Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

-3
votes
1answer
71 views

What type of hash is this MD4(MD4(($pass)).(strtolower($username))) [closed]

Can I decrypt this hash? Domain Cached Credentials: MD4(MD4(($pass)).(strtolower($username)))
8
votes
2answers
381 views

*NIX shadow file password format

I'm trying to get shell access to a router and have managed to retrieve its /etc/shadow file: root:$1$$N76hdwGfg11g0KdKbtyh21:0:0:root:/root:/bin/bash I've tried to use john to crack it but ...
7
votes
2answers
414 views

ProtonMail security concerns

This TED talk brought me here. First of all, to those who created ProtonMail: Nice job!!. Regardless of what people say, it's definitely a big step forward from tradition options like Hotmail, Gmail ...
-4
votes
2answers
62 views

How does the password become 30,000 times stronger?

This google support page says: For example, an eight-character password with numbers, symbols and mixed-case letters is harder to guess because it has 30,000 times as many possible combinations ...
12
votes
3answers
10k views

Can password-protected zip files be broken without brute force?

You have a zip file that you created with 7z to password-protect it with AES 128. Can a smart adversary extract the data only through brute force, or is the file vulnerable to other attacks - such as, ...
8
votes
1answer
67 views

Is Rfc2898DeriveBytes using HMAC SHA1 still considered “secure enough” for hashing passwords?

I've been told by a CISSP that the .NET class Rfc2898DeriveBytes would not pass a security audit today because it still uses SHA1. It's reliance on SHA1 - even with the iterations - leaves it too ...
0
votes
0answers
55 views

Windows Credentials - read password

What is the cipher used by windows Credential Manager to generate credentials backup files (*.crd)? With a backup file from Credential Manager and the password used to created that backup file is it ...
3
votes
1answer
88 views

Can OpenVPN monitor my passwords in my browser?

I want to know if I run OpenVPN when I want to log in to websites (like Gmail etc.....) is my username/password in danger? Can they monitor saved passwords in my browser or anything else? I'm new to ...
5
votes
3answers
180 views

Should I set a password for 'root'@'localhost' in MySQL?

The 'root'@'localhost' MySQL account can only be accessed by someone currently on the server hosting the MySQL server. Assuming that only the person or persons who are in charge of the MySQL server ...
3
votes
1answer
111 views

How to implement application-specific passwords using strong hashes?

I am implementing a service where application-specific passwords seem a good choice to improve security. A question on why and when they might make sense has already been discussed here Google ...
0
votes
1answer
157 views

Lock Windows to a specific app

Is it possible, using some program or application, to lock Windows 7 so only a specific app can be used, for example Word, until a password is entered? Thanks!
1
vote
1answer
743 views

How does a password authentication over a TCP protocol actually work?

When coming up with a password based login protocol, many solutions come in mind: User sends password in plain text. Compute hash on Server, compare to hash in database. - Bad because attacker can ...
2
votes
1answer
101 views

How much does knowing the zxcvbn password strength help an attacker?

On an answer to the question How critical is it to keep your password length secret?, Mike Ounsworth commented that by storing the zxcvbn-calculated entropy of a password you make it easier for an ...
2
votes
1answer
105 views

Where to store hashes, salts, keys in Desktop Applications

I am trying to figure out where or how i should store application secrets and keys inside a desktop application. For example a facebook app key or dropbox key and secret. So I've read that i should ...
2
votes
2answers
315 views

Secure database password stored in an env variable

I need to somewhere store my DB password on my production environment to access the DB. At the moment the prod system is deployed in the cloud, so is the DB. The password, the username and some other ...
2
votes
1answer
97 views

Is it insecure to provide a hash of an AES password?

I have made some software that encrypts and decrypts files using AES. I was wondering if it is safe to write a hash of the password to the file so that the program can check if a password is correct. ...
24
votes
1answer
2k views

Facebook password lowercase and uppercase

Recently I logged into my Facebook account and then noticed that my caps lock was on. So I tried to log in again with and without capslock on. I got in both times. Then I tried to log in with the ...
4
votes
4answers
347 views

Best way to store/retrieve sensitive key files?

We have our web servers running in AWS EC2. We have about 30 API Keys/passwords/etc (sensitive data) which is set in the environment for our app to use. Whenever we deploy, we start a new server ...
-2
votes
1answer
71 views

Is a ZIP file password easy to break? [duplicate]

I thought that ZIP file passwords were a fairly decent protection. I came across this video, that seems to indicate otherwise. https://www.youtube.com/watch?v=SqRSNuJSm4o [12 minutes view time] ...
4
votes
2answers
98 views

Reset links in password expiration emails

Our organization is rolling out yearly password expiration to our 40,000+ users this fall and we have been socializing this change for some time now. However being such a large organization, our users ...
5
votes
4answers
443 views

Bad password policy at my bank

I logged in to my bank tonight and was prompted that all customers were being forced to change their passwords for "security reasons". The policy for new passwords is: 6 to 10 characters, no special ...
1
vote
1answer
70 views

Why should I include a client_id in an OAUTHv2 password grant request?

Like little red riding hood, you don't know who is knocking on the door... Why even bother accepting a client_id in case of a API <-> Javascript-website or API <-> Android App password grant ...
19
votes
4answers
3k views

How secure is Snowden's MargaretThatcheris110%SEXY password?

In an extra from Edward Snowden's interview with John Oliver, Snowdon advises that a good password to use is one such as MargaretThatcheris110%SEXY.. Also, on the Errata Security blog, Robert Graham ...
-5
votes
1answer
69 views

Make really personalised wordlist file

i want to make a really customised wordfile with: 4 letters first + 2 numbers example: divo11 or yeve11 And not like this: p0oiw1 or u4hf3e This wordfile is really important. How can I do it?
6
votes
1answer
266 views

Any problems with scrypt yet?

