Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
4,019
questions
5
votes
2
answers
11k
views
Google: log in on a new machine without a phone [closed]
Trying to log into my google account from a new computer, I had no choice but to use my phone in order to connect, the options were:
use something like a "Security by Google" smartphone application
...
- 161
5
votes
2
answers
519
views
Why not 1FA with Google authenticator instead of passwords?
Why are passwords needed at all if the user signs in using a code from Google authenticator?
- 229
5
votes
5
answers
1k
views
How much is the entropy of a randomly generated password reduced if I regenerate until I get a password I like? [duplicate]
In many of the answers and comments on the well-known XKCD #936: Short complex password, or long dictionary passphrase? question, the importance was stressed of generating the password randomly, and ...
- 4,763
5
votes
2
answers
755
views
Possible way to extract sudo password from running system via the clipboard
I use to copy and paste my sudo password from a KeePass file so I guess the plain text user password will be saved in RAM at some point when I use it, for example, to accept an update. Is that right?
...
5
votes
4
answers
3k
views
Are there any disadvantages to encrypting the password hash?
Is encrypting the password hash in database more secure than storing only the hash?
Suppose we store encrypted SHA-256 result with AES instead of hash directly. Is this a good protection from a ...
- 411
5
votes
2
answers
259
views
Should password recommendations be different for devices, networks, and internet?
I started using a password manager last year and updated nearly all of my internet accounts to super-strong, unique passwords, and that isn't a problem, cause I only access them from web browsers or ...
- 2,007
5
votes
2
answers
830
views
Stolen Laptop - Next steps
My laptop (modded 2007 Macbook Pro) was stolen 2 days ago when I didn't pay attention to my backpack in a tourist spot in Europe and while I'm quite certain they won't have much use for it (the apple ...
- 153
5
votes
2
answers
10k
views
What password-based encryption to use with standard Java 6?
Which password-based encryption method should I use in Java 6? It should be as strong as possible, but work with the default security policy file (not the export restricted one which you have to ...
- 153
5
votes
3
answers
3k
views
How can a company tell if my password is similar to the previous 5 passwords?
Closely related (but not a duplicate): Company can tell if new and old passwords are too similar. Is there a security problem?
Also closely related (but not a duplicate): How can a system enforce a ...
5
votes
1
answer
1k
views
Bruteforce FileVault Encryption?
I've been getting into forensics and penetration testing lately and hoping someone can explain what the below data is and how it might be used to perform a bruteforce (hashcat) attacks against ...
- 51
5
votes
1
answer
1k
views
Is the idea of Single Sign-On (SSO) a flawed concept without Two-Factor Authentication (2FA)?
Before this gets flagged as a duplicate, I'm not asking a question about the disadvantages of single sign-on, I'm asking if the initial concept is flawed to begin with without enforcing two-factor ...
- 223
5
votes
3
answers
1k
views
What are human weaknesses at generating a password which shall be random? [closed]
Assuming I know a person who made-up a password with the goal that it should be random because he will use it for a important service. I would like to figure out how I can increase my chance to guess ...
- 932
5
votes
3
answers
269
views
Does salting your own password improve security? [duplicate]
Let's say you were to add a couple of extra characters to your password, unique to each site you visit. The password would be largely similar except for a few characters of salt, possibly taken from ...
- 158
5
votes
1
answer
749
views
Is it bad to add a guessable password to a random password?
Let's say a person has a password they used before they knew about how to make good passwords, like peter123. Let's also say that when they were thinking of a better password, they found they could ...
- 165
5
votes
3
answers
271
views
How to mitigate heartbleed like attacks prior to zero day
Whenever sensitive data such as a password is used on a server it resides in memory for a short time. Given that security flaws like heartbleed exist which have the ability to 'bleed' memory for their ...
- 134
5
votes
1
answer
707
views
Security of Yahoo's new authentication: On-demand password
Yahoo is trying to remove passwords from authentication and use on-demand password authentication system instead.
I wonder how this new system will be secure? Even if somebody steal your mobile can ...
5
votes
3
answers
552
views
Am I in this particular case allowed, to store password in java program?
