Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

1
vote
2answers
241 views

Password Cracking Mandarin Words English Character Set

I'll be looking to perform a domain password audit in which the user will be using english characters but may be 40% Mandarin speakers so I anticipate a large number of names, phrases, or words that ...
1
vote
1answer
121 views

Importance of password strength with secure element?

Greetings SE security community. Background: I have a number of items like certificates, databases, and encrypted file systems that require private keys. In order to avoid having duplicates of these ...
1
vote
2answers
159 views

How Empathy - a messaging program, is storing my passwords

I am connected to my chat accounts via Empathy, a messaging program, and it has my password stored in it. I am really curious to know how it is storing the passwords, and if there is any they can ...
1
vote
2answers
253 views

Remember Me vs Remember Email

From what I have noticed, there is very few services that offer the Remember Email over Remember Me or Sign-in Automatically. These options really do make the life easier for the end-user of ...
1
vote
3answers
137 views

How to limit the need to type a long master passphrase to only once per login session?

I want to set up a password management system on a home machine running Debian, and for this I'm considering only non-proprietary, open source password-managers available through Debian1. I'd like to ...
1
vote
2answers
2k views

How do I generate a word list from a known seed word? [duplicate]

I've lost my master password. Not all is lost as I know the original word that generated the password: It was generated by a random case switching for consonants and random vocal to numbers. For ...
1
vote
1answer
523 views

Challenge-response login without storing a password equivalent

A problem with many challenge-response login systems is that the server has to store a password equivalent. For example, if the server stores SHA1(salt + password), and an attacker captures that hash, ...
1
vote
3answers
310 views

cleartext passphrase for keystore

How is passphrase for a keystore to be stored? we have all passwords encrypted and the key to encrypt is stored in keystore , so how is the passphrase for the keystore to be stored? in clear text? if ...
1
vote
1answer
96 views

How do you manage credentials to multiple remote systems?

We are a vendor that provides software to the healthcare industry, and our application is locally hosted on customer infrastructure. As such, we are provided with VPN access in order to be able to ...
1
vote
1answer
2k views

What to do with .hash files when cracking WPA2

So, I'd say I'm one level above n00b. I've gotten to the point where I have accomplished a WPA Handshake (and saved the output as xxx-01.cap). I have also downloaded these hash tables (if that is the ...
1
vote
2answers
255 views

How could police identify digital contraband and charge someone if it's encrypted with keys?

For example, say I am transferring heavily-encrypted DVD/Blu-ray movies/game copies over the internet. However, I am using double or (+) encryption with keys required to decrypt the file using an ...
1
vote
1answer
1k views

FIPS 140-2 C# Password Hash

Is the following algorithm, using RNGCryptoServiceProvider & Rfc2898DeriveBytes, sufficient to implement a FIPS 140-2 password hash on Windows Server 2008R2? var provider = new System.Security....
1
vote
2answers
332 views

Storing database password in application

Let's say my application connects to my database. This requires me to have the username and database in my config as follows: postgresql://scott:tiger@localhost/mydatabase I have an automated ...
1
vote
2answers
1k views

How do you protect strings in code from users decompiling them and seeing them [duplicate]

For an example say we have an application such as a client based application which connects to an API using an api key. We are saying for this purpose there is no OAuth. How would a string or in this ...
1
vote
1answer
98 views

What is the best approach for securing log-in credentials on an HTML form?

I realize how basic this question is, but I have relied for years on mechanisms built into .NET to handle log in for me. These days, most of my work involves using client-side logic and calling API ...
1
vote
1answer
1k views

Is a simple Whirlpool hash with random salt secure enough? [duplicate]

I've been working on a site that requires users to login. It's written in PHP with MySQL, and passwords are stored as Whirlpool hashes with a salt (source code later). However, security sites or ...
1
vote
2answers
1k views

Should I decode a base64 password before hashing for storage?