In the question Do any security experts recommend bcrypt for password storage? Thomas Pornin recommends the hashing function scrypt but saying it is "too new to be recommended on a general basis". ...
1
vote
0answers
25 views

run runas in a shell [migrated]

I'm playing with a Windows 7 VM that I own. I started a reverse shell with ncat as listener. I can run commands except runas. Whenever I try to switch to another user I got prompted for the password ...
5
votes
5answers
592 views

How much is the entropy of a randomly generated password reduced if I regenerate until I get a password I like? [duplicate]

In many of the answers and comments on the well-known XKCD #936: Short complex password, or long dictionary passphrase? question, the importance was stressed of generating the password randomly, and ...
16
votes
2answers
1k views

Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML

It's clear there there is no consistent set of features among any of the popular authentication providers. Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
29
votes
7answers
4k views

Do non-keyboard characters make my password less susceptible to brute forcing?

I can put characters in my password for which there are no keys on a keyboard. On Windows, Alt+#### (with the numpad) inserts the character for whatever code you type in. When I put this in a ...
9
votes
4answers
7k views

How do online accounts get hacked?

How does your typical users run-of-the-mill Facebook/twitter/gmail/AIM/etc account get hacked? Is it simply a matter of a weak password? Are they typically the victim of phishing or other social ...
83
votes
11answers
12k views

How critical is it to keep your password length secret?

Is keeping your password length secret critical to security? Does someone knowing that you have a password length of say 17 make the password drastically easier to brute force?
5
votes
1answer
154 views

Is Django's approach to password reset tokens secure?

I am implementing a password reset feature for a web application and am contemplating adopting an implementation similar to Django. In a nutshell, Django creates a token who is comprised of a ...
1
vote
0answers
71 views

WifiPhisher not creating a fake access point

I recently came to know about WifiPhisher. To test it, I set up an access point using my Windows laptop and tried to obtain its password using this tool in my Ubuntu machine. So, when I run the ...
4
votes
3answers
515 views

Encrypted files storage. How to simplify the password management scheme?

It's probably dublicate but I can't figure out the correct keywords for search. You can help by just telling me those words, I'm rather good with Google :) I want to develop somewhat like file ...
4
votes
1answer
108 views

How to detect a database leak

Website keep getting hacked every day and every now and then we hear website owners react and tell "affected users that their password might had been compromised". Most sites that disclose such leaks ...
7
votes
3answers
2k views

How are leaked government credentials possible and what's the point?

In the wake of all these leaked/stolen/hacked government login/passwords being stolen it got me thinking. How is the leaking of these passwords even possible? Or are they of any real use? Aren't all ...
2
votes
1answer
75 views

Save Password length after hash to minimize calculation

Reading this topic How critical is it to keep your password length secret? following scenario comes to my mind: Assume I've a web application (PHP written using password_hash()) using salted password ...
3
votes
1answer
100 views

Bash scripting and password input

I am writing a bash script and prompt the user for his password. This password is supplied for either a local or domain account to query a MS SQL Server (using sqsh and freetds). How secure is the ...
2
votes
1answer
144 views

Dump linux password in clear text

Is it possible to dump a Linux password in clear text format? In Windows it is possible to do so using "Windows Credential Editor".
20
votes
4answers
3k views

How is Gmail susceptible to brute-force attacks?

In the Atlantic article "Hacked!" it says: My wife’s password was judged as “strong” when she first chose it for use with Gmail. But it was a combination of two short English words followed by ...
0
votes
2answers
214 views

Do WiFi passwords remain accessible significantly after logging in?

"... they'll go to the taskbar and look at the properties of the WiFi router to get the password." is a quote from another question on this site, and is in the context of WiFi passwords. The ...
2
votes
2answers
217 views

My Virgin Media account password is visible in plaintext to call center staff. What do I do?

Whilst on the phone to support staff (about billing) to Virgin Media, perhaps the largest ISP and telecoms company in the UK, I was asked to confirm my password over the phone. I asked the advisor ...
7
votes
2answers
274 views

Odd password scrambling algorithm

I'm researching an application that has password scrambling algorithm that I've not seen before. I generated a few passwords (the max. length allowed is 8 chars), and got the following results: ...
2
votes
1answer
225 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
31
votes
6answers
3k views

Does verifying identity by positions in passwords mean passwords are stored unhashed? [duplicate]

If authentication occurs by asking the user for the characters at certain positions in the password (such as: give the 3rd and 7th character in the password), does this imply that passwords are stored ...
2
votes
3answers
157 views

How secure are “pattern” passwords?

I was watching a TED Talk about password security recently which covers quite a few different types of passwords and compares how secure they are and how easy they can be remembered. One type of ...
1
vote
2answers
74 views

Is it Safe to Send an Invalid Password Back to the Client?

It is common for websites to remember the username input value after an invalid login attempt but not the password input value. Take SE for instance. When I attempt to login with an invalid password: ...
3
votes
3answers
169 views

Why do so many banks have relatively weak e-banking security? [closed]

I follow a few infosec-related Twitter personalities: Paul Moore, Taylor Swift, Troy Hunt are the main 3. Paul Moore is currently in the process of switching banks, frequently tweeting and retweeting ...
13
votes
5answers
23k views

How secure is WD MyPassport lock

I have a WD My Passport hard drive. There is an option that allows you to lock your hard drive with a password. How secure is this lock? They don't give details about the encryption algorith or the ...
1
vote
1answer
43 views

Should I show the security answer when the user goes back to edit the field?

So when a user signs up to create an account, they are required to select select questions and enter security answers. Once they do that, they can proceed forward to a review page that shows them the ...