Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

1
vote
1answer
313 views

How to crack SHA512 hexdigest passwords with John the Ripper?

I've been playing with John The Ripper (JtR) to try to crack/audit a salted password that was hashed with SHA-512, with 20 interactions according to the source (for the curious, this is a Rails app, ...
21
votes
3answers
2k views

Is there any advantage to splitting a password?

I've been reading about the LANMAN (LM) hash and I'm curious about a particular part of the algorithm. The LM hash is computed as follows: The user’s ASCII password is converted to uppercase. ...
29
votes
8answers
1k views

Who is responsible for the strength of user's passwords?

Who is responsible for a user's password's strength? Is it us (developers, architects, etc.) or the user? As a web developer, I've frequently wondered whether I should enforce the minimal password ...
0
votes
1answer
44 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
1
vote
0answers
30 views

Does whosthere.exe of pth toolkit have to run with administrative rights?

To see the users that are connected to the machine and they're pass hashes with Whosthere.exe, do I have to run it as an administrator?
0
votes
1answer
39 views

How does LM hash deal with passwords that are between 8 and 13 chars

If its 14 then it splits it to 7&7, but how about 13 characters? 7&6? How does it work?
19
votes
5answers
2k views

Do non-keyboard characters make my password less susceptible to brute forcing?

I can put characters in my password for which there are no keys on a keyboard. On Windows, Alt+#### (with the numpad) inserts the character for whatever code you type in. When I put this in a ...
4
votes
3answers
531 views

How often should I reset my salt?

I'm thinking of implementing a salt recycling scheme on my user credentials database. The motivation behind this decision is that even if the attacker manages to get his hands on the database and has ...
1
vote
2answers
145 views

Storing database password in application

Let's say my application connects to my database. This requires me to have the username and database in my config as follows: postgresql://scott:tiger@localhost/mydatabase I have an automated ...
2
votes
2answers
7k views

Excel 2007 Encryption Strength

With a strong password of 10+ characters, mixed case, etc... Is the encryption of a Excel 2007 document secure enough to create reasonably strong defense against a brute force attack? What encryption ...
3
votes
2answers
14k views

Remove Password Protection from XLS Document

Similar to what is listed here, http://datapigtechnologies.com/blog/index.php/hack-into-a-protected-excel-2007-or-2010-workbook/, is there a way to remove the password from an XLS (Excel 2003) ...
-1
votes
4answers
136 views

How do big companies and wealthy people secure their information? And how can I secure mine?

I've recently had some success and traffic increase with an online business I own and due to that someone has hacked my domain email and twitter accounts. My bank password is the same and I just ...
11
votes
7answers
6k views

Are services like “LastPass” less secure, as they have all my passwords protected by a single password?

If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security?
2
votes
4answers
193 views

How does a system authenticate a user using a hash function, after it has been salted?

I don't really understand how salting works. I read the Wikipedia article, but I still don't understand how can a system authenticate a salted hash? Let's say a user chooses a password. It's randomly ...
94
votes
7answers
6k views

Why are salted hashes more secure?

I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters). My ...
1
vote
3answers
12k views

Wordlists on Kali Linux?

I notice that in /usr/share/wordlists in Kali Linux (former Backtrack) there are some lists. Are they used to bruteforce something? Is there specific list for specific kind of attacks?
0
votes
1answer
89 views

What are common problems that reveal PHP code? [closed]

What is the best method for securing PHP scripts that contain database passwords? From what I've read, PHP can be revealed when an error occurs and is not caught. Is there any way to reveal PHP by ...
3
votes
4answers
288 views

True?: “Nearly all encrypted passwords are stored with the last character in clear text”?

[S]ome passwords are gleaned by hacking into computers where intruders can find stored passwords. Those are stored in encrypted form, but there's software that can attack the encryption. Nearly ...
3
votes
4answers
232 views

When and where do I hash a password?

Say I have a client and a server. I want the user with the client to login to the server with a username and password combination. To login, they have to enter the right password which (when hashed) ...
6
votes
5answers
697 views

Is storing plaintext passwords for email accounts any less bad? [duplicate]

I recently found out that the company I use for shared hosting stores passwords for email accounts in plaintext (they mentioned this to me incidentally, while troubleshooting another issue). They're a ...
10
votes
3answers
525 views

How can I promote good password practices in an organization that doesn't currently care about that?

I work with an organization that uses some very poor practices such as using default user accounts, default passwords (or passwords the same as user accounts), sharing password information between ...
3
votes
1answer
58 views

Webpage sent me my password in clear text can it be secure? [duplicate]

I registered for a webpage years ago and have been using it without issues, today I made some changes to my account and they sent me an email containing my username and password in clear text. I ...
2
votes
1answer
82 views

File Fault 1 password from memory dump

I have a osx 10.9 machine with a File Vault1 encrypted user partition. I would like to remove the encryption, but I don't remember the "master key" which is the only way to remove encryption ...
0
votes
5answers
1k views

Pronounceable Password Generator

I am currently looking for a password generator which produces pronounceable passwords. I have used this random password generator a few years ago to generate a 42 characters long password and found ...
2
votes
2answers
64 views

Why use PBKDF2 over multiple iterations of a another cryptographic hash function?

People often recommend PBKDF2 over using hash functions directly, but typically they compare PBKDF2 to a single unsalted hash. What advatages are there to using PBKDF2 over multiple iterations of a ...
2
votes
5answers
213 views

Password Recovery - what if user can't complete 2nd step?

