Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

5
votes
1answer
86 views

How to implement a password change policy when user's centralized password is in a lot of places?

I would like to implement password changing in an organization but they have the domain controller/LDAP passwords "all over the place". They have the passwords in a lot of places, for example, in ...
0
votes
1answer
57 views

How does one securely create a MySQL database and user via the command line?

I'm making an app whose functionality includes creating a database and its user. This is accomplished like so: mysql -e "grant all on database.* to 'user'@'localhost' identified by '$PW';" $PW is ...
1
vote
1answer
64 views

Storing credentials for desktop app

I have desktop application written in C# with three user roles and some predefined users. It is also possible to create another users or change passwords to predefined users. App has to work offline ...
1
vote
0answers
26 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
0
votes
1answer
39 views

Securing HSM's Login Keys

I have an PKCS#11 enabled application which interacts with HSM to store TDES keys. The HSM is initialized with the Security Officer (SO) password provided by the user while the application was first ...
23
votes
4answers
5k views

Why did Richard Stallman recommend not to use passwords for wireless networks? [closed]

In a short interview, Richard Stallman recommends not to put passwords on your wireless network. In the OS Revolution documentary he also mentions how he's disliked passwords ever since his job at MIT ...
1
vote
1answer
70 views

Copy-and-pasting plaintext data from encrypted container

Suppose we have sensitive information stored in plaintext within a dm-crypt/VeraCrypt encrypted file and this information is copy-and-pasted by a user into a web browser after decrypting (this could ...
-1
votes
2answers
33 views

What could be a suitable solution to single factor authorization worksheet bank password circulation with no control?

Passwords for various banks are written in an excel sheet and this excel sheet is password protected. However, there is no control on circulation of this sheet, for many banks only single factor ...
5
votes
0answers
61 views

Samba printer usernames and passwords , security problem

Password leaks , printing from Linux client to windows based print server When authenticating Linux users for using a windows share printer on their machine, the windows domain user-name and password ...
3
votes
1answer
68 views

Security problems with password-less SSH

Is there any downside of configuring password-less SSH authentication? Although it is very handy and secure, if someone gets access to my system with my account and there is password-less ...
5
votes
1answer
159 views

Router sends password plaintext: is this a serious vulnerability?

Today I went to go & reset my router, but forgot the account password for the ISP. On the (extremely) off-chance of the password being present in the 'Password' field, I went to the appropriate ...
3
votes
1answer
130 views

How to read the key3.db file?

The file key3.db contains the key that is used to encrypt the Firefox passwords stored in logins.json file. I don't use master password in Firefox, but according to this article, my passwords are ...
1
vote
1answer
63 views

Is it secure to allow an account to use `test123!` as their password?

I'm working on tightening up security for the auth layer of my app and I'm currently making a call on the complexity I'll require for passwords. Is there a 'standard' recommendation for complexity? ...
5
votes
1answer
594 views

Is it bad to add a guessable password to a random password?

Let's say a person has a password they used before they knew about how to make good passwords, like peter123. Let's also say that when they were thinking of a better password, they found they could ...
22
votes
1answer
1k views

How does Firefox encrypt passwords without selecting Master Password?

I know that the file logins.json contains all my encrypted passwords in Firefox browser. How does Firefox encrypt these passwords if I don't use the 'Master Password' option? Does this mean key3.db ...
2
votes
1answer
32 views

What are the demerits of a derived salt for password storage?

The general method used for storing passwords securely involves generating a salt, feeding the salt and password to the password hashing function, and then storing the salt and the output of the ...
-2
votes
1answer
62 views

Password complexity policy and practicality [closed]

If you are a user and your company implements a password policy that says your password must have at least 8 characters, at least 1 number, at least one alphabet and at least 1 special character, ...
0
votes
0answers
68 views

Generate password list with specific keywords and length

I need to generate a list of passwords to try penetrating into a wi-fi network. I have a pretty big list of keywords and I want to use them to generate as many possible passwords as possible, which ...
2
votes
1answer
66 views

What are the security features of the Microsoft PasswordVault class?

There doesn't seem to be much information on the PasswordVault but it seems to provide for local encryption of credentials. There are references to it in this source code and this blog. The reason ...
72
votes
14answers
7k views

How to store passwords written on a physical notebook?

Answers to the question "How safe are password managers like LastPass?" suggest that storing personal passwords on a physical notebook might be a reasonable option: I know someone who won't use ...
2
votes
2answers
194 views

Why are there places that still advises to use complex-only passwords? [closed]

Why are there organizations, websites that still, in 2015 advises that people should use complex, at least 8 character long passwords? Why doesn't they advise to use password-managers, long ...
1
vote
1answer
35 views

Is there a PAKE algorithm where the passwords can be tested in the first round?

I want to use PAKE for key exchange between two parties (Alice and Bob) which share a low entropy secret (a password they exchanged on a piece of papers). Alice and Bob use a software on there ...
0
votes
1answer
79 views

Could there be any implementations where the pw is truncated after “space”

A good human memorable password could be: My 1st passw%%%%%!!!!!rd But could there be any password storing implementations that cut off the password after the first space, so the password will be ...
0
votes
1answer
89 views

LastPass website requests Master Password when creating the account

When I wanted to tryout out LastPass today, I was stunned that the webpage form for creating the account at LastPass actually requested the "Master Password", which is the same "Master Password" that ...
4
votes
3answers
141 views

Is there more to consider than just keyspace when determining a password's strength?

Please consider the following passwords: CO/l37)[Ou It contains characters taken from a pool that contains [a-zA-Z0-9] and 32 'special' characters. That makes 94 characters in total. And this one: ...
6
votes
2answers
113 views

If no maximum length is placed on a password, can't collisions occur?

