Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

10
votes
4answers
9k views

Regulations that specify password length?

I have read: PCI DSS 1.2 SOX 404 AR 25-2 ISO 27001 But only PCI DSS specifies a minimum password length. Are there any other regulations that dictate password lengths for any industry? NIST ...
10
votes
2answers
2k views

How does Google not care about “spaces” in Application-specific passwords?

I have recently setup "2-step verification" for my Google account. One of the features is the ability to create "Application-specific passwords " for devices that do not support the 2 step process. ...
2
votes
2answers
156 views

How can I protect a client's mirror of the server's database?

The scenario is as follows: There are clients that users can access and work with. These clients can be online or offline. There is a central database on a server, holding all the authorization ...
12
votes
3answers
17k views

Is a password protected PDF file safe for bank statement attachments?

My bank emails my monthly statement to me in a password protected PDF attachment. Is this a secure method of transmitting something as sensitive as bank statement?
4
votes
3answers
399 views

Is it safe or even common to cache bcrypt checks in-memory

In a web application that (as a side effect of implementing the password anti-pattern) stores passwords, one recommendation is to bcrypt to store them (or computationally expensive one-way salted ...
4
votes
1answer
409 views

Thoughts on creating unscalable conditions to brute force even small passwords?

I stumbled upon something called "scrypt" which claims to add fixed time/space complexity requirements into password-based key derivation. Quoting from their page: A simple password-based encryption ...
21
votes
6answers
9k views

Is AES encrypting a password with itself more secure than SHA1?

This isn't really a practical question, but more a question of curiosity. I heard a CS professor recommend stepping up from md5ing passwords not to SHA1, but to AES encrypting the password using ...
18
votes
1answer
5k views

Can a dictionary attack crack a Diceware passphrase?

Everyone knows the words used in Diceware passwords (all 6^5 = 7776 words are published) -- they're all common words. Everyone seems to know that we're not supposed to use dictionary words for ...
5
votes
4answers
6k views

How secure is Windows Auto-Logon?

Obviously, if auto-logon is enabled, anyone who can gain physical access to the PC can use the PC. That's not the question. The question is, when I enable auto-logon for my Windows 7 box, will there ...
4
votes
1answer
3k views

Rainbow tables, generation and lookup, preferably using GPU

1a) What software can I use to generate my own rainbow tables, preferably software that can utilize CUDA or ATI Stream? One of the reasons I want to make my own, is that I want to use a specific ...
3
votes
1answer
441 views

Non English password dictionaries

What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
9
votes
6answers
1k views

Is putting every username and password for our organization in a giant Google spreadsheet a spectacularly bad idea?

Our startup has something like 100 usernames and passwords to keep track of, and we can't keep track of all of them. Would putting all of them in a Google spreadsheet shared amongst ourselves be a ...
4
votes
4answers
910 views

Store a password to avoid user interaction

I am creating a windows service that sends email to a user. It uses a Gmail account to send the email, so it needs a password to access the account. It also needs to do this automatically, without ...
9
votes
6answers
1k views

Cracking long Windows XP passwords

Completing an assignment for my Ethical Hacking unit at University at the moment and the first task I have is to crack some passwords. Decided to use backtrack to crack some passwords from a Windows ...
2
votes
4answers
638 views

passphrases - lowercase and dictionary words

Amid all the discussion about password length vs. complexity (summarized by the famous xkcd strip and the followup dicussion) I am trying to make up my mind about passphrases made up with dictionnary ...
9
votes
4answers
801 views

Is using a flash drive as a base for security a safe thing to do?

I'm developing some software for schools. I've found severe flaws with the current popular school LAN protection that I feel needs fixing so I plan on releasing my own software. One the those ...
7
votes
5answers
27k views

Modern high quality password dictionary

Has anyone come across any good password dictionary lately? Some of the lists I found dated back to 90's! Some are simply too big that I doubt their quality. There appears to be some work by someone ...
4
votes
1answer
1k views

Is a public known password protected Wifi more secure than one without a password?

When connecting to a public Wifi from a café for example, some don't use a password and some do. If they do use a password it is often publicly known to everybody around. Does having a password on ...
10
votes
2answers
6k views

Is it safe to store the password hash in a cookie and use it for “remember-me” login?

I want to store an encrypted string of the password hash in a cookie and use the hash to lookup the user and log them in (if they want to be remembered). Is this safe? The password is one-way hashed ...
5
votes
3answers
3k views

What are the odds of brute-forcing an archive with 256-bit encryption?

I have a file (a stand-alone archive). I lost the password to it, but it has been encrypted using 256-bit encryption. The password is some 20-odd characters long (including non-alphanumeric ...
3
votes
2answers
306 views

How does one make password easily forgettable?

Is there any phycological research that appears relevant to making passwords easily forgettable under adverse circumstances? Circumstances might include when under duress, after some duration of ...
6
votes
2answers
2k views

What algorithms are best be cracked by GPU?

What algorithms are best being attacked by a GPU powered password cracker? For example, I heard that md5crypt that is being used in unix shadow file, is not the best choice for GPU cracking because it ...
5
votes
6answers
909 views

What is the use of password encryption?

