Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

8
votes
4answers
365 views

Is autocorrecting typos in passwords secure?

Technology Review's Why Autocorrect for Passwords is a Great Idea says: New research shows those frustrations could be avoided using the same approach used to fix typos in text messages and ...
0
votes
1answer
33 views

Securely stored secondary password

I'm currently writing a portal site for Microsoft Dynamic CRM, the portal works like this: Each user has his own account to login to my portal. Each user is assigned a seperate CRM credential by ...
17
votes
6answers
3k views

Correct terminology when describing password security to layman

I am writing a page for our website which describes the measures we take to keep our customer's information secure. On this page one section describes how we keep their passwords secure. We are ...
87
votes
12answers
12k views

Is a 6 digit numerical password secure enough for online banking?

My bank went through a major redesign of their customer online banking system recently. The way security is managed across the platform was also reviewed. The password I am able to set now to log in ...
-5
votes
0answers
41 views

How does Apple stores Apple ID passwords?

The question is how does Apple stores passwords from Apple IDs? Does they store hash or use some other technologies? Didn't find any info.
7
votes
2answers
205 views

Why does Mozilla Firefox encrypt saved passwords?

If you ask Mozilla Firefox to remember the login details for a website, the credentials will be stored in your profile directory in Logins.json. Instead of storing plaintext values, the username and ...
-5
votes
1answer
51 views

Is possible to get password with stored XSS? [closed]

Is it possible to get password from a site with stored XSS? I have a forum where I can put JavaScript not directly but inside HTML (like <div onclick="alert()">CLICK</div>). Is it possible ...
-3
votes
2answers
94 views

Will hashing a password, and then splitting it into multiple db fields increase security? [duplicate]

I've been reading up on Password hashing, and it seems like there is a lot of opinions on "What's right." I'm curious about the possibility of storing a split of a Hashed password in multiple user ...
-2
votes
3answers
83 views

Is there something other than “if” and “else”

There are many ways for protecting a password like using strong algorithms like SHA-512, using salts, encrypting the database where the password is stored, packing the license file with UPX etc and ...
0
votes
1answer
135 views

Encrypt password with salt

Can anyone explain why formula 1 is safer than formula 2?I don't get it even I get the answer. According to 2, it says as s is in plaintext form, the attacker can decrypt the password by (y.s). Isn'...
2
votes
3answers
952 views

Is there a civilian friendly indicator of stored password safety?

As I understand it, by using one-way encryption we can protect stored password data in the event that they are stolen. Broadly speaking, password data can usually be cracked by guessing so the ...
1
vote
1answer
47 views

Challenge-Response Application in E-banking

Why is it important that Alice doesn't know K? What could happen if Alice knew K?
2
votes
1answer
53 views

Will the Credential Management API now available in Chrome 51 be widely adopted?

Google Chrome 51 stable includes support for the Credential Management API. This implementation is based on the W3C spec. Will other browsers support this technology (particularly Safari)? Will web ...
0
votes
0answers
52 views

What is the right strategy for me to develop a paid public wifi?

I want to establish a paid public WiFi system. Here is my model of how it will work: I will install a public WiFi in my apartment. Using the WiFi system is paid but, voluntary. Those who pay me a ...
64
votes
4answers
8k views

Does Microsoft's “Password Ban” list insecurely store user passwords?

Supposedly, Microsoft is banning common passwords, and their list will dynamically update: Microsoft says it is dynamically banning common passwords from Microsoft Account and Azure AD system. [&...
1
vote
3answers
87 views

Could these special characters be used in a password?

To use a good password, I was thinking about adding special characters. I remember that some login services don't allow all characters. Perhaps it depends also on the keyboard layout. Could these ...
0
votes
2answers
41 views

Is there any added security/vulnerabilities if you allow a “trusted-party” to vouch you are legit, if you were locked out of your account?

I was reading this answer on a question. http://security.stackexchange.com/a/498/106817 Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at ...
2
votes
1answer
149 views

How can Windows 10 not have the password in memory?

