Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

3
votes
1answer
149 views

Safe ways to store passwords without hashing them

I'm working on an email client for Windows, and to send emails, my application needs to have the email address and the password of that email address. When the user gives his password, I store it ...
109
votes
5answers
9k views

Does Facebook store plain-text passwords?

I was about to reset my Facebook password and got this error: Your new password is too similar to your current password. Please try another password. I assumed that Facebook stores only password ...
2
votes
1answer
80 views

File Fault 1 password from memory dump

I have a osx 10.9 machine with a File Vault1 encrypted user partition. I would like to remove the encryption, but I don't remember the "master key" which is the only way to remove encryption ...
0
votes
2answers
87 views

If P=NP, what is still cryptographically secure? [duplicate]

I know, I know - "If P=NP" is a really large, high-impact assumption. But this is a hypothetical. I mean, clearly RSA (and similar methods of obfuscation) would likely become totally irrelevant - or ...
-2
votes
2answers
93 views

Hydra https-form-post

I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives. This is what I have done so ...
1
vote
1answer
79 views

Passwordless login over email - security considerations

I'm proposing the use of a login system that sends a one-time login token (with high entropy) via email to the user. After using the token, the user receives another token via email and the previous ...
0
votes
2answers
58 views

Logging in after password reset email sent (but not acted on)

Should a user be allowed to request a password reset email and then log in (i.e. disregarding the reset email and using their existing password) or should the current account be locked until the ...
4
votes
2answers
97 views

Should I set different passwords for different Wi-Fi bands?

My new router supports both the 2.4 and the 5 Ghz bands, and it obviously allows me to set a different password for each of them. Now, since cracking just one of the two means that the attacker would ...
6
votes
4answers
199 views

Relationship of password strength and key strength

I have just started educating myself about cryptography, and while it is mostly making sense, a few things are still eluding me. One being: In systems that take a user's pass-word/-phrase in order to ...
2
votes
2answers
168 views

What are the benefits to a two-page login system for a webapp?

I have noticed many website going to a two-page (not two-factor) login system - where you enter your username on page 1 and click submit, and then enter your password on page two and click submit. ...
8
votes
1answer
309 views

Is the Litecoin Scrypt hashing technique a threat to hashed passwords?

The Bitcoin alternative, Litecoin uses a different algorithm to protect the block chain, namely Scrypt (not Sha256). Given that GPU accelerators exists, and ASICS are due to be released, does the ...
15
votes
3answers
400 views

Storing passwords in reversible form - a genuine use-case

What's wrong with you, you crazy fool, you're not supposed to be able to retrieve a password in plain text! I know. Hear me out. Assume I've got a service that's similar to Mint.com. For those that ...
1
vote
3answers
103 views

Are some passwords more vulnerable to password crackers?

Suppose I have a password made of n alphabetic characters. An attacker is given the hashed password and will attempt a brute force attack on cracking it. I can envision a naive password cracker ...
1
vote
2answers
144 views

Storing database password in application

Let's say my application connects to my database. This requires me to have the username and database in my config as follows: postgresql://scott:tiger@localhost/mydatabase I have an automated ...
1
vote
0answers
55 views

entropy of FIPS-181 automated password generator

From wikipedia article on password strength: NIST recommends 80-bits for the most secure passwords Is there any estimation of entropy for FIPS-181 automated password generator? Recommended ...
3
votes
2answers
143 views

How does my bank knows my second and forth chars of my password

I see that the new login mechanism used by some banks in UK and also used by visa debit authentication is to ask for three random characters from your password at login (for example second, ninth and ...
4
votes
1answer
89 views

Why is it bad encrypt to with plain passwords as encryption key?

It's my understanding that using "normal" passwords, such as an easy to remember sentence, is bad practice. Is that because such a string will not be random enough, or something else? From Ruby's ...
3
votes
3answers
161 views

How is a “commonly used password” determined?

When I try to create a virtual machine on Azure, and use the password P@ssw0rd I get an error message saying The password you provided is too common. Now, from my basic understanding, a provider ...
1
vote
3answers
197 views

Is Salt, IV and Key necessary when encrypting password in a database using AES? If so, how should they be used?

Imagine I have a website with user accounts. I want to authenticate users, so I need to know if the password they provide matches the one stored in my database. To protect the passwords from prying ...
2
votes
1answer
78 views

Given a hash, salt, charset and password length, how do you get the password without brute-forcing it?

I got that question on an exercise and I'm not sure what to answer. Without conventional brute-forcing and without a rainbow table, how could I find out the password? An improved brute-force ...
5
votes
3answers
496 views

Does it make any sense to alter a hashed password? [duplicate]

I've always wondered if it would make any sense to put fake characters into a hashed password? For example this is my password: 1234 and after hashing the password , this is the result: abcd Then ...
2
votes
3answers
200 views

What is wrong with a confirmation page displaying my password?

I just registered for a race and the confirmation page gave me the creeps. See below for a screenshot with fake data. I know nothing about internet security. Other than the obvious fact that if I ...
5
votes
1answer
141 views

Why does my bank bother asking basic personal questions to log in to online banking?

To log into my online banking, I have to answer a basic personal question such as "What is your mother's maiden name" or "What is your grandfather's middle name", as well as enter a one-time code from ...
3
votes
1answer
155 views

How can I store information securely when I can't use crypt or a hash?

