Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

73
votes
5answers
33k views

Is sending password to user email secure?

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?
1
vote
3answers
435 views

Logic for generating Strong Password?

I try to encrypt password using MD5 but there are decoders for MD5. So I'm worried about encryption of password for big website. Is there any logical suggestion or step function to generate strong ...
22
votes
2answers
5k views

Why are passwords limited to 16 characters?

What is the reason that most websites limit to 16 characters? I would have thought the longer the password the more difficult it makes it for someone to crack it? Is it something to do with hash ...
13
votes
3answers
3k views

Is it safe to generate passwords online?

I usually generate strong passwords using various online tools. Some time ago I mentioned it to a friend of mine and he was shocked that I do such dangerous thing. Is it really so unsafe to generate ...
23
votes
4answers
21k views

Possible to use both private key and password authentication for ssh login?

It seems that they are mutually exclusive, as disabling one gives me the other, and vice versa. Two-factor auth for my ssh servers sounds really nice, so is there any way to accomplish this?
5
votes
2answers
641 views

Can a HSM be used to make password hashing stronger?

Say a database server has a HSM which is in use for encrypting (reversibly of course) credit card numbers. Is there any way a HSM could be used to add strength to a password hashing scheme? (Or are ...
-2
votes
2answers
422 views

How to secure passwords when site is opensource [duplicate]

Possible Duplicate: How to securely hash passwords? How can I store passwords to have them secure? Right now the site use md5 md5, I was thinking about sha1+salt but if the source code for the ...
7
votes
3answers
4k views

How can I report PCI-DSS violations?

A large supermarket chain in the UK, are storing their passwords in plaintext. Apparently, Mastercard's security department are already involved. I'd like to report them for violating PCI-DSS, since ...
4
votes
4answers
567 views

Is there any explanation (other than storing plaintext) for case-insensitive passwords?

I've come across a few organisations stating that passwords are case-insensitive. Obviously this is ridiculous, and a gigantic red flag from a security point of view. Is there any explanation for why ...
83
votes
11answers
17k views

“Username and/or Password Invalid” - Why do websites show this kind of message instead of informing the user which one was wrong?

Lets say a user is logging into a typical site, entering their username and password, and they mistype one of their inputs. I have noticed that most, if not all, sites show the same message (something ...
4
votes
4answers
543 views

Is it secure to use similar password over different accounts?

I have a strong password which is a long, unfamiliar word phrase. I would like make other account use a password with similar level of complexity but I don't like to remember so many password over ...
33
votes
7answers
13k views

How can crackers reconstruct 200k salted password hashes so fast?

I'm researching for a small talk about websecurity and I found one article about the formspring hack, which made me curious. They claim to have used SHA-256 + salt We were able to immediately fix ...
8
votes
3answers
40k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
5
votes
7answers
2k views

What is the best way to securely keep clear passwords?

I'm working on a web project that will connect to a database. For that, I will have to store the login/password of that database user in clear (encrypted in a symmetrical way) in order to be able to ...
1
vote
2answers
432 views

Seeking advice on how to build a box to brute force hashes? [closed]

I work in a startup security firm, and I need to build a GPU-based to brute force password/hashes, which can be used to validate password strength and test hashing algorithms. I expect some high ...
1
vote
2answers
175 views

is it appropriate to set restrictions on a user's password? [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? Im developing a website and am curious as to the current trends in the nature of passwords. Is it good to ...
9
votes
4answers
797 views

How can we factor Moore's law into password cracking estimates?

How would we go about factoring Moore's law into exceedingly long password cracking estimates? Let's say we've got a 12 character password containing mixed-case alpha characters and numbers, i.e. a-z,...
2
votes
2answers
12k views

Excel 2007 Encryption Strength

With a strong password of 10+ characters, mixed case, etc... is the encryption of an Excel 2007 document secure enough to create reasonably strong defense against a brute force attack? What ...
6
votes
3answers
27k views

Windows 7 Password Hash Security

I recently came across a number of sources that suggest that cracking Windows user account passwords is easy by examining their password hashes. I understand that these hashes are stored in the SAM ...
3
votes
3answers
295 views

When changing a password, does it have to be completely different?

When changing a password how important is it to have a significantly different one? For example is it bad to reverse the sequencing of the old password to make a new one or change a few numbers?
5
votes
3answers
747 views

Trying to understand password hashing

I am trying to get a grasp of password hashing. Back in the days it seemed so simple, just MD5(password + salt) and you are done. Then md5 was proven to have collisions so people started moving to ...
2
votes
3answers
139 views

Clarification on an email about a security breach

I got the following email from a forum I was subscribed to: It is our duty to inform you that there has been a security breach on the server that Doom10 was being hosted on. It doesn't seem like ...
2
votes
4answers
545 views

If the attacker knows part of the password but not the length, does that help him in any way?

The idea behind this is that if knowing part of the password and not the length is useless, "passwords" can be easily stored in cleartext or paper since you would just add your own n characters ...
7
votes
3answers
18k views

How to crack password hashed using SSHA?

Is it possible to crack a password hashed using SSHA if I know the salt? How can I do it?
0
votes
0answers
244 views

What is the most secure way to recover password online? [duplicate]

Possible Duplicate: Can anyone provide references for implementing web application self password reset mechanisms properly? I have website which sends generated password to any person who ...
11
votes
6answers
36k views

Is howsecureismypassword.net safe to use?

