Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
3
votes
1answer
136 views
How to determine hashes/second in password cryptanalysis
I'm working on my dissertation concerning cryptanalysis on password hashes. As part of my research, I aim to crack a number of passwords with John the Ripper and rainbowcrack-mt.
I'd like to ...
18
votes
3answers
608 views
Does password-protecting a server's BIOS help in securing sensitive data?
I'm running a server of which I protected the BIOS with a password. One doesn't have to enter this password before booting, but before entering the BIOS setup. I just did this from routine. However, ...
9
votes
3answers
1k views
Cracking MS-CACHE v2 hashes using GPU
As most people here will know, Windows caches domain/AD credentials in a format known as MS-Cache v2. Obviously, these would be excellent passwords to gain during a penetration test when local access ...
11
votes
1answer
218 views
“Please Enter Nth Character” without HSM
This question has been asked a few times, but always in the format
"How does examplewebsite.com implement their 'please enter xth yth and zth characters of your password' function?"
And the ...
3
votes
3answers
581 views
Choosing a session ID algorithm for a client-server relationship
I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
2
votes
1answer
96 views
User Authentication API
I'm developing a web API for a user database that will be used to verify a given username / password combination is valid.
I'm just looking for comments / criticism on the following method that I'm ...
5
votes
3answers
2k views
With ASIC bitcoin miners, should SHA256 be considered insecure for password hashing?
I'm sure everyone here has seen the rise and further rise of bitcoin. The process used for mining bitcoin is basically "let's brute force an SHA256 hash that is less than this amount"
That being ...
1
vote
1answer
144 views
Can accounts still be logged onto if Password Caching is not enabled?
This is kind of an extension of my other question.. If you were not storing any of the passwords locally (caching disabled), would a user some how still be able to circumvent around this security ...
4
votes
3answers
634 views
How can I report PCI-DSS violations?
A large supermarket chain in the UK, are storing their passwords in plaintext. Apparently, Mastercard's security department are already involved. I'd like to report them for violating PCI-DSS, since ...
25
votes
8answers
2k views
Why would salt not have prevented LinkedIn passwords from getting cracked?
In this interview posted on Krebs on Security, this question was asked and answered:
BK: I’ve heard people say, you know this probably would not have
happened if LinkedIn and others had salted ...
11
votes
3answers
311 views
How to manage team passwords?
How do most teams handle the storage of passwords, in particular the required changes when team members leave ?
Right now, we use a centrally stored encrypted file but the thought of changing 100's ...
-2
votes
1answer
78 views
Why should I use the VPN? [closed]
Does a Virtual Private Network (VPN) provide an encrypted connection from outside networks or from ISPs to the internal network?
3
votes
1answer
104 views
Why regenerating a password's hash?
I've read http://alias.io/2010/01/store-passwords-safely-with-php-and-mysql/ on how to store passwords using PHP and MySQL, the secure way. Elbert says:
Use a cryptographically strong hashing ...
8
votes
6answers
11k views
Is howsecureismypassword.net safe to use?
Is it safe to enter my real passwords to test them?
I mean, are the entered passwords being recorded/transmitted to someone else?
5
votes
6answers
283 views
What's the most secure technique for authenticating user in a website?
I usually ask user for his username and password and run a query over database to return true or false, do you think it's secure enough? do you think it's better to add some steps to procedure?
2
votes
5answers
538 views
Why have username AND password? [duplicate]
It seems most security mechanisms nowadays default to a username + password combination for authorization. I want to know why there are 2 "keys," if you will. Won't one credential suffice?
Put ...
3
votes
1answer
83 views
How does VTP authentication prevent unauthorized access (Can the password be cracked given captured packets)
I know that when setting up VTP across switches in a network you should set a secret/password to prevent unauthorized requests. My question is I know that this uses an MD5 hash to ensure that ...
6
votes
2answers
608 views
Stretching a hash, many iterations versus longer input string
I have been reading up on various password hashing schemes, for example the SHA-based Crypt proposed by Ulrich Drepper and used in some Linux versions.
A recurring theme here is to 'strengthen' or ...
6
votes
3answers
194 views
What is the value in asking for a second password for sensitive operations?
When a user has logged in to a system using their primary password, is there any value in asking for a distinct second password when performing sensitive functions?
Does it provide any benefit over ...
0
votes
2answers
98 views
Does excluding username letters from passwords increase security?
Recently I was asked to change a password, along with a password policy which reqires you to use a digit, a special character and a letter, but forbids any letter from you log in name to be used for ...
15
votes
6answers
536 views
Is there additional security value in using passwords with words or phrases in non-English languages?
I was thinking about correct horse battery staple. I am not a native English speaker. In my language, the above could be written as:
vqrno kon bateriq telbod OR
вярно кон батерия телбод.
Keep in ...
6
votes
3answers
229 views
Increase the security of an already stored password hash
Right now we're using 1024 byte PBKDF2 with 256 byte user-specific salt and variable iterations. However, I would much prefer to be able to, perhaps once every year or two, to be able to flat out ...
18
votes
5answers
705 views
Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?
I just wanted to know if you can increase the cost (iterations) of those two algorithms off-line.
I want to increase the cost every year of my users passwords.
One solution is to recalculate them ...
11
votes
4answers
451 views
Handling passwords in a web application
I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client ...
2
votes
0answers
38 views
Is it the default in billing systems to send out the users password by email? [duplicate]
I recently made a complaint to a company about them sending out passwords in plain-text via email upon registration knowing that it is a potential security risk.
One of their employees responded with ...
