Tagged Questions

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

2
votes
1answer
87 views

Global user override - Uncomfortable

We have recently started a project with a service provider who is a little old fashioned in their ways. They provide a product but don't market it particularly well, so we (as users of the product) ...
-1
votes
1answer
143 views

How do I hash a password in C#? [duplicate]

I assume that the best way to handle passwords for a website is I create a hash of the password and save that hash in my database. Then when someone tries to login, I do a hash of the password they ...
14
votes
2answers
2k views

Linux password changed. Is this an attack or a hardware glitch?

My Linux (Ubuntu 12.04) password suddenly changed last night and I'm not sure if this is an attack or just a hardware/user error. This is on a personal/non-server box. Several strange events led up to ...
3
votes
2answers
91 views

entropy of two factor authentication

I have two independent authentication methods A and B with entropy a and b respectively. say compromise of A does not provide any information on B. Is entropy of two-factor authentication of A and B ...
5
votes
4answers
567 views

How can hackers guess passwords (using dictionary attack or brute force) without being locked out?

Nowadays almost every website you want to register in; is asking you to create a complicated password...But why cant we use simple passwords? I am just wondering because in case of multiple wrong ...
0
votes
3answers
359 views

What are the differences between dictionary attack and brute force attack?

Can someone explain the major differences between a Brute force attack and a Dictionary attack. Does the term rainbow table has any relation with these?
1
vote
1answer
70 views

Can windows passwords be recovered from the windows pagefile?

I was reading reasons for clearing page files on workstations with one reason listed is that passwords can be stored in the pagefile and therefore should be cleared upon reboot in the case of somebody ...
3
votes
2answers
165 views

Is there a strong reason to salt and hash passwords when password reuse is not an issue?

I am dealing with a system (in development) that uses randomly generated (not user provided), unique, strings to authenticate services that will consuming an API. Right now, these strings are stored ...
-3
votes
1answer
81 views

What is the algorithm of bcrypt? [closed]

In many places I heard that people recommend to use the bcrypt algorithm to save passwords into database while creating web applications.I want to know what is the algorithm used to bcrypt a password ...
1
vote
1answer
77 views

Predicting the Entropy of the entire Password Database

Suppose that the passwords created under some specific composition rule "C" is to be tested for the security. One of the way could be to conduct survey on x number of people and measure the average ...
0
votes
2answers
72 views

Identifying Memorable Composition Rules [closed]

A single word can be transformed in so many ways to create the password. With any word of length l there are l! different permutations. Appending digits and symbols to the word create alphanumeric ...
0
votes
4answers
201 views

Security of a Random Password

i. If I choose random password of length say 15 from the alphabet set of size 94 i.e. from the search space of 94^15, is my password protected against all kind of threats? ii. Will there be any need ...
0
votes
3answers
204 views

Are windows users passwords easier to crack than linux?

If i set the same password in both linux and Windows, is it easier for a hacker to break the windows password? If so why and how can i create a windows password in the same security level as Linux?
1
vote
1answer
58 views

How does authentication work without OAuth in mobile apps?

I have a (Drupal) website that needs a companion mobile app for some stuff (quite customized, not just creating/viewing nodes). I know I can use OAuth for this, but I was wondering about alternatives ...
0
votes
1answer
73 views

which password was paired with my gmail address

Recently media have reported that a file of about 5 million gmail address and password pairs was published on a Russian Bitcoin forum. A media article on the leak Other media have reported that the ...
3
votes
2answers
101 views

One time passwords using Mobile phones [closed]

It is safe to assume that the majority of users accessing the internet also possess the mobile phones. So can we take advantage of this and relieve users of remembering any passwords. Instead of ...
0
votes
2answers
65 views

Is my Password Hashing Secure or not?

