Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
41
votes
5answers
5k views
Is sending password to user email secure?
How secure is sending passwords through email to a user, since email isn't secured by HTTPS.
What is the best way to secure it? Should i use encryption?
33
votes
7answers
2k views
“Real” Salt and “Fake” Salt
During a Q&A period at DEFCON this year, one member of the audience mentioned that we're using "fake salt" when concatenating a random value and a password before hashing. He defined "real salt" ...
22
votes
7answers
3k views
Is salting a hash really as secure as common knowledge implies?
(I did search on this topic, but I found no complete question/answer that addressed it, or even good portions of questions that might be relevant.)
I'm implementing a salt function for user passwords ...
12
votes
6answers
525 views
Is This Login Security Enough?
I'm coming up with my next login system for admins of an ecommerce website to have
login form is SSL secured
password is converted to sha256 before being transmitted (bcrypt is too slow still for ...
20
votes
5answers
1k views
Is it common practice to log rejected passwords?
While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
4
votes
4answers
8k views
Modern high quality password dictionary
Has anyone come across any good password dictionary lately? Some of the lists I found dated back to 90's! Some are simply too big that I doubt their quality. There appears to be some work by someone ...
15
votes
3answers
2k views
How would you store a 4 digit pin code securely in the database?
I'm familiar with password hashing, using salts, bcrypt etc.
But it doesn't seem like this would work to store a 4 digit pin code since the attacker could try all 10,000 combinations quite quickly. ...
26
votes
7answers
946 views
Who is responsible for the strength of user's passwords?
Who is responsible for a user's password's strength? Is it us (developers, architects, etc.) or the user?
As a web developer, I've frequently wondered whether I should enforce the minimal password ...
20
votes
5answers
737 views
Should passwords be revealed in error message?
I am having pet-peeve with PHP's PDO class. As you can see on the Warning note: it reveals database password by default if an exception was not caught (when display errors is on which is a probable ...
15
votes
12answers
2k views
Why do we even use passwords / passphrases next to biometrics?
In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...
13
votes
3answers
13k views
How difficult to crack keepass master password?
How easily could someone crack my keepass .kdbx file if that person steals the file but never obtains the Master Password?
Is this a serious threat, or would a brute force attack require massive ...
8
votes
3answers
803 views
How can I mitigate the threat that DPAPick poses to my DPAPI protected data?
The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications).
DPAPick was presented at BlackHat ...
7
votes
3answers
260 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
6
votes
1answer
674 views
How will security need to be changed if P=NP?
If we suppose that it is found that P=NP, how will security measures need to be changed?
I'd like to know the major security measures that are affected, and how they would need to be changed. We can ...
6
votes
4answers
910 views
Password entropy in layman's terms
Entropy is a term used often in relation to password security and brute-force attacks, but it is a topic that can get complicated quickly. What is the best way to describe password entropy (what it is ...
17
votes
4answers
972 views
When hashing passwords, is it ok to use the hashed password as the salt?
I don't like this idea. But I can not come up with a technical argument against it. Can somebody explain it to me? The basic idea is:
$passwd = 'foo';
$salt = hash($passwd);
$finalHash = hash($passwd ...
14
votes
3answers
403 views
Is it OK to tell your password to an admin? [duplicate]
Possible Duplicate:
From a security point : Is it OK to tell your password to an admin?
I am working in a small company (20 employees) as a senior SW engineer.
After having some email ...
13
votes
2answers
257 views
Concrete figures on password cracking in the wild
While password guessing is a science, not every attacker out there is up-to-date with the latest advances or cares to invest in GPUs or FPGAs.
It's easy enough to test online password guessing ...
10
votes
7answers
416 views
Does adding dictionary words to passwords weaken them?
This might sound like a stupid question, but hear me out. If I'm encrypting my financial information and sensitive data via a program like TrueCrypt, the strength of the password is going to matter a ...
10
votes
3answers
1k views
Confused about (password) entropy
There seem to be many different 'kinds' of entropy. I've come across two different concepts:
A) The XKCD example of 'correcthorsebatterystaple". It has 44 bits of entropy because four words randomly ...
9
votes
3answers
979 views
Why are passwords limited to 16 characters?
What is the reason that most websites limit to 16 characters?
I would have thought the longer the password the more difficult it makes it for someone to crack it?
Is it something to do with hash ...
8
votes
2answers
1k views
How big salt should be?
I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2).
Having that in mind, how big salt should I use?
Should it be ...
8
votes
3answers
1k views
time to crack file-encryption password - more than just iteration
I have often seen that takes x amount of time to crack a certain length password. But this just seems to be the amount of time it takes to iterate through all the possibilities. What about the time it ...
7
votes
3answers
151 views
If multi factor authentication is enabled, how should that affect self-service password reset?
Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required)
...
7
votes
4answers
2k views
How do online accounts get hacked?
How does your typical users run-of-the-mill Facebook/twitter/gmail/AIM/etc account get hacked? Is it simply a matter of a weak password? Are they typically the victim of phishing or other social ...
3
votes
3answers
603 views
Calculating complex password entropy?
Whenever I look at password entropy, the only equation I ever see is E = log2(R)*L, or alternatively E = log2(R^L), where E is password entropy, R is the range of available characters, and L is the ...