I have a Java-Server program running on Ubuntu-Server which gets every 5 minutes current location data of my android-smartphone (which I carry with me).
My architecture is the following:
My smartphone ...
- 153
5
votes
2
answers
4k
views
Finding out whether a website uses unsalted MD5 for password hashing
I'm working on a project where websites are analyzed and rated according to password security (factors like min/max password length, alphabet size and more are then calculated into a score).
A great ...
- 346
5
votes
2
answers
1k
views
Slowing down repeated password attacks
I've been reading suggestions to use time-consuming formulas for checking passwords from login attempts, so that repeated attacks will be slowed down.
Wouldn't it suffice to just sleep a bit in the ...
- 1,821
5
votes
1
answer
339
views
Could a password hash that's prone to more collisions provide better overall security?
Website security breaches seem to be a common occurrence, giving the attacker password hashes that he can conduct a brute force attack against, often given him a list of passwords that will work on ...
- 1,438
5
votes
2
answers
1k
views
Passphrase using same word several times
I used a trivial 3-letter dictionary word five times in a row (smth similar to pwdpwdpwdpwdpwd), and am surprised to find my self in the list of hacked accounts in a penetration test using a ...
- 313
5
votes
2
answers
3k
views
Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password
I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects.
I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
- 905
5
votes
3
answers
397
views
What security factors should I take into consideration when selecting a bank?
I've gotten fed up with my bank and have made the decision to move all of my banking elsewhere. This is a rare occurrence for me and, I suspect, for other people as well. It represents an opportunity ...
- 171
5
votes
2
answers
916
views
Did I miss anything when checking for passwords?
I was provided with a "challenge" forensics image of 2MB in size (floppy); they provide the disk image and want you to uncover as many passwords as you can find. I downloaded the image and dd'd it to ...
- 261
5
votes
3
answers
2k
views
How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)
After the hack of Mat Honan I studied my own laundry list of accounts I have at the numerous web sites I use. There is one fact that stands out:
Many of the websites severely restrict the size and ...
- 569
5
votes
4
answers
3k
views
Is encrypting a salt value with a password/plaintext a viable alternative to straight up hashing?
The basic problem, as far as I can tell, is that hashing's flaw is that the password is in the hash. Asymmetric encryption's flaw is that the password is encrypted and can be reversed.
The posts ...
5
votes
2
answers
42k
views
hashcat - cracking a salted sha256
Given a SHA256 hash, and a salt, I am trying to crack the hash using hashcat. Every example I've found used a hashfile as input, is there way to provide salt and hash via commandline without the need ...
- 181
5
votes
6
answers
560
views
Should admin users confirm their password before changing a user password?
In a hypothetical website, there are two types of users, admin users and normal users. Normal users can change their own password, and in keeping with best practices are required to provide their ...
- 572
5
votes
3
answers
1k
views
Keyboard vs clipboard password manager threat models
A password manager (like KeePass) offers you the option to copy and paste your password (the clipboard is cleared after pasting/timeout) or to emulate a keyboard and "type" the password for the user.
...
- 73
5
votes
2
answers
9k
views
How Secure is Googles Saved Password feature?
So I signed into my google account to check my privacy settings. I found a Feature called "Saved Passwords" which had in it about 50 various accounts which I have signed into and clicked "Save ...
- 3,041
5
votes
1
answer
605
views
Spoofing an NTP server to allow bruteforce on any smartphone
We all know that smartphones (i'll take iPhone as an example) rely on SNTP/NTP servers to update a device's time and date. So, by creating an SNTP server that mimics Apple's server, we can actually ...
- 211
5
votes
1
answer
254
views
Is limiting/cutting password-length without notice insecure?
I have encountered that our linux system cuts the length of every password to a certain length, after that length every additional character seems to be ignored.
Does this make our linux system more ...
- 1,244
5
votes
5
answers
7k
views
How should I store a physical written copy of my password? [duplicate]
I can employ all the fancy encryption and the randomest of passwords to my hard drive, but it won't do me any good if I don't remember how to log in. It seems sensible to write down my password, then....
