Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
20
votes
2answers
968 views
Does versioning an encrypted file make it less secure?
Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices.
The kdb file in itself would be encrypted, but ...
20
votes
3answers
817 views
MD5 collision attacks: are they relevant in password hashing?
DISCLAIMER: This is not an endorsement of MD5 as a password hashing function. I know about parallelization, GPUs, and dedicated password hashing functions like bcrypt and scrypt.
With that out of ...
19
votes
3answers
974 views
Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers?
I just saw for the first time a new way to enter a password, at the Banque Postale (French Bank). You are given a virtual numeric keyboard and to type you can just leave the mouse cursor over a number ...
19
votes
5answers
980 views
Is it alright to tell everyone your encryption information?
I have an account in an online banking system and they have the FAQ with something like this:
How secure is the <Online Banking System Name>?
Each page you view and any information ...
19
votes
11answers
921 views
Is it safe to use a weak password as long as I have two-factor authentication?
I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
19
votes
3answers
811 views
Am I wrong to believe that passwords should never be recoverable (one way hash)?
I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
19
votes
2answers
4k views
HMAC - Why not HMAC for password storage?
Nota bene: I'm aware that the good answer to secure password storage is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding.
Let's say ...
18
votes
6answers
884 views
Online password managers
Can online password managers be used for storing and managing passwords? I mean from the security point of view. I understand that those systems can be different and some deserves more trust than the ...
18
votes
5answers
1k views
How valuable is secrecy of an algorithm?
On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
18
votes
3answers
606 views
Does password-protecting a server's BIOS help in securing sensitive data?
I'm running a server of which I protected the BIOS with a password. One doesn't have to enter this password before booting, but before entering the BIOS setup. I just did this from routine. However, ...
18
votes
5answers
1k views
Is my bank storing my password in plain text?
My bank (and every bank I've come across) only ever asks for individual characters from my password when logging in. Is my bank storing my password in plain text?
18
votes
5answers
705 views
Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?
I just wanted to know if you can increase the cost (iterations) of those two algorithms off-line.
I want to increase the cost every year of my users passwords.
One solution is to recalculate them ...
18
votes
4answers
2k views
How secure are my passwords in the hands of Firefox using a Master Password?
I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
17
votes
7answers
2k views
Why don't people hash and salt usernames before storing them
Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext.
What I ...
17
votes
6answers
1k views
Why do we ask for a user's existing password when changing their password?
In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
17
votes
4answers
971 views
When hashing passwords, is it ok to use the hashed password as the salt?
I don't like this idea. But I can not come up with a technical argument against it. Can somebody explain it to me? The basic idea is:
$passwd = 'foo';
$salt = hash($passwd);
$finalHash = hash($passwd ...
17
votes
4answers
549 views
Should I be concerned when a “Forgot Password?” tool sends my password in plaintext?
Some sites I have been a member of in the past don't go through the normal "Forgot Password?" process. Instead of e-mailing me a unique password reset link or something of the like, I have received ...
17
votes
9answers
1k views
Is a simple, but very long password a good password?
Is a password like
wwwwwwwwwwwwwwwwwwwwwwwww9
(25x 'w' and a number) secure? It would be easy to remember.
17
votes
7answers
738 views
Are common passwords at particular risk?
The question Should we disallow common passwords like “password” and “12345”? on User Experience immediately made me think that these common passwords were extremely dangerous not because they are ...
17
votes
6answers
787 views
Why do some sites prevent users from reusing their old passwords?
I have always wondered why it is that bad to reuse old passwords; it should not be the end of the world if we happen to use an old password that we previously used.
After all, I believe most of the ...
17
votes
5answers
1k views
What's the practical limit for rainbow-table based bruteforce?
Say we have a hash of a password. The password can be considered to be made of of totally random characters and has a fixed length of N. The hash is SHA1(password+salt), where the salt is of length M. ...
17
votes
3answers
3k views
Deleting a Java Object securely
I know that in order to delete a Java object I should use character array instead of String, since I can safely erase (rewrite the character array with other data) its content. This seems not to be ...
17
votes
5answers
681 views
Is there any legal reason to save a cleartext password?
I called customer service of a well known company and discovered that the operator had the ability to view my website password in clear text on her screen.
I asked her about this and she defended the ...
17
votes
8answers
4k views
Feeding /dev/random entropy pool?
Which way of additionally feeding /dev/random entropy pool would you suggest for producing random passwords? Or, is there maybe a better way to locally create fully random passwords?
17
votes
5answers
953 views
How can I choose a strong password that is easy use on a smartphone?
Typing on a smartphone is tedious. Special characters are the hardest; lowercase letters are generally the easiest. But even a long all-letter passphrase like "correct horse battery staple" is ...
17
votes
2answers
874 views
Sending temp password when users first registered - is that good for anything?
One of our clients has sent us a list of security requirements. One of them was that registration does not including setting a password - once complete, a temp password is sent to the user, and the ...
