Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

3
votes
3answers
170 views

Why do so many banks have relatively weak e-banking security? [closed]

I follow a few infosec-related Twitter personalities: Paul Moore, Taylor Swift, Troy Hunt are the main 3. Paul Moore is currently in the process of switching banks, frequently tweeting and retweeting ...
13
votes
5answers
24k views

How secure is WD MyPassport lock

I have a WD My Passport hard drive. There is an option that allows you to lock your hard drive with a password. How secure is this lock? They don't give details about the encryption algorith or the ...
1
vote
1answer
44 views

Should I show the security answer when the user goes back to edit the field?

So when a user signs up to create an account, they are required to select select questions and enter security answers. Once they do that, they can proceed forward to a review page that shows them the ...
-1
votes
1answer
114 views

Is hashed password safe if salt and key are stored with the hash

I am trying to hash the password using SHA256 with random salt and random key in php and storing back hash value with salt and key used. I want to know does this provide adequate safety? The ...
0
votes
0answers
86 views

Line Length Exception in hashcat

I'm very new to cracking a password so sorry if I sound stupid. I am trying to get my admin password from my second PC (I lost it). I did find the SAM file with kali linux and with bkhive and samdump ...
0
votes
1answer
149 views

Saving username and pasword inside SQL

I am currently managing a network of around 100 PCs. Many users have different mails/usernames and passwords for different services like login to PC, mail, local applications, ... When an application ...
-2
votes
1answer
48 views

Make password list with crunch [closed]

I want to make some password list like this : A4B9D It should has these : 5 characters first, third, and fifth characters are letters (A to Z) second and forth characters are numbers (0 to 9) ...
1
vote
3answers
76 views

What are the disadvantages of combining client-side and server-side authentication security?

Imagine situation: Application might or might not be run via SSL/TLS Application should not know password of the client because client might reuse passwords Wouldn't then combined client-side and ...
3
votes
2answers
68 views

Assuming proper creation, encryption, and storage, how is a breach/leak of a hash worriesome?

Let's say I create a pseudo-random password that is secure (24 alhpa numeric, upper lower, special chars...) for a system (say a password manager). Let's assume the password manager encrypts and ...
4
votes
1answer
71 views

Desktop Flickers Past Lock Screen

I'm using Fedora 22 with Gnome 3. I have a password set for my user account, so when my laptop awakens from sleep, I am presented with the lock screen and must enter my password before getting to my ...
2
votes
0answers
46 views

What technologies does ChromeOS use to secure saved passwords?

I have read that Chrome will use the system's native credential tools to manage saved passwords (e.g. KeyChain on OSX, libsecret on Linux/GNOME etc). Does anyone know what tools are used on ChromeOS? ...
87
votes
4answers
20k views

Recommended # of iterations when using PKBDF2-SHA256?

I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
2
votes
1answer
148 views

Security behind “Windows Security” Feature

Within the Windows Security authentication mechanism active, there are cases the user-login popup comes up. Are this username and password sent encrypted or they are sent as plain-text as the ...
8
votes
4answers
5k views

HMACSHA512 versus Rfc2898DeriveBytes for password hash

We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key The salt is 64 char randomly generated string. We allocated 2048 length on the database for the hashed base64 string ...
1
vote
1answer
26 views

Authentication between to devices where the same password is used on both

I'm writing two applications that are intended for execution on two separate devices. It is similar to a remote desktop solution such as TeamViewer. What follows below is my proposal for an ...
0
votes
1answer
61 views

Old phone as secure credential storage device

Can an old android phone (with sim card removed) be securely used as an OFFLINE storage device for password, user id's and acct numbers?
2
votes
2answers
153 views

Understanding salted password hashing using Java

Context: I am using this tutorial and trying to understand and implement salted password hashing using Java. After spending some time on this topic, I figured out that the basic idea is to: Convert ...
1
vote
2answers
97 views

I forgot my 7z password [closed]

I used 7zip to encrypt a 200mb archive of my code used a combination of some of 7 possible words and no numbers or caps. So 823543 possible passwords. What is the best free program I can use to ...
1
vote
2answers
203 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
8
votes
4answers
5k views

How can hackers guess passwords (using dictionary attack or brute force) without being locked out?

Nowadays almost every website you want to register in; is asking you to create a complicated password...But why cant we use simple passwords? I am just wondering because in case of multiple wrong ...
35
votes
10answers
3k views

Is there a method of generating site-specific passwords which can be executed in my own head?

I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
0
votes
2answers
199 views

Are passwords in Mozilla products stored insecurely?

I have just downloaded a Polish program Passtool Password Reader (written by Rafał Jelitto), unpacked it from .rar archive and run it. I have hit the bottom-left button (Pokaż wszystko) and this small ...
-5
votes
1answer
66 views

How to use wordlist [closed]

I have downloaded a wordlist from https://crackstation.net/buy-crackstation-wordlist-password-cracking-dictionary.htm The size of the wordlist is 4.2 GiB (compressed) or 15 GiB (uncompressed) The ...
44
votes
5answers
9k views

How can I know that developers will be ethical and not record my password in plaintext

I am not asking why hashing should be done. Instead, I want to know how to prevent that developers record user passwords to hack their user's other accounts, especially their email. Couldn't they ...
1
vote
3answers
71 views

Potential collision with hash password

Normally, the password size is fixed by the hash function in which the password is given right ? Because otherwise, if the password size is bigger than the hash result size, there should be potential ...
14
votes
7answers
4k views

Are password reset links that don't expire a security risk?