I'm thinking out my password recovery logic for an ecommerce system. Some backround: Passwords are stored using bcrypt, password recovery involves the standard reset link, which then can be used to ...
1
vote
1answer
51 views

FIPS 140-2 C# Password Hash

Is the following algorithm, using RNGCryptoServiceProvider & Rfc2898DeriveBytes, sufficient to implement a FIPS 140-2 password hash on Windows Server 2008R2? var provider = new ...
4
votes
3answers
2k views

What are the odds of brute-forcing an archive with 256-bit encryption?

I have a file (a stand-alone archive). I lost the password to it, but it has been encrypted using 256-bit encryption. The password is some 20-odd characters long (including non-alphanumeric ...
109
votes
5answers
9k views

Does Facebook store plain-text passwords?

I was about to reset my Facebook password and got this error: Your new password is too similar to your current password. Please try another password. I assumed that Facebook stores only password ...
8
votes
3answers
409 views

Should I reject obviously poor passwords?

UPDATE: My questions and concerns below boil down to: "Should I reject obviously poor passwords like 'hellomydarling' or 'password'? My guess is yes and I want to know to what extent. I'm using a ...
1
vote
3answers
139 views

What are the possible rules to identify password sharing- to prevent fraud

I am trying to build correlation/ potential red flag rules to detect if passwords are being shared or stolen... the primary driver for this is guidance from our compliance team, that much of our ...
13
votes
1answer
918 views

Why does Facebook bother comparing old and new passwords?

An answer to this question says Facebook generates a bunch of password guesses to see if they hash the same as a previous version of the password. Why bother? If a service forces every password to ...
2
votes
2answers
232 views

Is this password generator safe?

128-bit entropy is required http://nxtra.org/nxt-client/js/passphrasegenerator.js With all new browsers (Chrome, Firefox, IE 11) it uses crypto.getRandomValues which should be safe, but with IE 10 ...
3
votes
1answer
149 views

Safe ways to store passwords without hashing them

I'm working on an email client for Windows, and to send emails, my application needs to have the email address and the password of that email address. When the user gives his password, I store it ...
-2
votes
2answers
94 views

Hydra https-form-post

I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives. This is what I have done so ...
0
votes
2answers
87 views

If P=NP, what is still cryptographically secure? [duplicate]

I know, I know - "If P=NP" is a really large, high-impact assumption. But this is a hypothetical. I mean, clearly RSA (and similar methods of obfuscation) would likely become totally irrelevant - or ...
4
votes
3answers
129 views

Why is password strength often underestimated and uncertain in the context of password hashing?

An aspect of security has bugged me for a long time: Why is there positive certainty about the importance of hashing algorithms and salts, but password strength is either never mentioned at all or ...
1
vote
1answer
79 views

Passwordless login over email - security considerations

I'm proposing the use of a login system that sends a one-time login token (with high entropy) via email to the user. After using the token, the user receives another token via email and the previous ...
0
votes
2answers
58 views

Logging in after password reset email sent (but not acted on)

Should a user be allowed to request a password reset email and then log in (i.e. disregarding the reset email and using their existing password) or should the current account be locked until the ...
1
vote
3answers
198 views

Is Salt, IV and Key necessary when encrypting password in a database using AES? If so, how should they be used?

Imagine I have a website with user accounts. I want to authenticate users, so I need to know if the password they provide matches the one stored in my database. To protect the passwords from prying ...
4
votes
2answers
97 views

Should I set different passwords for different Wi-Fi bands?

My new router supports both the 2.4 and the 5 Ghz bands, and it obviously allows me to set a different password for each of them. Now, since cracking just one of the two means that the attacker would ...
6
votes
2answers
346 views

Detecting Pass-the-Hash

I was wondering what you guys are doing to detect attacks like Pass-The-Hash within your network. I've read about Breachbox ...
6
votes
8answers
1k views

Does truncating the cryptographic hash make it impossible to crack?

I store password hashes in their full value for example, $h = sha256('foo') outputs 64 characters: 2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae I store that directly in the ...
1
vote
3answers
103 views

Are some passwords more vulnerable to password crackers?

Suppose I have a password made of n alphabetic characters. An attacker is given the hashed password and will attempt a brute force attack on cracking it. I can envision a naive password cracker ...
15
votes
3answers
401 views

Storing passwords in reversible form - a genuine use-case

What's wrong with you, you crazy fool, you're not supposed to be able to retrieve a password in plain text! I know. Hear me out. Assume I've got a service that's similar to Mint.com. For those that ...
2
votes
2answers
168 views

What are the benefits to a two-page login system for a webapp?

I have noticed many website going to a two-page (not two-factor) login system - where you enter your username on page 1 and click submit, and then enter your password on page two and click submit. ...
3
votes
3answers
161 views

How is a “commonly used password” determined?

When I try to create a virtual machine on Azure, and use the password P@ssw0rd I get an error message saying The password you provided is too common. Now, from my basic understanding, a provider ...
8
votes
1answer
309 views

Is the Litecoin Scrypt hashing technique a threat to hashed passwords?

The Bitcoin alternative, Litecoin uses a different algorithm to protect the block chain, namely Scrypt (not Sha256). Given that GPU accelerators exists, and ASICS are due to be released, does the ...
1
vote
0answers
55 views

entropy of FIPS-181 automated password generator

From wikipedia article on password strength: NIST recommends 80-bits for the most secure passwords Is there any estimation of entropy for FIPS-181 automated password generator? Recommended ...
4
votes
1answer
89 views

Why is it bad encrypt to with plain passwords as encryption key?

It's my understanding that using "normal" passwords, such as an easy to remember sentence, is bad practice. Is that because such a string will not be random enough, or something else? From Ruby's ...