Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
6
votes
3answers
194 views
What is the value in asking for a second password for sensitive operations?
When a user has logged in to a system using their primary password, is there any value in asking for a distinct second password when performing sensitive functions?
Does it provide any benefit over ...
3
votes
1answer
85 views
How does VTP authentication prevent unauthorized access (Can the password be cracked given captured packets)
I know that when setting up VTP across switches in a network you should set a secret/password to prevent unauthorized requests. My question is I know that this uses an MD5 hash to ensure that ...
0
votes
2answers
101 views
Does excluding username letters from passwords increase security?
Recently I was asked to change a password, along with a password policy which reqires you to use a digit, a special character and a letter, but forbids any letter from you log in name to be used for ...
15
votes
6answers
537 views
Is there additional security value in using passwords with words or phrases in non-English languages?
I was thinking about correct horse battery staple. I am not a native English speaker. In my language, the above could be written as:
vqrno kon bateriq telbod OR
вярно кон батерия телбод.
Keep in ...
11
votes
4answers
455 views
Handling passwords in a web application
I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client ...
2
votes
0answers
38 views
Is it the default in billing systems to send out the users password by email? [duplicate]
I recently made a complaint to a company about them sending out passwords in plain-text via email upon registration knowing that it is a potential security risk.
One of their employees responded with ...
1
vote
1answer
201 views
Use brute force to mitigate brute force
Just an idea I had, and I am sure there is a lot of material about this subject, so I am looking for a pointer as to where I can find more information.
My idea is this...
When storing a password in ...
20
votes
8answers
1k views
Why improvising your own Hash function out of existing hash functions is so bad
I'm afraid I'll have tomatoes thrown at me for asking this old question, but here goes.
After reading that cooking up your own password hash out of existing hashing functions is dangerous over and ...
17
votes
4answers
976 views
When hashing passwords, is it ok to use the hashed password as the salt?
I don't like this idea. But I can not come up with a technical argument against it. Can somebody explain it to me? The basic idea is:
$passwd = 'foo';
$salt = hash($passwd);
$finalHash = hash($passwd ...
5
votes
4answers
307 views
Why using random salts?
I read this blogpost on how to store passwords in a database, the secure way. Elbert tells us to do this:
Generate a random salt and include something random and the username in it. Hash this.
Hash ...
211
votes
13answers
36k views
What technical reasons are there to have low maximum password lengths?
I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites I actually care about ...
7
votes
3answers
200 views
Is a password in the clipboard vulnerable to attacks?
I see situations where you may have to input the same password more than once. You may type it in a text editor and copy it to clipboard, to paste it two or more times.
In what scenarios this could ...
3
votes
3answers
382 views
Can password-protected zip files be broken without brute force?
You have a zip file that you created with 7z to password-protect it with AES 128. Can a smart adversary extract the data only through brute force, or is the file vulnerable to other attacks - such as, ...
2
votes
1answer
454 views
How long it will take to crack a RAR password?
I wonder how long it will take to crack 16 character alphanumeric WinRAR password for a mini supercomputer. As far as I know graphic cards are preferred over CPUs to crack passwords nowadays. If we ...
1
vote
1answer
39 views
Parameters in output of password hashing function
A number of encryption functions include their tuning parameters in the output. For example, SCrypt, which I've been considering for an app I'm building, outputs in the following format:
...
2
votes
2answers
156 views
user authentication by decrypting a random blob
Normal user authentication is done by comparing "hash"-values. A simple example of this:
The user password is hashed with PBKDF2 on the client using a salt (the salt is the hash of the user password ...
7
votes
4answers
819 views
Why does getting a password wrong takes more time than not
I type my password to login to Win or Linux.
Case 1: I get it right. Almost instant reaction.
Case 2: I misspelled it. It takes a while, and then rebounds.
Why does it takes longer to identify a ...
10
votes
2answers
288 views
Zip file with two password
I used this command to password protect a zip file on Linux :
zip -P 9000 hash.zip hash.py
and it creates the zip file just fine, then I wrote a program to test every possible password on it from 1 ...
5
votes
7answers
467 views
How easy is it to find a password in a huge text file?
Say that my password is PASSWORD1 I have a 10MB jumbled text file. I hide my password in two parts in the text, between > and < so I can find it myself. Then I put the 2 parts together and add the ...
2
votes
1answer
120 views
UUID and Open_id in cookie 'good' enough?
I am using Tomcat 7, jsp to build a small website. I am new to security and it is a school project so using Spring Security is not an option. I am attempting to store UUID and Open_id in the clients ...
4
votes
1answer
144 views
Reducing password length with hash function
Suppose I would like to use a very long string as a password. As an example we can just say this string is 100 characters in length.
However, suppose the application for which I would like to use ...
2
votes
2answers
71 views
Is there any way of recover a locked drive using TPM?
Just reading I learned about the TPM technology and how it works.
However, it make me wonder... if the motherboard crashes, is the data lost forever? Because you can't use the drive in other system ...
10
votes
2answers
1k views
Why are GPUs so good at cracking passwords?
What is it about GPUs that lets them crack passwords so quickly?
It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
0
votes
1answer
107 views
Recover password or password hash from locked acount.
I have a locked administrator account. Other accounts is unlocked, but it has no rights. I want to get a password from the locked account, or maybe password hash, if possible.
