Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

1
vote
1answer
176 views

Password entry on OS X and keyloggers

There's several places in my ‘personal security infrastructure’ (is there a better phrase for that?) where I find myself typing very important passwords into text-fields on OS X (for instance, ...
11
votes
4answers
861 views

Does it indicate a bad password system to disallow certain characters in passwords?

When creating an account to the game League of Legends, the user's password must comply to a few rules. The one I'm concerned about is the "Must not contain slashes or spaces" one. The others are ...
11
votes
2answers
679 views

How can I find out the password hashing schemes used by the specific Unix accounts I log in to?

Every day I ssh in to 3 or 4 independent Unix accounts. I have been regarding them as more or less "equivalently secure" on the grounds that I'm using ssh, but after learning of how much variety ...
6
votes
1answer
239 views

Security of LastPass' password generator

I currently use LastPass for all of my password generation and management. After reading Diceware, I realized that LastPass' password generator might be insecure, as somebody could potentially ...
1
vote
2answers
82 views

What is the evaluation criteria that a site uses for a password as strong , moderate or less secure

I have been in kind of jinx as to how a website decides on which password is highly vulnerable , strong etc . Lately my yahoo account was told to change password which I am using for long time as the ...
0
votes
0answers
89 views

THC-Hydra dictionary attack on JSP login form

I am trying to use Hydra to attack a JSP form but I have some confusion. Normally we use command something like this hydra -L list_user -P list_password HOST-ADDRESS http-post-form ...
62
votes
8answers
7k views

Is forcing users to use a strong password effective?

I am designing a service that would, among other things, store sensitive information. To ensure no unauthorized access of this information, it would be encrypted with a key derived from their password ...
0
votes
1answer
91 views

Office password protection crack

would just like to have a check on the password protection/encryption of MS office 2007 and above. It is said that its not that easy to crack the password protection except by brute force, since 2007 ...
1
vote
0answers
31 views

THC-Hydra - one good pass = shows all valid [duplicate]

As in title. I'm testing my router security and I came up with problem. hydra 192.168.0.1 http-get-form "/:un=^USER^&pw=^PASS^:User Name or Password is incorrect." -L usernames -P passwords ...
0
votes
1answer
96 views

How to store passwords to a remote web site?

Say I want to build a public API to access a website that doesn't have one. The website is protected by a standard username/password scheme and the API implementation will use scraping to get the data ...
1
vote
1answer
127 views

Email account password change via email-to-script

I host a mail server (postfix and dovecot) and I wish to set up a password change feature (especially useful when creating a new address provided with a temporary password). Does my scenario has ...
-2
votes
2answers
113 views

How much do unusual characters in passwords help?

If I use a system that allows all Unicode characters or a similarly large space for passwords, how much would using an unusual character help in practice (for example, ࡀ ,which I found under Mandaic ...
0
votes
4answers
115 views

Is secondary password (e.g.: pin) necessary?

I find some cases (especially in online games) that a software or website asks users to enter an additional password, such as 4 or 6 digit pin numbers, in addition to their original password. Most of ...
0
votes
2answers
94 views

Why do web users still use password manglers though password is sent in ciphertext

There are many variations of password manglers. An example would be Hash( user password + secret key + domain site ) During website login authentication , passwords are sent in ciphertext from ...
3
votes
2answers
117 views

John the Ripper not identifying a password contained in the username?

I have uploaded a screenshot of what exactly is going on, here: http://i.imgur.com/bJSv7C8.png I can see that single-crack mode includes a rule that looks at the username, and "slices" it to identify ...
5
votes
1answer
204 views

Best Practices for Security Questions

When a website asks me to enter security questions in addition to a password what is best practice on my part? This often happens with banks and other institutions but I see it less with other ...
0
votes
1answer
253 views

Good password hashing algorithm compatible with PHP and Linux apps

I'm looking for a password hash method for a new server system. The hashes must be generated from PHP code and verified from PHP as well as by a number of applications on a Linux system. I know that ...
1
vote
1answer
76 views

Best practices for usefully storing two factor authentication backup codes?

For a lot of web services offering two factor authentication, after setting up the system, you are given a short list of backup codes (one-time pads) that are around 7-10 characters long. These are ...
0
votes
0answers
53 views

Request for Google Password for Calendar Updates

A website that I trust (Delta Airlines) offers a link to add flight information to Google Calendar; that link opens a window asking for my Google login and password. Based on the advice in a similar ...
0
votes
1answer
103 views

Things to remember while building a password manager [closed]

I want to build a simple password manager for desktop whose sole purpose is to store the passwords that can be read by the user as and when required. I am not considering any fancy features such as ...
0
votes
1answer
86 views

Please help clarify password hashing - salted, multiple iterations of MD5 vs bcrypt/sha2, etc [duplicate]

I was reading an article about the Ars Technica hack here and had a couple of questions. The commenter said: "PHPass uses salted and iterated MD5 to hash passwords" My question is that if I were ...
1
vote
1answer
115 views

Passwords propagation, Password Trend and Word Generator in Human Mind

Some passwords like "123456", "admin" are outrageously popular, so are the leet transformations and concatenation of digits. The users seem to pick up the password suggestions or just copy the ...
0
votes
2answers
128 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
1
vote
2answers
81 views

How to avoid referer information leakage during password reset

Most password reset systems involve emailing the user a one-time link that lets them reset their password. The token needs to be in the URL, as most email clients do not allow HTML emails to perform ...
2
votes
1answer
207 views

Reverse Engineer this basic Hash using known answer?

