Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

-1
votes
2answers
77 views

Website says my new password can't be used because it is the same as an old one [duplicate]

What are the risks of storing (in hashes I guess) all the old passwords? Why would a company chose to not delete old passwords? Why not let users reuse old passwords?
7
votes
2answers
164 views

Is there any recommended approach for “upgrading” MD5 hashes to something secure? [duplicate]

I'm currently dealing with a couple of user accounts containing MD5 hashed passwords. These accounts got migrated from an old system into our current system which uses PBKDF2 for password hashing. I ...
6
votes
1answer
83 views

Is there a way to know if a server is using ssh public key or password?

I am wondering is there a way for an attacker through finger printing to find out whether a server is using public-key versus password authentication method for establishing an SSH connection?
-2
votes
1answer
337 views

How can someone hack Twitter accounts so fast? [closed]

You may have heard the news about ISIS twitter accounts hacked in light of the Orlando shootings. I am wondering how can it happen so fast (just 2 days after the incident) and what kind of technique ...
0
votes
0answers
40 views

Manually computable passphrases [duplicate]

I need to revamp my password scheme for my various logins on different sites. I had the idea to try and craft a method where I could, using just my brain, algorithmically recall a password so that ...
0
votes
2answers
209 views

Is PIN affective security for credit cards considering it's not always needed?

This question asked about how having a PIN is safer than signing the receipt when doing a credit card transaction (personally the question makes no sense to me as it's just a scientific fact that a ...
27
votes
3answers
4k views

Can I share what password hash function I used in a public report?

I have developed a web site during an internship, using a database with accounts. I used the crypt() method from PHP, with a secured algorithm plus salt (found on the web with a lot of feedback). ...
1
vote
2answers
70 views

Password storage in 1password and other similar password storing applications

My understanding of memory in a computer is that it is stored in blocks that are over written only when the computer finds it convenient. so if a program asks to write in a certain block rather than ...
2
votes
1answer
79 views

What encryption is used by 1password?

I use a password storage application on my Mac called 1password. I was wondering if it encrypts the data it stores on my computer and decrypts it using a key made from my "one password" or if it has ...
4
votes
1answer
109 views

Web Based penetration test that uses MD5 for password

I'm trying to penetrate test a web based form (which is MikroTik's login form) with different tools for security measurement. I've tried THC-Hydra but problem is the password computed as MD5 first ...
5
votes
2answers
986 views

Why is whatsapp using 6 digit codes for verification?

My question is kind a simple. Why does whatsapp use 6 digit codes to verify the device? They could also use 5 or 7+ digits and or alphanumeric characters. Are there any reasons they chose exactly 6?
-2
votes
0answers
18 views

How to make a excel file that will lock after one year from the date of enterinf password [duplicate]

I want to make a excel file that will lock automatically after one year.and there will beca password which can open it for next one year. Is it possible to make such type of file??
-5
votes
1answer
132 views

Where do webstites store the hashes? [closed]

I understand that lots of websites store passwords in hashes but where do they actually store the hashes? How can a website compare your hashed version of a password with theirs? Is it stored ...
0
votes
0answers
16 views

Password Managers — Generating Passwords On The Fly a Safe Approach? [duplicate]

Most password managers store user credentials for individual services encrypted on their own back-end databases, so that your passwords are available on multiple devices. So, a DB compromise on these ...
1
vote
2answers
133 views

What are the recommended steps involved in creating an encrypted file format? [closed]

I'm developing a pretty standard program which lets users save their work in a custom file format and reopen it later. Now I'd like to add the capability to encrypt the file using a user-defined ...
6
votes
3answers
130 views

Why are low-entropy passwords considered OK in many cases?

When talking symmetric encryption, a 56 bit key is known to be so weak. If you use it for your encryption, you are considered a goner as you wont survive brute-force. When talking passwords however, ...
1
vote
3answers
124 views

Is it secure to send a password recovery link for company application to an employee's personal email address?

