Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
1answer
79 views

Could there be any implementations where the pw is truncated after “space”

A good human memorable password could be: My 1st passw%%%%%!!!!!rd But could there be any password storing implementations that cut off the password after the first space, so the password will be ...
0
votes
1answer
89 views

LastPass website requests Master Password when creating the account

When I wanted to tryout out LastPass today, I was stunned that the webpage form for creating the account at LastPass actually requested the "Master Password", which is the same "Master Password" that ...
0
votes
2answers
63 views

Is authenticating via the database secure

Sorry for this probably noobish question. So far, I've read password comparison/verification is implicitly understood to be made on the application layer and not in the database. For example in PHP, ...
0
votes
1answer
236 views

Things to remember while building a password manager [closed]

I want to build a simple password manager for desktop whose sole purpose is to store the passwords that can be read by the user as and when required. I am not considering any fancy features such as ...
0
votes
4answers
413 views

Password Hashing Without a Unique Salt

I have a question about password hashing. This is not a question about the the BEST POSSIBLE method of hashing passwords, but rather a more utilitarian question about what is sufficient to hash a ...
0
votes
1answer
3k views

About password_hash() in PHP and storing (part of) its salt outside DB

So, i learned that new in PHP 5.5 is password-hash() which works much like crypt(). Which is more secure (slower) than md5() or sha1(). The result string is algo+hash+salt, which can be passed as-is ...
0
votes
1answer
93 views

A fake phone tech changed my start up password. [closed]

I was duped into believing a phone caller was a computer tech. I allowed him remote access and when I refused to pay a fee at the end of all his changes he hung up. My start up now has an unknown ...
0
votes
2answers
175 views

Using the same base string for a password in several different logins [duplicate]

It is clear to me that using the same password for different websites is a bad idea because if an attacker manages to get a hold of your password, then he can gain access to the other websites in ...
0
votes
2answers
234 views

How to retrieve the admin's password of a webapp?

I'm doing a pentesting example on a web app and I have dumped all the database. I have a table with the users in plaintext and the passwords hashed. I have to find the admin's password (I know that ...
0
votes
1answer
324 views

Password protection of encryption and signature keys

I would like to store encrypted backup of text files on my computer. I'm developing a python script using Pycrypto to achieve that, based on this code to use the library. (current code) The basic ...
0
votes
3answers
120 views

Best way to securely send passwords from an application to a user operated server

I have the following situation: A user sets up a server that will have to receive login details. Other users then create accounts and login to this server. All this happens only over LAN. I'm ...
0
votes
3answers
86 views

Is using my phone number as a pin for a phone a security risk?

I just did a factory reset on my smartphone to see if it might fix issues with battery life. I configured a phone number as the lock screen code so I have a code that's both long and easy to remember. ...
0
votes
1answer
324 views

When bruteforcing a WiFi network password, Can that admin see it?

When bruteforcing a captured packet containing the encrypted password, can the owner/admin of the router see each auth attempt? I'm assuming you just encrypt each passphrase in the dictionary file and ...
0
votes
1answer
115 views

Starting a new job after working at home for years. How to best protect data, secrets, and privacy in the workplace?

I have just started interviewing for new computer job after years of working from home. At home I feel very secure with how I protect myself from data loss and keeping my secrets secure. I backup ...
0
votes
1answer
291 views

What multiplier to use when calculating the average time to crack passwords with a given entropy?

Suppose that we have a process that generates passwords with entropy E. I'd like to compute the average time it would take for a brute-force attack to crack an MD5-hashed instance of such a password. ...
0
votes
1answer
69 views

How does LM hash deal with passwords that are between 8 and 13 chars

If its 14 then it splits it to 7&7, but how about 13 characters? 7&6? How does it work?
0
votes
2answers
2k views

Why store the password salt instead of generating it? [duplicate]

So, reading through this article: http://crackstation.net/hashing-security.htm it says that storing the salt is fine in plain text because it renders the lookup/rainbow tables ineffective. I get that, ...
0
votes
3answers
2k views

How to effectively save database password inside desktop application?

Suppose we are in the field of desktop applications which need to store their data in a database. How do I store the password for this database avoiding the most obvious mistakes, which are: 1) hard ...
0
votes
1answer
49 views

Software activation “by phone” [closed]

I'm a software developer, and I would like to protect my application in an offline way, like many software do activating by phone. Following a screenshot taken from google images on what I would like ...
0
votes
2answers
127 views

How can a weak root password be compromised?

I use ubuntu for personal computing. I've read an advice in many questions here to have a strong root password. I don't understand what's wrong with a weak root password. After all we have to type ...
0
votes
1answer
163 views

Saving username and pasword inside SQL

I am currently managing a network of around 100 PCs. Many users have different mails/usernames and passwords for different services like login to PC, mail, local applications, ... When an application ...
0
votes
2answers
62 views

Full Disk Encryption, Single User System: User/Root Passwords required?

Are there any security issues of having no (or weak) passwords for user and root account on a single user system with full disk encryption (except boot partition)? Assuming no SSH server is running, ...
0
votes
2answers
100 views

Need some docs that say we shouldn't upper the string when saving it as a password [closed]

I'm trying to find on the Internet some manual, guide or policy secure about applications should not convert lower string to upper string to store as password I mean, don't make ...
0
votes
2answers
378 views

Hashing request - What type of hash this?

I have a text which is hashed using several layers of hashing. The final hash looks like 2E55A1DD65AB839E62362DEF86D329D7. What type of hashing can it be? How can I find out what kind of hash sum I do ...
0
votes
3answers
176 views

Can you have Secure encryption with a backdoor, and still be secure?