I have read that Windows 10 does not hold the password in memory from the creator of mimikatz: Starting with 8.x and 10, by default, there is no password in memory. Exceptions: When ...
3
votes
3answers
180 views

Is it acceptable for customer service to ask for my PIN?

I tried to initiate an online chat with customer service of a company I am trying to do business with this weekend, but before they would answer any of my questions they requested that I give them the ...
3
votes
3answers
189 views

Sending sensitive infromation via self destructing link in an email

I need to come up with a simple way for people within the company to send out arbitrary sensitive information to arbitrary recipients. There is an equal chance that the sender and recipient will be ...
4
votes
1answer
77 views

Are there problems with reusing strong passwords for private gpg keys

I am currently maintaining a few different identities each associated with different gpg keys (for personal, academic, professional correspondence etc., whether or not this is a good idea is probably ...
0
votes
2answers
151 views

store passwords as one-way-hash, or just use it as an AES key?

I want to store some data so the only one who'll be able to access it is the user itself. Here is my idea: when user registers, his password will be hashed in SHA256 (so it'll fit as an AES key), and ...
6
votes
4answers
345 views

Why is using SQL injection to extract passwords or password hashes from a login database (that should never legitimately disclose them) even possible?

(Okay, so I'll confess upfront that while I'm trying to educate myself the current state of my knowledge on web applications security is still pretty shallow. So I appreciate your patience if the way ...
1
vote
1answer
109 views

How to implement iterations when hashing passwords?

To securely hash passwords, algorithms such as PBKDF2 do many iterations of a common hash such as SHA1. Are there certain ways that these iterations need to be done to be safe? In particular, from ...
1
vote
1answer
88 views

How is github 2FA personal access token more secure than passphrase?

I recently enabled 2-factor authentication (2FA) on my github account. Once you enable 2FA, you can no longer connect to the repo using your normal passphrase using command line tools. You have to ...
1
vote
1answer
91 views

How does JDBC send passwords to the server?

I am really curious about how JDBC sends passwords to the server. While I understand that is simply an API and it depends on the implementation, are they usually hashed and then sent to server? If I ...
0
votes
1answer
89 views

Windows security & data protection

I work for a hotel. The hotel stores a MySQL database online. This database only contains a Reference ID, number of nights and so on, but no private data. No names, no personal information on guests. ...
5
votes
4answers
238 views

Are bad passwords used to breach security in real life?

I sometimes hear news articles about hackers managing to get a list of usernames/emails and passwords from a given site, and I also hear news articles about how little entropy there is in some people'...
2
votes
0answers
52 views

How exactly does “Apache Shiro's” hashing work when using a Desktop-Client

I was looking at this question How does storing hash passwords work? and every answer essentially says that Hashing is done via the server, or most of it should, as that is the safest way to do it. ...
3
votes
3answers
113 views

How to transfer a database of usernames and passwords to a friend

Caveat: I basically know nothing about information security, so I apologize in advance. I'll try to keep the question as general as possible. I have a website X over which I have administrator ...
13
votes
1answer
3k views

Should I hash my passwords even if I am only allowed to generate limited traffic?

At this moment I'm busy working on an webapp with a friend of mine. The main problem we have is that we are only allowed to generate 50 GB a month in datatraffic. My question is: Does hashing the ...
36
votes
7answers
7k views

Is it possible to improve brute-force guessing of a password with a picture of the keyboard used to enter it?

Is it a bad idea to post a photo of your keyboard to social media? Can I look at a photo of a keyboard and determine the password of an account? Assuming a certain (set of) password(s) is the most ...
3
votes
1answer
48 views

Purpose of having a identifier on a password reset communication

A particular service I use, when asked for a password reset, showed me an identifier on the website - something like 4562708546, apparently random or sequential. They then sent me a new password over ...
7
votes
5answers
2k views

Why are generated access tokens for APIs much longer than passwords?

