Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

2
votes
1answer
211 views

IKEv2 in remote access scenarios

Can someone explain why, in remote access scenarios, IKEv2 EAP password-based user auth combined with IKEv2 PUBKEY gateway auth is preferable over mixed IKEv2 PSK/PUBKEY auth using the same password ...
5
votes
2answers
7k views

Is it safe to store password in PHP session?

I need to do some encryptions in the private zone of my website and I want to bcrypt the user's password. Is it safe to store the password in the session when user does the login, so that I can use ...
4
votes
2answers
491 views

From password to key

Can you explain this passage from Wikipedia? When a password (or passphrase) is used as an encryption key, well-designed cryptosystems first run it through a key derivation function which adds a ...
2
votes
2answers
163 views

Bad planning causing weak passwords

The athletic department at my university has a facebook page and on it they said "the first 500 people to register for this event will get free t-shirts". When registering one has to create an account ...
7
votes
4answers
3k views

Password Vault - Enterprise

I want to be clear from the get-go that I am NOT looking for a user password management solution. My organization already uses AD for that. What I am looking for is a password vault. Up until now, ...
3
votes
1answer
1k views

Why do some large companies still store passwords in plain text/decrypt-able format? [closed]

In the last couple of weeks I've come across two fairly large companies who seem to not have stringent password security: Tesco - they store passwords in an "encrypted" format, yet they can decrypt ...
5
votes
3answers
402 views

What steps can you take to make offline cracking of SRP harder?

In the aftermath of the Blizzard hack, what steps can I take to make offline cracking of SRP more difficult? My question assumes that your database is already gone and that you implemented SRP more ...
4
votes
4answers
2k views

SMS Authentication: random OTP or a cryptographic one

I'm adding two-factor authentication using SMS to enhance an existing login process. Since I'm not working with physical tokens, I was wondering what is considered the safest: Sending random 8 ...
6
votes
6answers
4k views

Does having a minimum number of digits improve password security?

Some password systems will enforce at least X of a type of character - a common one I see is 'minimum 3 numeric characters'. As far as I understand, simply allowing certain character classes, like ...
12
votes
4answers
7k views

HTTP Basic auth password storage more secure than Digest auth

If you are using SSL already, it appears Basic auth is the way to go since you can perform bcrypt with the password when you store it in the database, where as Digest auth only allows md5. As we know, ...
0
votes
1answer
206 views

How can I prevent my son accessing my PC? [duplicate]

Possible Duplicate: How can I prevent my kids from bypassing my computer restrictions based on Windows Vista? My 14 year-old son is using a Ctrl+Alt+Del procedure to get into my computer even ...
14
votes
5answers
8k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
22
votes
4answers
9k views

Google Account: implications of using application-specific passwords

In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google ...
1
vote
3answers
376 views

For what do I hash user passwords with PDKDF2 when the user data is stored in the same database?

I'm hashing the passwors of my users with PDKDF2 right now. A user can gain access to his account with his password. When the user is logged in he can edit his personal information and do other stuff ...
11
votes
4answers
2k views

How secure is the SRP that Blizzard uses to protect passwords?

Blizzard very recently announced that their network was compromised, but they assure users in their statement that the password information that the attackers had access to was saved in a secure way: ...
2
votes
6answers
765 views

Why does the password field not show the entered text?

Why does the password field not show the entered text? When we enter password it shows ... or '*'. What are the security advantages of this?
8
votes
2answers
973 views

Replacement for One Time Passwords (OTP)

OTP may known as new generation of password security techniques, but I want to know does it still safe enough after several years of appearance or it will deprecate soon? & what would be the ...
4
votes
3answers
678 views

How can I determine whether a website somehow protects against brute force attacks on my password? (assume I can't create an anonymous account)

After the hack of Mat Honan I studied my own laundry list of accounts I have at the numerous web sites I use. There is one fact that stands out: Many of the websites severely restrict the size and ...
8
votes
8answers
2k views

Does truncating the cryptographic hash make it impossible to crack?

I store password hashes in their full value for example, $h = sha256('foo') outputs 64 characters: 2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae I store that directly in the ...
8
votes
4answers
1k views

Is storing answers to security questions in plain text bad form?

If the input for the security question is completely digital, should the answer to a security question be hashed (or at least encrypted) on the authentication server?
20
votes
4answers
11k views

Password resets - what practices should web services follow?

Many of you may have seen How Apple and Amazon Security Flaws Led to My Epic Hacking, where a Wired reporter's Amazon, Apple, Gmail, and Twitter accounts were successfully hacked. The hacker followed ...
4
votes
4answers
1k views

Can public keys be a security risk when performing password-less SSH logins?

Some companies use monitoring software such as nagios or icinga. In order to perform checks on the servers, they often need password-less SSH logins. The servers being checked put the public key of ...
3
votes
3answers
11k views

Sample challenge questions for use with self service password reset and validation

I'm building a secure password recovery feature similar to the one described here. During the final phase of the password recovery, the user is asked a recovery question to verify their identity. ...
1
vote
1answer
630 views

Securely tell the user his password in new WHM/Cpanel account creation?

I understand it's not safe to send passwords via email but when accounts are created via WHM/Cpanel, I have to let the user know what password I created for them. How can I relay the password safely?
10
votes
2answers
1k views

Is there more to password hashing?

You have a plain text password and salt. The plain text password is assumed to be securely random and only known by the user and the salt is no secret and not necessarily unique but stored alongside ...
2
votes
1answer
678 views

How can passwords be stolen from Yahoo?