My server gets base64 encoded passwords from the client, and I am going to hash them for storage in a credentials table. Should I decode the password and hash the clear text password, or just hash ...
1
vote
1answer
283 views

Security implications of setting the same password on private key and PKCS12/JKS?

Are there any negative security implications of setting the private key password (DSA in this case) as a PKCS12 (and then JKS) export password (instead of generating/inventing a new one)? My use case ...
1
vote
1answer
102 views

storing username/email and password with a hash of the hash of the email/password? [duplicate]

Quite the simple discussion this one (one would assume): If I'd hash the email and password, and then hash the hashes, whould this be considered safe enough or would this just be a waste considering ...
1
vote
2answers
400 views

Encryption method and other security concerns for a simple password manager [closed]

I thought I would learn a little bit of cryptography programming by making myself a simple password manager program that I can potentially even use to keep track of my passwords. The idea is that my ...
1
vote
3answers
285 views

S/MIME doesn't protect against a stolen password, right?

We're setting up S/MIME so that we can send encrypted emails. However, I have a bit of a stupid (and maybe obvious) question... If someone steals a password for either the sender or the receiver, ...
1
vote
1answer
4k views

Brute force password cracking with a GPU

How are GPU's provisioned for password cracking? Do all, if not most cracking programs have special GPU aware software or do they just function at the basic driver or API level of the device? Can it ...
1
vote
6answers
632 views

How to keep website passwords safe among employees? [duplicate]

We're a website developer agency, and most of our websites are made using in Wordpress, Joomla or Drupal as a CMS. I'm having trouble to decide how we should manage our passwords, and I'm open for ...
1
vote
2answers
125 views

What is more secure: single long hash, or combination of two shorter?

Fictitious scenario: User accesses a restricted data (available online) identified by random string (supported by captcha to make brute-forcing more difficult). So data is not protected by a user/...
1
vote
1answer
2k views

How do I generate a blowfish password hash in Ubuntu?

What's the command line to generate a blowfish password hash? I can't seem to figure this out at all. Apache's htpasswd only supports bcrypt, and openssl passwd doesn't even do blowfish hahes (but it ...
1
vote
1answer
187 views

Simple and secure remote installation method that accepts input via a web page?

When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner? ...
1
vote
3answers
2k views

Preventing dictionary attacks against hashed passwords [duplicate]

Possible Duplicate: How to securely hash passwords? I have a website and on that website I use SHA-256 and salt my user's passwords. What I'm doing right now is padding each letter of the ...
1
vote
4answers
744 views

Security implications of using a OAuth-enabled password manager

I've resisted the idea of password managers for a long time. Bringing together passwords for all your online accounts in one place that is only protected by difficult-to-remember master password doesn'...
1
vote
1answer
630 views

Securely tell the user his password in new WHM/Cpanel account creation?

I understand it's not safe to send passwords via email but when accounts are created via WHM/Cpanel, I have to let the user know what password I created for them. How can I relay the password safely?
1
vote
3answers
577 views

Linux mcrypt security

I just installed 'mcrypt'. When I try to encrypt some file with DES using the command 'mcrypt -a des myfile', I am prompted for a passphrase with a maximum character count of 512. > mcrypt -a des ...
1
vote
4answers
67 views

When (if ever) should web app force numerical, generated (hence hard to remember) logins?

Some bank sites force me to use system generated numerical login (ie. 8 digit number). Apart from singnificantly decreasing usability and giving impression of security (to some), does it serve any ...
1
vote
1answer
263 views

Can accounts still be logged onto if Password Caching is not enabled?

This is kind of an extension of my other question.. If you were not storing any of the passwords locally (caching disabled), would a user some how still be able to circumvent around this security ...
1
vote
1answer
123 views

What function(s) to be used to generate Salt on Windows Mobile 6

I am looking for THE or a real function I can use to generate salt for my mobile app on Windows Mobile. In case I am not abusing in this request but in the future I plan as well the same app for ...
1
vote
1answer
56 views

Is Auth0 Passwordless Authentication secure?

