Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
2answers
41 views

Is there any added security/vulnerabilities if you allow a “trusted-party” to vouch you are legit, if you were locked out of your account?

I was reading this answer on a question. http://security.stackexchange.com/a/498/106817 Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at ...
0
votes
1answer
257 views

How long will it take to break a salted password?

Let's say that I have a system where all passwords must be 8 characters long and each character can be any 32 different values. All my passwords are hashed with a salt. I can test 64 passwords per ...
0
votes
1answer
101 views

How to conceal a computer in operation with a separate logon password? [on hold]

Goal: Disallow people physically near the computer to see its operations. No password to start the computer. But, I'd like to conceal the screen after startup and all programs loaded. Because of the ...
0
votes
2answers
109 views

Password based Asymmetric Key generation

I am looking for a password based key derivation scheme that results in an asymmetric key pair. I have worked with PBKDF and its variants but could not come up with any way of generating a key pair. I ...
0
votes
1answer
76 views

Can anyone help me build a combo file suitable for my problem? [closed]

I have a router model C1000A company: CenturyLink Actiontec I bought it through eBay, my problem is that I can not connect to the Settings page because I do not have the admin password (the password ...
0
votes
1answer
60 views

Securing HSM's Login Keys

I have an PKCS#11 enabled application which interacts with HSM to store TDES keys. The HSM is initialized with the Security Officer (SO) password provided by the user while the application was first ...
0
votes
1answer
112 views

Why does healthcare.gov exclude some special characters from passwords?

The site does not allow the following characters: = ?<> ( ) ‘ " / \ & It also limits maximum password length to 20 characters. This makes me suspicious that they might be being stored in ...
0
votes
1answer
1k views

How to avoid storing plaintext during CHAP authentication

When using CHAP authentication, passwords are stored in plaintext, then I used reversible encryption to store password. However, I recently found Citrix states " storing passwords using reversible ...
0
votes
3answers
184 views

securely storing passwords that can be retrieved

I'm trying to build a web application that can store passwords of other services like Facebook, Gmail ...etc. These passwords can be later retrieved and shown to the user. This has to be a web ...
0
votes
2answers
117 views

How much stronger does a paragraph/sentence based password becomes with random characters added?

I was reading some questions on here regarding the correct horse battery staple method, and the conclusion was that, assuming any words in the list of most common English words, every word adds about ...
0
votes
1answer
278 views

Why enter again (or at the very least confirm) my email address when I click “Forgot password”?

In most, if not all, web forms for logging into a site, you have your forgot password link. When clicking the link, you get a new form (usually in a new page) either empty (!) or prefilled with the ...
0
votes
1answer
122 views

Prevent brute force attacks on web publishing logins

Presumably, if someone tries to brute force into your website's control panel at your web host's site - they will be throttled/locked-out etc. But what about the web publishing logins (Web-Deploy, ...
0
votes
2answers
194 views

Saving passwords in database

I have recently been studying a lot on writing secure code and choosing secure methods for saving passwords to a database. I'm wondering if it's secure to use ready made libraries or APIs to do this ...
0
votes
1answer
76 views

Old phone as secure credential storage device

Can an old android phone (with sim card removed) be securely used as an OFFLINE storage device for password, user id's and acct numbers?
0
votes
1answer
125 views

QR-code based credential retrieval?

This is a sort of design review question that I'm hoping is suitable for this site. I am designing a system that uses a cloud service to establish a secure connection between a PC and a mobile device....
0
votes
1answer
125 views

What is the safest way to encrypt a password that can be decrypted at a later time?

In a web app I'm building, I need to use Apple's AutoIngestion tool for iTunes Connect. In this tool it seems the only way to use it is to send a password in plain text. What would be the best ...
0
votes
1answer
70 views

MD5 before PBKDF2 on legacy software

I am mantaining a legacy software that uses MD5 in the following way: The client asks for a 16 byte salt when authenticating an account. The server generates a 16 byte salt, links it to the account ...
0
votes
3answers
196 views

When to set security questions for a web application?