I always understood that servers don't actually store user passwords. Instead, they store hashes of passwords and then they validate the user input by applying the hash function, then compare the ...
5
votes
3answers
449 views

Are there any regulations against financial companies storing passwords in plaintext?

A bank that I use stores my password in cleartext or perhaps using reverisible encryption, which is just as bad. I know this because when you click "Forgot your password?" (or similar) link, it ...
14
votes
2answers
8k views

With PBKDF2, what is an optimal Hash size in bytes? What about the size of the salt?

When creating a hash with PBKDF2, it allows the developer to choose the size of the hash. Is longer always better? Also, what about the size of the random salt? Should that be the same size as the ...
75
votes
5answers
34k views

Is sending password to user email secure?

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?
1
vote
3answers
438 views

Logic for generating Strong Password?

I try to encrypt password using MD5 but there are decoders for MD5. So I'm worried about encryption of password for big website. Is there any logical suggestion or step function to generate strong ...
22
votes
2answers
5k views

Why are passwords limited to 16 characters?

What is the reason that most websites limit to 16 characters? I would have thought the longer the password the more difficult it makes it for someone to crack it? Is it something to do with hash ...
13
votes
3answers
3k views

Is it safe to generate passwords online?

I usually generate strong passwords using various online tools. Some time ago I mentioned it to a friend of mine and he was shocked that I do such dangerous thing. Is it really so unsafe to generate ...
26
votes
4answers
21k views

Possible to use both private key and password authentication for ssh login?

It seems that they are mutually exclusive, as disabling one gives me the other, and vice versa. Two-factor auth for my ssh servers sounds really nice, so is there any way to accomplish this?
5
votes
2answers
654 views

Can a HSM be used to make password hashing stronger?

Say a database server has a HSM which is in use for encrypting (reversibly of course) credit card numbers. Is there any way a HSM could be used to add strength to a password hashing scheme? (Or are ...
-2
votes
2answers
423 views

How to secure passwords when site is opensource [duplicate]

Possible Duplicate: How to securely hash passwords? How can I store passwords to have them secure? Right now the site use md5 md5, I was thinking about sha1+salt but if the source code for the ...
7
votes
3answers
4k views

How can I report PCI-DSS violations?

A large supermarket chain in the UK, are storing their passwords in plaintext. Apparently, Mastercard's security department are already involved. I'd like to report them for violating PCI-DSS, since ...
4
votes
4answers
568 views

Is there any explanation (other than storing plaintext) for case-insensitive passwords?

I've come across a few organisations stating that passwords are case-insensitive. Obviously this is ridiculous, and a gigantic red flag from a security point of view. Is there any explanation for why ...
84
votes
11answers
18k views

“Username and/or Password Invalid” - Why do websites show this kind of message instead of informing the user which one was wrong?

Lets say a user is logging into a typical site, entering their username and password, and they mistype one of their inputs. I have noticed that most, if not all, sites show the same message (something ...
4
votes
4answers
555 views

Is it secure to use similar password over different accounts?

I have a strong password which is a long, unfamiliar word phrase. I would like make other account use a password with similar level of complexity but I don't like to remember so many password over ...
33
votes
7answers
13k views

How can crackers reconstruct 200k salted password hashes so fast?

I'm researching for a small talk about websecurity and I found one article about the formspring hack, which made me curious. They claim to have used SHA-256 + salt We were able to immediately fix ...
8
votes
3answers
41k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
5
votes
7answers
3k views

What is the best way to securely keep clear passwords?

I'm working on a web project that will connect to a database. For that, I will have to store the login/password of that database user in clear (encrypted in a symmetrical way) in order to be able to ...
1
vote
2answers
434 views

Seeking advice on how to build a box to brute force hashes? [closed]

I work in a startup security firm, and I need to build a GPU-based to brute force password/hashes, which can be used to validate password strength and test hashing algorithms. I expect some high ...
1
vote
2answers
177 views

is it appropriate to set restrictions on a user's password? [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? Im developing a website and am curious as to the current trends in the nature of passwords. Is it good to ...
9
votes
4answers
800 views

How can we factor Moore's law into password cracking estimates?

How would we go about factoring Moore's law into exceedingly long password cracking estimates? Let's say we've got a 12 character password containing mixed-case alpha characters and numbers, i.e. a-z,...
2
votes
2answers
13k views

Excel 2007 Encryption Strength

With a strong password of 10+ characters, mixed case, etc... is the encryption of an Excel 2007 document secure enough to create reasonably strong defense against a brute force attack? What ...
6
votes
3answers
27k views

Windows 7 Password Hash Security

I recently came across a number of sources that suggest that cracking Windows user account passwords is easy by examining their password hashes. I understand that these hashes are stored in the SAM ...
3
votes
3answers
300 views

When changing a password, does it have to be completely different?

When changing a password how important is it to have a significantly different one? For example is it bad to reverse the sequencing of the old password to make a new one or change a few numbers?
5
votes
3answers
749 views

Trying to understand password hashing

I am trying to get a grasp of password hashing. Back in the days it seemed so simple, just MD5(password + salt) and you are done. Then md5 was proven to have collisions so people started moving to ...
2
votes
3answers
140 views

Clarification on an email about a security breach

I got the following email from a forum I was subscribed to: It is our duty to inform you that there has been a security breach on the server that Doom10 was being hosted on. It doesn't seem like ...