Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

5
votes
3answers
160 views

How to mitigate heartbleed like attacks prior to zero day

Whenever sensitive data such as a password is used on a server it resides in memory for a short time. Given that security flaws like heartbleed exist which have the ability to 'bleed' memory for their ...
374
votes
5answers
123k views

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
23
votes
4answers
5k views

Why did Richard Stallman recommend not to use passwords for wireless networks? [closed]

In a short interview, Richard Stallman recommends not to put passwords on your wireless network. In the OS Revolution documentary he also mentions how he's disliked passwords ever since his job at MIT ...
1
vote
0answers
26 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
16
votes
7answers
6k views

My IP address (with a NAS) is targeted by a hacker. What to do? Should I be worried?

I've noticed, based on the logging of my NAS, that my IP address is targeted by a hacker. I already took action by automaticly ban the IP address permanently after five unsuccesful login attemps. ...
1
vote
1answer
71 views

Copy-and-pasting plaintext data from encrypted container

Suppose we have sensitive information stored in plaintext within a dm-crypt/VeraCrypt encrypted file and this information is copy-and-pasted by a user into a web browser after decrypting (this could ...
11
votes
2answers
3k views

Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email

Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance MSFT even went to far as create ADMINSDUser rights to put ...
1
vote
1answer
129 views

custom input format for hashcat

I am doing a password strength audit (I have permission). I'm using Hashcat. It supports formats like sha-256(password.salt) and sha-256(salt.password) but my hashes are generated by ...
-2
votes
1answer
62 views

Password complexity policy and practicality [closed]

If you are a user and your company implements a password policy that says your password must have at least 8 characters, at least 1 number, at least one alphabet and at least 1 special character, ...
0
votes
2answers
273 views

Is this hash function safe?

Below is the hash function implementation of the roguewave library. It returns a 32 bit hash. The core operation is A = B ^ ((C << 5) | (C >> 27)). Is this hash safe to use as a password check ...
30
votes
8answers
5k views

Do non-keyboard characters make my password less susceptible to brute forcing?

I can put characters in my password for which there are no keys on a keyboard. On Windows, Alt+#### (with the numpad) inserts the character for whatever code you type in. When I put this in a ...
5
votes
4answers
708 views

Can't brute force password cracking somehow be throttled?

Online articles mention the importance of a strong password and suggest that hacking tools allows bad guys to attempt millions of passwords per second. I am wondering why OSes and websites and such ...
-1
votes
2answers
33 views

What could be a suitable solution to single factor authorization worksheet bank password circulation with no control?

Passwords for various banks are written in an excel sheet and this excel sheet is password protected. However, there is no control on circulation of this sheet, for many banks only single factor ...
5
votes
0answers
65 views

Samba printer usernames and passwords , security problem

Password leaks , printing from Linux client to windows based print server When authenticating Linux users for using a windows share printer on their machine, the windows domain user-name and password ...
5
votes
1answer
160 views

Router sends password plaintext: is this a serious vulnerability?

Today I went to go & reset my router, but forgot the account password for the ISP. On the (extremely) off-chance of the password being present in the 'Password' field, I went to the appropriate ...
37
votes
9answers
25k views

Feeding /dev/random entropy pool?

Which way of additionally feeding /dev/random entropy pool would you suggest for producing random passwords? Or, is there maybe a better way to locally create fully random passwords?
3
votes
1answer
70 views

Security problems with password-less SSH

Is there any downside of configuring password-less SSH authentication? Although it is very handy and secure, if someone gets access to my system with my account and there is password-less ...
3
votes
1answer
136 views

How to read the key3.db file?

The file key3.db contains the key that is used to encrypt the Firefox passwords stored in logins.json file. I don't use master password in Firefox, but according to this article, my passwords are ...
22
votes
1answer
1k views

How does Firefox encrypt passwords without selecting Master Password?

I know that the file logins.json contains all my encrypted passwords in Firefox browser. How does Firefox encrypt these passwords if I don't use the 'Master Password' option? Does this mean key3.db ...
46
votes
5answers
9k views

How can I know that developers will be ethical and not record my password in plaintext

I am not asking why hashing should be done. Instead, I want to know how to prevent that developers record user passwords to hack their user's other accounts, especially their email. Couldn't they ...
1
vote
1answer
64 views

Is it secure to allow an account to use `test123!` as their password?

I'm working on tightening up security for the auth layer of my app and I'm currently making a call on the complexity I'll require for passwords. Is there a 'standard' recommendation for complexity? ...
5
votes
1answer
594 views

Is it bad to add a guessable password to a random password?

Let's say a person has a password they used before they knew about how to make good passwords, like peter123. Let's also say that when they were thinking of a better password, they found they could ...
73
votes
14answers
7k views

How to store passwords written on a physical notebook?

Answers to the question "How safe are password managers like LastPass?" suggest that storing personal passwords on a physical notebook might be a reasonable option: I know someone who won't use ...
2
votes
1answer
33 views

What are the demerits of a derived salt for password storage?

The general method used for storing passwords securely involves generating a salt, feeding the salt and password to the password hashing function, and then storing the salt and the output of the ...
0
votes
0answers
72 views

Generate password list with specific keywords and length

I need to generate a list of passwords to try penetrating into a wi-fi network. I have a pretty big list of keywords and I want to use them to generate as many possible passwords as possible, which ...
44
votes
4answers
6k views

Is it good practice to ban an IP address if too many login attempts are made from it?

