Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
4,019
questions
4
votes
2
answers
2k
views
Where to store a pepper?
Assuming you're using a pepper in your password hashing, where should it be stored? I know you shouldn't store it in the database since it can easily be found there during a dump and the idea is to ...
4
votes
1
answer
1k
views
what is a valid challenge for 2 factor authentication?
When designing a password reset process:
Is an email address or an assigned username a valid piece of information (identifier) to ask for in two factor authentication?
How does two factor ...
4
votes
2
answers
569
views
Including and storing the order of character entry in a password as an enhanced security measure
I'm sure I will be quickly corrected if this is a stupid idea, or if it has already been tried. My question is: has this idea been tried before? If not, are there good reasons it would not work, or ...
4
votes
1
answer
2k
views
is 'mysql_real_escape_string' enough
Recently on stackoverflow I've seen many discussions that mysql_*_escape_string is deprecated and instead recommending PDO.
The way I've been doing it was to allow only letters and ' in the name field ...
4
votes
4
answers
23k
views
A low tech yet secure way to keep track of passwords?
I use LastPass and love it.
My girlfriend creates her own long, complex, unique, and thus difficult to remember passwords for every site. She frequently forgets them and has to rest the password.
...
4
votes
5
answers
378
views
Modes of Attack on Time-Bombed Password
I'm one of the co-founders of plaintextoffenders.com. We recently received a submission for which I'm not sure if there is a means of attack or not. The site in question is a hosting/VPS/etc. company.
...
4
votes
3
answers
1k
views
Encrypted files storage. How to simplify the password management scheme?
It's probably dublicate but I can't figure out the correct keywords for search. You can help by just telling me those words, I'm rather good with Google :)
I want to develop somewhat like file ...
4
votes
2
answers
18k
views
What exactly is 'single' mode in John the Ripper doing?
I'm testing out John the Ripper (1.7.9 Jumbo 7) on a file containing MD5 hashes without any usernames. I've been experimenting with different rules and configurations – I am currently using a wordlist ...
4
votes
5
answers
2k
views
passphrases - lowercase and dictionary words
Amid all the discussion about password length vs. complexity (summarized by the famous xkcd strip and the followup dicussion) I am trying to make up my mind about passphrases made up with dictionnary ...
4
votes
2
answers
933
views
How does Windows password protect my data?
As far as I know, Windows computers are not encrypted by default in case you are not signed into a Microsoft Account. Considering the aforementioned fact I cannot understand the purpose of the login ...
4
votes
1
answer
1k
views
Why not use a URL as a password?
When picking a password for a site, is it a good idea to use an unrelated URL, such as http://www.w3schools.com/Sql/sql_injection.asp, as the password?
I can see some benefits - it's hard to ...
4
votes
1
answer
482
views
Why, after a certain character limit, are larger passwords labeled as "weak" on some sites?
On many sites we see an indicator if our password is weak, or strong, to give us a good indication to go with that password, or not.
I've been noticing on some sites, that after x amount of ...
4
votes
1
answer
10k
views
How does a password authentication over a TCP protocol actually work?
When coming up with a password based login protocol, many solutions come in mind:
User sends password in plain text. Compute hash on Server, compare to hash in database. - Bad because attacker can ...
4
votes
3
answers
7k
views
SSH Public Key Authentication vs Username/password for API Access
I have a linux device that will be making periodic call to an API server, say everytime the system boots up. Everytime then it should authenticate itself and then do its thing.
I can either store the ...
4
votes
1
answer
1k
views
Is it a good idea to use two salts? [duplicate]
Is it a good idea to use two salts? This is implying that one would be unique to the user, and one would be unique to the server, using Bcrypt of course.
So for example, if you're using Golang as ...
4
votes
2
answers
5k
views
Reverse Engineer this basic Hash using known answer? [duplicate]
Little background: I forgot one of my CCTV accounts password, so used the admin account to create a new one. However I can't access the old one as it's not possible to change a user account password, ...
