Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

2
votes
2answers
104 views

Breach informing

I am a staff member of a large fanfic site, but not the head administrator with control over the site itself. Recently, we had a security breach and the databases were copied, which included the ...
2
votes
3answers
208 views

How to store passwords securely in my server?

Disclaimer: I know I should use bcrypt to securely store user's passwords. Please, keep reading. I want to store credentials for several email services for each user. So if I log in with my username ...
4
votes
3answers
125 views

Is it good practice to SHA512 passwords prior to passing them to bcrypt?

I want to allow any-sized passwords to be allowed to be submitted. I currently use bcrypt as a key derivation function for passwords, however I have realized that it has a maximum input length of 72. ...
9
votes
3answers
4k views

How often do two users use the same password

If no two users use the same password, then in theory salting the password hash is not needed. How often, in practice, do two users have the same password?
70
votes
8answers
9k views

Convincing my manager to use salts

My manager says we don't need to salt our passwords because people are not likely to use the same password because they all have different native languages, in addition to the websites they are active ...
0
votes
2answers
207 views

Storing multiple hashes to prevent collisions, security risk?

This is all just for curiosity's sake, so discussion on which hashing algorithm is harder/better/faster/stronger is irrelevant. But my question/thought is this.. With regards to password storage, and ...
1
vote
1answer
138 views

Theoretical home grown password options, or what is it that SCrypt, BCrypt, PBKDF2 does that is so special?

I'm developing a personal web framework, nothing internetty, and probably not even anything that will ever go on my personal LAN. And looking for password advice people seem to only recommend those ...
42
votes
5answers
4k views

Is it safe to tell your users what kind of hashing algorithm you use?

For example, on the user registration page, is it safe to tell people "Your password will be stored as a one-way hash using the (whatever) algorithm."
1
vote
2answers
73 views

In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?

I asked this question first on Stack Overflow but it was suggested that Information Security would be a better place for it (pretty obvious in hindsight). ...
-1
votes
4answers
70 views

Is salted MD5 or salted SHA considered secure?

Is using something like bcrypt or scrypt necessary? The hashes are so much longer to store in a database. Can one get away with using salted MD5 or SHA and still be secure?
0
votes
2answers
61 views

In addition to using strong hash algorithms, what is a good “password requirement”? [duplicate]

Assuming the use of bcrypt/scrypt: Would it be a good idea to "require" a password of at least 12 characters, also mentioning the possibility of using long passphrases, instead of your typical ...
2
votes
2answers
261 views

Is upgrading key-stretching algorithms and/or repetitions a thing?

Consider back in the 90s you're ahead of the curve, you hashed and salted your passwords with SHA, and you're a big site, millions of accounts, etc. Well the web evolves, and over time more advanced ...
3
votes
7answers
129 views

Is providing a website password over the phone any less secure than other identifying information?

I've been dealing with two separate banks for completing a 401k rollover (I do not have any other accounts with either of the two banks), and I've encountered something with both that I've never seen ...
2
votes
4answers
178 views

Should we rethink our entire password strategy? [closed]

Passwords get discussed a lot on this site, and there's quite a lot for both users and sites to do, to stay in line with "best practice". Web sites need a password strength policy, account lockout ...
4
votes
2answers
57 views

Should password recommendations be different for devices, networks, and internet?

I started using a password manager last year and updated nearly all of my internet accounts to super-strong, unique passwords, and that isn't a problem, cause I only access them from web browsers or ...
1
vote
6answers
203 views

Why not use weak passwords?

In a specific situation: online stores that cannot possibly store payment details because you pay using paypal, but require registration. What reason is there to use good passwords here? Breaking ...
18
votes
4answers
3k views

Is it a security concern that a shop I registered at obviously does not encrypt my password?

I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
21
votes
3answers
4k views

Doesn't plaintextoffenders.com just provide attackers with a good list of sites to attack for passwords?

On the face of it, PTO seems like a good idea in educating people about password security. On the other hand, if I were an attacker, PTO would be the first place I would start if I wanted to start ...
10
votes
4answers
958 views

Does the strength of password matter in bcrypt?

Even if I choose 1 character for my password or 32 characters with numbers, letters, uppercase symbols etc. the bcrypted password will still be 60 characters length password. So does the password ...
2
votes
1answer
59 views

Identical lanman hashes on AD accounts?

I ran metasploit's smart_hashdump module against my (2008r2) domain controllers, trying to find any accounts that may still have lanman hashes in place. These should have been disabled long ago. I'm ...
1
vote
0answers
37 views

Security for message queue in ActiveMQ

I am using ActiveMQ and WSO2 for my application. I need to protect my queue to restrict posting of messages by anonymous users(I need to protect my queue with some password). I know, there is a ...
1
vote
2answers
63 views

Are repeating random patterns weaker than non repeating random patterns?

Which would be harder to crack: a password comprising of n characters randomly selected or a password comprising of x randomly selected characters repeated m times so that m*x=n. For example: ...
0
votes
2answers
52 views

how long do lowercase alphabets-only passwords have to be to match more complex ones? [duplicate]

Lowercase-only passwords are convenient for phones since we dont hit shift or go to characters page(each which is as much effort as hitting a character in my Android devices). But how long would a ...
0
votes
2answers
59 views

Timing-safe string comparison in high-level languages

I'm looking for a reliable solution to compare two strings without leaking their content through time differences. The length of the strings is not secret. The background is this: I'm implementing ...
26
votes
5answers
4k views

Length of passwords that are rainbow table safe

With large computing power (like what you can get in the Amazon cloud for example) you can generate huge rainbow tables for passwords. There also seems to be some large rainbow tables reachable that ...
0
votes
1answer
65 views

How can I tell if my ISP account password is encrypted?