Why do we encrypt passwords? Is it to protect the password from eavesdropping? to protect the password after saving it in database? both? or for some other reason?
11
votes
3answers
340 views

How to test if a browser add-on is safe

I came across this plug-in that started some alarm bells ringing. The add-on would help submit a website to web directories. The first 100 submissions are free, then you need to pay $20 via pay-pal ...
4
votes
2answers
2k views

Keepass client on Android (reliable one)

I need some advice to choose a Keepass client on Android phone which can synchronize using Dropbox. As i keep all my passwords in one place, I would like to keep it safe. Is KeepassDroid client safe ...
3
votes
2answers
1k views

How is WEP/WPA2 key derived?

When I was a kid, WEP had a 40 bit key. Later, they came out with a 128-bit key. But as we all know, WEP was so badly-designed that the RC4 key length didn't really matter much. Ignoring this, my ...
2
votes
2answers
682 views

How to make a certificate encrypted flash drive?

I was wondering if it possible to encrypt a flash drive (or any other external medium) using certificates instead of a password. The idea is to have a number of encrypted pendrives that can be used on ...
29
votes
4answers
10k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
54
votes
2answers
60k views

How difficult to crack keepass master password?

How easily could someone crack my keepass .kdbx file if that person steals the file but never obtains the Master Password? Is this a serious threat, or would a brute force attack require massive ...
6
votes
2answers
7k views

Is it possible to speed up WPA/WPA2-PSK cracking using a rogue AP?

We know that WPA/WPA2-PSK uses a PTK (Pairwise Transient Key) for each client to encrypt the communication. This PTK is generated through the process known as 4-way handshake. As told in the related ...
9
votes
5answers
3k views

How to catch a gmail hacker/money-scammer? (in conversation with one right now!)

My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
10
votes
3answers
325 views

Is there any conceivable reason to prevent a password change in an authentication system?

I connect to the VPN of another company with a company-specific username and password (they aren't giving everyone the same password to every company to access it or anything ridiculous like that.) ...
12
votes
4answers
1k views

Is it “standard” to SMS passwords?

When I get credentials for a new machine, my company will often send the login id in email, then SMS (or sometimes Skype msg) the password. This is obviously in order to separate the login and ...
3
votes
3answers
914 views

Best password storage scheme for high entropy, unique passwords which is failure resistant [closed]

What is the best, most secure, easiest way to: store unique, strong passwords for every service which requires authentication make the system resistant (total loss of security is avoided, breaches ...
1
vote
2answers
207 views

Password system, possible solutions

I am trying to solve a problem with a password system. I need to figure out the probability of the password being guessed. If I have an 8-character alphanumeric password. it cannot be all #'s, ...
3
votes
1answer
2k views

Are Windows password hashes salted with the user name?

I'll readily admit I'm pretty clueless when it comes to cryptography, so there may already be some false assumptions in the question title itself :-) Still, I "heard" that it is more secure to store ...
14
votes
5answers
982 views

Is it legal to log passwords from failed logins?

Is it legal to store/log mistyped passwords? How many of you have seen this happen in a log file or DB?
13
votes
3answers
1k views

What is a good enough salt for a SaltedHash?

Since I'm hashing all passwords with each their own salt, is there a benefit to the salt being really random, or would an incremental counter or a guid be good enough? Also, is there a benefit of ...
3
votes
4answers
951 views

Laptop was stolen, they tried to log into my facebook from their location on my laptop

Can I get some advice on what I should do next? Laptop was stolen yesterday and they tried to log in my facebook today like 20 minutes ago.
3
votes
1answer
115 views

What are the implications of omitting the username in Secure Remote Password's verifier?

I consider implementing a Secure Remote Password (SRP-6a) verifier that omits the username from the x key hash. The intention is to allow authentication with multiple alternate user identifiers such ...
15
votes
2answers
4k views

What's wrong with storing private keys in the cloud?

I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
3
votes
2answers
478 views

What is considered a reasonably high iteration count?

I copy-pasted a function that implements the PBKDF2 hashing algorithm in PHP. The function asks for the amount of time that I would want it to loop in order to produce a hash. Now, I'm wondering, ...
5
votes
4answers
234 views

Should we be checking password restraints on log in forms?

We have many restraints we put on users when they set up their password. These restraints include password length, characters they can or cannot use, the use of numbers and letters, capitalization ...
25
votes
4answers
4k views

What should be used as a salt?

I always hear that it is best to use salts on top of stored passwords, which then somehow gets concatenated and hashed afterwards. But I don't know what to use as a the salt. What would be a good ...
15
votes
2answers
1k views

Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML

It's clear there there is no consistent set of features among any of the popular authentication providers. Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
2
votes
1answer
222 views

Detecting Key Loggers

We know that key loggers are the most effective and most annoying means of getting compromised over login id/password on the web or any application.... and your whole privacy is breached. Is there ...
4
votes
2answers
951 views

Known Password Lengths and security considerations

Many people wil often brag about the length of their password, like "yeah nobody is ever going to crack my password cause its 22 characters long." I was thinking, if you knew the exact length of their ...
9
votes
1answer
1k views

How to know the windows security dialog asking for username password is genuine?

I recently faced one issue. It appeared my outlook launched a dialog saying it needed password. It looked like this I noticed the "->" character in the domain name which usually it auto fills. Also ...
2
votes
1answer
205 views

How do we encrypt a password using another password?

Heys all I've got a nub question, I was wondering What does it mean to encrypt a password using another password? For example I want to encrypt a password foo using a password bar, does it mean that ...
14
votes
4answers
922 views

If a website allows another person to get a list of the site's users passwords, how likely is it that the passwords are stored in cleartext?

We had an incident where some of our managers were given passwords for the people they supervise using a particular company website. Ostensibly it was done so the managers could check in on the users ...