Tagged Questions

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
1answer
83 views

Encrypting the salt with password [duplicate]

Salts are stored in the plain text and readily available with the hashed passwords if the password database is compromised. What if we encrypt the salt using password itself? Doesn't it make offline ...
15
votes
6answers
5k views

My IP address (with a NAS) is targeted by a hacker. What to do? Should I be worried?

I've noticed, based on the logging of my NAS, that my IP address is targeted by a hacker. I already took action by automaticly ban the IP address permanently after five unsuccesful login attemps. ...
0
votes
1answer
90 views

Requiring a pin instead of password for websites?

Curious if this could be a good alternative to passwords. On a website, user can choose to use a pin instead of password. If she does elect to do this (given option) from then on, her account asks for ...
4
votes
3answers
450 views

How can I find if my password has been posted online?

I have just received this email from AbeBooks.com: Hello AbeBooks Customer, This is an important message from AbeBooks.com. As part of our routine security monitoring, we have learned ...
0
votes
0answers
30 views

drupal external authentication - how to handle password?

I need to implement an architecture someone else designed. They have a drupal as user interacting component, and an external authentication module. To authenticate, from drupal, username and ...
16
votes
6answers
4k views

Is my custom password hashing algorithm insecure?

For all of my hobby web projects, I have coded a login system that these projects share. There is no critical data in these projects, the only critical data could be reused passwords. So I try to hash ...
4
votes
2answers
188 views

XKCD-like passphrases to stdout

I'm trying to find a way to crack XKCD-like passphrases (correcthorsebatterystaple) from word dictionaries. Basically concatenate X number of words from a dictionary file. Right now it honestly ...
0
votes
1answer
17 views

Gnome-keyring iteration count location

I know that Gnome-keyring hashes master password between 1000 and 2000 times. It picks random number. I would like to ask where does it save this number, what is the location of that file? As far as I ...
2
votes
1answer
177 views

What are the typical ways to generate a One Time Password?

I'm looking for the typical ways to generate a One Time Password. I know about the HOTP and TOPT. But, in my case, the problem is that the "server" only has a display as interface and the ...
12
votes
2answers
583 views

How Does A Random Salt Work? [duplicate]

I don't understand how using a random salt for hashing passwords can work. Perhaps random salt refers to something other than hashing passwords? Here is my thought process: The salt is used to add ...
1
vote
2answers
104 views

Is it possible to find CryptoKey from orginal password and hashed password?

WebsitePanel is a windows hosting control panel that uses a CryptoKey to hash passwords into the databases. We have lost WebsitePanel config file and lost CryptoKey. We have to reinstall WebsitePanel ...
2
votes
1answer
172 views

Storing a user's password in a retrievable manner

I currently store my users passwords as PBKDF2 hashes, for the authentication part of my web application. Each user also has their own private key and public key (also stored in their user profile in ...
-2
votes
1answer
70 views

Salt and password [closed]

Reading the doc for setting the password, the command is : python -c "import crypt; print crypt.crypt('password', '\$6\$SALTsalt')" SALTsalt is the 8-character crpytographic salt. Valid characters in ...
4
votes
2answers
171 views

Two-factor verification without a mobile phone?

Currently, some services use a second layer of veficiation if logging in from a new device: Gmail and Facebook send a text or call with a code Facebook generates a code in the mobile application ...
-2
votes
1answer
75 views

client side and server side hash password [duplicate]

Another question about client or server side password hashing, I know. After reading many other post about this topic I'm still a little confused and not completely sure what is the best, because I ...
-3
votes
2answers
120 views

Time it takes to crack a password on site like yahoo [closed]

I have a question. If you were using a password brute force/dictionary attack utility on a site like yahoo or another site, how long would it take to crack a password like Jah13Wootiang if Wootiang is ...
2
votes
1answer
110 views

Temporarily save failed logins password hashes for using against brute force attack

My question is about online brute force attacks, that try to authenticate in the website. 1) For the first case if the requests are coming from the same ip, I think this are relatively easy as after ...
23
votes
3answers
3k views

For an HTTPS web application, is it worthwhile to encrypt the password before POSTing it, to keep a MITM attacker from harversting it?