- 523
5
votes
3
answers
278
views
Can a password be the same as its hash?
So me and my friend were pondering why passwords have a max length (and found the answer here) and I had an odd thought.. could a password be the same as its hash?
I realize that salted hashes are ...
- 51
5
votes
3
answers
392
views
Did I miss any vulns here?
I recently took a beating in a Security Engineer interview and I did not get any specific feedback on how I did. I'd like to re-ask the question to the community so I can polish up on these elements. ...
5
votes
8
answers
8k
views
Alternatives to sending out passwords in plain text via e-mail?
One of my hosting providers is sending a new password in plain text per e-mail, on request.
How insecure is this practice?
What would be a good (more secure) alternative to this?
- 291
5
votes
2
answers
396
views
Does adding a non-entropic part to a password makes it less secure?
Suppose I'm encrypting a file via AES using a password of my choice, or creating a TrueCrypt volume using a password and no keyfiles. Which of the following two passwords would be more secure:
...
- 53
5
votes
2
answers
3k
views
Would a massive blacklist of guessable passwords be useful? [duplicate]
Suggestions to make a good password all focus on creating a string that a computer (or more likely, a network of computers with multiple GPUs) can not guess. Putting a password meter for when users ...
- 1,269
5
votes
2
answers
2k
views
Can a HSM be used to make password hashing stronger?
Say a database server has a HSM which is in use for encrypting (reversibly of course) credit card numbers. Is there any way a HSM could be used to add strength to a password hashing scheme? (Or are ...
- 198
5
votes
2
answers
10k
views
Recommended length for WPA-2 password in 2020
I'm auditing my network setup and trying to determine an appropriate password length with a random set of digits and numbers. I found a Security Stack exchange answer but it was written in 2012 and ...
5
votes
1
answer
243
views
Do ciphers and encoding schemes make passwords more secure?
I recently came across a tech professional advising a user to take some plaintext of their choice, run it through one of these ciphers, convert it to Base64, and then use the result as their master ...
- 989
5
votes
1
answer
1k
views
Why do login screens hide the password input field until the username is provided? [duplicate]
I am noticing a trend in web development where login screens are no longer showing both the username and the password input fields simultaneously. Instead, you are required to type in your username ...
- 153
5
votes
2
answers
316
views
Does the iOS 10 keyboard click sound divulge too much?
The updated keyboard in iOS 10 has at least three distinct "click" sounds that I'm aware of: a high click upon entry of any normal character; a mid-range click when entering a space, toggling shift, ...
- 2,085
5
votes
2
answers
2k
views
Log User In Automatically After Clicking Account Activation Email
Scenario: Forum account registrations, user must click an activation email after they sign up e.g. they create an account with username, email, password, and an email is sent to the email they select. ...
- 1,223
5
votes
2
answers
510
views
Does adding a random character to a pseudo-randomly generated password improve entropy significantly?
I'm asking a practical question. I was taught computers are bad at generating random data. Does this mean password generators, such as the one built into Keepass, suck? If yes, then would it help for ...
- 10.2k
5
votes
1
answer
2k
views
Soundness of GRC.com Haystack padding concept [duplicate]
I was wondering how sound is the concept presented by the Gibson Research Corporation (see below if you do not want to follow the link) about simple passwords (= very easy to remember) with the ...
Dave Kimble
5
votes
3
answers
2k
views
Two-factor verification without a mobile phone?
Currently, some services use a second layer of veficiation if logging in from a new device:
Gmail and Facebook send a text or call with a code
Facebook generates a code in the mobile application
...
- 271
5
votes
1
answer
751
views
What techniques do web services use to identify password theft?
I've noticed that some web services use a security scheme in which log-in attempts that have some unusual characteristics trigger extra authentication steps.
For example when I try to login to my ...
- 173
5
votes
1
answer
809
views
Need to ephemerally store third-party password
One particular web service that I am writing interfaces with an API. Each API call requires the user's username and password to be sent, no state is maintained.
Ideally, when using my web service the ...
- 3,736
5
votes
2
answers
2k
views
Password History/Password policy
I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008).
Where is password ...
- 161