Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

-1
votes
1answer
6k views

Is my information secure when using Private Tunnel? [duplicate]

I am using Private Tunnel to do some tasks involving sensitive data like logging in to PayPal and online banking. Is my data safe or can it be retrieved by other users of the Private Tunnel service?
-1
votes
2answers
158 views

What is the safest way that you could hash/encrypt a password? [duplicate]

What is the safest way that I could could hash/encrypt a password for my website?
-1
votes
2answers
715 views

Looking for safe, simple way to store passwords with PHP 5.2.17 [duplicate]

I've found many posts on StackOverflow and other sites using Google, but since security is always changing, and what was safe a few months ago not me anymore... I felt the need to ask on here. ...
-2
votes
3answers
398 views

My friend hashes passwords with SHA512 algorithm without salt. How do I convince him that he needs to add salt?

Today I discovered something incredibly stupid - my friend hashes user passwords with sha512 algorithm without a salt. I immediately raised this issue to him but he said he wants to see anyone crack a ...
-2
votes
2answers
379 views

How to secure passwords when site is opensource [duplicate]

Possible Duplicate: How to securely hash passwords? How can I store passwords to have them secure? Right now the site use md5 md5, I was thinking about sha1+salt but if the source code for ...
-2
votes
2answers
712 views

How to secure a login.php file? [closed]

I have a hand built website, and am triying to build a cms/admin-panel, and my username and password, are not stored in a database, but, in a two setup file like seen below. index.php <?php ...
-2
votes
2answers
125 views

How much do unusual characters in passwords help?

If I use a system that allows all Unicode characters or a similarly large space for passwords, how much would using an unusual character help in practice (for example, ࡀ ,which I found under Mandaic ...
-2
votes
1answer
268 views

What are common problems that reveal PHP code? [closed]

What is the best method for securing PHP scripts that contain database passwords? From what I've read, PHP can be revealed when an error occurs and is not caught. Is there any way to reveal PHP by ...
-2
votes
1answer
187 views

Can Cain&Able Crack SSL? [closed]

I have been messing around with Cain and Able and used APR on another computer (also mine) to get a hashed version of my username and password for my yahoo e-mail account, but I seem to be lost as to ...
-2
votes
2answers
197 views

Password hashing and blowfish [duplicate]

What I'm about to say is probably going to make me look like an idiot but it's better to be wrong and learn than have unanswered questions. Ever since I started dealing with passwords I wondered what ...
-2
votes
1answer
121 views

client side and server side hash password [duplicate]

Another question about client or server side password hashing, I know. After reading many other post about this topic I'm still a little confused and not completely sure what is the best, because I ...
-2
votes
2answers
170 views

A Graphical Two-Step Authentication System [duplicate]

Changes made to system proposed in Two-factor authentication Without Mobile Phone: In previous system, shoulder surfing would reveal the user’s pre-decided image. In the current system, end image ...
-2
votes
1answer
265 views

How long does it take to break 128-bit key

Hmm, I was asking myself how to compute if we were given one day to try all possible keys for a 32-bit symmetric cypher, how long would it take us to break 128-bit key? My calculations suggest: ...
-2
votes
1answer
66 views

Is digested password safer than salted password?

which scheme is the better one in your opinion? I know that both are secure but which is better one? I know that digested passwords are very difficult or even impossible to decrypt. Thanks for your ...
-2
votes
4answers
197 views

Getting password cracking time and byte storage from bruteforce?

