Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

3
votes
3answers
174 views

Are there risks associated with a strong password reuse for disk encryption?

I understand the risks of password reuse when we share the password with 3rd parties as perfectly discussed under this question: Is password reuse a problem if the password is very strong? However I ...
1
vote
1answer
75 views

How secure is the UNIX sha_crypt as a password storage algorithm? [duplicate]

So I have been working on password storage, especially on the algorithms to use (and to not use). Most people are recommending scrypt or PBKDF2 for valuable reasons, but I have not seen any talks ...
130
votes
7answers
18k views

Internet courtship: Why would a hacker buy me poker chips?

Believe me, I never expected to ever write a title like that on a Stack Exchange site either! Yesterday evening I got a call from my mother. She is quite tech savvy and generally knows her way around ...
3
votes
3answers
182 views

Is it acceptable for customer service to ask for my PIN?

I tried to initiate an online chat with customer service of a company I am trying to do business with this weekend, but before they would answer any of my questions they requested that I give them the ...
22
votes
4answers
9k views

Google Account: implications of using application-specific passwords

In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google ...
5
votes
4answers
129 views

What are possible methods for calculating password entropy?

I noticed there are tons of questions and answers about password entropy on this forum, some even suggesting formulas for calculating it. None did answer my exact question. What are possible or ...
0
votes
3answers
126 views

Random characters and letters form obsfuscation

I know that this question has been asked many times, but would JavaScript encryption work if I just added 100 random numbers and letters to the password? That would be hard to reverse engineer, ...
21
votes
4answers
15k views

Router password vs MAC filtering?

I just bought a Galaxy S4, and it didn't connect to the WIFI in my house (I have a 14$ router). After a bit of testing, I've decided to leave my connection open without a password, but added the ...
2
votes
2answers
71 views

Periodic password change needed when using 2-step verification?

I know that it's considered good online security hygiene to change one's login passwords every 6 months or so. Is that needed on sites with 2-step verification? Isn't the 2nd step what will keep my ...
-1
votes
2answers
77 views

Website says my new password can't be used because it is the same as an old one [duplicate]

What are the risks of storing (in hashes I guess) all the old passwords? Why would a company chose to not delete old passwords? Why not let users reuse old passwords?
124
votes
6answers
47k views

Password Hashing add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
7
votes
2answers
164 views

Is there any recommended approach for “upgrading” MD5 hashes to something secure? [duplicate]

I'm currently dealing with a couple of user accounts containing MD5 hashed passwords. These accounts got migrated from an old system into our current system which uses PBKDF2 for password hashing. I ...
6
votes
1answer
83 views

Is there a way to know if a server is using ssh public key or password?

I am wondering is there a way for an attacker through finger printing to find out whether a server is using public-key versus password authentication method for establishing an SSH connection?
18
votes
6answers
3k views

What does “random” mean in the context of password creation?

Disclaimer: as you will see from my question I'm a total outsider in this subject, just very curious. I was wondering how easy it would be to crack a password-protected RAR5 file, and I found many ...
-2
votes
1answer
320 views

How can someone hack Twitter accounts so fast? [closed]

You may have heard the news about ISIS twitter accounts hacked in light of the Orlando shootings. I am wondering how can it happen so fast (just 2 days after the incident) and what kind of technique ...
0
votes
0answers
40 views

Manually computable passphrases [duplicate]

I need to revamp my password scheme for my various logins on different sites. I had the idea to try and craft a method where I could, using just my brain, algorithmically recall a password so that ...
27
votes
3answers
4k views

Can I share what password hash function I used in a public report?

I have developed a web site during an internship, using a database with accounts. I used the crypt() method from PHP, with a secured algorithm plus salt (found on the web with a lot of feedback). ...
4
votes
8answers
839 views

Does it take longer to brute force a password starting with z than one starting with a?

I was wondering about the following: If someone tries to get my password with Brute Force, will a password starting with "a" guessed faster than one starting with "z" ? In this case assume the ...
841
votes
23answers
168k views

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are ...
2
votes
1answer
118 views

PHP BLENC extension security concern

PHP BLENC is a extension that allows PHP developer encrypt their code, protect their ideas and avoid illegal copy. Although BLENC allow developer to define the main encryption key in source(in the ...
7
votes
2answers
2k views

When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?

When you take ownership of a TPM in Windows 7 you encounter a screen like this: Based on this document, it is my understanding that completing this dialog box somehow results in the generation of ...
26
votes
3answers
6k views

Security of LastPass together with YubiKey

I'm looking at password manager solutions and came across LastPass. I see that they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What ...
28
votes
4answers
13k views

Confused about (password) entropy

There seem to be many different 'kinds' of entropy. I've come across two different concepts: A) The XKCD example of correcthorsebatterystaple. It has 44 bits of entropy because four words randomly ...
1
vote
2answers
70 views

Password storage in 1password and other similar password storing applications

My understanding of memory in a computer is that it is stored in blocks that are over written only when the computer finds it convenient. so if a program asks to write in a certain block rather than ...
2
votes
1answer
79 views

What encryption is used by 1password?

I use a password storage application on my Mac called 1password. I was wondering if it encrypts the data it stores on my computer and decrypts it using a key made from my "one password" or if it has ...
5
votes
2answers
979 views

Why is whatsapp using 6 digit codes for verification?

