Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
2
votes
2answers
71 views
Is there any way of recover a locked drive using TPM?
Just reading I learned about the TPM technology and how it works.
However, it make me wonder... if the motherboard crashes, is the data lost forever? Because you can't use the drive in other system ...
10
votes
2answers
1k views
Why are GPUs so good at cracking passwords?
What is it about GPUs that lets them crack passwords so quickly?
It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
0
votes
1answer
107 views
Recover password or password hash from locked acount.
I have a locked administrator account. Other accounts is unlocked, but it has no rights. I want to get a password from the locked account, or maybe password hash, if possible.
168
votes
13answers
27k views
Are passwords stored in memory safe?
I just realized that, in any language, when you save a password in a variable, it is stored as plain text in the memory.
I think the OS does its job and forbids processes from accessing each other's ...
3
votes
1answer
91 views
Can a user's Apple Keychain be opened on a different computer?
Apple uses a nice keychain. This is used by, for example, Google's Chrome browser.
Imagine a user copies all the keychain files.
Would that user be able to unlock the keychain, if they knew the ...
5
votes
1answer
116 views
When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?
When you take ownership of a TPM in Windows 7 you encounter a screen like this:
Based on this document, it is my understanding that completing this dialog box somehow results in the generation of ...
-3
votes
2answers
295 views
Is pixel based image encryption secure?
I have encrypted an image using pixel encryption method. I just used a bmp image for that. What I did is, I retrieved each pixel value from the image and obtained the value of red, green and blue ...
3
votes
2answers
126 views
What exactly is the impact on security when forcing user passwords to contain a particular character?
Some years ago a sysadmin of large computing centre (on a campus) enforced the password of every single user to contain the character $ at an arbitrary position. They soon dropped this policy but I ...
6
votes
5answers
2k views
Email forgotten password or send reset link, both just as insecure?
I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
9
votes
8answers
666 views
Password management/synchronization?
Is there a good enough service I could run on my own home (Linux) server that I could use for storing/accessing/synchronizing passwords so they could be available for me from multiple ...
3
votes
4answers
161 views
Temporary passwords e-mailed out as plain text
Is this a security issue? Many big ecommerce platform companies use this feature. Where if you forgot your password, they e-mail you a temp password.
Could someone potentially figure out the ...
2
votes
1answer
100 views
Pointers for john the ripper rulesets
I've been pouring over the JtR ruleset documentation and making little progress. I understand how to use it to make various permutations from a given wordlist, that's fine. However, I'm trying to ...
10
votes
3answers
427 views
How much information about the reason for an unsuccessful login should a web application give?
After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application ...
2
votes
2answers
123 views
MySQL Access Control?
I have read somewhere that it is better to have two different MySQL logins in order to prevent hacking. What I mean is having one MySQL login for read access (SELECT permission) and another login for ...
4
votes
5answers
211 views
Are password complexity rules counterproductive?
In creating a login for this site I chose a nondictionary password that would be extremely hard to guess, but easy to remember.
I was told that it did not meet complexity rules.
After several ...
3
votes
2answers
193 views
LastPass One Time Recovery Passwords--How?
The LastPass password manager stores One Time Recovery Passwords locally in each browser you use the plugin with:
http://helpdesk.lastpass.com/account-recovery/
My question is, how can you have more ...
1
vote
2answers
196 views
Password Protected Zip: if attacker had one file, can use it to decrypt all files?
Consider a folder containing the following files:
(file1.txt, file2.doc, file3.pdf) all zipped and password protected, if attacker had one of these file, can use it for decrypting all without knowing ...
3
votes
2answers
210 views
Is GPG suitable as part of a password manager and generator?
I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
3
votes
5answers
246 views
Password reset links: random value or authenticated message?
Which is better?
Create tamper-proof encrypted password reset token which contains the user id and the expiration time within the encrypted token.
Generate a random token and store it in the ...
6
votes
3answers
670 views
Tools helps: First time cracking passwords
I am trying to crack passwords on two Windows member servers (2003 and 2008). There is no Active Directory. Each user seems to use the same password across servers, workstations, etc. I have access to ...
2
votes
3answers
194 views
Client-Side Hashing to decrease value of password guessing heuristics
Yes, this is 'yet another client-side hashing' question. But, don't leave yet, I think there is some value here.
I'd like to do something to mitigate the affect on the community as a whole when my ...
7
votes
3answers
1k views
Additional security of keyfile on top of a master password for KeePass
I use KeePass + Dropbox to manage and synchronize my passwords across my devices. This system works really great and I trust KeePass' security model.
However my biggest remaining concern is the ...
8
votes
3answers
263 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
2
votes
7answers
234 views
How to provide security for passwords stored in Database? [duplicate]
Passwords of end Users are stored in Database which is encrypted (using one way hash like MD5). Apart from me, there are 'other' people belonging to other teams who have access to Database which means ...
1
vote
2answers
274 views
What is the safest way to store a password in a single file?
I've been reading about it. This article helped me a lot. But the more I read the more complicated it seems. For example:
Is it better to use bcrypt, or PBKDF2, sha2 or something else for the salt?
...
2
votes
4answers
268 views
Yahoo Email Keeps Getting Phished
I keep getting spam emails from myself (and I am sending them to others as well) on my Yahoo Mail account. I have already went through two password changes which I thought were secure. My very last ...