17
votes
9answers
2k views
Best password strength checker
In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or ...
16
votes
3answers
964 views
Is there any advantage to splitting a password?
I've been reading about the LANMAN (LM) hash and I'm curious about a particular part of the algorithm.
The LM hash is computed as follows:
The user’s ASCII password is converted to uppercase.
...
16
votes
4answers
1k views
What should be used as a salt?
I always hear that it is best to use salts on top of stored passwords, which then somehow gets concatenated and hashed afterwards. But I don't know what to use as a the salt. What would be a good ...
16
votes
5answers
1k views
Do non-keyboard characters make my password less susceptible to brute forcing?
I can put characters in my password for which there are no keys on a keyboard. On Windows, Alt+#### (with the numpad) inserts the character for whatever code you type in.
When I put this in a ...
16
votes
5answers
400 views
Hashed password storage with random salt
Ever since I've been making sites that require a user to log in with a username and password I've always kept the passwords somewhat secure by storing them in my database hashed with a salt phrase. ...
16
votes
5answers
812 views
Why do some websites and programs restrict password characteristics?
There are some websites and even programs that I use that have rediculous password restrictions. Lots of forums for instance restrict passwords to ~32 characters. Others enforce a restricted charset.
...
15
votes
7answers
383 views
To salt, or not to salt? [duplicate]
Possible Duplicate:
Why is using salt more secure?
Why would salt not have prevented LinkedIn passwords from getting cracked?
Recently I decided that I wanted to learn more about web ...
15
votes
12answers
2k views
Why do we even use passwords / passphrases next to biometrics?
In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...
15
votes
5answers
954 views
From a security standpoint should users be asked to confirm their password when registering?
Is it advisable to have users re-type their password to confirm it's correct? On User Experience the general consensus seems to be no but I'm wondering if this has security ramifications?
EDIT: my ...
15
votes
2answers
828 views
Salting password with the first 8 bit of the password itself
Do you guys think salting password with the first 8 bit of the password itself will have same result as using stored salt to hash password?
[Clarification]
I am not storing salt but creating from the ...
15
votes
3answers
2k views
Should I have a maximum password length?
I'm creating a webapp, and part of my authentication method is password length.
Should I put one in place? (say, 50 characters?) Or should I just put a minimum length (Currently at 6).
Are there ...
15
votes
4answers
628 views
If a website allows another person to get a list of the site's users passwords, how likely is it that the passwords are stored in cleartext?
We had an incident where some of our managers were given passwords for the people they supervise using a particular company website. Ostensibly it was done so the managers could check in on the users ...
15
votes
5answers
2k views
Security impact of using a public password for free WiFi
We have a WiFi network that we want to be public and free.
Does having a password that is known to everyone provide any additional security advantage to the people using this network as opposed to ...
15
votes
4answers
536 views
My credit union is reducing its maximum password length to 10 characters
I just received an email from my credit union saying they are redesigning their online banking service and that I will need to change my password by October 22 to conform to the new limit of 10 ...
15
votes
4answers
1k views
Why is using salt more secure?
Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
15
votes
6answers
536 views
Is there additional security value in using passwords with words or phrases in non-English languages?
I was thinking about correct horse battery staple. I am not a native English speaker. In my language, the above could be written as:
vqrno kon bateriq telbod OR
вярно кон батерия телбод.
Keep in ...
15
votes
3answers
2k views
How would you store a 4 digit pin code securely in the database?
I'm familiar with password hashing, using salts, bcrypt etc.
But it doesn't seem like this would work to store a 4 digit pin code since the attacker could try all 10,000 combinations quite quickly. ...
15
votes
3answers
2k views
Password manager vs remembering passwords
I have always thought that you are not supposed to use a password manager but to keep your passwords in your head, but lately I have thought about the pros and cons of having a password manager.
Some ...
15
votes
3answers
1k views
MySQL OLD_PASSWORD cryptanalysis?
The password hash used for MySQL passwords prior to version 4.1 (now called OLD_PASSWORD()) seems like a very simple ad-hoc hash, without salts or iteration counts. See e.g an implementation in ...
15
votes
2answers
2k views
Standards for encrypting passwords in configuration files?
My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they ...
14
votes
3answers
403 views
Is it OK to tell your password to an admin? [duplicate]
Possible Duplicate:
From a security point : Is it OK to tell your password to an admin?
I am working in a small company (20 employees) as a senior SW engineer.
After having some email ...
14
votes
6answers
741 views
Hash function change
I have user account passwords stored in a database using an unsafe (old) cryptographic hash function.
What is the best/usual approach to changing password hash function? Only two ideas come to my ...
14
votes
6answers
713 views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
14
votes
4answers
571 views
How to treat non-optional bad security questions?
Every once in a while I have to set up an account on a site that, while apparently at least not storing my password in plaintext, still force me to choose from a limited set of security questions that ...
