firefox encrypt saved passwords?

If you ask Mozilla Firefox to remember the login details for a website, the credentials will be stored in your profile directory in Logins.json. Instead of storing plaintext values, the username and ...
2
votes
3answers
952 views

Is there a civilian friendly indicator of stored password safety?

As I understand it, by using one-way encryption we can protect stored password data in the event that they are stolen. Broadly speaking, password data can usually be cracked by guessing so the ...
433
votes
22answers
91k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
-3
votes
2answers
94 views

Will hashing a password, and then splitting it into multiple db fields increase security? [duplicate]

I've been reading up on Password hashing, and it seems like there is a lot of opinions on "What's right." I'm curious about the possibility of storing a split of a Hashed password in multiple user ...
2
votes
7answers
334 views

Does including the username in a password make it less secure?

Many registration forms prevent you from choosing a password that includes your username. Is it a reasonable restriction from security standpoint? I can see that if your username is "foobar" and ...
-5
votes
0answers
41 views

How does Apple stores Apple ID passwords?

The question is how does Apple stores passwords from Apple IDs? Does they store hash or use some other technologies? Didn't find any info.
-5
votes
1answer
50 views

Is possible to get password with stored XSS? [closed]

Is it possible to get password from a site with stored XSS? I have a forum where I can put JavaScript not directly but inside HTML (like <div onclick="alert()">CLICK</div>). Is it possible ...
-2
votes
3answers
83 views

Is there something other than “if” and “else”

There are many ways for protecting a password like using strong algorithms like SHA-512, using salts, encrypting the database where the password is stored, packing the license file with UPX etc and ...
2
votes
1answer
53 views

Will the Credential Management API now available in Chrome 51 be widely adopted?

Google Chrome 51 stable includes support for the Credential Management API. This implementation is based on the W3C spec. Will other browsers support this technology (particularly Safari)? Will web ...
1
vote
1answer
47 views

Challenge-Response Application in E-banking

Why is it important that Alice doesn't know K? What could happen if Alice knew K?
64
votes
4answers
8k views

Does Microsoft's “Password Ban” list insecurely store user passwords?

Supposedly, Microsoft is banning common passwords, and their list will dynamically update: Microsoft says it is dynamically banning common passwords from Microsoft Account and Azure AD system. [&...
0
votes
0answers
51 views

What is the right strategy for me to develop a paid public wifi?

I want to establish a paid public WiFi system. Here is my model of how it will work: I will install a public WiFi in my apartment. Using the WiFi system is paid but, voluntary. Those who pay me a ...