For enhanced security, we can use security questions and use them as a means for users to reset forgotten passwords or as an additional means for authenticating. When would we be the right time to ...
0
votes
1answer
184 views

Can I get rid of storing user secrets by using OpenID, and what do I need to store?

What information do you have to keep about a user to be an OpenID consumer? I want to use OpenID to let users register and authenticate on my system. So while I'm at it I want to not duplicate ...
0
votes
1answer
2k views

How to use multiple charsets in hashcat

I wanted to use a brute force attack on hashcat but WPA/WPA2 networks are 8-64 characters long and they have multiple possibilities of a password. I was wondering if there was a way to use multiple ...
0
votes
1answer
223 views

How to store passwords to a remote web site?

Say I want to build a public API to access a website that doesn't have one. The website is protected by a standard username/password scheme and the API implementation will use scraping to get the data ...
0
votes
1answer
63 views

Securely map random string to a custom charset

I'm writing a Python script to generate custom passwords based on a HMAC. I want the passwords to support various websites requirements so I want to map the HMAC output (ex: hex format) to an array of ...
0
votes
1answer
88 views

Predicting the Entropy of the entire Password Database

Suppose that the passwords created under some specific composition rule "C" is to be tested for the security. One of the way could be to conduct survey on x number of people and measure the average ...
0
votes
3answers
440 views

Are windows users passwords easier to crack than linux?

If i set the same password in both linux and Windows, is it easier for a hacker to break the windows password? If so why and how can i create a windows password in the same security level as Linux?
0
votes
1answer
124 views

Encrypting the salt with password [duplicate]

Salts are stored in the plain text and readily available with the hashed passwords if the password database is compromised. What if we encrypt the salt using password itself? Doesn't it make offline ...
0
votes
3answers
564 views

How secure are sentence passwords? [duplicate]

Lately I've been doing the trend of using passwords that are sentences, at least on sites that have a reasonable maximum character length and allow spaces. So for example the most basic variation is '...
0
votes
1answer
915 views

THC Hydra 16 Valid Passwords? [duplicate]

So when i do hydra -l Admin -P "rockyou.txt" -s 80 192.168.13.1 http-get / it doesnt work for me, it says all 16 passwords are valid, but none of them works, can anyone help me with this? I tried ...
0
votes
3answers
4k views

How important it is to change password regularly? [duplicate]

A WWW-site guided me to change the password regularly. Should I believe what the say, if my current password is long enough random string?
0
votes
2answers
127 views

Share passwords between developers [duplicate]

We have a project with 3 remote developers and myself, at the moment passwords (server logins, db passwords etc) are being shared via emails which are cc'ed to everyone, Is there a normal workflow ...
0
votes
2answers
234 views

How to combine a key and a password in practice

Alice wants to encrypt her data. She is not comfortable with using only a password. While she prefers to use a properly random crypto key, she isn't confident she can protect the key file from theft ...
0
votes
3answers
293 views

User Account Guessing [duplicate]

I'm doing some research on user account guessing, and wanted to ask a question about some "bad practices". My thought is generally this is a trade-off between great user functionality/UX and security....
0
votes
1answer
1k views

security in banking app with 4 digit pin code and social security number

The new banking app (for norwegian bank Gjensidige bank) for my android handset allows me to log in using only my social security number, and a 4 digit pin code. The social security number in norway ...
0
votes
2answers
101 views

Do dictionary attacks only use specific entries from a dictionary, or combinations of an entry?