I am stuck with this question, you can see it in the picture I have included below. PARTS (a and b) I know a-z will be 26^8, A-Z will be 26^8 guesses, and 0-9 will be 10^8 guesses. But I can't relate ...
-2
votes
1answer
112 views

Salt and password [closed]

Reading the doc for setting the password, the command is : python -c "import crypt; print crypt.crypt('password', '\$6\$SALTsalt')" SALTsalt is the 8-character crpytographic salt. Valid characters in ...
-2
votes
1answer
47 views

Drive lock Passwords [closed]

What is Drivelock Password? Is drivelock User Password the same with the Administrator Password i did in the Control Panel when I changed the Administrator User name and Password?
-2
votes
1answer
64 views

Escape from <script> to cause a XSS (XSS when reflection is already under <script>) [duplicate]

I am trying my level best to solve this issue i am totally not able to create a XSS i still thinks it to be a vulnerability and i think it is exploitable. I am frustrated around it for 8 days . Please ...
-2
votes
1answer
919 views

LophtCrack version 6.0.12 is not auditing my Administrator password [closed]

I am using LophtCrack on my Windows 8 OS. I was testing my password strength and the problem I am seeing it is not working. It doesn't reveal my Admin password, I've run the process for half an hour. ...
-2
votes
3answers
259 views

Password security : complexity and length [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? I've read that there is many solutions available to crack passwords. Reading these tips, I can ...
-3
votes
1answer
376 views

Why don't we do dual password instead of forgot password?

You can see a link Forgot Password? nearby almost all login form. As I mentioned in question, Since passwords are completely protected from outside access unless owner reveal, I come up with this ...
-3
votes
2answers
708 views

Good Practice: Storing Passwords in general

I've got a totally theoretical question to you on today - what is the "best" practice for storing passwords? [Best in terms of security and performance] Usually, especially PHP-Developers tend to ...
-3
votes
3answers
1k views

What's the use of making users use digits, uppercase-lowercase combination password if the passwords are hashed?

Some websites, even the StackOverflow asks for atleast 1 digit, 1 uppercase character in the password. Does this really matter when the developer uses a password-hash algorithm to store the passwords ...
-3
votes
2answers
294 views

Inform someone about a hacked account [closed]

I'm not a hacker but recently I was able to get someone's email password. I want to teach him a lesson to be careful when using internet and to pay attention to his passwords but I have some problems: ...
-3
votes
1answer
1k views

Retrieve Admin Password from router [closed]

There is a way to retrieve a router admin password without hard reset? I'm loggen on LAN and know username and local ip address... TKS
-3
votes
2answers
63 views

Can I prevent brute forcing of hashed+salted user passwords without a dedicated validation server? [duplicate]

Salted hashes don't seem to offer any real protection for user passwords by itself. So long as a hacker has a quick way to check if a password is right or wrong, it's trivial to brute force it to view ...
-3
votes
2answers
2k views

Is pixel based image encryption secure?

I have encrypted an image using pixel encryption method. I just used a bmp image for that. What I did is, I retrieved each pixel value from the image and obtained the value of red, green and blue ...
-3
votes
1answer
109 views

What is the algorithm of bcrypt? [closed]

In many places I heard that people recommend to use the bcrypt algorithm to save passwords into database while creating web applications.I want to know what is the algorithm used to bcrypt a password ...
-3
votes
1answer
40 views

Which encryption technique should be used for users name and passwords in my notebook [duplicate]

i writing all my passwords and users names on my notebook emails,amazons,facebook. and i have really Nosy little's brothers that will probably look at my notebook when i am not around, which ...
-3
votes
3answers
205 views

Hashing credentials. Is hash(email+password) secure enough?

I am working on a client server application where to identify each user I was thinking of storing a single database entry: hash(email + password) In my opinion, this is enough to stop some known ...
-3
votes
1answer
2k views

Good Password Length [duplicate]

If you are looking to be careful and your passwords include all the types of characters, what is the ideal password length?
-3
votes
1answer
102 views

What type of hash is this MD4(MD4(($pass)).(strtolower($username))) [closed]

Can I decrypt this hash? Domain Cached Credentials: MD4(MD4(($pass)).(strtolower($username)))
-3
votes
1answer
51 views

Make password list with crunch [closed]

I want to make some password list like this : A4B9D It should has these : 5 characters first, third, and fifth characters are letters (A to Z) second and forth characters are numbers (0 to 9) ...
-3
votes
2answers
572 views

Time it takes to crack a password on site like yahoo [closed]

