Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

17
votes
7answers
1k views

How different should my passwords be? [duplicate]

Suppose I use remember one long high entropy master password, and use variations of it for each of my passwords. Eg if I remember tSaF4nWeACVkUU4 as a master password and use tSaF4nWeACVkUU4t (with a ...
1
vote
3answers
106 views

Site allows both Partial and Complete password authentication; do they have my password in plain text? [duplicate]

My bank provides online banking facility like most of the banks these days. On the web they have Partial Password Authentication. Although I don't really believe in PPA providing extra security but ...
43
votes
8answers
6k views

Do bad passwords produce bad salted hashes?

When you have a password stored in a database that has been strongly hashed and salted does it really matter if the underlying user password is weak? If you setup features like limiting login ...
0
votes
1answer
133 views

John the Ripper password cracker is viable?

Is this still viable? I remember using this when it just worked in shells. http://www.openwall.com/john/
3
votes
2answers
116 views

Similarity comparisons with hashed passwords possible?

At a company I worked at, I had to change my password every 90 days and I could only reuse a password after 8 iterations. This no-reusal included passwords being too similar to the old one, e.g. when ...
8
votes
6answers
927 views

Is it useful to protect hashed password with encryption?

Imagine that I am hashing the users' passwords with a random, long enough, salt, using key stretching, and a secure hash. Would it be more secure to finally encrypt the hash with a symmetric key?
4
votes
3answers
722 views

Question about a simple strong password management system

I am designing a system which requires access control via a strong password and for that purpose will use a password generation algorithm A that produces a strong password of length L >= 32. The ...
3
votes
1answer
252 views

Perfectly Robust Hashing Scheme, or Completely Over-Engineered?

This is going to get long, so prepare. Basis of the question is, Do all these steps improve security, or am I completely overthinking the problem? Are my assumptions/thought process valid? We all ...
2
votes
5answers
824 views

Looking for password manager in company [duplicate]

I was looking for solution everywhere, but maybe because lack of specialized words I can't find it. I've got a problem in finding a program, but I don't know how to describe it in one word so I'll ...
-1
votes
1answer
43 views

ICloud and Quality Password [duplicate]

How many 'random' characters should my iCloud password be if it were going up against the BEST hackers and the best hacking software?
-2
votes
1answer
46 views

Is digested password safer than salted password?

which scheme is the better one in your opinion? I know that both are secure but which is better one? I know that digested passwords are very difficult or even impossible to decrypt. Thanks for your ...
1
vote
1answer
61 views

Multi hash security [duplicate]

Is md5(sha1(pass)) more secure than md5(pass)? For example in case of sqli when attacker cant get our hashing schema, brute force or dictionary attack would be much less efficient. Am i right or is it ...
3
votes
5answers
314 views

How to deal with password schemes that can produce weak passwords?

Introduction Since the xkcd note on password strength, there has been a lot of attention for password entropy. However, this raised the question: what if you used a strong scheme, but happened to ...
20
votes
9answers
1k views

Is a simple, but very long password a good password?

Is a password like wwwwwwwwwwwwwwwwwwwwwwwww9 (25x 'w' and a number) secure? It would be easy to remember.
9
votes
8answers
1k views

Sequential password updates

Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse. What's to stop the user from changing the ...
0
votes
2answers
55 views

What is the solution for handling exceptions in password hashing schemes?

There is a technique called password hashing that describes creating unique passwords based on a unique master key and a static and arbitrary hash value. Using this technique, the user only has to ...
2
votes
2answers
155 views

Should email verification be followed by password-based login? Why?

[This is a duplicate, considered off-topic at http://stackoverflow.com/questions/26564992/should-email-verification-be-followed-by-password-based-login-why] A typical account creation process seems ...
0
votes
0answers
206 views

Is the password “Z” more secure than the password “a”? [duplicate]

Okay, I guess it's not possible to call one-letter-passwords "secure" - so let's compare ZZZZZZZZZZ with aaaaaaaaaa. Both are using the same character pool [A-z], so the number of combinations for a ...
1
vote
0answers
174 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
0
votes
0answers
141 views

oclHashcat error messag in Kali Linux

I am in the process of learning oclHashcat syntax. Currently, I am working on breaking a file of md5crypt strings with a dictionary file. The dictionary I am using is rockyou.txt from an installation ...
3
votes
3answers
143 views

Why require new users to change password?

I have noticed that it is common practice when setting up a user account (Windows users accounts and Google Apps user accounts in my case) to require new users to create their own password immediately ...
23
votes
11answers
4k views

One liner to create passwords in linux?

How do you create a readable password using bash with one line? What if i'm looking for 128 bits of entropy? EDIT By readable I mean the 94 printable ascii characters (without space). It can use ...
0
votes
2answers
123 views

Passwords: Symbols and length > 20 disallowed [duplicate]

I'm going through a bunch of accounts at the moment changing my passwords, some of them are looking a little weak and i've reused them, but i keep coming across websites that don't allow you to use ...
1
vote
2answers
84 views

Facebook security

I check my security settings (from my Facebook acc.) from time to time, and sometimes I see there are IP addresses which logged into my account but don't belong to me. When I look in the web who is ...
3
votes
6answers
8k views

Hardware USB Key to Reset Any Windows Password

This tool requires physical access of course, and there are many things you can do once you have physical access, but this peaked my curiosity. The tool in question: ...
5
votes
3answers
230 views

When form submission fails, password field gets blanked, why is that the case?