If I wanted to crack a password, "cba", but the dictionary I was using only had abc in it, does a dictionary attack try all combinations of abc? abc, acb, bca, bac, cba, cab Or would cba have to be ...
0
votes
2answers
108 views

In addition to using strong hash algorithms, what is a good “password requirement”? [duplicate]

Assuming the use of bcrypt/scrypt: Would it be a good idea to "require" a password of at least 12 characters, also mentioning the possibility of using long passphrases, instead of your typical 8-...
0
votes
2answers
225 views

how long do lowercase alphabets-only passwords have to be to match more complex ones? [duplicate]

Lowercase-only passwords are convenient for phones since we dont hit shift or go to characters page(each which is as much effort as hitting a character in my Android devices). But how long would a ...
0
votes
1answer
143 views

How can I tell if my ISP account password is encrypted?

How can I be sure my ISP encrypts my account password? I found out accidentally that mine did not. I had called to report an interruption in service, and in the process of "troubleshooting", the ...
0
votes
1answer
475 views

Is there a FIPS 181 like standard for random password generation with alphanumerical seed?

NIST recommends FIPS 181 as a random password generator for "easy to remember" passwords. As far as I understand the standard: it will generate a password that is lowercase, and with some ...
0
votes
1answer
289 views

How compromised should I assume my computer is?

I had turned ssh on a while ago to do some remote work. I was just looking over some netstat info when I noticed someone had established an ssh session with me D: I turned ssh off immediately and ...
0
votes
1answer
332 views

Multi user symmetric key encryption

I realize SIMILAR questions have been asked before but I'm looking for certain specifics I can't seem to find elsewhere. The following question closely resembles mine but falls short for me on details:...
0
votes
1answer
78 views

Is it safe to use the Keccak Algorithm to create the Key for a Serpent cipher?

I like to store some configuration but would encrypt them with the Serpent cipher. Is it safe to do this? When not, what is a better solution?
0
votes
1answer
197 views

What are the implications of an overly-restrictive password policy? [duplicate]

I came across an interesting password policy online recently: "Please be sure to enter a password that meets the following criteria: must be 8 characters long must not be based on dictionary words ...
0
votes
1answer
117 views

Handling passwords in wicket

I have a form which contains a password field. In swing the getPassword() method returns a character array. After the password has been processed by my web application the array can be wiped to ...
0
votes
2answers
313 views

Registration Password

Is it best to create an application that allows a user to sign up with username and email at the beginning and password once you click the generated email sent to you or should the password entering ...
0
votes
1answer
1k views

What happens if you run out of password attempts?

In Samsung Knox, you have 20 password attempts. However, it is never explained what happens if you run out of attempts. Does it delete your Knox data, do you need to enter the recovery PIN or is it ...
0
votes
1answer
4k views

How to enable a http post form penetration test?

I don't get the correct results and I'm not sure what I'm doing wrong: $ ./hydra -l admin -x 3:9:a http://localhost http-post-form "/admin/login:j_username=^USER^&j_password=^PASS^:failed" -s ...
0
votes
1answer
483 views

Question about a “Password Space” definition

I am currently reading the "Green Book" (http://csrc.nist.gov/publications/secpubs//rainbow/std002.txt) of the "Rainbow Series" and have a question on chapter "C.4 Password Space". From this ...
0
votes
1answer
152 views

Is MS-CHAPv2 incompatible with securely stored passwords?

I have a directory service that can speak a number of protocols and is used for user authentication. Currently user credentials are stored using Bcrypt to protect them in case of a compromised ...
0
votes
3answers
265 views

Storing passwords and other data for coworkers

At the moment we are encrypting our server passwords and other important data internal via PGP. Every coworker has got his/her own private key/pass combination set up on their workstation. The problem ...
0
votes
1answer
83 views

How much space is needed? [closed]

How much memory is needed if I want to generate a dictionary of all possible combination of length 6 with a-z and 0-9 characters? Is it a good idea to go for cracking password if I know password ...
0
votes
2answers
339 views

Using authentication only one time passwords [duplicate]

I would be interested in advice. Imagine a authentication mechanism where users are authenticated ONLY using some code (e.g., one time password) which they receive (say as SMS) on their mobile phone? ...