I have a question. If you were using a password brute force/dictionary attack utility on a site like yahoo or another site, how long would it take to crack a password like Jah13Wootiang if Wootiang is ...
-3
votes
2answers
147 views

How to make a strong password? [duplicate]

I always hear conflicting things. Should I use a long sentence? Or is this privy to dictionary attacks? Or should I use a long string of random alphanumeric garbage with upper/lowercase and ...
-3
votes
1answer
782 views

What are some good user login/authentication libraries or protocols to use with Python on Google App Engine? [closed]

I've read elsewhere (http://forums.udacity.com/questions/6028436/bcrypt-not-suitable-for-pythongae) that bcrypt is not suitable for use on Google App Engine. What are some good ways to create a user ...
-3
votes
1answer
120 views

Why should I use the VPN? [closed]

Does a Virtual Private Network (VPN) provide an encrypted connection from outside networks or from ISPs to the internal network?
-4
votes
2answers
405 views

How do I construct a rainbow table to crack a 6 character password? [closed]

Given the hash: 491c290affbf5436f0fc0584ccefb2 how do I construct a rainbow table to crack this password?
-4
votes
1answer
573 views

Feasibility of brute-force on online password [closed]

I am familiar with how offline brute-force attacks work. But for online accounts, assuming no social engineering, how feasible is it to brute-force attack a password? For example, is this dependent ...
-4
votes
1answer
159 views

How can I crack ArrayOS password [closed]

I have some Array Load Balance device that the user password hash like: user "array" "XXXXXXXXXVkjTX9a1kYtNo". How can I crack the password or find out the algorithm of the hash?
-4
votes
2answers
66 views

How does the password become 30,000 times stronger?

This google support page says: For example, an eight-character password with numbers, symbols and mixed-case letters is harder to guess because it has 30,000 times as many possible combinations ...
-4
votes
0answers
67 views

Am I in troubles? [on hold]

So I've done a job as a game developer and as payment I chose an origin game (which costs aroung 20 dollars). To that end I've created a new blank email account and a new origin account. Both of those ...
-4
votes
1answer
94 views

How many possible symbols and punctuations in a password? [closed]

I want to compute the possible combinations of a password consists of 8 digits of: alphabetical letters (26), numbers (0-9), symbols and punctuations. In order to compute this, I have to know the ...
-5
votes
7answers
1k views

Are passwords made up from concatenating a few foreign words better than shorter random characters? [duplicate]

Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example: "pussiMeansCatInEskimo" "caballoMeansHorse" "CatIsGatto" "SalopeMeansBitch" ...
-5
votes
1answer
81 views

Time-based password change [closed]

I have created this script and it runs great, but important questions remain. Is this script useful and secure? Does it have any possible problem or weakness? root@010010:/# ls -la ...
-5
votes
1answer
3k views

How to decrypt the encrypted data, in SHA256, of mysql database? [closed]

I have some data in column of table of mysql database in the encrypted form applied with SHA-256. How to decrypt that data using Java. I stuck at this since 4 days. Please spend 5 minutes of your ...
-5
votes
2answers
521 views

in which format this code is encoded ? and how i decode it? [closed]

"jmHMRWncShQ%3D" this is my encoded text , i want to know that in which format , this text was encoded , and also want to know that how i decode these types of code ??? this password may be ...
-5
votes
1answer
78 views

What is the most secure way to protect a custom CMS from infiltration? [closed]

I have a custom CMS with a randomly generated ASCII 100-character string from this site for both my username/password. I also have this following sha512 encryption system, which was created by ...
-5
votes
1answer
97 views

How to use wordlist [closed]

I have downloaded a wordlist from https://crackstation.net/buy-crackstation-wordlist-password-cracking-dictionary.htm The size of the wordlist is 4.2 GiB (compressed) or 15 GiB (uncompressed) The ...
-6
votes
1answer
80 views

Make really personalised wordlist file

i want to make a really customised wordfile with: 4 letters first + 2 numbers example: divo11 or yeve11 And not like this: p0oiw1 or u4hf3e This wordfile is really important. How can I do it?