I would like to automate the recovery of the password for the employees of a company. However, the problem is that not every employee has a corporate email account and some employees can't access ...
62
votes
5answers
5k views

Do 2FA sites leak info by confirming a correct password guess?

Here's my relatively layman's view of the issue. Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly. ...
0
votes
2answers
107 views

Secure password generation for different websites [duplicate]

I came up with the idea to generate passwords for internet sites by the following shema: $masterpassword $hostname $TLD hashfunction($TDL.$masterpassword.$hostname) So the actual password is a ...
24
votes
8answers
4k views

Patterned password, based on site name [duplicate]

I'm considering implementing a pattern for my passwords, using the following ideas: Master password that I store nowhere An algorithm to mangle it based on the site I am accessing So for example I ...
0
votes
2answers
107 views

Password security in a Snapchat photo

This is going to be an extremely stupid question, so forgive my ignorance. Let's say I took a Snapchat photo of one of my passwords written in plaintext (let's ignore for a moment the security ...
3
votes
2answers
143 views

Are password generators secure?

Here's a scenario that I often encounter: Some user needs access to something on my network, but they don't have an existing account in AD. I create an AD account for them which I then use to allow ...
5
votes
3answers
148 views

Does salting your own password improve security? [duplicate]

Let's say you were to add a couple of extra characters to your password, unique to each site you visit. The password would be largely similar except for a few characters of salt, possibly taken from ...
20
votes
3answers
4k views

Why do password creation/login screens hide the typed password?

I realize that the concept behind obscuring a password on a screen is to prevent someone "shoulder surfing" behind a user and seeing the typed in password. As a fairly good typist I have no problems ...
8
votes
4answers
370 views

Is autocorrecting typos in passwords secure?

Technology Review's Why Autocorrect for Passwords is a Great Idea says: New research shows those frustrations could be avoided using the same approach used to fix typos in text messages and ...
0
votes
1answer
36 views

Securely stored secondary password

I'm currently writing a portal site for Microsoft Dynamic CRM, the portal works like this: Each user has his own account to login to my portal. Each user is assigned a seperate CRM credential by ...
17
votes
6answers
3k views

Correct terminology when describing password security to layman

I am writing a page for our website which describes the measures we take to keep our customer's information secure. On this page one section describes how we keep their passwords secure. We are ...
87
votes
12answers
12k views

Is a 6 digit numerical password secure enough for online banking?

My bank went through a major redesign of their customer online banking system recently. The way security is managed across the platform was also reviewed. The password I am able to set now to log in ...
7
votes
2answers
224 views

Why does Mozilla Firefox encrypt saved passwords?

If you ask Mozilla Firefox to remember the login details for a website, the credentials will be stored in your profile directory in Logins.json. Instead of storing plaintext values, the username and ...
-5
votes
1answer
59 views

Is possible to get password with stored XSS? [closed]

Is it possible to get password from a site with stored XSS? I have a forum where I can put JavaScript not directly but inside HTML (like <div onclick="alert()">CLICK</div>). Is it possible ...
-3
votes
2answers
97 views

Will hashing a password, and then splitting it into multiple db fields increase security? [duplicate]

I've been reading up on Password hashing, and it seems like there is a lot of opinions on "What's right." I'm curious about the possibility of storing a split of a Hashed password in multiple user ...
-2
votes
3answers
83 views

Is there something other than “if” and “else”

There are many ways for protecting a password like using strong algorithms like SHA-512, using salts, encrypting the database where the password is stored, packing the license file with UPX etc and ...
0
votes
1answer
163 views

Encrypt password with salt

Can anyone explain why formula 1 is safer than formula 2?I don't get it even I get the answer. According to 2, it says as s is in plaintext form, the attacker can decrypt the password by (y.s). Isn'...
2
votes
3answers
971 views

Is there a civilian friendly indicator of stored password safety?

