Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

16
votes
3answers
754 views

Is it OK to tell your password to an admin? [duplicate]

Possible Duplicate: From a security point : Is it OK to tell your password to an admin? I am working in a small company (20 employees) as a senior SW engineer. After having some email ...
5
votes
2answers
7k views

Can DES-based hashed password be recovered if salt is known?

Can a hashed password be recovered if the hashing is done with DES based crypt function in PHP and both the hash and salt are known by the attacker? Consider the following example: $salt = 'mysalt'; ...
14
votes
2answers
1k views

Salting password with the first 8 bit of the password itself

Do you guys think salting password with the first 8 bit of the password itself will have same result as using stored salt to hash password? [Clarification] I am not storing salt but creating from the ...
8
votes
4answers
2k views

How to protect ftp account information in the source code of a program

I wrote a game which stores high score information on an ftp server. In the the source code I need to write out the ftp link with the account name and password in it. For example: url = new ...
3
votes
1answer
2k views

Will using unicode chars in my password increase security? [duplicate]

Possible Duplicate: Do non-keyboard characters make my password less susceptible to brute forcing? Bruteforce tries cracking the hash with every possible combination of letters. Then, If ...
7
votes
3answers
305 views

Should I restrict access to the username and passwords in a web app?

I'm starting to write my first serious web application and am thinking about how to store username and password information. There are plenty of articles detailing how storing plain text passwords is ...
11
votes
2answers
417 views

What problems does this “recover account” procedure have?

On a website I run I have implemented this procedure for account recovery (forgotten password procedure). I would like to know whether there are any issues with it that I have not spotted, that make ...
3
votes
0answers
201 views

Checking whether a password is derived from previous passwords [duplicate]

Possible Duplicate: How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext? On a system I used several years ...
18
votes
6answers
1k views

Appropriate password requirements for a login (OpenID) service/provider/delegate/thing

This is with regards* to Stack Exchange's upcoming OpenID provider (and in particular, discussion about password requirements). Currently, password requirements are: Must contain 3 of: lower case ...
8
votes
3answers
2k views

How does LastPass' grid multi-factor authentication work behind the scenes?

I understand how to use the Grid multi-factor authentication as a user but how does it work technically? Specifically how can just a few letters from the grid be enough to decrypt any secret defined ...
4
votes
2answers
2k views

Cisco IOS question - password management, service password encryption types

I'm university student studying for my certification exam, and I was doing some reviewing today when I found a question that I can't find an answer to. Basically, in the CCNA3 2.4.1 Cisco Netacademy ...
10
votes
5answers
2k views

Is Skype secure enough to transmit passwords?

Is it considered "secure" to send a password in a skype message and delete the message after the recipient remembered the password?
8
votes
6answers
8k views

One Time Passwords. Using OTP at Windows, Ubuntu and internet sites

my question is this: Is there a way (software,hardware/token or web-ware) to use One Time Passwords in the following scenarios: Logon to my pc/laptop (windows or ubuntu) Logon to sites with OTP ...
5
votes
2answers
3k views

Reference implementation of C# password hashing and verification

Does anyone have a reference implementation (ideally 3rd party certified, or government approved) way one-way hash a password for C# and or Java? Ideally,I'd like to see something that includes a ...
3
votes
2answers
554 views

BlackBerry client authenticating to Java Web Service

I already asked this question at StackOverflow here: http://stackoverflow.com/questions/4970681/blackberry-app-security and was directed to this site, can anyone pitch in as to how I can solve this ...
9
votes
6answers
425 views

How can I ensure that default passwords are no longer in use?

There are two situations in which 'default' passwords get used on a network: A new user is registered. In her registration pack, along with her new username, e-mail address and so on is her initial ...
3
votes
1answer
1k views

Does the Ophcrack LiveCD require hash collection via programs like pwdump?

When I used the Ophcrack LiveCD recently, the program automatically ran without me manually loading any hashes. Question is: If Ophcrack does not automatically find hashes, how can I go about ...
15
votes
7answers
357 views

Is a “security measure” that doesn't provide a security benefit actually harmful?

If a security measure is implemented that doesn't provide any additional security benefit, can it be considered harmful? As an example, consider a login page where the user is asked to enter their ...
4
votes
6answers
991 views

What are the weaknesses of this password-generation-method? How can it be improved?

I recently came up with the problem, that I have much more accounts, than I'm able to remember passwords. I don't want to use a password-safe, because I cannot access it on another computer, I lose ...
6
votes
2answers
1k views

Storing third-party auth info securely

Suppose there's a multi-user web application that requires access to user's mailbox (on third-party service, like gmail, etc.). This access needs to be persistent. Which means we'd have to store user ...