Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

1
vote
1answer
47 views

Where to store hashes, salts, keys in Desktop Applications

I am trying to figure out where or how i should store application secrets and keys inside a desktop application. For example a facebook app key or dropbox key and secret. So I've read that i should ...
2
votes
3answers
111 views

Can I initially hash passwords with SHA instead of hashing them with bcrypt to decouple requests from slow crypto functions?

I'm using bcrypt for some web service requests that hash multiple passwords. The problem is that these web service requests can take minutes to complete due to bcrypt. Not very user friendly. My ...
1
vote
1answer
76 views

How is the username and password captured on this mobile device?

I have a Motorola phone, and I am concerned about my privacy after reading this article : http://www.beneaththewaves.net/Projects/Motorola_Is_Listening.html The poster says: For both of these ...
21
votes
6answers
2k views

Is there a use-case that renders the password manager obsolete?

Background Trevor posed a question about the nature and validity of using a password manager, given the current prevailing model of authentication on most web resources. Caveat: this is not the ...
2
votes
1answer
166 views

Secure database password stored in an env variable

I need to somewhere store my DB password on my production environment to access the DB. At the moment the prod system is deployed in the cloud, so is the DB. The password, the username and some other ...
1
vote
3answers
138 views

Will hashing passwords in my use case improve security and why?

I am developing an application the architecture of which is arranged as follows: Session host <---> Central relay server <---> Session client All communication between the initiating ...
1
vote
1answer
45 views

Why should I include a client_id in an OAUTHv2 password grant request?

Like little red riding hood, you don't know who is knocking on the door... Why even bother accepting a client_id in case of a API <-> Javascript-website or API <-> Android App password grant ...
13
votes
5answers
7k views

How can I avoid putting the database password in a perl script?

I have a cronned perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
21
votes
3answers
4k views

Security of LastPass + YubiKey

I'm looking at password manager solutions and came across LastPass. I see they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What are ...
38
votes
9answers
10k views

How long should the password be?

The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
2
votes
1answer
54 views

What is the best way to store passwords in OpenLDAP?

I would like to store user credentials in an OpenLDAP or similar directory server. A lot of online commentary about storing passwords in modern contexts recommends using password derivation schemes ...
16
votes
2answers
4k views

How big should salt be?

I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2). Having that in mind, how big salt should I use? Should it be ...
23
votes
4answers
2k views

Why do some sites block pasting into username or password input fields?

I use a few websites that prevent me from copying & pasting into the username or password fields. It's quite frustrating when using a password manager, and if anything I'd think it discourages ...
29
votes
6answers
7k views

Length of passwords that are rainbow table safe

With large computing power (like what you can get in the Amazon cloud for example) you can generate huge rainbow tables for passwords. There also seems to be some large rainbow tables reachable that ...
2
votes
2answers
125 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
2
votes
3answers
113 views

Is it safe to generate a password for a user during sign up in a web application?

I'm working on updating a web application. It currently creates a password for a user during sign up. Is asking the user to create the password themselves safer than relying on a generated password?
1
vote
1answer
104 views

How is password information stored and used on Android accounts?

How difficult would it be for someone who stole your device to gain access to the username and password information stored under the Settings -> More -> Accounts section of an Android device? ...
0
votes
1answer
28 views

Diceware & Database hosting [duplicate]

I'm currently setting up a new SQL database with DotEasy as my Hosting/Database provider. I've heard a lot about Diceware being one of the best methods of creating a really strong password, so I ...
9
votes
2answers
656 views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
-7
votes
1answer
84 views

How to attack on a web page to gain username and password? [closed]

In a situation where a web page is not using SSL and someone wants to attack to gain the username and password. How it can be done? Given the situations: Passwords are not stored in plain text. ...
1
vote
4answers
895 views

RatticDB for passwords is not encrypted. Is this good approach?

I am looking for a password application for storing passwords, and RatticDB have a web interface and SSH access is planned, which are exactly the features I am looking for. However, they write that ...
6
votes
3answers
6k views

Is it safe to store password in HTML5 sessionStorage?

I am trying to improve the user experience on registration by not requiring the user to retype their password if validation on other fields fail. There are a few ways to implement this, example using ...
2
votes
2answers
86 views

How significant is the risk in having someone email/IM an htpasswd hash?

I need to set users up for subversion access, and we're currently stuck using htpasswd for our credential storage. If a user sends me an htpasswd record via email (or GChat / off the record?), what's ...
1
vote
0answers
109 views

Deobfuscated Malicious PHP Code Comprehensively [closed]

I found 3 php files in a htaccess-password-protected upload folder on my server: 1. default_folders.php 2. factory.php 3. HMAC.php Each of them contains a variable string, eg: ...
12
votes
7answers
2k views

Why don't we reward users who choose strong passwords? [closed]

Suppose there is a web property that has some sort of reward system or commodity that its users desire. It could be reputation on Stack Exchange-like sites, rank badges on message boards, or add-on ...
2
votes
2answers
69 views

Password strength with grouping of characters

For better readability and easier entry of long passwords I thought it was a good idea to group these using a fixed separator like so: f6hyF.75zaG.FhtYb.1a63h Assuming this structure of the ...
1
vote
2answers
295 views

What impact do the frequency of password resets have on password reuse?

