Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
0answers
34 views

I forgot my ZIP file password. How do I bypass the encryption? Which software would work? [duplicate]

Should I use brute-force attacks? Do they even work? What options do I have? I only remember short fragments of the password and it's definitely more than 7 characters long.
8
votes
4answers
4k views

HMACSHA512 versus Rfc2898DeriveBytes for password hash

We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key The salt is 64 char randomly generated string. We allocated 2048 length on the database for the hashed base64 string ...
0
votes
1answer
216 views

Good password hashing algorithm compatible with PHP and Linux apps

I'm looking for a password hash method for a new server system. The hashes must be generated from PHP code and verified from PHP as well as by a number of applications on a Linux system. I know that ...
604
votes
21answers
121k views

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are ...
1
vote
1answer
26 views

How can I defend against Heroku (or any PAAS) ID theft?

How can I defend against Heroku (or any PAAS) ID theft? Is it correct to assume that if someone obtained my Heroku credentials that they would have access to any data in my app, regardless of any ...
0
votes
2answers
63 views

What is the severity if someone read the ConnectionStrings_Prod.config?

I was doing an pen test in a website and the programmer did a big mistake and I was able to read any file. So I read the web.config and see the password for database was in ...
9
votes
5answers
3k views

Using Google Search results to determine password strength

Google is a repository of Internet data, as it indexes tremendous amount of data. It uses a prediction service to determine the rest of the search query. With such a huge repository in place, can we ...
2
votes
1answer
51 views

Is it sensible to use application password bypassing two factor authentication? [duplicate]

I discovered that some applications (like Sylpheed) seems unable to support two factor authentication. Google has a feature called application passwords - a separate password that "grants complete ...
6
votes
2answers
216 views

Does password-hashing “busy-work” need to be cryptographically secure

All modern password hashing schemes are deliberately designed to include a huge amount of "busy-work", to limit the speed with which an attacker would be able to conduct password hashing attempts. ...
6
votes
3answers
757 views

How to encrypt all existing customer passwords [closed]

I work for an online shop and since I worked here we have stored customer passwords in plaintext. I joined the company as a data inputter and when I discovered that we did this I flagged it up with ...
4
votes
2answers
101 views

Should password recommendations be different for devices, networks, and internet?

I started using a password manager last year and updated nearly all of my internet accounts to super-strong, unique passwords, and that isn't a problem, cause I only access them from web browsers or ...
3
votes
0answers
141 views

Any problems with scrypt yet?

In the question Do any security experts recommend bcrypt for password storage? Thomas Pornin recommends the hashing function scrypt but saying it is "too new to be recommended on a general basis". ...
4
votes
4answers
209 views

how to check for duplicate passwords

Is it possible to check if like 100 people are using the same pasword? without risking anyones password getting out? I heard google does this, not allowing the user to set a password 1000 people are ...
0
votes
1answer
122 views

When bruteforcing a WiFi network password, Can that admin see it?

When bruteforcing a captured packet containing the encrypted password, can the owner/admin of the router see each auth attempt? I'm assuming you just encrypt each passphrase in the dictionary file and ...
3
votes
3answers
417 views

Rainbow Tables: What is the Reduction Used for?

This is a follow up from this answer. The answer is very good, and it put me to thinking and doing some research. I have found another good explanation on this site. At some point, the author says: ...
3
votes
5answers
251 views

Are all unsalted password hashes inherently insecure?

Maybe I'm missing something obvious... Are all passwords stored in common, unsalted hash algorithms able to be attacked via rainbow tables?
0
votes
1answer
83 views

Brute force attacks detection risks

I would like to ask if using brute force attacks on some websites or online services can be risky in any way for the hacker? Let's say that someone is using medusa tool to crack password on his ...
-1
votes
1answer
4k views

How to get a Network's WIFI Password through CMD? [closed]

I found that Wifi's Password can be retrived using the network and sharing wizard in Windows, And Technicaly theres no way to store Passwords/collection of bytes in the memory after switching/shutting ...
10
votes
3answers
805 views

Should an admin user be able to edit passwords?

For your typical web app, should an admin superuser have the right to edit a user's password, or should only that user have the right? (Even with edit ability, the admin would never see the current ...
0
votes
0answers
24 views

How rainbow table works? [duplicate]

I have roughly understand how a rainbow table works from http://en.wikipedia.org/wiki/Rainbow_table, but I am quite curious why there is a need of different reduction functions for each column for ...
2
votes
3answers
181 views

How do clients enroll using SRP?

From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
23
votes
4answers
3k views

What is the purpose of the “Password minimum age” setting?

What additional security can a "password minimum age" provide? For example: the user can change their password only after 24 hours have elapsed since the last password change.
5
votes
2answers
286 views

How will security need to be changed if we can crack password hashes in quasi-polynomial time?

If we suppose that we have access to some form of generalized password hacking/cracking that can somehow find an $n$-bit password in time $O(n^{\log n})$, is there need for alarm? This question ...
1
vote
1answer
58 views

Are there best practices concerning application account credentials?