Is it safe to enter my real passwords to test them? I mean, are the entered passwords being recorded/transmitted to someone else?
11
votes
3answers
1k views

Does the salt need to be unique or not predictable?

I always thought that salts is simply used to prevent rainbow tables to be used. Other have suggest they should be unique on a per account basis. Currently i have been using a config file to use as ...
15
votes
7answers
861 views

To salt, or not to salt? [duplicate]

Possible Duplicate: Why is using salt more secure? Why would salt not have prevented LinkedIn passwords from getting cracked? Recently I decided that I wanted to learn more about web ...
3
votes
4answers
1k views

How password hashing is useful in MITM attack?

Even though I read a lot about hashing and how passwords are protected, I am still confused about it. If passwords are hashed at client side, it will be useless because it can be sniffed and used by ...
295
votes
8answers
56k views

How to store salt?

Nowadays, if we expect to store user password securely, we need at least do the following thing $pwd=hash(hash($password) + salt) then store $pwd in your system instead of the real password. I have ...
0
votes
1answer
653 views

website hacked and all its content erased despite the protections

i was hacked by a guy who erased everything. I spent the day to put everything in order, and i would like to find a solution for this : he erased all the files, and also changed the title for "www" in ...
-2
votes
3answers
299 views

Password security : complexity and length [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? I've read that there is many solutions available to crack passwords. Reading these tips, I can understand ...
11
votes
5answers
4k views

Is it worth the effort to store FTP passwords encrypted?

I have a project to build a system that needs to push files to multiple third-party FTP servers. I have asked these third parties to provide a more secure interface; all have declined. So now I have ...
-1
votes
1answer
658 views

What encryption hash function I should use for password securing? [duplicate]

Possible Duplicate: How to securely hash passwords? What is the best encryption algorithm? MD5, SHA1, SHA2 or maybe something else? Can you explain me why?
8
votes
4answers
2k views

password complexity policy for non “English” passwords

In an internationalized application, what is the best practice for a policy on complexity of passwords? I am not having luck searching for the answer. Wikipedia lists these items for password policy:...
1
vote
3answers
307 views

Does this kind of hashing exist?

Let's say you have two user defined strings, X, Y and you want to hash them into the hash Z. That is what most websites would do, X is the user's password and Y is the salt. It takes a lot of time to ...
2
votes
3answers
871 views

Differences between brute forcing access versus decrypting password files or databases

I was just reading about how it's better to use bcrypt to protect passwords instead of saving password hashes in databases, and that got me thinking about other aspects that hackers work on that I had ...
-2
votes
5answers
542 views

Is this password hashing method secure?

I have made a custom hashing method to help make my users' passwords more secure if the database will be leaked. The encryption method is like this: A method takes an input of 1 character, gets the ...
3
votes
2answers
1k views

SASL Authentication Protocol with No Cleartext passwords

As you know, LDAP supports three authentication mechanisms: anonymous, simple and SASL. The first one is only suitable for particular cases, and therefore I'm not going to talk about that. The ...
7
votes
6answers
1k views

Storing password hashes without a correlation to the user account

I read an interesting article about an alternative way to store password hashes ans was rather intrigued. A better way to store password hashes? The primary concept is having a large table full of ...
11
votes
4answers
717 views

How should I tell an organisation that they are vulnerable when I wasn't given permission to check?

I was recently at a village hall (in the UK), some distance from where I live, for a party. I noticed that they had unsecured wi-fi with an SSID of NETGEAR. I assumed it was free wi-fi for users of ...
7
votes
3answers
514 views

Is it advisable to have a web browser remember login credentials?

I have a really long random password for my cellphone account and have it written down in a safe place. I only use it once a month and am considering having my browser remember it. Would there be any ...
3
votes
2answers
465 views

Is the password hash better when you concatenate the password and username?

Is the password hash (with bcrypt) better when You concatenate the username with password? For example: $this->hash($username . $password); and $this->hash($password); Last time I used ...
0
votes
2answers
2k views

Long Passwords: How are they more secure? [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? How are long passwords more secure? The only situation in which I can accept long passwords are more ...
30
votes
5answers
5k views

Is it common practice to log rejected passwords?

While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
1
vote
4answers
527 views

Are there vunerabilities with this authentication mechanism?

I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL. The goal here is to avoid sending any sensitive information across the wire. I was ...
1
vote
2answers
545 views

Hash, encryption of file… key? Need help [closed]

So my previous question was with some help on pcap files as I am doing a security course and we have a challenge to figure out what was going on in our network. Now one of the files I retrieved is an ...
16
votes
3answers
7k views

Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password?

Given an option , which one should I choose , a HMAC for storing a password securely or a bcrypt or scrypt library?
3
votes
3answers
2k views

Recompute Rainbow table with salt?

So, as I understand it, you prepend a password with salt before you hash it so that the resulting hash can't be used with a rainbow table to find the original password, as you could if the password ...
-4
votes
7answers
2k views

Are passwords made up from concatenating a few foreign words better than shorter random characters? [duplicate]

Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example: "pussiMeansCatInEskimo" "caballoMeansHorse" "CatIsGatto" "SalopeMeansBitch" "...