Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

30
votes
4answers
15k views

Standards for encrypting passwords in configuration files?

My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they ...
9
votes
3answers
841 views

How secure are sha256 + salt hashes for password storage [duplicate]

I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 ...
1
vote
1answer
65 views

Is it worth it to implement both SHA2 and SHA3 at the same time?

I'm creating a password storage system for a web server I'm building for fun. Would it be more secure for me to use both SHA2 and SHA3 for hashing, and then store them in a database? If I use both ...
13
votes
6answers
2k views

Does prepending a salt to the password instead of inserting it in the middle decrease security?

I read somewhere that adding a salt at the beginning of a password before hashing it is a bad idea. Instead, the article claimed it is much more secure to insert it somewhere in the middle of the ...
1
vote
1answer
65 views

Give Someone Access to Secure Website? [closed]

I have someone I hired on a Freelancing website working for me - so far he has worked for me for about two weeks and is doing a good job. In order for him to complete his work he will need access to ...
2
votes
0answers
27 views

General Entropy as opposed to Password Entropy [duplicate]

I know that the formula for the entropy of a message is: (I believe b can be set to 2) but when calculating the entropy of a password websites usually only compute log2(p-1), ignoring the first ...
1
vote
3answers
211 views

Why do banks still hack-up autocomplete=off functionality?

With Bug #1025703 in the latest Firefox 38, Mozilla has finally decided to stand up for its users instead of catering to the banks that don't want the passwords remembered. However, I've noticed ...
4
votes
1answer
113 views

Re-display password in registration form good or bad?

When a user tries to register and the data he submits are not right such as bad email, or weak password, we would display the registration page again to him with the data he just submitted along with ...
3
votes
3answers
139 views

Would requiring multiple passwords enhance security?

I assume that it was considered at one point, and that there's a good reason for not doing it, I'm just curious as to why. I'm sure that there are many people who struggle to remember a single ...
5
votes
3answers
330 views

What steps can you take to make offline cracking of SRP harder?

In the aftermath of the Blizzard hack, what steps can I take to make offline cracking of SRP more difficult? My question assumes that your database is already gone and that you implemented SRP more ...
5
votes
5answers
3k views

Alternatives to sending out passwords in plain text via e-mail?

One of my hosting providers is sending a new password in plain text per e-mail, on request. How insecure is this practice? What would be a good (more secure) alternative to this?
6
votes
1answer
1k views

How does an attacker know when he has the password?

An attacker gets a list of hashed passwords. How does he know when he has cracked the password(s)? He can't try millions of times on the comprised account. Attacker gets hashed password. How does he ...
2
votes
1answer
994 views

How secure is automatic authentication in Skype?

How secure is checking the automatic authentication option in Skype client? What if I sign in with Microsoft account instead of Skype id? What if both accounts are merged? Is there any documentation ...
0
votes
1answer
317 views

How can American Express Serve login be PCI-DSS compliant?

Today I went to log into my American Express Serve account at https://secure.serve.com/ and accidentally discovered what appears to be a huge hole in their login process. Here are the steps involved: ...
1
vote
1answer
59 views

how to get cookies from aspx site to use it with hydra

I've been playing around with Hydra and .aspx site and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. ...
16
votes
2answers
8k views

Facebook API : App Secret - possible misuse

I've recently find out that by simple quick look into compiled code of one of our applications, you can get both App ID (API Key) and App Secret for Facebook API I suppose that we should really keep ...
9
votes
5answers
2k views

Gold Standard for password hashing

I've developing a web application that will be dealing with highly sensitive information and I want to ensure the hashing of passwords is gold standard. Ideally I'd go for per-user salted SHA512 ...
5
votes
3answers
164 views

Storing random initial (one-time) passwords in plain text

I manage a vendor app that issues accounts (with passwords, of course) to end users. From what I can see, final user passwords are stored properly. My concern is the initial account generation and ...
0
votes
1answer
39 views

QR-code based credential retrieval?

This is a sort of design review question that I'm hoping is suitable for this site. I am designing a system that uses a cloud service to establish a secure connection between a PC and a mobile ...
6
votes
4answers
643 views

Method to integrate Touch ID in iOS apps

With the recent announcement of Touch ID APIs for third party apps, I am wondering how can we leverage this feature to perform secure transaction ? I am looking for a method to use Touch ID in my ...
1
vote
2answers
91 views

Why is “\000” added to the end of passwords prior to hashing with bcrypt?

I am implementing bcrypt for java as found here. Before the actual hash takes place, line 455 of this implementation takes the raw String password, and transforms it into a byte array like so: ...
13
votes
4answers
1k views

Why will Google no longer allow me to end or begin passwords with a space? [closed]

Why won't Google allow me to use a password ending in a space anymore? Backstory: I have memorized a cipher that allows me to generate a different and very strong password across many different ...
13
votes
8answers
8k views

Are services like “LastPass” less secure, as they have all my passwords protected by a single password?

If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security?
8
votes
3answers
1k views

How can I find if my password has been posted online?

I have just received this email from AbeBooks.com: Hello AbeBooks Customer, This is an important message from AbeBooks.com. As part of our routine security monitoring, we have learned ...
9
votes
7answers
28k views

Recommend Length for Wi-FI PSK?