Wondering if there's any research behind the most common password reset cycle I've seen of 90-days, and if there's any research that gives any insight into how to optimize password resets to reduce ...
1
vote
1answer
85 views

Free VPN and bank password security [closed]

For some odd reason my online banking fails when on mobile data. It works fine on wifi. In times past I used nokia's Xpress browser to route it through their servers but it is no longer available for ...
0
votes
2answers
5k views

Hydra https-form-post

I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives. This is what I have done so ...
1
vote
1answer
73 views

Password-less authentication in web apps - How safe it is?

I read a long time ago this article about how could work a Password-less Authentication System, which sounded to me like a great idea. I even built it in a small fun little application for fun. To ...
2
votes
1answer
91 views

Plain text password emailed back during registration [duplicate]

I would like to ask if the passwords in the database are not encrypted if during registration I am receiving plain text password with username.
16
votes
3answers
2k views

Why do some bank websites use passwords that are not case sensitive?

It was recently brought to my attention that a certain big bank website allows users to log in with passwords that are not case sensitive. After confirming this, I checked other websites I bank with ...
3
votes
4answers
218 views

How do clients enroll using SRP?

From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
1
vote
1answer
105 views

Has anyone used this ICLOAK USB device? [closed]

Does anyone know about this ICLOAK USB device? Opinions or how well they work? I'm looking for a security solution when I'm using PCs where I work. Occasionally we have to log into to web sites, ...
4
votes
2answers
310 views

Password entry on OS X and keyloggers

There's several places in my ‘personal security infrastructure’ (is there a better phrase for that?) where I find myself typing very important passwords into text-fields on OS X (for instance, ...
48
votes
10answers
11k views

Why does the user pick the password?

Almost every web service I can imagine has the user pick the password. Why is this? Couldn't the system choose a better password? It doesn't have to be some complicated mess; see ...
23
votes
6answers
4k views

Source code as password

Passwords with a mixture of letters, numbers, and special characters are sometimes hard to remember. Is it secure to instead use a small amount of memorable source code as a 'passphrase'? As an ...
7
votes
2answers
325 views

An analysis of storing hints for passwords?

What are the security implications of asking users to provide password hints? What are best practices for storing user hints? What research has been done on using user-supplied password hints to ...
2
votes
2answers
100 views

Single-use password as the default authentication method?

The crazy password requirements (joke1, joke2) lead me to a situation where there is no way for me to memorize the passwords to the several sites that make those requirements. The result is that ...
4
votes
2answers
186 views

Is it safe to store a passphrase encrypted SSH key in git?

I have a bunch of servers that need to access somewhat sensitive data (passwords for ftps, api keys, etc). Currently I copy a plaintext file back-and-forth between the servers via ssh and encrypt all ...
2
votes
1answer
72 views

Securely storing passwords using PHP5

Starting note: After going through some articles and answers posted on SO related to storing secured passwords I'm still not sure whether my way of thinking is applicable to todays reality. I'm ...
4
votes
1answer
50 views

Countermeasures for a family-member attack on a password reset procedure

Given an account reset procedures, there are usually some recovery questions, and in better implementations a link will be sent to confirm the password change via email or SMS. Therefore, the attacker ...
31
votes
5answers
6k views

If a web site shows me what my password was changed to, is it stored as plain text?

I just changed the password on a school-related web site. After completing the change successfully, the next page showed what the password was changed to. Can I conclude from this that the password ...
4
votes
2answers
209 views

Password strength metrics

In the question Source code as password I suggested using a combination of entropy and as @Lawtonfogle put it 'meatspace difficulty'. As suggested in the xkcd comic correct staple horse battery is a ...
1
vote
2answers
51 views

Do I need to set maximum characters length for password using bcrypt?

I using bcrypt to create a password hash and in the php documentation it says Caution: Using the PASSWORD_BCRYPT for the algo parameter, will result in the password parameter being truncated to ...
23
votes
10answers
4k views

Password Management within an Organisation

Within an organisation there are many passwords such as those for root accounts on servers, hosting accounts, router logins and other such things, that need to be kept track of. I know in some ...
15
votes
6answers
4k views

Managing website passwords for small team

I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
3
votes
0answers
86 views

What is the most efficient password scheme in terms of entropy per convenience [closed]

Although the main points are right, but now six words are needed, which is both inconvenient to remember, and inconvenient to type. My question is, has then been any case studies on the most ...
0
votes
2answers
45 views

Full Disk Encryption, Single User System: User/Root Passwords required?

Are there any security issues of having no (or weak) passwords for user and root account on a single user system with full disk encryption (except boot partition)? Assuming no SSH server is running, ...
2
votes
1answer
61 views

Why use a password manager to protect browser logons when e-mail client is neglected?

Friends use password managers like lastpass or dashlane which have plugins for the browser, but not for the email clients (thunderbird or livemail). But surely the email password is the Achilles heel ...