3
votes
3answers
696 views
Best password storage scheme for high entropy, unique passwords which is failure resistant [closed]
What is the best, most secure, easiest way to:
store unique, strong passwords for every service which requires authentication
make the system resistant (total loss of security is avoided, breaches ...
1
vote
3answers
193 views
Logic for generating Strong Password?
I try to encrypt password using MD5 but there are decoders for MD5. So I'm worried about encryption of password for big website.
Is there any logical suggestion or step function to generate strong ...
15
votes
2answers
828 views
Salting password with the first 8 bit of the password itself
Do you guys think salting password with the first 8 bit of the password itself will have same result as using stored salt to hash password?
[Clarification]
I am not storing salt but creating from the ...
13
votes
6answers
440 views
Primary Key as Salt?
Is it okay to use the primary key as the salt in a Users table?
The only disadvantage that I can see is if the PK changes (unlikely), then the passwords break.
What are your thoughts?
11
votes
2answers
1k views
What's wrong with storing private keys in the cloud?
I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
10
votes
4answers
891 views
How secure is the SRP that Blizzard uses to protect passwords?
Blizzard very recently announced that their network was compromised, but they assure users in their statement that the password information that the attackers had access to was saved in a secure way:
...
10
votes
5answers
313 views
Security of using passwords or even passphrases to encrypt files
Is it ever appropriate to use real-world passwords to encrypt files to be sent via unsecure means.
By real world, I mean a password that is memorable and memorisable by a mere person?
I am implying ...
9
votes
3answers
773 views
What is a good enough salt for a SaltedHash?
Since I'm hashing all passwords with each their own salt, is there a benefit to the salt being really random, or would an incremental counter or a guid be good enough? Also, is there a benefit of ...
8
votes
4answers
310 views
How to evaluate the strength of a hashing algorithm?
At work the hashing algorithm we use for passwords appears to be bespoke. Obviously that's a pretty bad idea, but the management don't seem bothered.
The algorithm always produces 20 character long ...
8
votes
3answers
894 views
Password in file .php
My connection.php file stores the credentials to connect to the database.
<?php
$objConnect = mysql_connect("localhost","username","password");
mysql_select_db("selectDB", $objConnect);
...
7
votes
5answers
378 views
Utility company does not hash passwords in the database
I had to use my utility company's online account information application and forgot the password. Going through the steps of resetting the password I was emailed the password in the open. I found this ...
7
votes
3answers
1k views
Additional security of keyfile on top of a master password for KeePass
I use KeePass + Dropbox to manage and synchronize my passwords across my devices. This system works really great and I trust KeePass' security model.
However my biggest remaining concern is the ...
6
votes
3answers
229 views
Increase the security of an already stored password hash
Right now we're using 1024 byte PBKDF2 with 256 byte user-specific salt and variable iterations. However, I would much prefer to be able to, perhaps once every year or two, to be able to flat out ...
6
votes
1answer
231 views
Reversible password storage obfuscation method for third-party login credentials
I have an internal business application, that as part of its functionality connects to a third-party app using login credentials specific to the user of my own app. These passwords are stored in a ...
6
votes
2answers
608 views
Stretching a hash, many iterations versus longer input string
I have been reading up on various password hashing schemes, for example the SHA-based Crypt proposed by Ulrich Drepper and used in some Linux versions.
A recurring theme here is to 'strengthen' or ...
5
votes
3answers
180 views
Is it safe to generate passwords online?
I usually generate strong passwords using various online tools. Some time ago I mentioned it to friend of mine and he looked at me as if my life was one big fail. Is it really so unsafe to generate ...
5
votes
2answers
1k views
What algorithms are best be cracked by GPU?
What algorithms are best being attacked by a GPU powered password cracker?
For example, I heard that md5crypt that is being used in unix shadow file, is not the best choice for GPU cracking because it ...
5
votes
3answers
649 views
Attack vectors for brute-forcing website passwords
When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
5
votes
4answers
3k views
Brute force vs other methods of recovering passwords from shadow file
Do you know any good approach for de-hashing/actually bruteforcing hashed passwords in the shadow file?
On various operating systems, any good solutions/methods/programs.
Or is it better to upload ...
4
votes
3answers
367 views
Encrypting user data using password and forgot my password
I am planning to do a web application which stores a lot of personal stuff (info, photos...). And to give users a sense of protection, I want to encrypt the data before storing it to the database.
...
4
votes
2answers
771 views
openssl: recover key and IV by passphrase
A large amount of files were encrypted by
openssl enc -aes-256-cbc -pass pass:MYPASSWORD
Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
4
votes
1answer
200 views
Should password hashes be encrypted or HMACed?
Assume I am hashing user passwords with PBKDF2, bcrypt, scrypt, or some other secure key derivation function.
Are there:
tangible security benefits,
precedents, and
respected research
for ...
4
votes
3answers
270 views
password complexity policy for non “English” passwords
In an internationalized application, what is the best practice for a policy on complexity of passwords? I am not having luck searching for the answer. Wikipedia lists these items for password ...
4
votes
4answers
1k views
Are there lists of most common words or ngrams used in passwords and passphrases?
I've been thinking about ways to focus brute forcing dictionary attacks on passwords and passphrases based on the assumption that certain words, combinations of letters, and combinations of words are ...