I see this advertised Medium post about building a React application with passwordless authentication through Auth0. from the link, here is the explanation of how it works: Passwordless ...
1
vote
1answer
55 views

Are UEFI vulnerable to the same password bypass techniques as BIOS?

I'm trying to understand if the old school ways of bypassing a BIOS password (flip the BIOS jumper or remove the CMOS battery) still affect (some or all) modern UEFI? If not, what protections do ...
1
vote
1answer
84 views

What are good password storage policies? [duplicate]

The world has progressed to the point where most of us have faulty memories and dozens of passwords to remember. What are good ways to solve this problem? I am interested in multiple answers and ...
1
vote
1answer
30 views

Passing a hash of a secret to a server instead of the plain text

Instead of passing an authentication token or api key in an http header to a server in the plain text, what if I calculated its hash and passed the hash? This way even if a adversary intercepts the ...
1
vote
1answer
53 views

What are the advantages of a ZKP authentication system?

So, I read somewhere that Zero Knowledge Proof based authentication is good because it makes sure that the server does not store your password and neither is your password being transmitted over the '...
1
vote
1answer
97 views

How much more difficult does it become to crack a password when appending a 5-digit pin?

I have a quick question regarding password cracking. Lets say you append a 5 digit pin on the end of your password. An example would be instead of a password of "password" it would be "password12345"....
1
vote
1answer
89 views

What password based key derivation does PKCS #12 use?

I would like to make a note that I have read all of rfc 7292. I am trying to decrypt encrypted private key in a pkcs#12 pfx file. The private key is enveloped within pkcs#8 shrouded key bag. The ...
1
vote
1answer
72 views

Storing credentials for desktop app

I have desktop application written in C# with three user roles and some predefined users. It is also possible to create another users or change passwords to predefined users. App has to work offline ...
1
vote
1answer
146 views

Copy-and-pasting plaintext data from encrypted container

Suppose we have sensitive information stored in plaintext within a dm-crypt/VeraCrypt encrypted file and this information is copy-and-pasted by a user into a web browser after decrypting (this could ...
1
vote
1answer
47 views

Is there a PAKE algorithm where the passwords can be tested in the first round?

I want to use PAKE for key exchange between two parties (Alice and Bob) which share a low entropy secret (a password they exchanged on a piece of papers). Alice and Bob use a software on there ...
1
vote
2answers
34 views

Rembering password on client (not database) [closed]

I am trying to implement the capability for my program (C++) to remember a user/password combination, so the user does not need to type it in again. Is there a secure way for my program to store this?...
1
vote
2answers
212 views

Is Linux getting less or more secure? [closed]

The famous so-called virus-and-hacker-free Mac is a thing of the past: As it gets more popular it gets more vulnerabilities. Will Linux be the same at some point in time? Is it getting less of more ...
1
vote
1answer
354 views

Hiding database passwords for classic ASP connection strings

Looking at some old classic ASP sites which could do with a bit of tightening up. The SQL server database connection string has the password in clear text within an include file on the server. ...
1
vote
1answer
157 views

WordPress is asking for my FTP password to update. Is this official behavior or am I compromised?

I'm running a personal WordPress server and I have 3 pending updates: WP update from 4.2.2 to 4.3.1. Akismet plugin update to 3.1.5 which addresses XSS issues. Twenty-fifteen theme update. For ...
1
vote
2answers
183 views

Questions about user authentication over REST API

I'm now trying to implement user authentication on my android app. I, however, have a few questions. I use a REST API. How do I safely request and send data to and from the phone? I'm assuming that I ...
1
vote
1answer
115 views

HMAC password reset link and replay attacks

I like the look of this technique for sending password reset links: https://neosmart.net/blog/2015/using-hmac-signatures-to-avoid-database-writes/ (TLDR: don't store token in database. Send password ...
1
vote
1answer
57 views

What is a viable time-frame for links that expire? [closed]

Links that expire can be found anywhere from Email Verification to Password Reset procedures, I understand in most cases this is considered "security theater", but wanted to know what a viable time-...