Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

5
votes
2answers
842 views

Appropriate response to 2014 Russian Security Breach (CyberVor)

The report from Hold Security says that 1.2 billion sets of credentials are in the possession of this party. I have a feeling that this report may be a hoax or a partial hoax due to grammatical errors ...
0
votes
2answers
94 views

Share passwords between developers [duplicate]

We have a project with 3 remote developers and myself, at the moment passwords (server logins, db passwords etc) are being shared via emails which are cc'ed to everyone, Is there a normal workflow ...
7
votes
2answers
1k views

Is it bad practice to ask only for individual characters of a password? [duplicate]

Some financial websites that I use use passwords in a peculiar way. Instead of asking me the whole password string, they only ask me to enter e.g. "3rd, 5th and 8th character of your password", i.e. a ...
27
votes
6answers
4k views

Is Linux really that secure, with only root password denying external access?

While I was searching online for information about Linux security, the most typical explanation was: Linux is secure, because the root password is required to access the kernel and install new ...
0
votes
0answers
24 views

Syncing service passwords during offline installations

Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of ...
0
votes
2answers
89 views

How to combine a key and a password in practice

Alice wants to encrypt her data. She is not comfortable with using only a password. While she prefers to use a properly random crypto key, she isn't confident she can protect the key file from theft ...
0
votes
3answers
108 views

User Account Guessing [duplicate]

I'm doing some research on user account guessing, and wanted to ask a question about some "bad practices". My thought is generally this is a trade-off between great user functionality/UX and ...
1
vote
1answer
99 views

Server + Client certificate vs Server certificate + Client password

There are three different ways how TLS (1.2) can be used: server and client authenticate, only the server authenticates or neither authenticates. If neither server nor client authenticates using a ...
-1
votes
1answer
164 views

Cracking a 6-character alphanumeric password Windows dialog box

To put this problem in context, I have a touch monitor screen whose firmware program is protected by a password. The firmware program is downloaded over RS232 via a Windows utility program provided ...
3
votes
3answers
640 views

Websites Forcing Weak Password Standards (Updated) [duplicate]

Please Note: I am not going to name the websites which have these horrible standards for their clients and users. I have had to change my passwords for my routine update just recently in the last ...
13
votes
3answers
2k views

Known characters in passwords?

I generate passwords for everything that requires security using the following method: ksoviero@ksoviero-Latitude-E7440:~$ head -c 16 /dev/urandom | base64 gorv/cp+lSiwiEfKck2dVg== 256^16 ...
2
votes
4answers
160 views

Does it take longer to brute force a password starting with z than one starting with a?

I was wondering about the following: If someone tries to get my password with Brute Force, will a password starting with "a" guessed faster than one starting with "z" ? In this case assume the ...
0
votes
1answer
167 views

security in banking app with 4 digit pin code and social security number

The new banking app (for norwegian bank Gjensidige bank) for my android handset allows me to log in using only my social security number, and a 4 digit pin code. The social security number in norway ...
1
vote
2answers
86 views

Password Cracking Mandarin Words English Character Set

I'll be looking to perform a domain password audit in which the user will be using english characters but may be 40% Mandarin speakers so I anticipate a large number of names, phrases, or words that ...
2
votes
1answer
169 views

PDF.zip file password forgotten and need to reset [duplicate]

I have an old PDF.zip file that is password secured. Naturally I can't remember it. Is there a way to change it or disable it?
1
vote
2answers
99 views

Database compromised and some passwords cracked

I run an MMORPG game and today while moving from one server to another, apache failed and listed some of the data on the server including a back-up of all the source code + database which a few people ...
1
vote
1answer
38 views

Importance of password strength with secure element?

Greetings SE security community. Background: I have a number of items like certificates, databases, and encrypted file systems that require private keys. In order to avoid having duplicates of these ...
13
votes
5answers
2k views

Can sites which check your password as you type pose a security risk?

Some sites that I use check my password as I type it into the login (not registration) form. So, for example, to begin with I might have: Username: sapi ✓ Password: passw × and by the time I've ...
4
votes
4answers
233 views

Does Windows have a built-in password store?

What passwords are stored in Microsoft Windows? How can I know what password are saved in computer?
0
votes
2answers
139 views

Does cPanel store my login password as plaintext

On attempt to change my cPanel password I was warned that: Your password could not be changed because the new password failed with the following reason : (is too similar to the old one), please try ...
1
vote
1answer
58 views

Running an Open Server (contents are visible)

I'm considering the possibility of running an Open Server, as I would call it, that is, a server where as much of its contents are publicly visible as possible. I would like to give read access to ...
-1
votes
3answers
77 views

Can I safely use my own statistics to assess password strength on number of times a password is used?

Lets assume I want to give my hypothetic 10mio users userbase a good feedback on their password strength. Besides the classical entropy tests and top500 list of bad passwords, I might want it to be ...
2
votes
1answer
75 views

Would it be possible to add additional files to a password protected zip 2.0 file

So the scenario is this: I don't have the ability to determine/recover the master password for a production system that uses zip 2 archives. However, I need to be able to add new files to existing ...
3
votes
1answer
118 views

PUT vs. POST for password update

I am writing a User Management system that has to include a change of password utility. We don't front end hash passwords (hopefully we will soon). As a result passwords are passed over https in the ...
7
votes
4answers
1k views

Should the password of a password protected channel be hashed?

Let's take a chat system, where any user can create a channel with a password protection. Thus, other users may only join using the channel password. This password is therefore known to every person ...
0
votes
0answers
24 views

Is there a repository of credentials used in training materials/samples and SDKs?

Similar to a default password list for network appliances, it's conceivable that application layer passwords are default from training materials given to a developer. In fact, I have discovered ...
2
votes
1answer
664 views

Why use an authentication token instead of the username/password per request?