Is it possible to have an encryption algorithm/implementation that has a "backdoor", that also wouldn't introduce flaws into the encryption? For instance, if you have a master password, once that ...
0
votes
1answer
97 views

which password was paired with my gmail address

Recently media have reported that a file of about 5 million gmail address and password pairs was published on a Russian Bitcoin forum. A media article on the leak Other media have reported that the ...
0
votes
2answers
152 views

Simplest way of hashing a password with multiple different hash algorithms [closed]

I have a list of plaintext passwords that I would like to hash with various different hash algorithms (for educational purposes). As a minimum I would like to obtain hashes under MD5, SHA1, SHA256, ...
0
votes
1answer
94 views

Is there an anti virus that protects processes from being injected code to?

As title says, is there an av that does that? And if not, is there any other program that protects processes like lsass in windows, apart from protected process utility in win8.1?
0
votes
2answers
8k views

Hydra https-form-post [closed]

I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives. This is what I have done so ...
0
votes
1answer
607 views

How could be my skype password stolen? [closed]

My skype password was recently changed. I've changed it back and found it in the internet on hacker's site. My password is pc-generated, like as2fZ12v. How did they manage to hack it, if I've never ...
0
votes
2answers
116 views

How do you overcome the problem of the salt being public and known by the attacker? [duplicate]

I believe that when adding a salt to the password you need to store the values so you can compute the hash again. But, what does happen if the attacker get the salt? How is it possible to add value ...
0
votes
4answers
1k views

Is it bad practice to use the same password on different sites?

Is it considered bad practice to use the same password on separate sites, if so why? Even if the passwords to a site are compromised the attacker still doesn't know the user names or sites the same ...
0
votes
1answer
672 views

Does password “strength” matter anymore? [duplicate]

In the early days we happily saved whatever password a person wanted to the database. Later we decided that passwords must include certain characteristics like numbers, upper and lower case and ...
0
votes
1answer
126 views

Banking platform accepts password containing subset of real password [duplicate]

How would it be possible that if my password was 123abc that my bank also accepts something like 123abc12? Isn't that an extreme security flaw? If the password was hashed and salted, wouldn't the ...
0
votes
3answers
135 views

Best way to store passwords for a LAN tool?

I am making an app in Python for linux as a front end to the router (to automate some tasks). But I need to log in to the router before I can do any operations on it and since it uses a http-auth I ...
0
votes
1answer
737 views

How long would it take to brute force the AES encryption?

I'm trying to write a secure code that can keep my site users passwords as safe as possible. Now I'm fairly new to encryption and would like some professional opinions and suggestions. As well as a ...
0
votes
1answer
448 views

How to encrypt files without giving the user access? [duplicate]

I don't know if I should ask this question on security.SE or stackoverflow, so please move my post if necessary. I want to store my (C#) application data in a way that the user cannot read or modify ...
0
votes
3answers
3k views

Is it possible to change the wifi password with a script?

I was wondering if it is possible to change the password for a wifi with a script instead of having to log-in to the routers firmware?
0
votes
3answers
127 views

Lowest possible threshold for smartphone app login

I am developing an iPhone/Android game app. Currently users must register USERNAME (3 chars min, letters only) + PASSWORD (8 chars min, ascii only) before allowed into the game. Testing shows some ...
0
votes
1answer
77 views

How to manage all the unlock codes for thousands of mobile devices (iPads)?

I need to manage (assign, store, notify, etc.) the unlock code for thousands of mobile devices (iPads). How to manage optimally this unlock code? Maintenance users should be able to access the unlock ...
0
votes
1answer
44 views

Two reset password tokens used for the same reset password flow

I've a question regarding a forgotten password flow. Basically I'm sending the password reset token out-of-band to the user, and then the user sends it back with the first request via querystring, I ...
0
votes
2answers
51 views

Is it insecure to temporarily save user's data in a session while they register?

My plan is to save the registration, as they go along so if they close the page by accident they will still have all of there information saved so they can continue it again. But my question is it ...
0
votes
2answers
142 views

How to check an open source product for password handling quality?

I just created an account on Magento Commerce, which is an online shop solution. During account creation, I entered a password. Personally I prefer longer, generated passwords that do not contain ...
0
votes
2answers
98 views

How much more secure would using alt codes in a password make it? [duplicate]

My friend and I were talking about how fast computers could potentially brute force a password these days. I came up with the idea of using letters from a foreign alphabet to use in your password, ...
0
votes
1answer
96 views

Ignoring collision and (second) pre-image resistance, what makes a cryptographic hash function strong?

With regards to resistance against dictionary and brute-force attacks to "crack" hashes containing passwords, what determines the resistance of a cryptographic hash function? Since collision ...
0
votes
2answers
119 views

Store password in Public Domain using files and md5sum

Whenever I check integrity of a file using md5sum, I get a string of alphanumeric characters to compare and verify if it was downloaded correctly. Couldn't the concatenation of several of those ...
0
votes
1answer
41 views

Is there any problem using empty salts with PBDKF for this purpose?

The aim is to generate a secure key for symmetric encryption. I have a master password, from which I want to generate the key for symmetric encryption, in order to encrypt other passwords. The idea ...
0
votes
1answer
59 views

Use PIN or Password [duplicate]

Which one is better, using PIN or password ? I want my app using PIN number to user login and register. Does not matter if I use PIN number only for user login and registration in my web application ? ...
0
votes
2answers
125 views

Several hashing routines support client side work. Doesn't the hash just become a password equivalent?

Isnt Secure Remote Password Protocol (SRP) pretty much client side hashing? Argon2 the winner of the PHC also allows for client side hashing. How do these systems avoid the plaintext equivalence ...
0
votes
2answers
89 views

Random characters and letters form obsfuscation

I know that this question has been asked many times, but would JavaScript encryption work if I just added 100 random numbers and letters to the password? That would be hard to reverse engineer, ...