-2
votes
3answers
148 views
What's the use of making users use digits, uppercase-lowercase combination password if the passwords are hashed?
Some websites, even the StackOverflow asks for atleast 1 digit, 1 uppercase character in the password so my question is does this really matter when the developer uses 1 way encryption algorithm to ...
4
votes
1answer
113 views
Need to ephemerally store third-party password
One particular web service that I am writing interfaces with an API. Each API call requires the user's username and password to be sent, no state is maintained.
Ideally, when using my web service the ...
6
votes
2answers
191 views
When, exactly, should old password reset tokens be deleted?
I'm trying to figure out best practices for working with password reset tokens.
Say a user initiates the password reset process and the are emailed the reset token and we store a hashed copy in the ...
3
votes
2answers
189 views
File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?
I've been using this command to encrypt files for a while now:
openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc
Then I type in a password.
Can someone tell me, roughly speaking, ...
-2
votes
5answers
276 views
Is this password hashing method secure?
I have made a custom hashing method to help make my users' passwords more secure if the database will be leaked.
The encryption method is like this:
A method takes an input of 1 character, gets the ...
1
vote
4answers
295 views
How password hashing is useful in MITM attack?
Even though I read a lot about hashing and how passwords are protected, I am still confused about it.
If passwords are hashed at client side, it will be useless because it can be sniffed and used by ...
5
votes
3answers
258 views
How can we factor Moore's law into password cracking estimates?
How would we go about factoring Moore's law into exceedingly long password cracking estimates?
Let's say we've got a 12 character password containing mixed-case alpha characters and numbers, i.e. ...
1
vote
2answers
86 views
How to protect against an attack where a person claims to be in a position of authority?
In an office if a person approaches an employee and claims to be a new IT staff and to give them access to their computer, what can prevent this kind of attack? I've worked a couple tech support jobs ...
6
votes
2answers
363 views
Production ready bcrypt implementation for .NET
Which, if any, .NET / C# bcrypt implementations are considered suitable for production environments?
I have seen CryptSharp and BCrypt.Net mentioned in answers to other questions but without any ...
6
votes
2answers
228 views
How to proceed if a new hash algorithm for passwords is introduced?
I have an e-mail address at a certain institution. A few days ago they sent me an e-mail (in German), which I'd like to paraphrase without revealing the institution:
Dear Madams and Sirs,
a ...
13
votes
2answers
753 views
Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML
It's clear there there is no consistent set of features among any of the popular authentication providers.
Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
0
votes
1answer
147 views
What type of attack should be used in order to pass this authentication
I am practicing the Astalavista Wargames and i came across this challenge. The question is:
Bob wrote a piece of software but the password verification doesn't seem to work. You must find a way to
log ...
4
votes
2answers
186 views
Passphrase using same word several times
I used a trivial 3-letter dictionary word five times in a row (smth similar to pwdpwdpwdpwdpwd), and am surprised to find my self in the list of hacked accounts in a penetration test using a ...
2
votes
3answers
89 views
Is password authentication worse that signed messaging if done over SSL?
Let there is a public API:
HTTP-based
via SSL
there are no browsers, just connections between custom written programs
The first authentication scheme that came to my mind was... client signs their ...
19
votes
11answers
925 views
Is it safe to use a weak password as long as I have two-factor authentication?
I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
6
votes
3answers
2k views
Why is Chrome asking for the application-specific password and my account's password every time?
I enabled Google's two-factor authentication and found it ironic that Google Chrome Sync requires #1 You account password, and #2 an application-specific password. First of all, don't applications ...
3
votes
1answer
170 views
How genuine are password entropy calculations?
I apologise for perhaps the confusing title, I'll try and elaborate a little better.
Many discussions I see surrounding password entropy focus on the specific context of the range of choices ...
7
votes
2answers
238 views
What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?
I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
2
votes
3answers
612 views
Can the salt for PBKDF2 be a hash of the user-entered password?
I want to derive a key from a password in a client application that will be used as a master key that decrypts a data key. As far as I understand the salt should be private knowledge. Would it be ...
5
votes
1answer
153 views
How does SRP prevent man-in-middle attacks?
SRP is designed to resist both active and passive attacks, how does SRP prevent man-in-middle and packet modification attacks?
-1
votes
1answer
73 views
What makes EAP-SRP-256 better than SRP? [closed]
What is the advantage of the EAP-SRP protocol? Is it only used in wireless?
9
votes
3answers
983 views
Why are passwords limited to 16 characters?
What is the reason that most websites limit to 16 characters?
I would have thought the longer the password the more difficult it makes it for someone to crack it?
Is it something to do with hash ...
4
votes
4answers
2k views
How secure is Windows Auto-Logon?
Obviously, if auto-logon is enabled, anyone who can gain physical access to the PC can use the PC. That's not the question.
The question is, when I enable auto-logon for my Windows 7 box, will there ...
3
votes
2answers
315 views
SASL Authentication Protocol with No Cleartext passwords
As you know, LDAP supports three authentication mechanisms: anonymous, simple and SASL.
The first one is only suitable for particular cases, and therefore I'm not going to talk about that. The ...
