Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

1
vote
1answer
152 views

Error using ncrack

I am trying to run a ncrack command of the following format: ncrack -P filePath1 filePath2 --user user1, user2, user3 ipAddress:port and I get the following error; Does anybody know why I'm ...
-3
votes
2answers
894 views

Good Practice: Storing Passwords in general

I've got a totally theoretical question to you on today - what is the "best" practice for storing passwords? [Best in terms of security and performance] Usually, especially PHP-Developers tend to ...
4
votes
2answers
5k views

Why doesn't Microsoft implement salt on users passwords in Windows?

Pretty straightforward - So we use rainbow tables to get passwords of users out of hashes. So why won't Microsoft implement salt on the passwords in Windows to be hash(password+salt)? Won't this ...
1
vote
0answers
41 views

Database hash for password field [duplicate]

I'm using a mysql database and am looking for a cryptographic hash method for a password with salt added to it. What would be the best hash method for this problem?
2
votes
1answer
2k views

Using John the Ripper to crack SHA hash w/ partial knowledge

Group, I have a SHA1 hash that I would like to brute-force. I have knowledge of several characters before and after the password (ie, if the hash is derived from "xxxpasswordyyy", I know both xxx and ...
4
votes
4answers
805 views

Insecure to require numbers in passwords?

Earlier, I went to a site that required a number and special character, and it got me thinking – wouldn't that make the password easier to brute force? If you assume most passwords have around 12 ...
4
votes
1answer
377 views

Saved passwords (use case)

I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together. Both the data and the password are encrypted ...
-6
votes
1answer
584 views

Secure Web application Password vault/manager [duplicate]

I would like to build an open source online password vault which allows users to securely store their passwords, like Keepass or roboform, but where a user can access their passwords through a ...
3
votes
2answers
388 views

Fixing the high-bit problem in PHP's crypt() implementation

I'm working on a site that has to have compatibility with older versions of PHP, which suffer from a high-bit issue in the Blowfish crypt() implementation. Essentially, non-ASCII characters are not ...
9
votes
3answers
3k views

Encrypting user data using password and forgot my password

I am planning to do a web application which stores a lot of personal stuff (info, photos...). And to give users a sense of protection, I want to encrypt the data before storing it to the database. ...
1
vote
2answers
4k views

Is there a way to find out how long it takes John the Ripper to crack a particular password?

I am looking to test/demonstrate things like: when the supplied wordlist contains "abc123" and pw="abc123" then John cracks the pw in 1/2 a second... but if word list does not contain "abc123" John ...
3
votes
4answers
258 views

Securing opensource web application

I have an open source website. I need to add an admin section to the website which is accessible to only one person. To make it secure, I was thinking about providing a login page which checks if the ...
8
votes
2answers
685 views

Banning specific passwords?

There have been a couple of questions about enforcing good passwords, so I thought I'd add my own: In addition to enforcing a minimum Shannon entropy, would it generally be a good practice to ...
2
votes
2answers
445 views

What are my options for securely printing an OTP Scratchcard?

I want to print and distribute several One Time Passwords (OTPs) that can't be easily disclosed to a 3rd party in transit. (think the physical version of a TLS session for private secrets) To me ...
10
votes
3answers
861 views

If multi factor authentication is enabled, how should that affect self-service password reset?

Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required) ...
1
vote
3answers
226 views

What day-to-day activities can compromise a person's information security [closed]

Recently a car was stopped next to me at the traffic lights. The driver had his phone connected to the car's bluetooth and the conversation could be heard by me crystal clear in the next car - the ...
5
votes
3answers
589 views

Use of rainbow tables with the NY Times hack?

The NY Times recently published a story about how they were hacked during a four month period. The hacks allegedly were carried out by part of the Chinese military. One part of the story that ...
10
votes
4answers
496 views

When changing a password using a WebPage, must the old password be entered on the same screen?

There is a convention to always prompt for the old password on the same page as the one where the old password is being changed as shown below. Is it acceptable from a security perspective to allow a ...
10
votes
7answers
4k views

Does adding dictionary words to passwords weaken them?

This might sound like a stupid question, but hear me out. If I'm encrypting my financial information and sensitive data via a program like TrueCrypt, the strength of the password is going to matter a ...
6
votes
3answers
2k views

Is using the same password for multiple TrueCrypted volumes safe?

I want to use TrueCrypt for encrypting multiple disk volumes. Assume I use the default cryptographic algorithm (AES) and hash algorithm (RIPEMD-160) and that nobody can get my passwords through ...
8
votes
3answers
986 views

Generating random passwords by clicking randomly on the keyboard?

How secure is it to generate random strings/passwords manually for different purposes by just clicking randomly on the keyboard ? I usually need random strings for salts and for passwords, and I ...
10
votes
2answers
8k views

Salted hashes vs HMAC?

Most of discussions involving access credentials include references to "hashing salted passwords". Is this another way to referring to the HMAC algorithm or a totally different operation? Different or ...
4
votes
2answers
2k views

How does processor architecture affect password hashing speed?

Does hashing speed vary significantly using different architectures (x86 vs ARM)? Scenario I am investigating the possibility of using a cluster of Raspberry Pi for cracking passwords hashed with ...
19
votes
5answers
2k views

From a security standpoint should users be asked to confirm their password when registering?