As I was thinking about storing password hashes in a database, it dawned on me that there might be hash collisions if there is no set maximum length for the password being hashed. My understanding is ...
11
votes
8answers
260 views

How to choose a password that I have to remember for a long time but do not use a lot

I have a scenario where I have to remember a password / keyphrase, which I will not be able to recover if I forget it, for a long time (probably more than 10 years). The problem is because this ...
4
votes
1answer
80 views

Is keepass random password generator fully secure and trustworthy?

Am I safe using keepass for generating passwords? For example my accounts, am I safe using a keepass generated password? Could my future keepass master-keys be safely generated in keepass? What method ...
-9
votes
1answer
135 views

Can you decrypt this encrypted password? [duplicate]

I'm coding a social network so I need to get serious about security as people will be sharing personal information on my site. Can you decrypt this encrypted password? ...
36
votes
6answers
7k views

Somebody hacked my router and changed my wifi SSID

One of my neighbours hacked the password of my router and he uses my limited internet package. I change the wifi SSID almost daily, but he can hack it easily. Today, he changed the SSID to a hate ...
0
votes
0answers
15 views

How to store shared passwords? [duplicate]

Sometimes it's needed to have shared passwords because the work is done by teams. Let's not get to ssh-key login, we are talking about passwords. Question: How to store shared passwords securely in ...
5
votes
4answers
232 views

Password guessing: Is it more effective to try many passwords against a few accounts or a few (very common) passwords against many accounts?

I was watching a security vid on Irongeek the other day (I immediately lost track of which specific vid, unfortunately) where the creator gave some interesting advice about doing live password ...
0
votes
2answers
69 views

Need to protect passwords (or 1fa) in the context of 2fa

I am trying to get some clarity on this. I am not looking at personal or risk mgmt perspectives. Why do we need to protect passwords (or 1st factor) in the context of 2fa (or multi factor ...
2
votes
0answers
51 views

Reviews of Argon2

I am not a security guy but just curious about the things here. I have seen several people in various answers here talked about the password hashing competition. Now that the winner is announced, I ...
12
votes
4answers
1k views

Does an *additional* company-wide password offer any real security?

So, let's say a company has what could be referred to as an "access key". Each user has their own username and password, and there is an additional company-wide access key that people must input with ...
2
votes
1answer
57 views

Strength of variable-length generated password

I am contributing to the Word Sequencer plugin for KeePass password manager, which can generate diceware-style passwords using a high-quality PRNG. Something in particular I'm working on is estimating ...
1
vote
4answers
239 views

Complex password rules - is there any sense?

Let us assume that our system is well designed and it limits the amount of login errors so that brute force attach on the user interface is not possible. Say after 5 failed logins for an account the ...
20
votes
4answers
2k views

Is it safer to ssh as a privileged user than to ssh and sudo?

I came across this old paper, discussing the possibility of password length information being disclosed when usin SSH: Timing Analysis of Keystrokes and Timing Attacks on SSH. The paper has been ...
1
vote
0answers
76 views

Securely storing users PIN on Android with fingerprint authentication

I am have an Android app where the user can enter a pin specific to a particular phone to save them entering the full password. I'm now looking at the new fingerprint reader API on Android M where I ...
4
votes
2answers
688 views

I tried to break my WiFi: is 8 uppercase letter strong enough?

My Wi-Fi WPA-PSK password looked pretty weak: 8 uppercase letter. I have checked with another router from the same provider and the pattern is the same. To see how weak this is I tried to hack it ...
0
votes
1answer
49 views

Software activation “by phone” [closed]

I'm a software developer, and I would like to protect my application in an offline way, like many software do activating by phone. Following a screenshot taken from google images on what I would like ...
27
votes
9answers
3k views

Best way to administer all my passwords

I am trying to figure out what the best solution is to store different types of passwords: Personal passwords (my personal email, my company's email, all the services I use to buy things like ...
0
votes
2answers
127 views

How can a weak root password be compromised?

I use ubuntu for personal computing. I've read an advice in many questions here to have a strong root password. I don't understand what's wrong with a weak root password. After all we have to type ...
0
votes
0answers
70 views

Hydra command for cracking a webpage which uses <span> tag for failed login attempts

I'm trying to for crack a simple webform for testing hydra in Kali. When the webpage encounters a wrong username and password combination it pops up a message using the following html code:: ...
3
votes
2answers
163 views

Why is a bad idea to use a common password form?

I've heard that its a bad idea to create passwords based on a common form such as random letters appended with the start of a websites domain name. So for example a password to gmail might be ...
3
votes
3answers
94 views

how is strength of password calculated from standard keyboard patterns?

In password strength calculator is there an algorithm to determine the keyboard pattern? there could be thousands if not millions of patterns that could be generated with a standard qwerty keyboard. ...
1
vote
2answers
31 views

Rembering password on client (not database) [closed]

I am trying to implement the capability for my program (C++) to remember a user/password combination, so the user does not need to type it in again. Is there a secure way for my program to store ...
2
votes
1answer
88 views

How to store client login credentials?

My company has to constantly connect to remote server where there are numerous way to access, often via vpn and remote desktop connections, as well as SQL servers. There are over 50 clients that this ...
8
votes
4answers
2k views

Hashing passwords and dealing with duplicates

Currently my project still uses MD5 hashing to encrypt passwords. Yeah, I know. I'm planning to update the password system to use the newer password_hash and password_verify functions in PHP, which ...
2
votes
3answers
185 views

I didn't wipe my hard drive before I sold it. How would a criminal take advantage?

I just sold a Mac Mini, and I erased/formatted the hard drive before I turned it over, but I didn't wipe it securely (not wise, I know). How would a criminal take advantage of this fact? What is the ...