My question is kind a simple. Why does whatsapp use 6 digit codes to verify the device? They could also use 5 or 7+ digits and or alphanumeric characters. Are there any reasons they chose exactly 6?
8
votes
3answers
323 views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of one-...
-2
votes
0answers
18 views

How to make a excel file that will lock after one year from the date of enterinf password [duplicate]

I want to make a excel file that will lock automatically after one year.and there will beca password which can open it for next one year. Is it possible to make such type of file??
8
votes
4answers
370 views

Is autocorrecting typos in passwords secure?

Technology Review's Why Autocorrect for Passwords is a Great Idea says: New research shows those frustrations could be avoided using the same approach used to fix typos in text messages and ...
1
vote
1answer
82 views

Multi hash security [duplicate]

Is md5(sha1(pass)) more secure than md5(pass)? For example in case of sqli when an attacker can't get our hashing schema, brute force or dictionary attack would be much less efficient. Am I right or ...
-5
votes
1answer
132 views

Where do webstites store the hashes? [closed]

I understand that lots of websites store passwords in hashes but where do they actually store the hashes? How can a website compare your hashed version of a password with theirs? Is it stored ...
4
votes
1answer
101 views

Is it possible to use parallelism when computing a key derivation function for a single password/key?

Suppose I have an AES-256 encrypted file, and I want to derive the key using PBKDF2 and a given salt with a large number of rounds (say 1 million), but I'm limited by user tolerance for UI lag when ...
1
vote
3answers
123 views

Is it secure to send a password recovery link for company application to an employee's personal email address?

I would like to automate the recovery of the password for the employees of a company. However, the problem is that not every employee has a corporate email account and some employees can't access ...
62
votes
5answers
5k views

Do 2FA sites leak info by confirming a correct password guess?

Here's my relatively layman's view of the issue. Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly. ...
17
votes
6answers
3k views

Correct terminology when describing password security to layman

I am writing a page for our website which describes the measures we take to keep our customer's information secure. On this page one section describes how we keep their passwords secure. We are ...
0
votes
0answers
16 views

Password Managers — Generating Passwords On The Fly a Safe Approach? [duplicate]

Most password managers store user credentials for individual services encrypted on their own back-end databases, so that your passwords are available on multiple devices. So, a DB compromise on these ...
1
vote
2answers
133 views

What are the recommended steps involved in creating an encrypted file format? [closed]

I'm developing a pretty standard program which lets users save their work in a custom file format and reopen it later. Now I'd like to add the capability to encrypt the file using a user-defined ...
6
votes
3answers
130 views

Why are low-entropy passwords considered OK in many cases?

When talking symmetric encryption, a 56 bit key is known to be so weak. If you use it for your encryption, you are considered a goner as you wont survive brute-force. When talking passwords however, ...
-1
votes
1answer
124 views

How does one securely create a MySQL database and user via the command line?

I'm making an app whose functionality includes creating a database and its user. This is accomplished like so: mysql -e "grant all on database.* to 'user'@'localhost' identified by '$PW';" $PW is ...
24
votes
8answers
4k views

Patterned password, based on site name [duplicate]

I'm considering implementing a pattern for my passwords, using the following ideas: Master password that I store nowhere An algorithm to mangle it based on the site I am accessing So for example I ...
4
votes
3answers
581 views

Is it a good idea to use non-Latin Unicode characters in a password?

I've heard many suggestions as to what makes a good password (hard to guess, not a dictionary word or permutation thereof, at least a certain length, etc.) so that it cannot be cracked in a realistic ...
17
votes
5answers
3k views

Is this idea for a password manager secure? If so, why doesn't anybody use it? [closed]

I've been thinking of a problem with usual password managers: although they do provide better security than manually using passwords, there's a central database that can get lost, get compromised, etc....
87
votes
12answers
12k views

Is a 6 digit numerical password secure enough for online banking?

My bank went through a major redesign of their customer online banking system recently. The way security is managed across the platform was also reviewed. The password I am able to set now to log in ...
20
votes
3answers
4k views

Why do password creation/login screens hide the typed password?

I realize that the concept behind obscuring a password on a screen is to prevent someone "shoulder surfing" behind a user and seeing the typed in password. As a fairly good typist I have no problems ...
0
votes
2answers
107 views

Secure password generation for different websites [duplicate]

I came up with the idea to generate passwords for internet sites by the following shema: $masterpassword $hostname $TLD hashfunction($TDL.$masterpassword.$hostname) So the actual password is a ...
206
votes
17answers
18k views

Passwords being sent in clear text due to users' mistake in typing it in the username field

Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
3
votes
2answers
143 views

Are password generators secure?

Here's a scenario that I often encounter: Some user needs access to something on my network, but they don't have an existing account in AD. I create an AD account for them which I then use to allow ...
0
votes
2answers
107 views

Password security in a Snapchat photo

This is going to be an extremely stupid question, so forgive my ignorance. Let's say I took a Snapchat photo of one of my passwords written in plaintext (let's ignore for a moment the security ...
5
votes
3answers
148 views

Does salting your own password improve security? [duplicate]

Let's say you were to add a couple of extra characters to your password, unique to each site you visit. The password would be largely similar except for a few characters of salt, possibly taken from ...
9
votes
5answers
7k views

what are good requirements for a password

I'm making a website and I'm deciding on the password policy. What does make a good password? I really have no idea. I guess passwords should be at least 6 characters long. EDIT: are there any ...