I am looking for best practices concerning application account credentials. For example, suppose I got a corporate application which uses an Active Directory application user account to communicate ...
0
votes
1answer
88 views

Office password protection crack

would just like to have a check on the password protection/encryption of MS office 2007 and above. It is said that its not that easy to crack the password protection except by brute force, since 2007 ...
0
votes
1answer
41 views

How to use multiple charsets in hashcat

I wanted to use a brute force attack on hashcat but WPA/WPA2 networks are 8-64 characters long and they have multiple possibilities of a password. I was wondering if there was a way to use multiple ...
1
vote
1answer
47 views

How do you practically manage your never-use-personal-accounts-on-a-work-machine-ever double life, when your personal machine is a limited iOS device? [closed]

This is follow-up to Starting a new job after working at home for years. How to best protect data, secrets, and privacy in the workplace? The answer to that question is Follow company security ...
0
votes
1answer
80 views

Starting a new job after working at home for years. How to best protect data, secrets, and privacy in the workplace?

I have just started interviewing for new computer job after years of working from home. At home I feel very secure with how I protect myself from data loss and keeping my secrets secure. I backup ...
3
votes
2answers
307 views

Is fourteen characters long password really weak?

I've tried to sign in to Samsung Cyber Service Center1. Since I'm from Poland, at first I tried Polish version of that service. I have entered a password, that has: 6 numbers in total (in three ...
1
vote
1answer
52 views

Storing salt and hashed password [duplicate]

Is there a benefit to storing salt appended to hashed password in a single column of a table verses storing salt and hashed password in different columns of the table. The OWASP guide here ...
0
votes
2answers
119 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
62
votes
8answers
7k views

Is forcing users to use a strong password effective?

I am designing a service that would, among other things, store sensitive information. To ensure no unauthorized access of this information, it would be encrypted with a key derived from their password ...
-3
votes
2answers
43 views

Can I prevent brute forcing of hashed+salted user passwords without a dedicated validation server? [duplicate]

Salted hashes don't seem to offer any real protection for user passwords by itself. So long as a hacker has a quick way to check if a password is right or wrong, it's trivial to brute force it to view ...
213
votes
7answers
29k views

How to store salt?

Nowadays, if we expect to store user password securely, we need at least do the following thing $pwd=hash(hash($password) + salt) then store $pwd in your system instead of the real password. I have ...
0
votes
1answer
158 views

Can any App Store app access all of my passwords?

Whilst researching another question, I've noticed that on OS X 10.9.4 there are many instances of Library/Keychains/login.keychain from ~ within the Data folder of what looks like apps from Apple App ...
12
votes
7answers
6k views

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
11
votes
2answers
641 views

How can I find out the password hashing schemes used by the specific Unix accounts I log in to?

Every day I ssh in to 3 or 4 independent Unix accounts. I have been regarding them as more or less "equivalently secure" on the grounds that I'm using ssh, but after learning of how much variety ...
11
votes
4answers
853 views

Does it indicate a bad password system to disallow certain characters in passwords?

When creating an account to the game League of Legends, the user's password must comply to a few rules. The one I'm concerned about is the "Must not contain slashes or spaces" one. The others are ...
1
vote
2answers
81 views

What is the evaluation criteria that a site uses for a password as strong , moderate or less secure

I have been in kind of jinx as to how a website decides on which password is highly vulnerable , strong etc . Lately my yahoo account was told to change password which I am using for long time as the ...
7
votes
4answers
1k views

password complexity policy for non “English” passwords

In an internationalized application, what is the best practice for a policy on complexity of passwords? I am not having luck searching for the answer. Wikipedia lists these items for password ...
6
votes
2answers
1k views

How do I block LinkedIn from extracting data from Microsoft Exchange Server?

LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click ...
1
vote
2answers
209 views

Can Hydra crack a flash-based login?

Is it possible to brute force a flash login with hydra? If not, what is a good tool to pen test a flash login?
10
votes
2answers
648 views

Password generation - too primitive?

A while ago (12 years old), I recognized my passwords weren't safe at all. Because I used the very same password everywhere, some grumpy admin could easily take over all my accounts (he got mail and ...
0
votes
0answers
70 views

THC-Hydra dictionary attack on JSP login form

I am trying to use Hydra to attack a JSP form but I have some confusion. Normally we use command something like this hydra -L list_user -P list_password HOST-ADDRESS http-post-form ...
-1
votes
2answers
4k views

Hydra https-form-post

I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives. This is what I have done so ...
2
votes
1answer
944 views

Hydra bruteforce and JSON

I am having problems with Hydra and a JSON payload. The login request (intercepted with Fiddler), is the following: POST http://architectureservice.test.com/api/v1/login HTTP/1.1 Host: ...
3
votes
1answer
151 views

Is it possible to retrieve SSH v2 credentials in a username/password authentication scheme?

I'm currently analysing a compromised network(root access has been gained to a workstation and logs show that it has been used for port scanning and service brute forcing attacks on the remaining ...
0
votes
1answer
93 views

How to store passwords to a remote web site?

Say I want to build a public API to access a website that doesn't have one. The website is protected by a standard username/password scheme and the API implementation will use scraping to get the data ...
1
vote
1answer
118 views

Email account password change via email-to-script

I host a mail server (postfix and dovecot) and I wish to set up a password change feature (especially useful when creating a new address provided with a temporary password). Does my scenario has ...
1
vote
0answers
31 views

THC-Hydra - one good pass = shows all valid [duplicate]

As in title. I'm testing my router security and I came up with problem. hydra 192.168.0.1 http-get-form "/:un=^USER^&pw=^PASS^:User Name or Password is incorrect." -L usernames -P passwords ...