Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

3
votes
0answers
57 views

Is it possible to use parallelism when computing a key derivation function for a single password/key?

Suppose I have an AES-256 encrypted file, and I want to derive the key using PBKDF2 and a given salt with a large number of rounds (say 1 million), but I'm limited by user tolerance for UI lag when ...
-10
votes
6answers
162 views

Is the password FFFFFggggg&&&&&22222 safe from being guessed? [closed]

It is 20 characters long, mixes alphanumeric and special symbols. It is one among ** 20.
7
votes
2answers
1k views

philosophical: restricting the password space increases security

This is more of a philosophical question. Suppose that you are trying to choose a good password for a particular online service, say your bank's e-banking service. Now the bank has some restrictions ...
51
votes
4answers
5k views

Why submit a website to plaintext offenders?

I've read this question and to quote from the accepted answer Besides that, by submitting the site to plaintext offenders, you will provide a third-party point of view, which might help your ...
4
votes
3answers
120 views

Is emailing a password recovery code as bad as emailing a password in plain text? [duplicate]

I am creating a mobile app where my password recovery feature involves sending a password recovery code (randomly generated string) to the user's email address. They get the code, then enters it ...
8
votes
2answers
121 views

How can I enforce strong password policy with non-technical user base?

I've been using zxcvbn to enforce strong passwords for a service where break-ins would cause considerable problems. However, the service is only viable if many users sign up. We've found that users ...
3
votes
3answers
108 views

Is it insecure to reveal if a password is being used for another account after a set period of time?

Password reuse can be considered a pandemic of security. The obvious way to fix this is to encourage people to use password managers, but (comparatively) few people actually do. My idea is to have ...
-1
votes
1answer
79 views

Do you consider PWGen safe to use?

Do you consider PWGen safe enough to use? What do you use to make truly random password. PWGen should be using "movement of your mouse" to make it really random, right?
139
votes
5answers
10k views

What to do if stuck with website that has poor security?

I have a student loan account with a company, not the biggest company but big enough to where they should have their act together. Today I couldn't remember my password to log into my account ...
3
votes
5answers
259 views

Recommended level of password complexity for Keepass

I want to start using a Keepass master password that I can easily remember. Let's take this sentence: I really hate blue mountains, and let's make it one password: ireallyhatebluemountains. Is this ...
3
votes
1answer
54 views

Membership.GeneratePassword

I am looking for a method to generate a onetime password for provisioning purposes in ASP.NET-MVC. I came across the Membership.GeneratePassword which is in the System.Web.Security namespace. Is this ...
4
votes
1answer
78 views

Is limiting/cutting password-length without notice insecure?

I have encountered that our linux system cuts the length of every password to a certain length, after that length every additional character seems to be ignored. Does this make our linux system more ...
3
votes
3answers
162 views

Prevent password reusing across different sites

I'm generally against too strict or complex rules to accept passwords (rules like "It must contain at least one upper-case character, one number and one symbol" and things like that, see also XKCD ...
4
votes
1answer
129 views

Is using OAuth for login less or more secure than maintaining your own passwords?

Pros: The complexity in managing passwords is maintained by a company with stronger security policy. Let's assume they secure passwords properly. The user doesn't have to maintain yet another ...
3
votes
1answer
46 views

Single randomly generated passphrase for both identity and authentication

There are questions about using a password only to identify and authenticate a user, rather than an email address or username plus password: Why do we authenticate by prompting a user to enter both ...
1
vote
1answer
48 views

What are the advantages of a ZKP authentication system?

So, I read somewhere that Zero Knowledge Proof based authentication is good because it makes sure that the server does not store your password and neither is your password being transmitted over the ...
3
votes
4answers
217 views

Are limited length passwords a security risk? [duplicate]

I found a webpage where users can be registered. However, it seems that the length of the password must be between 6 to 12 characters. Is that a security risk?
0
votes
0answers
15 views

Are excessively strong password requirements counter-productive? [duplicate]

Some sites have strong requirements. E.g. Your new password must: be at least 8 characters long (longer passwords are more secure) contain at least 1 uppercase character contain at least 1 ...
2
votes
1answer
62 views

php's password_hash with system wide salt [duplicate]

I'm thinking about using password_hash function for generating password hashes. I have read that own salts shouldn't be generated and instead use the default one that the function generates. Own salts ...
1
vote
2answers
69 views

How can i Identify and use hash function given enough text and their hash?

So, I have this old program currently in use, as i have access to the database i have adopted all data i need except the user passwords.. Now users will provide me with the plain text password and ...
2
votes
2answers
87 views

When is a group password for a closed circle of users acceptable?

I am developing a tool for a company, that takes some technical data and creates PDF reports. In the tool you have several text fields, which get filled by the database. If the user wants to, he can ...
6
votes
1answer
177 views

When I register on a website, is there a way to know whether or not the site admin will be able to see my password? [duplicate]

It seems to me that whenever I register on a website, there is absolutely no guarantee that the administrator will not be able to decrypt and view my password (if they even bother encrypting my ...
4
votes
1answer
77 views

Android auto complete and passwords

I have an Android phone and when I enter a password in a password field (bank application or other), the auto complete system proposes to complete the password. I expected password not to be saved by ...
64
votes
13answers
9k views

Should I allow browsers to remember my passwords and synchronize them?

I wonder, how wise is it to allow Chrome and Firefox to a) remember the passwords b) synchronize them? My gut tells me that if it's not man in the middle who can intercept them, but Google and Mozilla ...
0
votes
1answer
77 views

Checking a salted hash against known password?