I've recently asked a question about blanking the password fields in UX for usability purposes, but It seems all the sites use this approach for security reasons. Why is it insecure to post back the ...
42
votes
6answers
3k views

Is the option to jump to blanks in password fields a security risk?

Using Ctrl + ← / →, it's a common behavior across different operating systems to jump from word to word (or from blank to blank) in text input fields. Now I've discovered that this also applies on ...
-1
votes
3answers
285 views

Gmail, Yahoo, Hotmail , and so on; How do they check the content of an attached password-protected archived file like Winrar?

How is it possible that mailing systems like Gmail, Yahoo, and Hotmail are able to check the content of an attached password-protected archived file like WINRAR, if the password cannot be guessed, ...
323
votes
12answers
53k views

What technical reasons are there to have low maximum password lengths?

I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites I actually care about ...
-1
votes
2answers
10k views

Recover Windows Server 2003 admin password through restricted user

OK, so here goes after a lot of trial and error: background: My client recently took over another firm. However, apparently the administrator passwords to the server (along with some other non-IT ...
12
votes
6answers
2k views

What is the simplest safe way to convey a password to another person? [duplicate]

What is the easiest way for two people – neither of whom are computer specialists and cannot meet in person – to send a password for an encrypted file that is attached to an email? The two simplest ...
1
vote
4answers
107 views

Password recovery flow - Send Password recovery to any email?

I am building a new MVC app. Considering this "forgot password" flow: 1)You enter an email. 2)You press "send recovery password". 3)An email awaits in the inbox, pressing the link in it brings you to ...
2
votes
1answer
82 views

How to handle legacy website account login credentials

I have a lot (>1000) of credentials for website logins in my Chrome's password safe. Some of them are quite old (> 10 years) and have weak (dictionary) passwords. Some of the accounts have low value ...
1
vote
0answers
92 views

Database row level encryption scheme

I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
0
votes
3answers
116 views

One Less Password

I just came across this: https://blog.webmaker.org/one-less-password Basically a technique for eliminating passwords as the primary authentication mechanism for connecting to a website by replacing ...
1
vote
2answers
58 views

Would it better to enforce more complex passwords or passphrases? [duplicate]

I have read in different places that passphrases offer better security and are more user friendly however, I have also read contradictory information thats says longer passwords are not really more ...
-8
votes
1answer
114 views

I need help on how to hack into a scammer computer via IP/DNS [closed]

I really need your help in this one. Today I got scammed by a "trader" for 100$, but I managed to get his IP, reverse DNS and Hostname but I am unskilled in hacking. I need help here, I just want to ...
3
votes
2answers
3k views

How does Authy's 2FA work, if it doesn't connect to the server?

I thought I knew how two-factor authentication works: I enter the password. Server generates a random number (token) and sends it to me via SMS. I enter this token. Server checks that the token I ...
12
votes
4answers
3k views

Is an 80 bit password good enough for all practical purposes?

I know that asking how many bits of entropy comprise a strong password is rather like asking the length of a piece of string. But assuming the NSA is not on to you, and that it is hardly worthwhile ...
5
votes
1answer
504 views

Chinese or “pinyin” wordlists for dictionary attacks

Background: I am currently trying to crack a salted md5 hash which I have recovered from an embedded device running busybox and manufactured in china. I have tried john the ripper using all of the ...
-2
votes
3answers
146 views

My friend hashes passwords with SHA512 algorithm without salt. How do I convince him that he needs to add salt?

Today I discovered something incredibly stupid - my friend hashes user passwords with sha512 algorithm without a salt. I immediately raised this issue to him but he said he wants to see anyone crack a ...
11
votes
6answers
598 views

Security of carrying passwords on person

While in college I decided to have a randomly generated 16 character password. I used parts of that password in various sites. However, one of the sites was compromised so I had to change my password. ...
300
votes
20answers
51k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
2
votes
1answer
231 views

Is there more risk in changing administrator password locally vs from a centralized location?

I'm working on a mechanism to better handle group policy passwords in response to MS14-025. We formerly used this mechanism for setting the local admin account passwords on our workstations (primarily ...
1
vote
4answers
443 views

Authenticate user without knowing their password

I'm working on a project where each each user will have a public/private RSA key-pair. Users will be able to send encrypted messages to each other using the each target user's public key so that only ...
1
vote
1answer
1k views

Due to which reason might a windows 7 password been reset to empty?

A user reports on monday he cannot access his windows 7 account anymore due to a "wrong password", which perfectly worked on friday. It turns out the password has been reset to empty for that account. ...
0
votes
1answer
47 views

Securely map random string to a custom charset

I'm writing a Python script to generate custom passwords based on a HMAC. I want the passwords to support various websites requirements so I want to map the HMAC output (ex: hex format) to an array of ...
5
votes
4answers
2k views

How can hackers guess passwords (using dictionary attack or brute force) without being locked out?

Nowadays almost every website you want to register in; is asking you to create a complicated password...But why cant we use simple passwords? I am just wondering because in case of multiple wrong ...
3
votes
4answers
9k views

A low tech yet secure way to keep track of passwords?

I use LastPass and love it. My girlfriend creates her own long, complex, unique, and thus difficult to remember passwords for every site. She frequently forgets them and has to rest the password. ...
0
votes
3answers
127 views

Can you have Secure encryption with a backdoor, and still be secure?

Is it possible to have an encryption algorithm/implementation that has a "backdoor", that also wouldn't introduce flaws into the encryption? For instance, if you have a master password, once that ...