4
votes
1
answer
266
views
How secure is choosing one out of N generated passwords?
I'm looking to generate some new passwords for myself that are easy to remember, but hard to crack. By choosing a generation algorithm and generating one random password with it, I can be relatively ...
4
votes
3
answers
356
views
How to simply and efficiently generate different keys from one password?
I saw here that using the same key to encrypt and mac (in that order) a message could eventually be unsafe.
What is the best way to generate two different keys from the same password (using a PBKDF ...
4
votes
3
answers
4k
views
sniff SSH password on the server
Is it possible on the server to log the password encoded by the remote user inside a log.
I want to make a honeypot to see the type of user/password used.
4
votes
2
answers
1k
views
Can key files be brute-forced like passwords?
Let's say you use a program like Truecrypt or Keepass which allows you to have a password + key file. I understand that passwords can be brute-forced/dictionary-attacked but is the same true for key ...
4
votes
1
answer
7k
views
Please explain Time-step in Time-Based One-Time Password Algorithm
I am studying about OTPs (One Time Passwords). I have gone through all the methods: HOTP (HMAC-based One Time Password), TOTP (Time-based One Time Password)
I have no issues with HOTP. But according ...
4
votes
3
answers
739
views
Hashed passwords - How many variations of rainbow tables?
First off...I passed the CISSP exam. WOOOO. I had to get that out. GCIH and CEH by Sept. 11'
So, while studying for the technical side of things, I see that there are rainbow tables. They are pre-...
4
votes
2
answers
2k
views
Is it safe to leave MySQL root user without a password if it uses auth_socket?
Since MySQL 5.7, the root user is configured to use the auth_socket authentication plugin instead of a password.
Is it safe to leave the root user that way (without a password)?
4
votes
2
answers
1k
views
Can you use RSA2048 to hash passwords?
Assuming I'm working on an environment that currently uses MD5 to hash passwords, and I want to switch to something more secure.
I already heard of bcrypt, but I had another idea.
Would it be ...
4
votes
4
answers
2k
views
Password managers with U2F security risks
After a lot of research about password manager and a lot of reference obtained from this discussion
How safe are password managers like LastPass?
I come to the conclusion that password managers have ...
4
votes
1
answer
3k
views
Do you consider PWGen safe to use?
Do you consider PWGen safe enough to use? What do you use to make truly random password. PWGen should be using "movement of your mouse" to make it really random, right?
4
votes
4
answers
532
views
Are limited length passwords a security risk? [duplicate]
I found a webpage where users can be registered. However, it seems that the length of the password must be between 6 to 12 characters.
Is that a security risk?
4
votes
2
answers
2k
views
I tried to break my WiFi: is 8 uppercase letter strong enough?
My Wi-Fi WPA-PSK password looked pretty weak: 8 uppercase letter. I have checked with another router from the same provider and the pattern is the same.
To see how weak this is I tried to hack it ...
4
votes
3
answers
15k
views
Where are the user credentials stored when remember password is selected?
Provided a user has chosen the remember me option while logged in last time into a web application,how does the web application server identifies the user next time when he logs in? The credentials ...
4
votes
3
answers
1k
views
Does cPanel store my login password as plaintext
On attempt to change my cPanel password I was warned that:
Your password could not be changed because the new password failed with the following reason : (is too similar to the old one), please try ...
4
votes
4
answers
4k
views
password generating algorithm
I read the question about the relevancy of the xkcd password creation algorithm.
Would it be more secure if you used a string of common words with a function that only you knew that would rearrange ...
4
votes
2
answers
33k
views
NTLM/LM Hashes on Domain Controller
I've noticed that when extracting password hashes from a domain controller (using Elcomsoft proactive password auditor) sometimes I'll get LM and NTLM hashes and other times I'll only get NTLM hashes.
...
4
votes
4
answers
752
views
How do clients enroll using SRP?
From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
4
votes
2
answers
507
views
Is it ok to email someone their password from a newly created account? [duplicate]
I have a pretty standard registration form. One thing I've decided to do away with is the requirement to enter the password twice, for usability reasons.