I have recently created a code for hashing password. Can you please give your advice over the security of my code? The function takes a password, then converts it to a number. #include <string> ...
-1
votes
2answers
82 views

Simple Ciphers to Create Secure Passwords

A shift cipher shifts every letter of a word by "n" amount and creates new word. The number of possible keys in the shift cipher is equal the size of the alphabet set from which the word is derived. ...
1
vote
2answers
144 views

Longer passwords v/s Password Composition Rule [duplicate]

Password composition rule is being considered as a burden for the users and some experts are recommending the increase in the password length instead of enforcing users to comply with the composition ...
0
votes
1answer
79 views

Encrypting the salt with password [duplicate]

Salts are stored in the plain text and readily available with the hashed passwords if the password database is compromised. What if we encrypt the salt using password itself? Doesn't it make offline ...
15
votes
6answers
5k views

My IP address (with a NAS) is targeted by a hacker. What to do? Should I be worried?

I've noticed, based on the logging of my NAS, that my IP address is targeted by a hacker. I already took action by automaticly ban the IP address permanently after five unsuccesful login attemps. ...
0
votes
1answer
86 views

Requiring a pin instead of password for websites?

Curious if this could be a good alternative to passwords. On a website, user can choose to use a pin instead of password. If she does elect to do this (given option) from then on, her account asks for ...
4
votes
3answers
440 views

How can I find if my password has been posted online?

I have just received this email from AbeBooks.com: Hello AbeBooks Customer, This is an important message from AbeBooks.com. As part of our routine security monitoring, we have learned ...
0
votes
0answers
27 views

drupal external authentication - how to handle password?

I need to implement an architecture someone else designed. They have a drupal as user interacting component, and an external authentication module. To authenticate, from drupal, username and ...
16
votes
6answers
4k views

Is my custom password hashing algorithm insecure?

For all of my hobby web projects, I have coded a login system that these projects share. There is no critical data in these projects, the only critical data could be reused passwords. So I try to hash ...
4
votes
2answers
180 views

XKCD-like passphrases to stdout

I'm trying to find a way to crack XKCD-like passphrases (correcthorsebatterystaple) from word dictionaries. Basically concatenate X number of words from a dictionary file. Right now it honestly ...
0
votes
0answers
11 views

Gnome-keyring iteration count location

I know that Gnome-keyring hashes master password between 1000 and 2000 times. It picks random number. I would like to ask where does it save this number, what is the location of that file? As far as I ...
2
votes
1answer
174 views

What are the typical ways to generate a One Time Password?

I'm looking for the typical ways to generate a One Time Password. I know about the HOTP and TOPT. But, in my case, the problem is that the "server" only has a display as interface and the ...
12
votes
2answers
568 views

How Does A Random Salt Work? [duplicate]

I don't understand how using a random salt for hashing passwords can work. Perhaps random salt refers to something other than hashing passwords? Here is my thought process: The salt is used to add ...
1
vote
2answers
101 views

Is it possible to find CryptoKey from orginal password and hashed password?

WebsitePanel is a windows hosting control panel that uses a CryptoKey to hash passwords into the databases. We have lost WebsitePanel config file and lost CryptoKey. We have to reinstall WebsitePanel ...
2
votes
1answer
160 views

Storing a user's password in a retrievable manner

I currently store my users passwords as PBKDF2 hashes, for the authentication part of my web application. Each user also has their own private key and public key (also stored in their user profile in ...
-2
votes
1answer
67 views

Salt and password [closed]

Reading the doc for setting the password, the command is : python -c "import crypt; print crypt.crypt('password', '\$6\$SALTsalt')" SALTsalt is the 8-character crpytographic salt. Valid characters in ...
4
votes
2answers
166 views

Two-factor verification without a mobile phone?

