Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
0answers
115 views

Line Length Exception in hashcat

I'm very new to cracking a password so sorry if I sound stupid. I am trying to get my admin password from my second PC (I lost it). I did find the SAM file with kali linux and with bkhive and samdump ...
0
votes
1answer
159 views

Saving username and pasword inside SQL

I am currently managing a network of around 100 PCs. Many users have different mails/usernames and passwords for different services like login to PC, mail, local applications, ... When an application ...
-3
votes
1answer
53 views

Make password list with crunch [closed]

I want to make some password list like this : A4B9D It should has these : 5 characters first, third, and fifth characters are letters (A to Z) second and forth characters are numbers (0 to 9) ...
1
vote
3answers
83 views

What are the disadvantages of combining client-side and server-side authentication security?

Imagine situation: Application might or might not be run via SSL/TLS Application should not know password of the client because client might reuse passwords Wouldn't then combined client-side and ...
3
votes
2answers
68 views

Assuming proper creation, encryption, and storage, how is a breach/leak of a hash worriesome?

Let's say I create a pseudo-random password that is secure (24 alhpa numeric, upper lower, special chars...) for a system (say a password manager). Let's assume the password manager encrypts and ...
5
votes
1answer
1k views

What happens if an attacker steals my phone's IMEI number?

I have some questions regarding IMEI numbers and data and identity theft. While searching online I have found many conflicting answers regarding this topic and would like some clarification if ...
2
votes
3answers
173 views

How secure are “pattern” passwords?

I was watching a TED Talk about password security recently which covers quite a few different types of passwords and compares how secure they are and how easy they can be remembered. One type of ...
2
votes
2answers
69 views

Justifying strong 1st factor in the context of multi factor authentication — beyond passwords

I am wondering if you need strong 1st factor (for theoretical correctness, please note it is the knowledge factor -- not necessarily a password, but definitely also includes strong passwords)? What ...
2
votes
0answers
46 views

What technologies does ChromeOS use to secure saved passwords?

I have read that Chrome will use the system's native credential tools to manage saved passwords (e.g. KeyChain on OSX, libsecret on Linux/GNOME etc). Does anyone know what tools are used on ChromeOS? ...
4
votes
1answer
84 views

Desktop Flickers Past Lock Screen

I'm using Fedora 22 with Gnome 3. I have a password set for my user account, so when my laptop awakens from sleep, I am presented with the lock screen and must enter my password before getting to my ...
1
vote
1answer
27 views

Authentication between to devices where the same password is used on both

I'm writing two applications that are intended for execution on two separate devices. It is similar to a remote desktop solution such as TeamViewer. What follows below is my proposal for an ...
2
votes
1answer
154 views

Security behind “Windows Security” Feature

Within the Windows Security authentication mechanism active, there are cases the user-login popup comes up. Are this username and password sent encrypted or they are sent as plain-text as the ...
20
votes
4answers
4k views

How is Gmail susceptible to brute-force attacks?

In the Atlantic article "Hacked!" it says: My wife’s password was judged as “strong” when she first chose it for use with Gmail. But it was a combination of two short English words followed by ...
2
votes
2answers
243 views

Understanding salted password hashing using Java

Context: I am using this tutorial and trying to understand and implement salted password hashing using Java. After spending some time on this topic, I figured out that the basic idea is to: Convert ...
0
votes
1answer
61 views

Old phone as secure credential storage device

Can an old android phone (with sim card removed) be securely used as an OFFLINE storage device for password, user id's and acct numbers?
1
vote
2answers
106 views

I forgot my 7z password [closed]

I used 7zip to encrypt a 200mb archive of my code used a combination of some of 7 possible words and no numbers or caps. So 823543 possible passwords. What is the best free program I can use to ...
-5
votes
1answer
97 views

How to use wordlist [closed]

I have downloaded a wordlist from https://crackstation.net/buy-crackstation-wordlist-password-cracking-dictionary.htm The size of the wordlist is 4.2 GiB (compressed) or 15 GiB (uncompressed) The ...
1
vote
3answers
73 views

Potential collision with hash password

Normally, the password size is fixed by the hash function in which the password is given right ? Because otherwise, if the password size is bigger than the hash result size, there should be potential ...
0
votes
2answers
213 views

Are passwords in Mozilla products stored insecurely?

I have just downloaded a Polish program Passtool Password Reader (written by Rafał Jelitto), unpacked it from .rar archive and run it. I have hit the bottom-left button (Pokaż wszystko) and this small ...
44
votes
5answers
9k views

How can I know that developers will be ethical and not record my password in plaintext

I am not asking why hashing should be done. Instead, I want to know how to prevent that developers record user passwords to hack their user's other accounts, especially their email. Couldn't they ...
1
vote
3answers
90 views

Why is there a preference towards long passphrases instead of increasing the hashing iterations?

There seems to be an agreement that when it comes to offline password brute-forcing, long but simple passwords are better than short complex ones. I recently saw a question related to increasing the ...
0
votes
0answers
55 views

Hashed master password and generated encryption key in a password manager program

I'm writing a WPF password manager application to practice programming, so far this is the scheme I intend to use to store master password and individual site password: Master password: Generate a ...
2
votes
2answers
74 views

Enabling feature to log in as soon as right password is typed (without pressing enter)

My phone has an option for the PIN lock screen to unlock it as soon as the correct number is entered (without pressing enter). So for example if the password is 77912 then you only have to enter 77912 ...
2
votes
2answers
172 views

“Sniffing” Wifi Password? [duplicate]

I wonder if the follwing is possible: Assume you want to gain access to the AP "ap". Isn't it possible to set up a hotspot with the same BSSID, so that clients think that you are ap and send the ...
2
votes
1answer
96 views

Should you be able to reset a password without verifying the email address first?