In order to mitigate the increased risk of ...
4
votes
4
answers
423
views
Composition of passwords
Passwords (passphrases) that are taken from known texts (books etc.) are commonly considered to be weak, but what if they are employed in combination with random stuffs, i.e. in forms of AX, XA or AXB,...
4
votes
4
answers
2k
views
Can public keys be a security risk when performing password-less SSH logins?
Some companies use monitoring software such as nagios or icinga. In order to perform checks on the servers, they often need password-less SSH logins.
The servers being checked put the public key of ...
4
votes
1
answer
2k
views
Why does Windows 7 require a password hint during setup?
Correct me if I am wrong, but I think Windows 7 is the only operating system out there that requires a hint for the first user created on the system (have not had a chance to check out Windows 8 Beta)....
4
votes
1
answer
5k
views
BCrypt vs PBKDF2-SHA256
I read that LastPass uses PBKDF2-SHA256 for storing the Master Password hash, I wonder how this compares to BCrypt and why did they chose this, as SHA256 is a quick hash (probably compensated by PKDF2?...
4
votes
2
answers
7k
views
How does the password Tr0ub4dor&3 have ~28 bits of entropy? [duplicate]
I rencently seen this :
I can't figure out, how he computes 28 bits of entropy for a password like
"Tr0ub4dor&3" seems really few...
4
votes
3
answers
2k
views
Is it more secure to limit passwords that have two identical characters in a row?
OWASP recommends this practice and so do some other companies. I think it makes sense at first glance but if you think about it, it actually limits entropy instead of increasing it. How many ...
4
votes
2
answers
2k
views
Why Yahoo is still using MD5 to hash users passwords? [closed]
I have received a warning email from Yahoo regarding data breach that they might had.
...The stolen user account information may have included names, email
addresses, telephone numbers, dates of ...
4
votes
1
answer
765
views
Password managers and SSD wear and tear
I've been looking at this topic for a long time, and am still paranoid about this.
I have an 1 TB SSD with Ubuntu 16.04 on it. From what I have read, using disk encryption is bad for an SSD due to ...
4
votes
1
answer
2k
views
How is github 2FA personal access token more secure than passphrase?
I recently enabled 2-factor authentication (2FA) on my github account. Once you enable 2FA, you can no longer connect to the repo using your normal passphrase using command line tools. You have to ...
4
votes
1
answer
436
views
How to safely reuse passwords in variation?
Remembering a lot of passwords is difficult. A lot of people use the same or a small set of passwords for everything.
Of course, this is very unsafe. If such a password a password is stolen, the ...
4
votes
3
answers
1k
views
Is it safe to generate a password for a user during sign up in a web application?
I'm working on updating a web application. It currently creates a password for a user during sign up. Is asking the user to create the password themselves safer than relying on a generated password?
4
votes
3
answers
553
views
Is it good to not have keyboard-based sequences in our password generator?
If we have to write a password generator, is it a good idea to contain a "keyboard-based sequence" checker? So if the generated password is:
asdf4%'Q!76342
Then this password will be rejected by ...
4
votes
3
answers
6k
views
Why require new users to change password?
I have noticed that it is common practice when setting up a user account (Windows users accounts and Google Apps user accounts in my case) to require new users to create their own password immediately ...
4
votes
1
answer
9k
views
Cracking MD5 passwords with the same salt
How long would it take to crack passwords up to 10 letters long if you knew the hashes were MD5 with a salt (that you know)?
4
votes
3
answers
746
views
Could using a generated key from an online service be considered a risk?
With some colleagues we're having a debate regarding the randomkeygen.com website.
I do think that there is a security risk using the generated keys of this (or any of this kind) website.
Why ? ...
4
votes
1
answer
23k
views
Where to download a list of email accounts hacked from Adobe? [closed]
Adobe announced they had been hacked and millions of user accounts and passwords compromised.
These sites allow a search on email address to see if it was compromised:
https://lastpass.com/adobe/
...