Our application has recently gone through penetration testing. The test found one critical security breach, which is essentially: The problem: Attacker sets up a WiFi spot. User enters our site ...
-3
votes
1answer
37 views

Which encryption technique should be used for users name and passwords in my notebook [duplicate]

i writing all my passwords and users names on my notebook emails,amazons,facebook. and i have really Nosy little's brothers that will probably look at my notebook when i am not around, which ...
2
votes
1answer
169 views

Is there a way to identify the location of a person trying to intrude your wifi network? my wifi router is picking up his attempts

Aug 30 20:28:09 dropbear[6799]: Child connection from ::ffff:5.10.69.82:38463 Aug 30 20:28:11 dropbear[6799]: login attempt for nonexistent user from ::ffff:5.10.69.82:38463 Aug 30 20:28:12 ...
5
votes
3answers
175 views

How secure is this method to remember security questions?

So I found an interesting method of remembering those pesky security questions. Basically, the guy takes a hash of the question (IE what is your mother's maiden name?) and then appends his own ...
29
votes
4answers
3k views

What is the point in having arbitrary username requirements?

I've looked around on Security.SE, but couldn't find much related to the following problem: I recently signed up for Chase Quick Pay as my method of being paid by a part-time job. I've heard of ...
3
votes
2answers
202 views

Are weak passwords acceptable for internal development?

We have a number of internal development environments that use weak passwords in the Auth and SQL components; particularly using passwords such as "password" or "Password1". These are obviously ...
3
votes
2answers
232 views

Can the human brain generate cryptographically secure random numbers?

A security conscious friend of mine was attempting to generate entropy using random dice rolls to generate a random password, and I became curious about the security of random number generators and ...
1
vote
2answers
316 views

Brute force alphanumeric password using JohnTheRipper

I recently recovered a zip archive with some files I need access to, but I can't remember the password. All I can remember is that the password was short (around 3-4 characters), and contained only ...
24
votes
6answers
2k views

Are there secure alternatives to single-use password reset links?

We currently have what I believe to be a pretty standard scheme for dealing with password resets. Our reset links are single-use links: They expire immediately after they've been visited, even if the ...
1
vote
4answers
246 views

Should BCRYPT be used for client-side password hashing

I am concerned about the use of bcrypt for client-side password generation. I am developing a password generation function to be used client-side, similar to PwdHash and PasswordMaker. Much has been ...
-2
votes
2answers
83 views

A Graphical Two-Step Authentication System [duplicate]

Changes made to system proposed in Two-factor authentication Without Mobile Phone: In previous system, shoulder surfing would reveal the user’s pre-decided image. In the current system, end image ...
2
votes
3answers
193 views

What risks am I taking with a weak password on a laptop?

I'm setting up a Mac laptop for my wife. Mine has a ridiculously strong password, but she finds this annoying. If I give her a (relatively) weak password for convenience, what risks am I taking? A ...
0
votes
3answers
143 views

How secure are sentence passwords? [duplicate]

Lately I've been doing the trend of using passwords that are sentences, at least on sites that have a reasonable maximum character length and allow spaces. So for example the most basic variation is ...
0
votes
1answer
72 views

What multiplier to use when calculating the average time to crack passwords with a given entropy?

Suppose that we have a process that generates passwords with entropy E. I'd like to compute the average time it would take for a brute-force attack to crack an MD5-hashed instance of such a password. ...
-5
votes
1answer
708 views

How to decrypt the encrypted data, in SHA256, of mysql database? [closed]

I have some data in column of table of mysql database in the encrypted form applied with SHA-256. How to decrypt that data using Java. I stuck at this since 4 days. Please spend 5 minutes of your ...
1
vote
4answers
217 views

Protecting Password in Code

I am writing a program in Processing (which is basically java), that (amongst other things) downloads files from a FTP Server. To connect to the Server the program needs the correct FTP-password, ...
0
votes
2answers
110 views

Where are passwords hashed? [duplicate]

The way I understand password security is that the user enters a password, which is then converted using a hash function. The website then compares it to the stored hash to see if it is correct. That ...
0
votes
1answer
107 views

Why doesn't the OS give every application a secret password?