I'm creating an application for Google Glass (technically it's Glassware, but whatever). The user will do the following steps when going through setup for the Glassware: Go to my website, redirected ...
-3
votes
1answer
115 views

How long does it take to break 128-bit key

Hmm, I was asking myself how to compute if we were given one day to try all possible keys for a 32-bit symmetric cypher, how long would it take us to break 128-bit key? My calculations suggest: ...
0
votes
2answers
65 views

How do you protect strings in code from users decompiling them and seeing them [duplicate]

For an example say we have an application such as a client based application which connects to an API using an api key. We are saying for this purpose there is no OAuth. How would a string or in this ...
5
votes
5answers
1k views

How can one secure a password/key in source code [duplicate]

If there is a need for source code to have a password in it, how should this be secured? This is purely an example, but say there is an app that is using an API, and you don't want to expose ...
1
vote
1answer
116 views

Why does Debian security guide recommend md5 hashed passwords?

I am reading the Debian Security How-To and came across a section that I found odd: it recommends to use md5 hashes for /etc/shadow passwords ...
2
votes
1answer
77 views

Locality Sensitive Hash (LSH) function to approximately match old passwords

Recently, I ran across a website that requires me to change my password after X number of days had passed since I had last created one. Intelligently, the service made sure that the password did not ...
6
votes
5answers
697 views

Is storing plaintext passwords for email accounts any less bad? [duplicate]

I recently found out that the company I use for shared hosting stores passwords for email accounts in plaintext (they mentioned this to me incidentally, while troubleshooting another issue). They're a ...
0
votes
1answer
134 views

How could be my skype password stolen? [closed]

My skype password was recently changed. I've changed it back and found it in the internet on hacker's site. My password is pc-generated, like as2fZ12v. How did they manage to hack it, if I've never ...
0
votes
1answer
149 views

Why don't we do dual password instead of forgot password?

You can see a link Forgot Password? nearby almost all login form. As I mentioned in question, Since passwords are completely protected from outside access unless owner reveal, I come up with this ...
0
votes
2answers
113 views

What is truly unbreakable these days? [closed]

Just very curious, count my knowledge in cryptography, algorithms, and security in general as non-existent. Now I am aware that this might be a VERY broad question, but here it goes. What is the most ...
1
vote
1answer
313 views

How to crack SHA512 hexdigest passwords with John the Ripper?

I've been playing with John The Ripper (JtR) to try to crack/audit a salted password that was hashed with SHA-512, with 20 interactions according to the source (for the curious, this is a Rails app, ...
1
vote
2answers
191 views

How weak is MD5 as a password hashing function ?

A professor told us today, that MD5 is weak. I understand his chain of thought but pointed out, that IMHO MD5 is a good way to go if you would use a long (even really long) dynamic salts and static ...
1
vote
1answer
401 views

Are post requests secure?

If a post request is sent from a client on a website without SSL, is the request secure? For example, I visit a site badsecurity.com, and I login using a password: Will this password be encrypted ...
1
vote
1answer
133 views

How secure is the PwdHash algorithm and system?

I use the PwdHash service (http://crypto.stanford.edu/PwdHash/) and plugins for pretty much all of my passwords. I believe this is safer because: No service gets the same password as another, so if ...
1
vote
1answer
75 views

Is it a good idea to give users an additional password that they do not control?

It's a given that users will choose bad passwords. Why not help them out? Using a securely-random choice from a large dictionary, choose one or two words and tell the user to write them down. When ...
0
votes
2answers
56 views

How do you overcome the problem of the salt being public and known by the attacker? [duplicate]

I believe that when adding a salt to the password you need to store the values so you can compute the hash again. But, what does happen if the attacker get the salt? How is it possible to add value ...
1
vote
1answer
67 views

What is the best approach for securing log-in credentials on an HTML form?

I realize how basic this question is, but I have relied for years on mechanisms built into .NET to handle log in for me. These days, most of my work involves using client-side logic and calling API ...
1
vote
3answers
251 views

What is the correct way to make a password salt?

I've made the below function to make a completely random 64 character long hash function password_salt($password){ $salt = hash("sha512", mt_rand(1,100000) . strtotime("now") . $password . ...
19
votes
4answers
2k views

Is using SHA-512 for storing passwords tolerable?

I know that the best options to use for storing passwords are bcrypt/PBKDF2/scrypt. However, suppose you have to audit a system and it uses SHA-512 with salt. Is that "fine"? Or it is a vulnerability ...
8
votes
4answers
480 views

Why does password strength matter?

I understand from a cryptographic standpoint that you want a password to be as random as possible to resist brute force or dictionary attacks. That is fine- but in what circumstances can those ...
8
votes
4answers
950 views

Is 2FA really necessary with long, high entropy passwords?

I was wondering if two factor authentication is really necessary if you are using high entropy, long, unique passwords for each site. From my experience 2fa just beefs up security a little more, by ...
94
votes
7answers
6k views

Why are salted hashes more secure?

I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters). My ...
5
votes
1answer
103 views

Is it okay to normalize unicode passwords with NFC/NFD?

I am currently designing a login for a web service. I will use a PBKDF2 implementation for hashing the passwords. However, I intend to allow unicode for passwords, as I will have international users, ...
1
vote
0answers
58 views

Rainbow Tables: Why do we need to store the last value of a chain?

Surely we could just make it so a rainbow table says for each beginning of chain do 10k iterations and then we wouldn't have to store both values? Or does by doing it this way it stop collisions? ...
1
vote
1answer
107 views

Retrieve RAR Password through Extracted File

So I was wondering about something, but for the simplicity, consider this example: You have a file with n encrypted files in it, of which one is called 'Note.txt' You also happen to have another ...
1
vote
0answers
54 views

How should I authenticate my SPA frontend with my API since I´ve got no authentication process in the site?

We are designing a web site for selling financial products online. The following is a high level description of the components: Our frontend will be a SPA built with AngularJs. The frontend will ...
1
vote
3answers
140 views

Time Memory Trade-Off Attacks

Given, we want to crack a password. With Time Memory Trade-Off Attacks one tries to find the right balance between time to compute hashes for all possible passwords. And the used memory to store all ...