The author of http://stackoverflow.com/a/477578/14731 recommends: DO NOT STORE THE PERSISTENT LOGIN COOKIE (TOKEN) IN YOUR DATABASE, ONLY A HASH OF IT! [...] use strong salted hashing (bcrypt / ...
138
votes
18answers
14k views

What is a good analogy to explain to a layman why passwords should be hashed?

Note: This is not an actual situation I'm currently in. Assume your boss is one of those old-fashioned computer-illiterate managers and wants to store the passwords in plaintext to simplify ...
4
votes
1answer
59 views

How to help users manage password portfolios based on risks of compromise?

A framework for modeling password management risks and costs, and the beginnings of a good strategy for users to help them manage passwords for their often large portfolios of accounts is outlined in ...
1
vote
2answers
63 views

How Empathy - a messaging program, is storing my passwords

I am connected to my chat accounts via Empathy, a messaging program, and it has my password stored in it. I am really curious to know how it is storing the passwords, and if there is any they can ...
3
votes
1answer
85 views

How secure is choosing one out of N generated passwords?

I'm looking to generate some new passwords for myself that are easy to remember, but hard to crack. By choosing a generation algorithm and generating one random password with it, I can be relatively ...
1
vote
2answers
90 views

On password change in a web application, should it log users out

When a user is logged into a web-based application in multiple tabs, and changes their password should it automatically log them out of the other tabs? The use case is an account is compromised, the ...
3
votes
2answers
261 views

Is it really “Time to add a word” if there are no tools to crack passphrases of 3 words and up?

It's "time to add a word" says Arnold Reinhold, the creator of Diceware, in his blog (3/2014). He advices to use 6 word sentences (or 5 words with one extra character chosen and placed at random) from ...
1
vote
1answer
70 views

What is the point of hosting database externally?

Following the breach of avast:forum.avast.com they decided to host the database externally@id.avast.com. My question is, what is the point of hosting the database externally since when you get remote ...
2
votes
3answers
194 views

Should I implement my own local password hash?

Having a more-than-elementary knowledge of internet security, I've realized that some web applications and websites I use implement a less-than-ideal password policy. Some examples include: ...
0
votes
1answer
114 views

Save password on user-side for autologin

If a user wants to login to a system/server, it's recommended to have the hashed&salted password saved in a database, along with its salt. So the user wants to login, types in the password, ...
1
vote
2answers
132 views

Remember Me vs Remember Email

From what I have noticed, there is very few services that offer the Remember Email over Remember Me or Sign-in Automatically. These options really do make the life easier for the end-user of ...
3
votes
4answers
159 views

Storing Old Password History and Information

Google, Facebook, Twitter, and several other services still knows the older passwords which we used on our accounts. At times, I can not reuse the same password as I have. Then with Google, if I type ...
3
votes
3answers
196 views

Method to integrate Touch ID in iOS apps

With the recent announcement of Touch ID APIs for third party apps, I am wondering how can we leverage this feature to perform secure transaction ? I am looking for a method to use Touch ID in my ...
0
votes
2answers
79 views

Do dictionary attacks only use specific entries from a dictionary, or combinations of an entry?

If I wanted to crack a password, "cba", but the dictionary I was using only had abc in it, does a dictionary attack try all combinations of abc? abc, acb, bca, bac, cba, cab Or would cba have to be ...
2
votes
4answers
157 views

password generating algorithm

I read the question about the relevancy of the xkcd password creation algorithm. Would it be more secure if you used a string of common words with a function that only you knew that would rearrange ...
125
votes
9answers
21k views

Is “the oft-cited XKCD scheme […] no longer good advice”?

I was stumbling around and happened onto this essay by Bruce Schneier claiming that the XKCD password scheme was effectively dead. Modern password crackers combine different words from their ...
-1
votes
4answers
299 views

What if I develop my own hash algorithm to create strong passwords from easy ones?

I came up with this idea but I cant figure out if it's good or bad, maybe you can help. My goal is: I want to create extremely strong passwords for my main accounts (gmail, skype and so on). I want to ...
46
votes
9answers
5k views

Generic error message for wrong password or username - is this really helpful?

It is really common (and I would say it is some kind of security basic) to not show on the login page if the username or the password was wrong when a user tries to log in. One should show a generic ...
2
votes
1answer
76 views

How could someone change a root password without modifying `chage -l root` date?

How could someone change the root password without changing chage -l root Last password change date? I know it was changed because it does not match the value in Keepass. I noticed when I tried to use ...
2
votes
2answers
93 views

Password reset system code system vs long hash

I'm building a password reset system at the moment and I've come across a dilema. Currently we have a system which creates a long md5 has (16 characters) and emails a link to a customer which they ...
3
votes
3answers
205 views

Client-side hashing of password before sending it from login form [duplicate]

I have just realized, that my web application is sending unencrypted passwords from login form. It's just like that -- I've analysed, that string sent by user from login form is hashed with MD5 (which ...
3
votes
3answers
667 views

Is this a secure way of storing passwords? [duplicate]

So a couple years ago when I was learning basic back-end web development, I found a tutorial for creating a basic log in system. I haven't done much modification to the code since, but I have the ...
-1
votes
2answers
80 views

How does salting increase security? [duplicate]

I'm currently going through a course on software security. I've recently been introduced to the idea of password salting, where a random value is concatenated to a password prior to being hashed and ...
1
vote
4answers
197 views

Password protect an excel file for a period of time?

I'm trying to find a way to password protect an Excel file (.xlsm) beyond the built-in password encryption options. Ideally: Enter the password File works for a week(/other period of time) After a ...