Little background: I forgot one of my CCTV accounts password, so used the admin account to create a new one. However I can't access the old one as it's not possible to change a user account password, ...
17
votes
5answers
2k views

Is sending plaintext passwords to a SQL Server database a security risk?

I have a database which has stored procedures which take plaintext passwords. It hashes them and inserts them into the DB. If an attacker has access to the DB connection, it is possible to intercept ...
15
votes
2answers
898 views

Distance between two passwords

It is known that people reuse their passwords across different sites. The reuse can be done in two ways: using exactly same password for two different sites, slight modifying the password of one ...
9
votes
2answers
150 views

What concrete parameters can I change to make my passphrase-protected private gpg key more secure

There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever. Rather than ...
0
votes
2answers
65 views

What is the severity if someone read the ConnectionStrings_Prod.config?

I was doing an pen test in a website and the programmer did a big mistake and I was able to read any file. So I read the web.config and see the password for database was in ...
3
votes
1answer
732 views

what is a valid challenge for 2 factor authentication?

When designing password reset process: 1- Is a an email address or an assigned username a valid piece of information ( identifier) to ask for in two factor authentication? 2- How does two factor ...
-1
votes
1answer
88 views

TLS/SSL and password transmission

I am still getting confused with security topics. At the moment the advantages and disadvantages of some of authentication methods are still not very clear. According to OWASP Authentication Cheat ...
0
votes
3answers
102 views

Creating user and safely sending password

Assuming I currently use a safe way to salt-challenge-response-authentication-method, passwords are stored secured and all. I now question myself - how do users set the password? Meaning, they enter ...
15
votes
1answer
761 views

Linux /etc/shadow password change security

I wonder what happens what happens when I am changing my password on a Linux system. Basically all passwords are stored in a file called /etc/shadow or /etc/master.passwd in BSD-like systems as I do ...
-1
votes
1answer
102 views

Why not use md5 auth mechanisms for IMAP over TLS?

I'm using Dovecot for IMAP connections. I've read a lot of tutorials on how to set up Dovecot, and a lot of them said to only allow: auth_mechanisms = plain login Why should I not allow *-md5 ...
-1
votes
1answer
6k views

How to get a Network's WIFI Password through CMD? [closed]

I found that Wifi's Password can be retrived using the network and sharing wizard in Windows, And Technicaly theres no way to store Passwords/collection of bytes in the memory after switching/shutting ...
4
votes
1answer
99 views

Soundness of GRC.com Haystack padding concept [duplicate]

I was wondering how sound is the concept presented by the Gibson Research Corporation (see below if you do not want to follow the link) about simple passwords (= very easy to remember) with the ...
4
votes
2answers
319 views

Including and storing the order of character entry in a password as an enhanced security measure

I'm sure I will be quickly corrected if this is a stupid idea, or if it has already been tried. My question is: has this idea been tried before? If not, are there good reasons it would not work, or ...
30
votes
8answers
5k views

Why must I have a “strong” password for sites like this? [duplicate]

I don't share any personal information with StackExchange, I'm not really worried about anyone trying to hack my account and I can't see any incentive for them to do so, and yet the password strength ...
4
votes
4answers
249 views

Using a password manager vs manual

was wondering, who still uses the traditional method of storing passwords (in envelope) in an actual physical safebox vs modern methods like password managers? what are the pros and cons of each ...
0
votes
0answers
57 views

Detection of pass the hash

I have researched about PTH Attacks but yet found any solid way detecting it in a network.is there a way to detect a pass the hash ? analysing the windows message from the dcs or something ?
1
vote
1answer
206 views

What is the right way to implement Keyed Password Hashing?

As mentioned in this wonderful link, the way to get a PBKDF2 Hash of a user given password given a password (of course), a salt (generated Cryptographically Secure Random Number Generator. iteration ...
2
votes
2answers
107 views

Who can actually see the password when I accidentally used ftp instead of sftp?

It has been said that if we accidentally use ftp instead of sftp, people can actually see the login name and password in pure text form, and it is very bad. But who can actually see it? Will it be ...
4
votes
1answer
319 views

What is the best way to store password in memory (RAM) in Java?

Imagine there is a login form in Java application. We need assign usename and password to variables. Moment after we can Hash or HMAC password and keep it just for authentication step (no caching). ...
20
votes
5answers
3k views

Does too long a salt reduce the security of a stored password hash?

Suppose we have passwords that are statistically 7-8 characters long. Is appending a 200 character long salt less secure than a 5 character salt, because of the similar hash function inputs? I was ...
5
votes
3answers
283 views

Are there any disadvantages to encrypting the password hash?

Is encrypting the password hash in database more secure than storing only the hash? Suppose we store encrypted SHA-256 result with AES instead of hash directly. Is this a good protection from a ...
2
votes
1answer
73 views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a ...
3
votes
4answers
261 views

How effective are password checking websites? [duplicate]

I typed the following password in howsecureismypassword.net: yummy candy yummy It said it would take 100 billion years for a personal computer to crack. Is this accurate? Even though it has English ...
1
vote
2answers
122 views

Encrypted retrievable password

I have a password conundrum. I need to store an encrypted password in a DB table but in such a manner that would allow me to retrieve the password as plain text afterwards. Please note that this is a ...
15
votes
3answers
5k views

Is it possible to get the salt if I have the hash and original password?

Is it possible to get the salt if I have the hash and original password? My gut feeling is no, but would it be impossible or will it just take very long?
1
vote
2answers
78 views

bscrypt,scrypt v/s iterative SHA-x [duplicate]

Both bcrypt and scrypt hashing algorithms are designed to increase the resources required during the computation. Hashing passwords with these algorithms can be beneficial as it makes the task of an ...