I currently have a network set up with WPA2 and AES encryption, the password is 8 characters long but was randomly generated and contains no dictionary words. However I'm concerned about the ...
73
votes
9answers
11k views

New Gmail login system—going against conventional wisdom?

I noticed that the new gmail login asks for username first, and then confirms if such username exists, before asking for password input. Does this not go against conventional security wisdom to not ...
13
votes
3answers
2k views

Is it truly possible to store passwords securely, but be able to see the password?

Every place I looked, people recommended that storing passwords via encryption is like storing passwords in plain text. But every place I've looked, everyone recommends using a password manager like ...
6
votes
4answers
1k views

Store password using sha1 [duplicate]

I've been using the sha1() function to hash password before inserting it into my database. But I have this procedure so that it just won't be the password to be hashed. My page would register a user ...
18
votes
4answers
7k views

Deleting a Java Object securely

I know that in order to delete a Java object I should use character array instead of String, since I can safely erase (rewrite the character array with other data) its content. This seems not to be ...
26
votes
6answers
26k views

Most secure password hash algorithm(s)?

What is/are currently the most cryptographically secure hashing algorithm(s)? (available in PHP) Speed is irrelevant, because I'm iterating the hash over a fixed time (rather than a fixed number of ...
46
votes
6answers
6k views

How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?

I thought How can a system enforce a minimum number of changed characters... would answer my question, but it seems this is a different case. When I sign on to my online banking account, I'm prompted ...
1
vote
3answers
66 views

Sensitive issue regarding windows 8 password [closed]

Although I know this sort of request probably isn't exactly what stackoverflow is for, I am desperately seeking help. One of my best friends recently passed away and his parents asked me if I knew a ...
4
votes
3answers
668 views

Which passwords to exclude from a password manager?

The benefits of a password manager are clear. Still, it seems that there might be a case to keep at least some passwords out of it: Your primary e-mail, to minimize the "single point of attack" ...
1
vote
1answer
94 views

How can one know if the password database on the server is stolen or not?

There are many password breaches happening now a days. How can the system administrator detect if the password database on the server is hacked? Obviously, the admin can know once the password ...
2
votes
3answers
126 views

Can I initially hash passwords with SHA instead of hashing them with bcrypt to decouple requests from slow crypto functions?

I'm using bcrypt for some web service requests that hash multiple passwords. The problem is that these web service requests can take minutes to complete due to bcrypt. Not very user friendly. My ...
1
vote
1answer
79 views

How is the username and password captured on this mobile device?

I have a Motorola phone, and I am concerned about my privacy after reading this article : http://www.beneaththewaves.net/Projects/Motorola_Is_Listening.html The poster says: For both of these ...
21
votes
6answers
2k views

Is there a use-case that renders the password manager obsolete?

Background Trevor posed a question about the nature and validity of using a password manager, given the current prevailing model of authentication on most web resources. Caveat: this is not the ...
1
vote
3answers
142 views

Will hashing passwords in my use case improve security and why?

I am developing an application the architecture of which is arranged as follows: Session host <---> Central relay server <---> Session client All communication between the initiating ...
13
votes
5answers
7k views

How can I avoid putting the database password in a perl script?

I have a cronned perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
21
votes
3answers
5k views

Security of LastPass + YubiKey

I'm looking at password manager solutions and came across LastPass. I see they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What are ...
40
votes
9answers
11k views

How long should the password be?

The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
2
votes
1answer
96 views

What is the best way to store passwords in OpenLDAP?

I would like to store user credentials in an OpenLDAP or similar directory server. A lot of online commentary about storing passwords in modern contexts recommends using password derivation schemes ...
16
votes
2answers
4k views

How big should salt be?

I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2). Having that in mind, how big salt should I use? Should it be ...
24
votes
4answers
2k views

Why do some sites block pasting into username or password input fields?

I use a few websites that prevent me from copying & pasting into the username or password fields. It's quite frustrating when using a password manager, and if anything I'd think it discourages ...
29
votes
6answers
7k views

Length of passwords that are rainbow table safe

With large computing power (like what you can get in the Amazon cloud for example) you can generate huge rainbow tables for passwords. There also seems to be some large rainbow tables reachable that ...
2
votes
3answers
123 views

Is it safe to generate a password for a user during sign up in a web application?

I'm working on updating a web application. It currently creates a password for a user during sign up. Is asking the user to create the password themselves safer than relying on a generated password?
0
votes
1answer
32 views

Diceware & Database hosting [duplicate]

I'm currently setting up a new SQL database with DotEasy as my Hosting/Database provider. I've heard a lot about Diceware being one of the best methods of creating a really strong password, so I ...
11
votes
2answers
781 views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
-6
votes
1answer
108 views

How to attack on a web page to gain username and password? [closed]

In a situation where a web page is not using SSL and someone wants to attack to gain the username and password. How it can be done? Given the situations: Passwords are not stored in plain text. ...
1
vote
4answers
1k views

RatticDB for passwords is not encrypted. Is this good approach?

I am looking for a password application for storing passwords, and RatticDB have a web interface and SSH access is planned, which are exactly the features I am looking for. However, they write that ...