I am currently working on a password reset flow. We have decided to go with a password reset link being emailed to the user's registered email and allowing them to follow that and input a new ...
5
votes
3answers
377 views

How can I detect users that have requested AD Administrators to reuse an expired password?

There is a trend among companies I've worked at where administrators (or helpdesk folks) give a user a courtesy extension of the old expired password... rather than forcing the user to change it. ...
1
vote
3answers
87 views

Why is there a preference towards long passphrases instead of increasing the hashing iterations?

There seems to be an agreement that when it comes to offline password brute-forcing, long but simple passwords are better than short complex ones. I recently saw a question related to increasing the ...
0
votes
0answers
49 views

Hashed master password and generated encryption key in a password manager program

I'm writing a WPF password manager application to practice programming, so far this is the scheme I intend to use to store master password and individual site password: Master password: Generate a ...
2
votes
2answers
71 views

Enabling feature to log in as soon as right password is typed (without pressing enter)

My phone has an option for the PIN lock screen to unlock it as soon as the correct number is entered (without pressing enter). So for example if the password is 77912 then you only have to enter 77912 ...
17
votes
5answers
502 views

What concrete parameters can I change to make my passphrase-protected private gpg key more secure

There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever. Rather than ...
18
votes
2answers
783 views

Can client-side hashing reduce the denial-of-service risk with slow hashes?

When storing user's passwords that you need to verify against (but not use as plaintext) the current state of the art is: Hash the password Use a salt Use a slow hash function - bcrypt, scrypt, etc. ...
3
votes
4answers
138 views

Are there any two way + two factor authentication systems in use?

My bank, Google etc. use two factor systems where they send me a One Time Password via out of band means. e.g. SMS or an App on my Cellphone or a standalone RSA token generator. This seems good ...
1
vote
2answers
155 views

“Sniffing” Wifi Password? [duplicate]

I wonder if the follwing is possible: Assume you want to gain access to the AP "ap". Isn't it possible to set up a hotspot with the same BSSID, so that clients think that you are ap and send the ...
46
votes
7answers
3k views

Do security questions subvert passwords?

Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
6
votes
7answers
14k views

Is a longer WiFi password more secure?

Today I had to type the same password to connect to a WPA2-secured WiFi network several times, and got really annoyed with the length of the password. Especially since it is just a phrase repeated ...
2
votes
1answer
90 views

Should you be able to reset a password without verifying the email address first?

I just noticed with Instagram, what you can do is: From the logged in Instagram app, change your email address. This will send a verification link to the new email address. Verifiying the email ...
2
votes
3answers
3k views

Microsoft password email reset link leads to different url?

...I am really annoyed and unsettled by the password reset email I just received from Microsoft. What should I think of this? My email client correctly told me that the underlying url is not the same ...
5
votes
1answer
160 views

How secure is CertiVox M-PIN?

CertiVox have designed a system with the aim of "getting rid of passwords". Essentially the system authenticates users with two factors of authentication: A 4 digit PIN and a token stored within the ...
2
votes
2answers
141 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
39
votes
7answers
8k views

Why isn't open WiFi encrypted?

As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
1
vote
1answer
163 views

How is password information stored and used on Android accounts?

How difficult would it be for someone who stole your device to gain access to the username and password information stored under the Settings -> More -> Accounts section of an Android device? ...
4
votes
1answer
84 views

How can I delete a password and lock the account in one step?

I have a minimal server install on a remote machine with a root password set to a temporary, but chosen, value. I have added a separate administrator user. This user has an authorized key for SSH, no ...
0
votes
1answer
99 views

What can I do if someone is using my IP address? [closed]

Another device in my network is using my IP address, what can he do if he is using my IP address? Is this a crime? Can him be caught by police or sue by Malaysia government?
16
votes
5answers
4k views

What is a good practical (and sane) way to manage all your passwords for online sites?

I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords. This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
1
vote
1answer
121 views

Password management: how an administrator should reset password for a user?

I implement simple user management. How an administrator should reset password for a user? Just provide a new password for a user (as in Active Directory)? Is it secure enough? Added Is it secure ...
31
votes
4answers
16k views

Standards for encrypting passwords in configuration files?

My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they ...
9
votes
3answers
1k views

How secure are sha256 + salt hashes for password storage [duplicate]

I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 ...
1
vote
1answer
75 views

Is it worth it to implement both SHA2 and SHA3 at the same time?

I'm creating a password storage system for a web server I'm building for fun. Would it be more secure for me to use both SHA2 and SHA3 for hashing, and then store them in a database? If I use both ...
13
votes
6answers
2k views

Does prepending a salt to the password instead of inserting it in the middle decrease security?

I read somewhere that adding a salt at the beginning of a password before hashing it is a bad idea. Instead, the article claimed it is much more secure to insert it somewhere in the middle of the ...