As far as I understand if Dropbox wants to automatically run in the background without asking the user for a password it has to store the password somewhere on the harddrive and has currently no way ...
0
votes
4answers
97 views

How long does a passphrase have to be to be as secure as a random collection of letters, digits, punctuation, etc.?

If one uses a passphrase which is grammatical, such as "I put my keys under the doormat because they're safe there."... how many words (on average) must it contain to be as secure as a password with ~ ...
0
votes
1answer
142 views

Are all OSes vulnerable to local password reset attacks

It's not that difficult to reset the password of the administrator account in MSWindows when you have local physical access to the machine Same thing applies on any Linux distro, it's possible to ...
0
votes
1answer
190 views

THC Hydra 16 Valid Passwords? [duplicate]

So when i do hydra -l Admin -P "rockyou.txt" -s 80 192.168.13.1 http-get / it doesnt work for me, it says all 16 passwords are valid, but none of them works, can anyone help me with this? I tried ...
-1
votes
3answers
79 views

What does one call the strategy of using “pre-password transforms” as passwords?

Suppose that instead of using, say, Google, let me in! as my Google password, I used some consistent transform of this string, say ZWE1NjMyNm? What search keywords would be helpful to search for ...
0
votes
3answers
216 views

How important it is to change password regularly? [duplicate]

A WWW-site guided me to change the password regularly. Should I believe what the say, if my current password is long enough random string?
1
vote
4answers
176 views

Authentication with an untrusted server

I asked a related question earlier, but I want to ask a broader version this time: To simplify things let's say I've developed an application that allows users to send messages in a chat room, and to ...
0
votes
1answer
115 views

Can any App Store app access all of my passwords?

Whilst researching another question, I've noticed that on OS X 10.9.4 there are many instances of Library/Keychains/login.keychain from ~ within the Data folder of what looks like apps from Apple App ...
0
votes
2answers
99 views

Simplest way of hashing a password with multiple different hash algorithms [closed]

I have a list of plaintext passwords that I would like to hash with various different hash algorithms (for educational purposes). As a minimum I would like to obtain hashes under MD5, SHA1, SHA256, ...
1
vote
5answers
192 views

Why after a website password reset am I asked to login again?

I have noticed that every web site has the exact same behavior for their password reset pages. They send a link to your email using which you can reach the password reset page. On that page you enter ...
1
vote
1answer
93 views

Should I NOT choose a password of max allowable character length?

Q: Suppose an attacker knows the max allowable character length, n, for a website's passwords. Would it be smart for them to attack passwords of length n BEFORE length n - k (where k is small portion ...
5
votes
2answers
848 views

Appropriate response to 2014 Russian Security Breach (CyberVor)

The report from Hold Security says that 1.2 billion sets of credentials are in the possession of this party. I have a feeling that this report may be a hoax or a partial hoax due to grammatical errors ...
0
votes
2answers
95 views

Share passwords between developers [duplicate]

We have a project with 3 remote developers and myself, at the moment passwords (server logins, db passwords etc) are being shared via emails which are cc'ed to everyone, Is there a normal workflow ...
7
votes
2answers
1k views

Is it bad practice to ask only for individual characters of a password? [duplicate]

Some financial websites that I use use passwords in a peculiar way. Instead of asking me the whole password string, they only ask me to enter e.g. "3rd, 5th and 8th character of your password", i.e. a ...
27
votes
5answers
4k views

Is Linux really that secure, with only root password denying external access?

While I was searching online for information about Linux security, the most typical explanation was: Linux is secure, because the root password is required to access the kernel and install new ...
0
votes
0answers
24 views

Syncing service passwords during offline installations

Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of ...