How can I be sure my ISP encrypts my account password? I found out accidentally that mine did not. I had called to report an interruption in service, and in the process of "troubleshooting", the ...
1
vote
0answers
69 views

Trusted Platform Module (TPM) secure password

I'm trying to set secure Trusted Platform Module (TPM) passwords on a network and would like to set it to the maximum length possible. How long can the TPM's password be? Is it limited by bits or by ...
42
votes
9answers
5k views

Can users make use of a password manager when banks tell them never to write passwords down?

Consider a user who wants to use a password manager for their banking passwords. Advice from banks usually says they should never write down their password. The user would be concerned about going ...
0
votes
1answer
95 views

How do I generating a word list from a known seed word?

I've lost my master password. Not all is lost as I know the original word that generated the password: It was generated by a random case switching for consonants and random vocal to numbers. For ...
2
votes
1answer
109 views

Should a space in a password count as a symbol when checking for complexity?

There is no doubt in my mind that spaces should be allowed in passwords. I see some websites disallow spaces, symbols in passwords and even enforce minimum length which seems t otally nonsensical to ...
1
vote
1answer
251 views

Why is it considered safe for services like Mint to store bank password?

My understanding is that, typically websites are recommended to store only hashes of passwords using one-way cryptographic hash function. This way, there is no way to retrieve the passwords even when ...
1
vote
1answer
43 views

Storing encryption passphrases in memory in Dalvik?

Given KeePassDroid, I'm considering some of the security implications of accessing KeePass databases on an Android device. In the native applications for Windows, OSX, and Linux, whenever the ...
2
votes
1answer
99 views

Is there more risk in changing administrator password locally vs from a centralized location?

I'm working on a mechanism to better handle group policy passwords in response to MS14-025. We formerly used this mechanism for setting the local admin account passwords on our workstations (primarily ...
0
votes
0answers
26 views

Is there a FIPS 181 like standard for random password generation with alphanumerical seed?

NIST recommends FIPS 181 as a random password generator for "easy to remember" passwords. As far as I understand the standard: it will generate a password that is lowercase, and with some ...
3
votes
1answer
51 views

SAML, and forcing a re-authentication

I have a use case forced upon me by industry regulation. I wish it wasn't there, but it is. A user logs in to my service, navigates around, etc. The user can perform many actions, but one of the ...
3
votes
4answers
182 views

Ethical brute force demo on a web login when knowing the password complexity requirements

We are currently having accounts compromised at a substantially high rate. Some in the organization believe that our password complexity requirements is enough to thwart brute force attacks. I wanted ...
38
votes
2answers
4k views

Is it good practice to ban an IP address if too many login attempts are made from it?

Since an IP address does not necessarily represent a specific device, but probably a whole network/company/etc. does it at all make sense to block an IP address if there is a significant amount of ...
1
vote
1answer
73 views

Is there anyway to generate a SAM file?

I was wondering if it is possible to create a windows SAM file. I already tried using chntpw but it seems like it only works under a Redhat based linux, ie I was able to blank/change a Windows 7 ...
1
vote
1answer
77 views

Exploiting Writeable SNMP

So, I've come across a couple of devices that are using default writable community names for SNMP such as 'private' (on windows machines) and 'Secret c0de' (on Brocade switches). I'm aware of the ...
15
votes
2answers
510 views

Can client-side hashing reduce the denial-of-service risk with slow hashes?

When storing user's passwords that you need to verify against (but not use as plaintext) the current state of the art is: Hash the password Use a salt Use a slow hash function - bcrypt, scrypt, etc. ...
4
votes
3answers
181 views

Why use Keepass, etc. if all your passwords are in one place?

I'm a firm proponent of using a password manager like Keepass to generate and store secure passwords. I also encourage others to do the same. But there's always one person who says they'll never use ...
0
votes
1answer
153 views

How compromised should I assume my computer is?

I had turned ssh on a while ago to do some remote work, and didn't turn it off (yes, I'm an idiot). I was just looking over some netstat info when I noticed someone had established an ssh session with ...
0
votes
2answers
90 views

How secure would this method be considered for password storage

Ok I am currently storing the passwords in most secure way I could think of. With use of Encryption and Hash. The passwords are first generated by user as plain-text with minimum length of 6 ...
0
votes
2answers
285 views

Automated software hackers use to try passwords

Because of the eBay hacking, I had to go and look for other accounts that I have used the same password to change the passwords on those site as well. (I know that it's very bad to have same passwords ...
1
vote
3answers
104 views

Touch tone phone username and password

I just got off the phone with Fidelity, who manage the health benefits for the company where I work. Before talking to a person, I was prompted to enter my username and password on the numeric keypad: ...
1
vote
1answer
150 views

Any reason I shouldn't be salting and hashing before putting through bCrypt?

I've been reading up on password storage and such, and have come to the conclusion that I need to be using bCrypt. I've got an implementation working correctly, but I'm wondering the best way to move ...
0
votes
2answers
74 views

Precise measurement of password complexity

I am thinking on a system, which measures the complexity of a password not based on its entropy or compressibility, but with a simply sophisticated method. The measurement of the ...
1
vote
1answer
86 views

Challenge-response login without storing a password equivalent

A problem with many challenge-response login systems is that the server has to store a password equivalent. For example, if the server stores SHA1(salt + password), and an attacker captures that hash, ...
3
votes
3answers
185 views

How can a site know about insecure password?

I received an email from my web host recently that informed me I had an "insecure" password on one of my email accounts and that I had to change it. Their definition of what a secure password is as ...
13
votes
2answers
1k views

How many passwords does the average user know?

Looking for research on the count and complexity of passwords that an average user is actively using. Note: Also, just to be clear, by research, this is not a request for you to respond with an ...