Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

5
votes
3answers
2k views

Bank forces me to use six character alphanumeric password

My bank (it's Westpac, one of the big ones in Australia) has some strange restrictions on passwords. They're maximum 6 characters in length and it must contain only characters A-Z and digits 0-9, and ...
10
votes
2answers
987 views

My bank makes me enter my password using the mouse. What's up with that?

Internet banking login process for Westpac requires user to enter the password using the mouse. It's annoying, what's up with that? Is it just to try and stop keyloggers on public computers or is ...
2
votes
1answer
270 views

Password checking in the context of symmetric encryption

It is my understanding that block ciphers like AES don't have any built-in mechanisms to verify data integrity upon decryption, although some modes of operation might provide that. I played around ...
21
votes
7answers
2k views

My company policy states I must put all passwords in a password safe shared with management. Is this secure?

As the title says, my company has a policy that all passwords to e.g. our workstations and server logins must be stored in an online safe. I won't say which one but there are some out there you can ...
9
votes
1answer
1k views

Reversible password storage obfuscation method for third-party login credentials

I have an internal business application, that as part of its functionality connects to a third-party app using login credentials specific to the user of my own app. These passwords are stored in a ...
2
votes
1answer
187 views

Security of re-encryption with a list of pre-computed password based keys

I have a problem where an encrypted file stored on a server needs to be decrypted through a precomputed list of passwords that are used one time only - OTP applied to encryption basically. The file is ...
7
votes
1answer
6k views

Password length limits in history of operating systems and popular web sites

I heard that many years ago for example passwords on linux systems were limited to 8 characters. Or rather, you could type in more than 8 characters, but only the first 8 characters mattered. ...
26
votes
12answers
7k views

How secure are passwords made of whole english sentences

I often read as an advice to build strong passwords, just to think about a sentence and then take the initial letters. For example take a nonsense sentence like "I watch Grey's Anatomy at 9.40" gives ...
0
votes
1answer
190 views

Proxy Non-HTTPS logins through EC2

I've been thinking a lot about password security these days, and have been becoming more and more hesitant to use services that have login forms that are not on HTTPS. As I was researching security, ...
6
votes
3answers
8k views

What key does Linux use when storing user passwords?

Linux typically stores user names and password hashes in /etc/passwd or /etc/shadow. Now lets say I have an old CentOS distro and I want to attempt to recover a user's password (it's in a legal, ...
9
votes
11answers
3k views

How to easily remember lots of different passwords?

I know that you shouldn’t use the same password on every site. But, when you log into several dozen sites, keeping track of all the passwords can be pretty hard. What system do you recommend that ...
2
votes
2answers
925 views

Is a password easier to brute force if it contains a repeating pattern?

My question is different from this previous question: Does repeating one word to form a password result in a similar pattern in its encrypted format?. I'm specifically wondering about brute force ...
1
vote
2answers
599 views

Known password length, brute force character in place?

We all know that brute forcing is a very slow process and trying all unnecessary possibilities is dumb. By knowing the password length, we can skip trying possibilities of other password lengths and ...
12
votes
5answers
1k views

If a bank says they do not have my login and password info, is that true? [closed]

After an investigation on their part, the bank simply states that if someone accessed my accounts via internet banking, (and a simswap) I was the one who didn't secure my login and password info. I ...
1
vote
3answers
1k views

How to secure data before returning Macbook Air?

I am returning my MacBook Air to Apple and want to know the best way to ensure my data is not recoverable from the flash storage. I currently have Filevault 2 enabled, however before I enabled it I ...
19
votes
1answer
5k views

How to apply a pepper correctly to bcrypt?

Update: There is a better way to add a server side key, than using it as a pepper. With a pepper an attacker must gain additional privileges on the server to get the key. The same advantage we get ...
2
votes
3answers
1k views

Preventing dictionary attacks against hashed passwords [duplicate]

Possible Duplicate: How to securely hash passwords? I have a website and on that website I use SHA-256 and salt my user's passwords. What I'm doing right now is padding each letter of the ...
22
votes
4answers
11k views

Confused about (password) entropy

There seem to be many different 'kinds' of entropy. I've come across two different concepts: A) The XKCD example of 'correcthorsebatterystaple". It has 44 bits of entropy because four words randomly ...
8
votes
4answers
234 views

What standards are there for mangaging high value passwords?

I am leading a small team at a start-up and I am facing a dilemma with high value passwords. I am the only one on the team who knows all the key passwords for production servers, databases ... etc. ...
11
votes
3answers
4k views

Calculating complex password entropy?

Whenever I look at password entropy, the only equation I ever see is E = log2(R)*L, or alternatively E = log2(R^L), where E is password entropy, R is the range of available characters, and L is the ...
3
votes
3answers
607 views

What are the security implications of phone based keyless entry systems?

I have just been reading about Lockitron which promises to provide phone based keyless entry for the home. As great an idea as this sounds it strikes me that it could come along with some very serious ...
7
votes
3answers
1k views

Is it secure to use bcrypt-generated salt in cookie to serve as token in place of a password?

I have a (hobby) web site that runs only on SSL. The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to secure it as much as ...
7
votes
3answers
10k views

Why is Chrome asking for the application-specific password and my account's password every time? [closed]

I enabled Google's two-factor authentication and found it ironic that Google Chrome Sync requires #1 You account password, and #2 an application-specific password. First of all, don't applications ...
14
votes
1answer
867 views

XKCD #936: under what assumptions is 1000 guesses/second over a network plausible?

In XKCD #936, a rate of 1000 password guesses/second is proposed as a "plausible attack on a weak remote web service". Under what assumptions is this rate plausible? It seems much too high to me. I ...
5
votes
1answer
1k views

Can a Bitlocker To Go user pin be brute forced?