I'll take Twitter as an example. On one hand, when registering on Twitter, the password must contain at least 6 characters. On the other hand, access token to the API have about 50 characters: (...
19
votes
5answers
4k views

How to tell if a webapp transmits my password in cleartext?

I am trying to see if a webapp transmit password in some form of cleartext. The problem is that the web app is NOT using https! This is why I wondering is my passwords is sent in clear text. I've ...
33
votes
12answers
9k views

Is it acceptable practice to only increment a number when changing a password?

Note: I'm not asking about this password scheme is the best or not (of course it isn't); I'm asking about its theoretical or practical secureness relative to the optimal password scheme based on the ...
-1
votes
1answer
147 views

How can this encryption algorithm be improved?

I am currently developing an application to store my passwords safely. It will be a proof-of-concept at first, but I am planning to upgrade it later. Anyway, here is how the passwords are accessed: ...
6
votes
2answers
812 views

Is it safe to publish something encrypted with a password if you make it insanely difficult to crack?

Let's say you have a very important private key that you don't want to lose. You think of posting it to http://pastebin.com/ but then relize that elimanates the point. So you think of encrypting with ...
1
vote
2answers
180 views

Advantages with PIN code authentication where the digits are placed at random positions?

I noticed that a lot of high-risk websites, such as bank and payment platforms, do not use a passwords for authentication (as usual) but instead use a PIN code where the numbers are placed at random ...
7
votes
4answers
403 views

Do hackers still use iterative password cracking techniques?

It's World Password Day! Rejoice, for today is the day that all of our friends will change their passwords from abc123 to 123abc!!! While we're on the topic of passwords, one thing websites do to ...
3
votes
5answers
534 views

How secure is changing or adding a single character in your passphrase?

I'd wager quite a many people are required to periodically change their passwords for certain applications or even at the office. I'd also wager that a large percentage of these people "change" their ...
0
votes
2answers
90 views

Obfuscate Identity for Password Reset Information

I am just wondering your opinions on why it would/would not be a good idea to mask or obfuscate email address data in a password reset web submission once the user has entered their username informing ...
0
votes
2answers
96 views

How do data breaches of account login information end up in plaintext?

For example, see this story. Am I missing something here? Are the login details actually still encrypted? I don't understand how it is possible for a data breach of what I assume is encrypted ...
3
votes
2answers
87 views

For high entropy credentials, is SHA256 hashing good enough?

Let's say I've got a database of high-entropy credentials (e.g. 256-bit random values) used as API keys by clients. I'd like to hash them in my database so that a database compromise doesn't allow an ...
0
votes
2answers
60 views

Replacing files with infected files on anonymous ftp server

I am creating a new question as i now have another question which was raised from a previous answered question post. What im trying to figure out is would this scenario be possible. I have an ...
0
votes
2answers
52 views

How to properly hash a key? big vs small digest

We have to roll (decommission) database access keys often, but it's important to know which key each system is using in order to avoid removing a key in use thus creating unavailability. We want each ...
0
votes
2answers
73 views

Pros and cons of password policy filtering common weak passwords? [duplicate]

We all know the basics "password rules" when a user register on a website, such as: more than 8 characters, must contain an upper case letter, must contain numbers and so on Why don't websites ...
0
votes
3answers
40 views

How secure is it to use passwords consisting of one common part and one site specific prefix? [duplicate]

One of the greatest problems with passwords is having to remember different passwords for different sites. Some people use password managers, others use the password reset link every time they want to ...
0
votes
0answers
72 views

How to safely pass password reset token from http get request to html page?

I am working on implementing my own custom password reset that sends an email where the user is taking to a page to reset their password. So far I have generated a unique token that gets put in an ...
7
votes
1answer
119 views

What are the recommended scrypt cost factors for 2016?

I've been trying to look for the answer, but the latest one I found was outdated by three years. So what are the recommended scrypt cost factors for 2016?