Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

-1
votes
1answer
109 views

Is hashed password safe if salt and key are stored with the hash

I am trying to hash the password using SHA256 with random salt and random key in php and storing back hash value with salt and key used. I want to know does this provide adequate safety? The ...
0
votes
0answers
76 views

Line Length Exception in hashcat

I'm very new to cracking a password so sorry if I sound stupid. I am trying to get my admin password from my second PC (I lost it). I did find the SAM file with kali linux and with bkhive and samdump ...
0
votes
1answer
149 views

Saving username and pasword inside SQL

I am currently managing a network of around 100 PCs. Many users have different mails/usernames and passwords for different services like login to PC, mail, local applications, ... When an application ...
-2
votes
1answer
47 views

Make password list with crunch [closed]

I want to make some password list like this : A4B9D It should has these : 5 characters first, third, and fifth characters are letters (A to Z) second and forth characters are numbers (0 to 9) ...
1
vote
3answers
72 views

What are the disadvantages of combining client-side and server-side authentication security?

Imagine situation: Application might or might not be run via SSL/TLS Application should not know password of the client because client might reuse passwords Wouldn't then combined client-side and ...
3
votes
2answers
68 views

Assuming proper creation, encryption, and storage, how is a breach/leak of a hash worriesome?

Let's say I create a pseudo-random password that is secure (24 alhpa numeric, upper lower, special chars...) for a system (say a password manager). Let's assume the password manager encrypts and ...
4
votes
1answer
66 views

Desktop Flickers Past Lock Screen

I'm using Fedora 22 with Gnome 3. I have a password set for my user account, so when my laptop awakens from sleep, I am presented with the lock screen and must enter my password before getting to my ...
2
votes
0answers
46 views

What technologies does ChromeOS use to secure saved passwords?

I have read that Chrome will use the system's native credential tools to manage saved passwords (e.g. KeyChain on OSX, libsecret on Linux/GNOME etc). Does anyone know what tools are used on ChromeOS? ...
87
votes
4answers
20k views

Recommended # of iterations when using PKBDF2-SHA256?

I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
2
votes
1answer
145 views

Security behind “Windows Security” Feature

Within the Windows Security authentication mechanism active, there are cases the user-login popup comes up. Are this username and password sent encrypted or they are sent as plain-text as the ...
23
votes
10answers
5k views

Best password strength checker

In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or ...
8
votes
4answers
5k views

HMACSHA512 versus Rfc2898DeriveBytes for password hash

We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key The salt is 64 char randomly generated string. We allocated 2048 length on the database for the hashed base64 string ...
1
vote
1answer
26 views

Authentication between to devices where the same password is used on both

I'm writing two applications that are intended for execution on two separate devices. It is similar to a remote desktop solution such as TeamViewer. What follows below is my proposal for an ...
0
votes
1answer
59 views

Old phone as secure credential storage device

Can an old android phone (with sim card removed) be securely used as an OFFLINE storage device for password, user id's and acct numbers?
2
votes
2answers
139 views

Understanding salted password hashing using Java

Context: I am using this tutorial and trying to understand and implement salted password hashing using Java. After spending some time on this topic, I figured out that the basic idea is to: Convert ...
1
vote
2answers
95 views

I forgot my 7z password [closed]

I used 7zip to encrypt a 200mb archive of my code used a combination of some of 7 possible words and no numbers or caps. So 823543 possible passwords. What is the best free program I can use to ...
1
vote
2answers
202 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
8
votes
4answers
5k views

How can hackers guess passwords (using dictionary attack or brute force) without being locked out?

Nowadays almost every website you want to register in; is asking you to create a complicated password...But why cant we use simple passwords? I am just wondering because in case of multiple wrong ...
35
votes
10answers
3k views

Is there a method of generating site-specific passwords which can be executed in my own head?

I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
0
votes
2answers
198 views

Are passwords in Mozilla products stored insecurely?

I have just downloaded a Polish program Passtool Password Reader (written by Rafał Jelitto), unpacked it from .rar archive and run it. I have hit the bottom-left button (Pokaż wszystko) and this small ...
-5
votes
1answer
63 views

How to use wordlist [closed]

I have downloaded a wordlist from https://crackstation.net/buy-crackstation-wordlist-password-cracking-dictionary.htm The size of the wordlist is 4.2 GiB (compressed) or 15 GiB (uncompressed) The ...
44
votes
5answers
9k views

How can I know that developers will be ethical and not record my password in plaintext

I am not asking why hashing should be done. Instead, I want to know how to prevent that developers record user passwords to hack their user's other accounts, especially their email. Couldn't they ...
1
vote
3answers
71 views

Potential collision with hash password

Normally, the password size is fixed by the hash function in which the password is given right ? Because otherwise, if the password size is bigger than the hash result size, there should be potential ...
14
votes
7answers
4k views

Are password reset links that don't expire a security risk?

I am currently working on a password reset flow. We have decided to go with a password reset link being emailed to the user's registered email and allowing them to follow that and input a new ...
5
votes
3answers
373 views

How can I detect users that have requested AD Administrators to reuse an expired password?