I just noticed with Instagram, what you can do is: From the logged in Instagram app, change your email address. This will send a verification link to the new email address. Verifiying the email ...
5
votes
1answer
180 views

How secure is CertiVox M-PIN?

CertiVox have designed a system with the aim of "getting rid of passwords". Essentially the system authenticates users with two factors of authentication: A 4 digit PIN and a token stored within the ...
4
votes
1answer
86 views

How can I delete a password and lock the account in one step?

I have a minimal server install on a remote machine with a root password set to a temporary, but chosen, value. I have added a separate administrator user. This user has an authorized key for SSH, no ...
0
votes
1answer
105 views

What can I do if someone is using my IP address? [closed]

Another device in my network is using my IP address, what can he do if he is using my IP address? Is this a crime? Can him be caught by police or sue by Malaysia government?
3
votes
4answers
143 views

Are there any two way + two factor authentication systems in use?

My bank, Google etc. use two factor systems where they send me a One Time Password via out of band means. e.g. SMS or an App on my Cellphone or a standalone RSA token generator. This seems good ...
1
vote
1answer
123 views

Password management: how an administrator should reset password for a user?

I implement simple user management. How an administrator should reset password for a user? Just provide a new password for a user (as in Active Directory)? Is it secure enough? Added Is it secure ...
9
votes
3answers
1k views

How secure are sha256 + salt hashes for password storage [duplicate]

I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 ...
1
vote
1answer
83 views

Is it worth it to implement both SHA2 and SHA3 at the same time?

I'm creating a password storage system for a web server I'm building for fun. Would it be more secure for me to use both SHA2 and SHA3 for hashing, and then store them in a database? If I use both ...
2
votes
0answers
28 views

General Entropy as opposed to Password Entropy [duplicate]

I know that the formula for the entropy of a message is: (I believe b can be set to 2) but when calculating the entropy of a password websites usually only compute log2(p-1), ignoring the first ...
1
vote
1answer
76 views

Give Someone Access to Secure Website? [closed]

I have someone I hired on a Freelancing website working for me - so far he has worked for me for about two weeks and is doing a good job. In order for him to complete his work he will need access to ...
2
votes
3answers
231 views

Why do banks still hack-up autocomplete=off functionality?

With Bug #1025703 in the latest Firefox 38, Mozilla has finally decided to stand up for its users instead of catering to the banks that don't want the passwords remembered. However, I've noticed ...
6
votes
1answer
1k views

How does an attacker know when he has the password?

An attacker gets a list of hashed passwords. How does he know when he has cracked the password(s)? He can't try millions of times on the comprised account. Attacker gets hashed password. How does he ...
3
votes
3answers
147 views

Would requiring multiple passwords enhance security?

I assume that it was considered at one point, and that there's a good reason for not doing it, I'm just curious as to why. I'm sure that there are many people who struggle to remember a single ...
0
votes
1answer
327 views

How can American Express Serve login be PCI-DSS compliant?

Today I went to log into my American Express Serve account at https://secure.serve.com/ and accidentally discovered what appears to be a huge hole in their login process. Here are the steps involved: ...
1
vote
1answer
120 views

how to get cookies from aspx site to use it with hydra

I've been playing around with Hydra and .aspx site and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. ...
1
vote
1answer
128 views

Windows Passwords

What are the security concerns of the following user account setups on a normal Windows 7/8/10 desktop machine compared to: Using a non-privileged account with a password and having an admin account ...
0
votes
1answer
54 views

QR-code based credential retrieval?

This is a sort of design review question that I'm hoping is suitable for this site. I am designing a system that uses a cloud service to establish a secure connection between a PC and a mobile ...
2
votes
2answers
149 views

Why is “\000” added to the end of passwords prior to hashing with bcrypt?

I am implementing bcrypt for java as found here. Before the actual hash takes place, line 455 of this implementation takes the raw String password, and transforms it into a byte array like so: ...
12
votes
4answers
1k views

Why will Google no longer allow me to end or begin passwords with a space? [closed]

Why won't Google allow me to use a password ending in a space anymore? Backstory: I have memorized a cipher that allows me to generate a different and very strong password across many different ...
6
votes
4answers
1k views

Store password using sha1 [duplicate]

I've been using the sha1() function to hash password before inserting it into my database. But I have this procedure so that it just won't be the password to be hashed. My page would register a user ...
13
votes
3answers
2k views

Is it truly possible to store passwords securely, but be able to see the password?

Every place I looked, people recommended that storing passwords via encryption is like storing passwords in plain text. But every place I've looked, everyone recommends using a password manager like ...
5
votes
4answers
455 views

Bad password policy at my bank

I logged in to my bank tonight and was prompted that all customers were being forced to change their passwords for "security reasons". The policy for new passwords is: 6 to 10 characters, no special ...
1
vote
3answers
98 views

Sensitive issue regarding windows 8 password [closed]

Although I know this sort of request probably isn't exactly what stackoverflow is for, I am desperately seeking help. One of my best friends recently passed away and his parents asked me if I knew a ...
4
votes
3answers
728 views

Which passwords to exclude from a password manager?

The benefits of a password manager are clear. Still, it seems that there might be a case to keep at least some passwords out of it: Your primary e-mail, to minimize the "single point of attack" ...
76
votes
9answers
12k views

New Gmail login system—going against conventional wisdom?

I noticed that the new gmail login asks for username first, and then confirms if such username exists, before asking for password input. Does this not go against conventional security wisdom to not ...
1
vote
1answer
100 views

How can one know if the password database on the server is stolen or not?

There are many password breaches happening now a days. How can the system administrator detect if the password database on the server is hacked? Obviously, the admin can know once the password ...