I've created a mysql dump of my users and passwords and awked them into a presentable form: Passwords: ...
9
votes
3answers
1k views

Client-side BCrypt, store salt and hash separately in MySQL database [duplicate]

I’m developing an Android app with a MySQL database for storing user login credentials. I’m using jBCrypt for hashing passwords before storing them in the database. On registration, the password is ...
9
votes
2answers
242 views

How to create dictionary to prevent weak passwords?

I've been tasked with adding a "dictionary check" against user's passwords to prevent weak passwords. Unfortunately, that is about as much guidance as I've been given and I need some help deciphering ...
32
votes
7answers
5k views

How to prevent username and password matches when changing a username?

Let's say that I have a system where one of the security requirements is preventing users from choosing a password that matches their username. Usernames are not case sensitive but the passwords are. ...
3
votes
1answer
94 views

Unable to completely enforce password policy

PCI DSS has a few requirements regarding the password policy (like remember last four passwords, change password every 90 days, use at least seven numeric and alphabetic characters and more). These ...
0
votes
1answer
24 views

Principal Password in Kerberos KDC database

Is there a way for me to merge a bank account number, fingerprint image and IMEI of a phone into a single entity that I could possibly use as a password in the Kerberos KDC to uniquely identity a ...
0
votes
1answer
77 views

Is there a way to securely check if a password is one of the most used ones?

So lets's say that a user wants to register to some website. For whatever reason, I want to not allow that password if it is one of the top 100 passwords used on my site (So I'm not checking against ...
5
votes
3answers
221 views

How can I prove that my software is secure for those who are interested to install it?

I've written a password locker program for Microsoft Windows that encrypts its contents to the local machine. The only way to get the data out is with the encryption key the user knows. It uses the ...
2
votes
2answers
53 views

Would a multilingual Diceware password be more secure than a monolingual one? [duplicate]

I've been reading up on Diceware recently, and I'm wondering if using a mix of languages would make it even more secure. On the face of it, it would force a potential attacker to consider an even ...
0
votes
2answers
104 views

Password based Asymmetric Key generation

I am looking for a password based key derivation scheme that results in an asymmetric key pair. I have worked with PBKDF and its variants but could not come up with any way of generating a key pair. I ...
1
vote
2answers
127 views

Pin delivery: SMS, mail, or pin mailer?

Imagine a scenario where a 4-digit pincode needs to be delivered securely to an end-user. Several possibilities exists: Pin mailer (this seems to be standard according to ISO 9564-1) SMS Email Email ...
2
votes
1answer
116 views

How might a PIN based Web authentication scheme work?

I'm interested in implementing PIN based authentication for a web application, similar to what Facebook provides in their mobile web site. Here is the user flow: User visits the site for the first ...
0
votes
0answers
33 views

What is a straightforward way to brute force CLI applications?

This is a question to maybe more CTF-experienced guys among you. I wonder how you generally brute force a simple CLI application. For example if you have an application which tells you a user's data ...
1
vote
2answers
67 views

Custom word list generation for a specific web domain

I am looking for a tool that generates a set of word lists based on the words it finds on the pages of a particular web domain. This question has an answer that generates permuted word lists starting ...
5
votes
3answers
388 views

1Password for team how secure it is?

I would like to ask you opinion about how secure is the 1Passowrd for Teams. For someone who doesn't know how 1Password - Personal use - works here a summary: You create a master password (hard to ...
1
vote
3answers
171 views

Are longer passwords safer even if the encryption/database security used is compromised?

Let me preface this that I am having a lot of trouble wording my question. Hopefully my description will help clarify. I have always wondered if long passwords actually provide you any more security ...
1
vote
0answers
97 views

Is Trillian application unsafe? (Got “Someone has your password” message from Google)

Trying to connect to GoogleTalk from the Trillian app for Android (a universal instant messenger app), I got denied even with the correct password. Then Google e-mailed me saying that my password is ...
1
vote
2answers
145 views

Password may not be similiar to last 5 passwords [duplicate]

SAP NetWeaver has a password policy to prevent your new password beeing similiar to the last 5 passwords. Are the passwords stored in plaintext to verify this? Or is something like a soundex value ...
0
votes
1answer
83 views

Is Entropy all that matters in a Password? [duplicate]

My question is, is it more reliable having a password that is composed by words like FootballPractice more secure than using a password that has only 2 or 3 bits less, for example FootbalPractic , my ...
1
vote
1answer
65 views

Distinct error messages for wrong email / password

I want to continue discussion started in this question "Username and/or Password Invalid" - Why do websites show this kind of message instead of informing the user which one was wrong? but ...
2
votes
1answer
58 views

Remembering email in login form

After logging out Google remembers recently used email addresses in the login form so the user only needs to enter the password. See accounts.google.com. How secure is it? What factors should I ...
0
votes
1answer
28 views

Creating secure random output that is repeatable across machines [duplicate]

I'm having trouble figuring out a solution to this problem. Basically what i am trying to do is create random data that can be repeated across multiple machines by a user but is also secure from ...
3
votes
6answers
218 views

How secure is this process for creating passwords?

I've been research into how to be as secure as possible when it comes to password security for online services and websites. Obviously there are some big no no's like using dictionary words, using the ...
8
votes
7answers
360 views

Strong password vs. restriction on number of attempts

To begin with, I am considering the password protection of standard internet services like Gmail or Dropbox. They often force users to choose a "strong" password, that is many characters, including ...
2
votes
2answers
68 views

Securely generate a rng seed using a small number

I'm trying to figure out a secure method to generate a rng seed to a rng using a small pin number that is 5 digits. The issue that i can see with this is an attacker could very easily just loop ...
1
vote
1answer
93 views

How much more difficult does it become to crack a password when appending a 5-digit pin?

I have a quick question regarding password cracking. Lets say you append a 5 digit pin on the end of your password. An example would be instead of a password of "password" it would be ...