There is a trend among companies I've worked at where administrators (or helpdesk folks) give a user a courtesy extension of the old expired password... rather than forcing the user to change it. ...
1
vote
3answers
87 views

Why is there a preference towards long passphrases instead of increasing the hashing iterations?

There seems to be an agreement that when it comes to offline password brute-forcing, long but simple passwords are better than short complex ones. I recently saw a question related to increasing the ...
0
votes
0answers
47 views

Hashed master password and generated encryption key in a password manager program

I'm writing a WPF password manager application to practice programming, so far this is the scheme I intend to use to store master password and individual site password: Master password: Generate a ...
2
votes
2answers
70 views

Enabling feature to log in as soon as right password is typed (without pressing enter)

My phone has an option for the PIN lock screen to unlock it as soon as the correct number is entered (without pressing enter). So for example if the password is 77912 then you only have to enter 77912 ...
17
votes
5answers
500 views

What concrete parameters can I change to make my passphrase-protected private gpg key more secure

There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever. Rather than ...
18
votes
2answers
781 views

Can client-side hashing reduce the denial-of-service risk with slow hashes?

When storing user's passwords that you need to verify against (but not use as plaintext) the current state of the art is: Hash the password Use a salt Use a slow hash function - bcrypt, scrypt, etc. ...
3
votes
4answers
138 views

Are there any two way + two factor authentication systems in use?

My bank, Google etc. use two factor systems where they send me a One Time Password via out of band means. e.g. SMS or an App on my Cellphone or a standalone RSA token generator. This seems good ...
1
vote
2answers
153 views

“Sniffing” Wifi Password? [duplicate]

I wonder if the follwing is possible: Assume you want to gain access to the AP "ap". Isn't it possible to set up a hotspot with the same BSSID, so that clients think that you are ap and send the ...
46
votes
7answers
3k views

Do security questions subvert passwords?

Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
6
votes
7answers
14k views

Is a longer WiFi password more secure?

Today I had to type the same password to connect to a WPA2-secured WiFi network several times, and got really annoyed with the length of the password. Especially since it is just a phrase repeated ...
2
votes
1answer
89 views

Should you be able to reset a password without verifying the email address first?

I just noticed with Instagram, what you can do is: From the logged in Instagram app, change your email address. This will send a verification link to the new email address. Verifiying the email ...
2
votes
3answers
3k views

Microsoft password email reset link leads to different url?

...I am really annoyed and unsettled by the password reset email I just received from Microsoft. What should I think of this? My email client correctly told me that the underlying url is not the same ...
5
votes
1answer
157 views

How secure is CertiVox M-PIN?

CertiVox have designed a system with the aim of "getting rid of passwords". Essentially the system authenticates users with two factors of authentication: A 4 digit PIN and a token stored within the ...
2
votes
2answers
140 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
39
votes
7answers
8k views

Why isn't open WiFi encrypted?

As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
1
vote
1answer
159 views

How is password information stored and used on Android accounts?

How difficult would it be for someone who stole your device to gain access to the username and password information stored under the Settings -> More -> Accounts section of an Android device? ...
4
votes
1answer
84 views

How can I delete a password and lock the account in one step?

I have a minimal server install on a remote machine with a root password set to a temporary, but chosen, value. I have added a separate administrator user. This user has an authorized key for SSH, no ...
0
votes
1answer
98 views

What can I do if someone is using my IP address? [closed]

Another device in my network is using my IP address, what can he do if he is using my IP address? Is this a crime? Can him be caught by police or sue by Malaysia government?
16
votes
5answers
4k views

What is a good practical (and sane) way to manage all your passwords for online sites?

I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords. This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
1
vote
1answer
121 views

Password management: how an administrator should reset password for a user?

I implement simple user management. How an administrator should reset password for a user? Just provide a new password for a user (as in Active Directory)? Is it secure enough? Added Is it secure ...
31
votes
4answers
16k views

Standards for encrypting passwords in configuration files?

My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they ...
9
votes
3answers
978 views

How secure are sha256 + salt hashes for password storage [duplicate]

I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 ...
1
vote
1answer
73 views

Is it worth it to implement both SHA2 and SHA3 at the same time?

I'm creating a password storage system for a web server I'm building for fun. Would it be more secure for me to use both SHA2 and SHA3 for hashing, and then store them in a database? If I use both ...
13
votes
6answers
2k views

Does prepending a salt to the password instead of inserting it in the middle decrease security?

I read somewhere that adding a salt at the beginning of a password before hashing it is a bad idea. Instead, the article claimed it is much more secure to insert it somewhere in the middle of the ...
1
vote
1answer
71 views

Give Someone Access to Secure Website? [closed]

I have someone I hired on a Freelancing website working for me - so far he has worked for me for about two weeks and is doing a good job. In order for him to complete his work he will need access to ...
2
votes
0answers
27 views

General Entropy as opposed to Password Entropy [duplicate]

I know that the formula for the entropy of a message is: (I believe b can be set to 2) but when calculating the entropy of a password websites usually only compute log2(p-1), ignoring the first ...