As I understand it, by using one-way encryption we can protect stored password data in the event that they are stolen. Broadly speaking, password data can usually be cracked by guessing so the ...
1
vote
1answer
47 views

Challenge-Response Application in E-banking

Why is it important that Alice doesn't know K? What could happen if Alice knew K?
2
votes
1answer
57 views

Will the Credential Management API now available in Chrome 51 be widely adopted?

Google Chrome 51 stable includes support for the Credential Management API. This implementation is based on the W3C spec. Will other browsers support this technology (particularly Safari)? Will web ...
1
vote
1answer
80 views

What is the right strategy for me to develop a paid public wifi?

I want to establish a paid public WiFi system. Here is my model of how it will work: I will install a public WiFi in my apartment. Using the WiFi system is paid but, voluntary. Those who pay me a ...
64
votes
4answers
8k views

Does Microsoft's “Password Ban” list insecurely store user passwords?

Supposedly, Microsoft is banning common passwords, and their list will dynamically update: Microsoft says it is dynamically banning common passwords from Microsoft Account and Azure AD system. [&...
1
vote
3answers
88 views

Could these special characters be used in a password?

To use a good password, I was thinking about adding special characters. I remember that some login services don't allow all characters. Perhaps it depends also on the keyboard layout. Could these ...
0
votes
2answers
42 views

Is there any added security/vulnerabilities if you allow a “trusted-party” to vouch you are legit, if you were locked out of your account?

I was reading this answer on a question. http://security.stackexchange.com/a/498/106817 Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at ...
2
votes
1answer
177 views

How can Windows 10 not have the password in memory?

I have read that Windows 10 does not hold the password in memory from the creator of mimikatz: Starting with 8.x and 10, by default, there is no password in memory. Exceptions: When ...
3
votes
3answers
185 views

Is it acceptable for customer service to ask for my PIN?

I tried to initiate an online chat with customer service of a company I am trying to do business with this weekend, but before they would answer any of my questions they requested that I give them the ...
3
votes
3answers
190 views

Sending sensitive infromation via self destructing link in an email

I need to come up with a simple way for people within the company to send out arbitrary sensitive information to arbitrary recipients. There is an equal chance that the sender and recipient will be ...
4
votes
1answer
81 views

Are there problems with reusing strong passwords for private gpg keys

I am currently maintaining a few different identities each associated with different gpg keys (for personal, academic, professional correspondence etc., whether or not this is a good idea is probably ...
0
votes
2answers
163 views

store passwords as one-way-hash, or just use it as an AES key?

I want to store some data so the only one who'll be able to access it is the user itself. Here is my idea: when user registers, his password will be hashed in SHA256 (so it'll fit as an AES key), and ...
6
votes
4answers
389 views

Why is using SQL injection to extract passwords or password hashes from a login database (that should never legitimately disclose them) even possible?

(Okay, so I'll confess upfront that while I'm trying to educate myself the current state of my knowledge on web applications security is still pretty shallow. So I appreciate your patience if the way ...
1
vote
1answer
112 views

How to implement iterations when hashing passwords?

To securely hash passwords, algorithms such as PBKDF2 do many iterations of a common hash such as SHA1. Are there certain ways that these iterations need to be done to be safe? In particular, from ...
1
vote
1answer
96 views

How is github 2FA personal access token more secure than passphrase?

I recently enabled 2-factor authentication (2FA) on my github account. Once you enable 2FA, you can no longer connect to the repo using your normal passphrase using command line tools. You have to ...
1
vote
1answer
97 views

How does JDBC send passwords to the server?

I am really curious about how JDBC sends passwords to the server. While I understand that is simply an API and it depends on the implementation, are they usually hashed and then sent to server? If I ...
0
votes
1answer
89 views

Windows security & data protection

I work for a hotel. The hotel stores a MySQL database online. This database only contains a Reference ID, number of nights and so on, but no private data. No names, no personal information on guests. ...