Is it advisable to have users re-type their password to confirm it's correct? On User Experience the general consensus seems to be no but I'm wondering if this has security ramifications? EDIT: my ...
5
votes
3answers
386 views

Mutual authentication for humans

Is there any way for two people to securely authenticate each other without access to any special software (like PGP)? For example, when speaking over the phone or by sending SMSes to each other or ...
8
votes
4answers
6k views

what are good requirements for a password

I'm making a website and I'm deciding on the password policy. What does make a good password? I really have no idea. I guess passwords should be at least 6 characters long. EDIT: are there any ...
17
votes
4answers
1k views

How to treat non-optional bad security questions?

Every once in a while I have to set up an account on a site that, while apparently at least not storing my password in plaintext, still force me to choose from a limited set of security questions that ...
14
votes
8answers
8k views

Are services like “LastPass” less secure, as they have all my passwords protected by a single password?

If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security?
1
vote
1answer
2k views

Due to which reason might a windows 7 password been reset to empty?

A user reports on monday he cannot access his windows 7 account anymore due to a "wrong password", which perfectly worked on friday. It turns out the password has been reset to empty for that account. ...
4
votes
3answers
449 views

Completely mimimise the possibility of my web hosting account being hacked

I've just moved web hosting providers and I want a fresh, secure start. To a certain extent, I don't mind what I have to do I'm just fed up my account being hacked or infected. I just wondered how to ...
3
votes
1answer
2k views

I've heard that salt is not meant to be secret, but what if I made it secret? [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? How to store salt? Ok I have been studying a lot about password hashing lately. And I have a few questions. So I ...
22
votes
3answers
3k views

Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers?

I just saw for the first time a new way to enter a password, at the Banque Postale (French Bank). You are given a virtual numeric keyboard and to type you can just leave the mouse cursor over a number ...
1
vote
1answer
3k views

Retrieving saved password from Firefox on Linux [closed]

I know there are ways to get the cookies from browsers in Windows and retrieve and decrypt saved passwords from them. Is there a similar way to do so on CentOS?
4
votes
2answers
388 views

is it easier to get the original password if you have multiple hashes of it?

Most users tipically use the same password for multiple applications. Let's say all of these applications hash the password in some way. Would it be easier for an attacker to get the original password ...
33
votes
4answers
2k views

If email is insecure, why do we use it for password resets?

I found myself telling a coworker today "Email is insecure, that's why we developed our secure report application." But then it struck me, Why is email considered insecure? If it is so insecure, why ...
3
votes
0answers
287 views

Can an attacker guess my password length from a hash? [duplicate]

Possible Duplicate: Possible to detect password length from hash? Is doubling your password adds more security? Considering I do not provide him any personal information relating to it, are ...
5
votes
1answer
3k views

Security of bcrypt/sha256 key used with AES to encrypt a file

I'm looking to encrypt files using secure hashing and encryption algorithms in Python. Having used bcrypt in the past, I decided to use it for my passphrase calculator, then pass the output through ...
5
votes
5answers
921 views

When hashing passwords, is it okay to store the algorithm used right there in the database?

Since hashing password has become a hot topic recently, it is only natural to expect things to change and assume that some time down the road you might want to replace/tweak the algorithm used in your ...
0
votes
2answers
2k views

Can my ISP know my passwords

If I am using some proxy service, proxy service provider can know my passwords to my online accounts. In which case my ISP can filter my requests and get my passwords to my online accounts? And how ...
3
votes
1answer
244 views

Is this acceptable login security?

I was logging into a VM on a computer at work. The VM was Linux Debian 2.30.2. I discovered that I could input my password, followed by garbage, and it would be accepted. How is this considered ...
7
votes
3answers
724 views

Is it a good idea to have a “master” password?

Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
-3
votes
3answers
2k views

What's the use of making users use digits, uppercase-lowercase combination password if the passwords are hashed?

Some websites, even the StackOverflow asks for atleast 1 digit, 1 uppercase character in the password. Does this really matter when the developer uses a password-hash algorithm to store the passwords ...
2
votes
3answers
251 views

How to regain access to the server?

I have a Debian server with KVM available 24/7. It was recently broken into and its root password changed. My hosting provider has restored my access and helped me change the password. But in the ...
3
votes
6answers
644 views

Methods for remembering passwords around the web

What's the least painful way to manage passwords for user accounts that you have on various sites? I see only 3 options: Password manager. Passwords can be different and strong, but the downside is ...
16
votes
3answers
16k views

openssl: recover key and IV by passphrase

A large amount of files were encrypted by openssl enc -aes-256-cbc -pass pass:MYPASSWORD Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
4
votes
7answers
3k views

Is it possible to detect password length from hash? Does doubling your password add more security?

Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
345
votes
13answers
67k views

Are passwords stored in memory safe?

I just realized that, in any language, when you save a password in a variable, it is stored as plain text in the memory. I think the OS does its job and forbids processes from accessing each other's ...
2
votes
5answers
1k views

Looking for password manager in company [duplicate]

I was looking for solution everywhere, but maybe because lack of specialized words I can't find it. I've got a problem in finding a program, but I don't know how to describe it in one word so I'll ...
2
votes
2answers
429 views

In this example why do they hash a randomly generated piece of salt before hashing it with the password?

From here, in the code return substr(sha1(mt_rand()),0,22); what is the point of taking the sha1 value? It is appended to the password and together they are hashed using Blowfish. Why not just append ...
5
votes
2answers
461 views

Does the password you use to sign into a VPN determine the strength?

I subscribed to a VPN service and need to change the password. Does the password I use to log in determine the strength? For example should it be 64 characters long or can it be 10? I'm thinking of ...