3
votes
1answer
91 views
Can a user's Apple Keychain be opened on a different computer?
Apple uses a nice keychain. This is used by, for example, Google's Chrome browser.
Imagine a user copies all the keychain files.
Would that user be able to unlock the keychain, if they knew the ...
5
votes
1answer
116 views
When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?
When you take ownership of a TPM in Windows 7 you encounter a screen like this:
Based on this document, it is my understanding that completing this dialog box somehow results in the generation of ...
-3
votes
2answers
294 views
Is pixel based image encryption secure?
I have encrypted an image using pixel encryption method. I just used a bmp image for that. What I did is, I retrieved each pixel value from the image and obtained the value of red, green and blue ...
13
votes
2answers
259 views
Concrete figures on password cracking in the wild
While password guessing is a science, not every attacker out there is up-to-date with the latest advances or cares to invest in GPUs or FPGAs.
It's easy enough to test online password guessing ...
3
votes
2answers
126 views
What exactly is the impact on security when forcing user passwords to contain a particular character?
Some years ago a sysadmin of large computing centre (on a campus) enforced the password of every single user to contain the character $ at an arbitrary position. They soon dropped this policy but I ...
3
votes
4answers
160 views
Temporary passwords e-mailed out as plain text
Is this a security issue? Many big ecommerce platform companies use this feature. Where if you forgot your password, they e-mail you a temp password.
Could someone potentially figure out the ...
2
votes
1answer
99 views
Pointers for john the ripper rulesets
I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to ...
10
votes
3answers
427 views
How much information about the reason for an unsuccessful login should a web application give?
After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application ...
6
votes
3answers
229 views
Increase the security of an already stored password hash
Right now we're using 1024 byte PBKDF2 with 256 byte user-specific salt and variable iterations. However, I would much prefer to be able to, perhaps once every year or two, to be able to flat out ...
2
votes
2answers
123 views
MySQL Access Control?
I have read somewhere that it is better to have two different MySQL logins in order to prevent hacking. What I mean is having one MySQL login for read access (SELECT permission) and another login for ...
4
votes
5answers
211 views
Are password complexity rules counterproductive?
In creating a login for this site I chose a nondictionary password that would be extremely hard to guess, but easy to remember.
I was told that it did not meet complexity rules.
After several ...
1
vote
2answers
196 views
Password Protected Zip: if attacker had one file, can use it to decrypt all files?
Consider a folder containing the following files:
(file1.txt, file2.doc, file3.pdf) all zipped and password protected, if attacker had one of these file, can use it for decrypting all without knowing ...
139
votes
18answers
7k views
Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field
Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
3
votes
2answers
208 views
Is GPG suitable as part of a password manager and generator?
I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
6
votes
3answers
670 views
Tools helps: First time cracking passwords
I am trying to crack passwords on two Windows member servers (2003 and 2008). There is no Active Directory. Each user seems to use the same password across servers, workstations, etc. I have access to ...
2
votes
3answers
194 views
Client-Side Hashing to decrease value of password guessing heuristics
Yes, this is 'yet another client-side hashing' question. But, don't leave yet, I think there is some value here.
I'd like to do something to mitigate the affect on the community as a whole when my ...
8
votes
3answers
263 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
2
votes
7answers
234 views
How to provide security for passwords stored in Database? [duplicate]
Passwords of end Users are stored in Database which is encrypted (using one way hash like MD5). Apart from me, there are 'other' people belonging to other teams who have access to Database which means ...
0
votes
3answers
337 views
What about fuzzy passwords? For “correct” entry within a margin of error?
I'm wondering if a fuzzy password system would be in any way beneficial to users, or worth implementing.
The idea would be that a certain margin of error is acceptable for allowing the user to log ...
2
votes
4answers
267 views
Yahoo Email Keeps Getting Phished
I keep getting spam emails from myself (and I am sending them to others as well) on my Yahoo Mail account. I have already went through two password changes which I thought were secure. My very last ...
3
votes
2answers
193 views
LastPass One Time Recovery Passwords--How?
The LastPass password manager stores One Time Recovery Passwords locally in each browser you use the plugin with:
http://helpdesk.lastpass.com/account-recovery/
My question is, how can you have more ...
1
vote
2answers
274 views
What is the safest way to store a password in a single file?
I've been reading about it. This article helped me a lot. But the more I read the more complicated it seems. For example:
Is it better to use bcrypt, or PBKDF2, sha2 or something else for the salt?
...
4
votes
1answer
112 views
Need to ephemerally store third-party password
One particular web service that I am writing interfaces with an API. Each API call requires the user's username and password to be sent, no state is maintained.
Ideally, when using my web service the ...
6
votes
2answers
189 views
When, exactly, should old password reset tokens be deleted?
I'm trying to figure out best practices for working with password reset tokens.
Say a user initiates the password reset process and the are emailed the reset token and we store a hashed copy in the ...
3
votes
2answers
189 views
File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?
I've been using this command to encrypt files for a while now:
openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc
Then I type in a password.
Can someone tell me, roughly speaking, ...
1
vote
2answers
86 views
How to protect against an attack where a person claims to be in a position of authority?
In an office if a person approaches an employee and claims to be a new IT staff and to give them access to their computer, what can prevent this kind of attack? I've worked a couple tech support jobs ...