Currently, some services use a second layer of veficiation if logging in from a new device: Gmail and Facebook send a text or call with a code Facebook generates a code in the mobile application ...
-2
votes
1answer
60 views

client side and server side hash password [duplicate]

Another question about client or server side password hashing, I know. After reading many other post about this topic I'm still a little confused and not completely sure what is the best, because I ...
-3
votes
2answers
107 views

Time it takes to crack a password on site like yahoo [closed]

I have a question. If you were using a password brute force/dictionary attack utility on a site like yahoo or another site, how long would it take to crack a password like Jah13Wootiang if Wootiang is ...
2
votes
1answer
93 views

Temporarily save failed logins password hashes for using against brute force attack

My question is about online brute force attacks, that try to authenticate in the website. 1) For the first case if the requests are coming from the same ip, I think this are relatively easy as after ...
23
votes
3answers
3k views

For an HTTPS web application, is it worthwhile to encrypt the password before POSTing it, to keep a MITM attacker from harversting it?

Our application has recently gone through penetration testing. The test found one critical security breach, which is essentially: The problem: Attacker sets up a WiFi spot. User enters our site ...
-3
votes
1answer
35 views

Which encryption technique should be used for users name and passwords in my notebook [duplicate]

i writing all my passwords and users names on my notebook emails,amazons,facebook. and i have really Nosy little's brothers that will probably look at my notebook when i am not around, which ...
2
votes
1answer
166 views

Is there a way to identify the location of a person trying to intrude your wifi network? my wifi router is picking up his attempts

Aug 30 20:28:09 dropbear[6799]: Child connection from ::ffff:5.10.69.82:38463 Aug 30 20:28:11 dropbear[6799]: login attempt for nonexistent user from ::ffff:5.10.69.82:38463 Aug 30 20:28:12 ...
5
votes
3answers
160 views

How secure is this method to remember security questions?

So I found an interesting method of remembering those pesky security questions. Basically, the guy takes a hash of the question (IE what is your mother's maiden name?) and then appends his own ...
28
votes
4answers
3k views

What is the point in having arbitrary username requirements?

I've looked around on Security.SE, but couldn't find much related to the following problem: I recently signed up for Chase Quick Pay as my method of being paid by a part-time job. I've heard of ...
3
votes
2answers
201 views

Are weak passwords acceptable for internal development?

We have a number of internal development environments that use weak passwords in the Auth and SQL components; particularly using passwords such as "password" or "Password1". These are obviously ...
3
votes
2answers
217 views

Can the human brain generate cryptographically secure random numbers?

A security conscious friend of mine was attempting to generate entropy using random dice rolls to generate a random password, and I became curious about the security of random number generators and ...
1
vote
2answers
251 views

Brute force alphanumeric password using JohnTheRipper

I recently recovered a zip archive with some files I need access to, but I can't remember the password. All I can remember is that the password was short (around 3-4 characters), and contained only ...
24
votes
6answers
2k views

Are there secure alternatives to single-use password reset links?

We currently have what I believe to be a pretty standard scheme for dealing with password resets. Our reset links are single-use links: They expire immediately after they've been visited, even if the ...
1
vote
4answers
224 views

Should BCRYPT be used for client-side password hashing

I am concerned about the use of bcrypt for client-side password generation. I am developing a password generation function to be used client-side, similar to PwdHash and PasswordMaker. Much has been ...
-2
votes
2answers
77 views

A Graphical Two-Step Authentication System [duplicate]

Changes made to system proposed in Two-factor authentication Without Mobile Phone: In previous system, shoulder surfing would reveal the user’s pre-decided image. In the current system, end image ...
2
votes
3answers
179 views

What risks am I taking with a weak password on a laptop?

I'm setting up a Mac laptop for my wife. Mine has a ridiculously strong password, but she finds this annoying. If I give her a (relatively) weak password for convenience, what risks am I taking? A ...
0
votes
3answers
129 views

How secure are sentence passwords? [duplicate]

Lately I've been doing the trend of using passwords that are sentences, at least on sites that have a reasonable maximum character length and allow spaces. So for example the most basic variation is ...
0
votes
1answer
62 views

What multiplier to use when calculating the average time to crack passwords with a given entropy?

Suppose that we have a process that generates passwords with entropy E. I'd like to compute the average time it would take for a brute-force attack to crack an MD5-hashed instance of such a password. ...