I have a external hard disk and protected a partition on it with Bitlocker To Go. I printed the recovery code but I lost it. I can't remember the user PIN either. If I could only know the first ...
8
votes
3answers
4k views

bcrypt: random salt vs computed salt

I'm pretty new to the whole password hashing business, so I might be missing something obvious. I was looking at the bcrypt algorithm, in particular BCrypt.Net, and I was wondering if it wouldn't be ...
-1
votes
3answers
664 views

find password and iv of an encoded string knowing the decoded string

If I would know the clear and encoded versions of a string could I somehow find the password and.or iv that wore used to encode it? Encoding done with open_ssl aes-128-cbc.
21
votes
6answers
4k views

Why do some sites prevent users from reusing their old passwords?

I have always wondered why it is that bad to reuse old passwords; it should not be the end of the world if we happen to use an old password that we previously used. After all, I believe most of the ...
8
votes
1answer
3k views

Why does Microsoft limit password length? [duplicate]

Possible Duplicate: Should I have a maximum password length? According to a recent TNW article: Microsoft doesn’t like long passwords. In fact, the software giant not only won’t let ...
5
votes
2answers
298 views

How will security need to be changed if we can crack password hashes in quasi-polynomial time?

If we suppose that we have access to some form of generalized password hacking/cracking that can somehow find an $n$-bit password in time $O(n^{\log n})$, is there need for alarm? This question ...
14
votes
5answers
10k views

How can I avoid putting the database password in a perl script?

I have a cronned perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
2
votes
1answer
855 views

Can I check if a work colleague logged into my user account on a shared computer?

I think that someone at work has logged onto my user account when I'm not in work and moved some files from my desk top to my work in progress. Can this happen? They may know my user name as this is ...
2
votes
1answer
261 views

What authentication threat data exists?

I recently read an article that said there was not much data on which authentication threat vectors were actually being exploited in the real world. Eg what percent of password theft was by ...
4
votes
3answers
2k views

sniff SSH password on the server

Is it possible on the server to log the password encoded by the remote user inside a log. I want to make a honeypot to see the type of user/password used.
6
votes
5answers
747 views

Creating multiple secure and easy to remember passwords

I have recently developed a new web application which our clients log into using a username and password. As we're just rolling out this system, we'll be setting the usernames and passwords ourselves, ...
0
votes
1answer
340 views

How key_derivation and key_verification functions are implemented of a 7-zip archive's encryption mechanism?

I am curious about how password recovery works for password protected files. And I want to know the exact flow of the 7-zip encryption mechanism :) !! 7-zip uses the AES-256 encryption algorithm in ...
3
votes
1answer
421 views

DPAPI offline attack by cracking windows password?

I'm thinking of using DPAPI to protect configuration file information in my program. After doing some reading on it, it looks like it uses the user's Windows password as part of the encryption ...
22
votes
4answers
8k views

How secure is Windows 8's Picture Password login?

The final Windows 8 build has been released to manufacturing. One of the new features of Windows 8 is "Picture Password", where the end user logs on to Windows by clicking a specific pattern on the ...
2
votes
2answers
145 views

Is there a term for a “Master + extension” style password scheme?

I personally have (and preach) a password system using a "root" password shared amongst many passwords, plus a unique password component. So for Gmail my password might be correcthorsebatterystaple + ...
3
votes
2answers
6k views

Password recovery tool over telnet or http basic auth

In my feeble attempt to secure my router, I disabled the service login and either changed the "admin" login and the password, or changed only the password for the "admin" login Normally, I would ...
5
votes
8answers
1k views

Is this a good way to store passwords in a Web Application?

I've been tasked with finding a better way to store passwords and came up with this Algorithm. My understanding of Crypto is not strong enough but can someone check this please? Inputs: Username ...
7
votes
1answer
3k views

Store user passwords in NoSQL database?

I am currently coding the backend of a website and I have not come across an article where this is discussed. I want to store all my application data in MongoDB but I'd like to split out my sensitive ...
1
vote
1answer
190 views

tools automating logins/hashes grabbing

Lets assume I have access to the windows machine. I want to grab raw info about logins/hashes from both system and installed apps, dump and analyze it later. I could manually dump things like SAM ...
5
votes
2answers
761 views

Best practice for password-protecting a secret key

What approaches are generally accepted for generating a password-protected symmetric key? My intuition is to generate and store a random string of appropriate length as the password-protected key, ...
10
votes
2answers
4k views

Estimating the size of a rainbow table

What are rainbow tables and how are they used? Gives a very precise answer about what rainbow tables are and how they are used. I had always confused hash-tables and rainbow tables. My question is ...
18
votes
2answers
10k views

Facebook API : App Secret - possible misuse

I've recently find out that by simple quick look into compiled code of one of our applications, you can get both App ID (API Key) and App Secret for Facebook API I suppose that we should really keep ...
6
votes
3answers
787 views

How does KeePass master key derivation increase security?

I don't understand how KeePass key derivation increases the security of the password db at all. First I'll try to explain what I understood from the key derivation described here. I'll use some pseudo ...
13
votes
2answers
9k views

Bypassing the BIOS password

Are there any reliable methods that allow an attacker to bypass a BIOS password, or alter BIOS settings without entering the password? A few ideas come to mind: The old battery trick (remove ...
4
votes
3answers
853 views

Tracking stolen laptop which has a login password

I have been reading about solutions that track your computer in case of missing. Since I'm using Ubuntu 12.04, the best option would be prey for me, but I'm open to other suggestions. The question is ...
3
votes
0answers
110 views

How should I manage my passwords? [duplicate]

Possible Duplicate: What is a good practical (and sane) way to manage all your passwords for online sites? So even if I come up with memorable passwords like "correct horse battery staple," ...