Since an IP address does not necessarily represent a specific device, but probably a whole network/company/etc. does it at all make sense to block an IP address if there is a significant amount of ...
0
votes
1answer
79 views

Could there be any implementations where the pw is truncated after “space”

A good human memorable password could be: My 1st passw%%%%%!!!!!rd But could there be any password storing implementations that cut off the password after the first space, so the password will be ...
27
votes
9answers
3k views

Best way to administer all my passwords

I am trying to figure out what the best solution is to store different types of passwords: Personal passwords (my personal email, my company's email, all the services I use to buy things like ...
1
vote
1answer
37 views

Is there a PAKE algorithm where the passwords can be tested in the first round?

I want to use PAKE for key exchange between two parties (Alice and Bob) which share a low entropy secret (a password they exchanged on a piece of papers). Alice and Bob use a software on there ...
6
votes
1answer
161 views

Password security when connecting to ldap with rails application

How do you store a username/password securely in a rails app when using it for many ldap searches? The connection in the app requires ldap_bind_authenticate(Net::LDAP.new, username, password) ...
2
votes
2answers
194 views

Why are there places that still advises to use complex-only passwords? [closed]

Why are there organizations, websites that still, in 2015 advises that people should use complex, at least 8 character long passwords? Why doesn't they advise to use password-managers, long ...
8
votes
6answers
32k views

Modern high quality password dictionary

Has anyone come across any good password dictionary lately? Some of the lists I found dated back to 90's! Some are simply too big that I doubt their quality. There appears to be some work by someone ...
5
votes
1answer
120 views

Fido: trusting user-agent

As I went through Fido specifications: the server (providing web app/services) need to trust user agent for local fido authentication and if needed can enforce certain policies" I am not sure ...
2
votes
0answers
69 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
4
votes
3answers
141 views

Is there more to consider than just keyspace when determining a password's strength?

Please consider the following passwords: CO/l37)[Ou It contains characters taken from a pool that contains [a-zA-Z0-9] and 32 'special' characters. That makes 94 characters in total. And this one: ...
0
votes
1answer
89 views

LastPass website requests Master Password when creating the account

When I wanted to tryout out LastPass today, I was stunned that the webpage form for creating the account at LastPass actually requested the "Master Password", which is the same "Master Password" that ...
36
votes
6answers
7k views

Somebody hacked my router and changed my wifi SSID

One of my neighbours hacked the password of my router and he uses my limited internet package. I change the wifi SSID almost daily, but he can hack it easily. Today, he changed the SSID to a hate ...
1
vote
4answers
206 views

How different should passwords be?

It seems to be generally accepted the same password should not be used for different sites or devices. How different should passwords be? For example +_^gum<JW1 and +_^gum<JW2 are very similar. ...
13
votes
3answers
2k views

Is it safe to generate passwords online?

I usually generate strong passwords using various online tools. Some time ago I mentioned it to a friend of mine and he was shocked that I do such dangerous thing. Is it really so unsafe to generate ...
6
votes
2answers
113 views

If no maximum length is placed on a password, can't collisions occur?

As I was thinking about storing password hashes in a database, it dawned on me that there might be hash collisions if there is no set maximum length for the password being hashed. My understanding is ...
2
votes
3answers
965 views

Key stretching a hash

If I implement a function which hashes the first half of my password with MD5 and the second half with SHA-2 and MD5, is there a security issue when I put these two hashes together to create a 64 ...
1
vote
3answers
399 views

Need a word-list generator from a few words and numbers

I have an old rar backup and I am trying to recover the password. I remember the words in the password, but I usually add some numbers and cap some characters (don't know which ones though). I have ...
6
votes
3answers
1k views

Is using the same password for multiple TrueCrypted volumes safe?

I want to use TrueCrypt for encrypting multiple disk volumes. Assume I use the default cryptographic algorithm (AES) and hash algorithm (RIPEMD-160) and that nobody can get my passwords through ...
7
votes
1answer
822 views

“No password hashes loaded” John does not recognise my hashes

I am trying to learn how john works. I made a password-protected rar archive, and written that password inside a file named pass.txt. I used rar2john to build the hash: # more test.hash ...
27
votes
6answers
10k views

Is AES encrypting a password with itself more secure than SHA1?

This isn't really a practical question, but more a question of curiosity. I heard a CS professor recommend stepping up from md5ing passwords not to SHA1, but to AES encrypting the password using ...
11
votes
8answers
260 views

How to choose a password that I have to remember for a long time but do not use a lot

I have a scenario where I have to remember a password / keyphrase, which I will not be able to recover if I forget it, for a long time (probably more than 10 years). The problem is because this ...
14
votes
6answers
1k views

Is this login security enough?

I'm coming up with my next login system for admins of an e-commerce website, which will have this: login form is SSL secured password is converted to SHA-256 before being transmitted (bcrypt is too ...
3
votes
3answers
208 views

Help generating wordlist using crunch

I need to configure crunch so that it produces a wordlist with the following set of rules: Exactly 10 characters long Contains exactly 4 letters, which have to be a-f (all lowercase) Contains ...
4
votes
1answer
88 views

Is keepass random password generator fully secure and trustworthy?

Am I safe using keepass for generating passwords? For example my accounts, am I safe using a keepass generated password? Could my future keepass master-keys be safely generated in keepass? What method ...
5
votes
2answers
690 views

Docker containers, environment variables, and databases

Environment variables (set with -e) in Docker containers are available to every linked container. Consider a typical use case, a database. The official MySQL image gives this example command: docker ...