211
votes
13answers
36k views
What technical reasons are there to have low maximum password lengths?
I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites I actually care about ...
20
votes
8answers
1k views
Why improvising your own Hash function out of existing hash functions is so bad
I'm afraid I'll have tomatoes thrown at me for asking this old question, but here goes.
After reading that cooking up your own password hash out of existing hashing functions is dangerous over and ...
7
votes
4answers
188 views
When changing a password using a WebPage, must the old password be entered on the same screen?
There is a convention to always prompt for the old password on the same page as the one where the old password is being changed as shown below.
Is it acceptable from a security perspective to allow a ...
17
votes
4answers
971 views
When hashing passwords, is it ok to use the hashed password as the salt?
I don't like this idea. But I can not come up with a technical argument against it. Can somebody explain it to me? The basic idea is:
$passwd = 'foo';
$salt = hash($passwd);
$finalHash = hash($passwd ...
1
vote
1answer
198 views
Use brute force to mitigate brute force
Just an idea I had, and I am sure there is a lot of material about this subject, so I am looking for a pointer as to where I can find more information.
My idea is this...
When storing a password in ...
7
votes
3answers
198 views
Is a password in the clipboard vulnerable to attacks?
I see situations where you may have to input the same password more than once. You may type it in a text editor and copy it to clipboard, to paste it two or more times.
In what scenarios this could ...
5
votes
4answers
304 views
Why using random salts?
I read this blogpost on how to store passwords in a database, the secure way. Elbert tells us to do this:
Generate a random salt and include something random and the username in it. Hash this.
Hash ...
-2
votes
2answers
200 views
How to secure passwords when site is opensource [duplicate]
Possible Duplicate:
How to securely hash passwords?
How can I store passwords to have them secure? Right now the site use md5 md5, I was thinking about sha1+salt but if the source code for ...
2
votes
1answer
428 views
How long it will take to crack a RAR password?
I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we ...
1
vote
2answers
1k views
Storing passwords online using Gmail documents
Following this discussion about "Online Passwords Managers" I wonder whether it is a good idea to store the passwords using a spreadsheet inside Gmail documents? I mean, it seems to me that these ...
2
votes
2answers
155 views
user authentication by decrypting a random blob
Normal user authentication is done by comparing "hash"-values. A simple example of this:
The user password is hashed with PBKDF2 on the client using a salt (the salt is the hash of the user password ...
1
vote
1answer
38 views
Parameters in output of password hashing function
A number of encryption functions include their tuning parameters in the output. For example, SCrypt, which I've been considering for an app I'm building, outputs in the following format:
...
19
votes
3answers
974 views
Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers?
I just saw for the first time a new way to enter a password, at the Banque Postale (French Bank). You are given a virtual numeric keyboard and to type you can just leave the mouse cursor over a number ...
10
votes
2answers
284 views
Zip file with two password
I used this command to password protect a zip file on Linux :
zip -P 9000 hash.zip hash.py
and it creates the zip file just fine, then I wrote a program to test every possible password on it from 1 ...
2
votes
1answer
117 views
UUID and Open_id in cookie 'good' enough?
I am using Tomcat 7, jsp to build a small website. I am new to security and it is a school project so using Spring Security is not an option. I am attempting to store UUID and Open_id in the clients ...
7
votes
4answers
815 views
Why does getting a password wrong takes more time than not
I type my password to login to Win or Linux.
Case 1: I get it right. Almost instant reaction.
Case 2: I misspelled it. It takes a while, and then rebounds.
Why does it takes longer to identify a ...
5
votes
7answers
466 views
How easy is it to find a password in a huge text file?
Say that my password is PASSWORD1 I have a 10MB jumbled text file. I hide my password in two parts in the text, between > and < so I can find it myself. Then I put the 2 parts together and add the ...
4
votes
1answer
139 views
Reducing password length with hash function
Suppose I would like to use a very long string as a password. As an example we can just say this string is 100 characters in length.
However, suppose the application for which I would like to use ...
13
votes
2answers
257 views
Concrete figures on password cracking in the wild
While password guessing is a science, not every attacker out there is up-to-date with the latest advances or cares to invest in GPUs or FPGAs.
It's easy enough to test online password guessing ...
371
votes
20answers
57k views
XKCD #936: Short complex password, or long dictionary passphrase?
How accurate is this XKCD comic from August 10, 2011?
XKCD 936: Password Strength
I've always been an advocate of long rather than complex passwords, but most security people (at least the ones ...
2
votes
2answers
68 views
Is there any way of recover a locked drive using TPM?
Just reading I learned about the TPM technology and how it works.
However, it make me wonder... if the motherboard crashes, is the data lost forever? Because you can't use the drive in other system ...
10
votes
2answers
965 views
Why are GPUs so good at cracking passwords?
What is it about GPUs that lets them crack passwords so quickly?
It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
0
votes
1answer
105 views
Recover password or password hash from locked acount.
I have a locked administrator account. Other accounts is unlocked, but it has no rights. I want to get a password from the locked account, or maybe password hash, if possible.
168
votes
13answers
27k views
Are passwords stored in memory safe?
I just realized that, in any language, when you save a password in a variable, it is stored as plain text in the memory.
I think the OS does its job and forbids processes from accessing each other's ...
3
votes
1answer
91 views
Can a user's Apple Keychain be opened on a different computer?
Apple uses a nice keychain. This is used by, for example, Google's Chrome browser.
Imagine a user copies all the keychain files.
Would that user be able to unlock the keychain, if they knew the ...
