Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
1answer
41 views

Diceware & Database hosting [duplicate]

I'm currently setting up a new SQL database with DotEasy as my Hosting/Database provider. I've heard a lot about Diceware being one of the best methods of creating a really strong password, so I ...
0
votes
2answers
140 views

Can I save passwords in my app securely and retrieve them without asking for a master password? [closed]

I need to save some passwords used on my app, so the user doesn't have to input them so often. I'm trying to understand how this is done. I imagine to keep them safe they should be encrypted however ...
0
votes
0answers
27 views

KeePassX and Dropbox [duplicate]

I am currently using KeePassX on Linux to allow me to have a different strong password for each website. With this program there comes two major inconveniences: I lose access to everything in the case ...
0
votes
1answer
71 views

MDM: Semi-Complex Password Implications [duplicate]

What would be the security implications if an organisation decided to impliment semi-complex passwords (one letter and one letter), and not fully complex. I'm thinking in terms of mobile devices and ...
0
votes
2answers
82 views

How does RealVNC Enterprise Know My System Credential?

After the installation of RealVNC on a Windows computer, the default login username and password via VNC is the same as the system username and password. Can anyone tell me how RealVNC can access such ...
0
votes
1answer
166 views

Are there best practices concerning application account credentials?

I am looking for best practices concerning application account credentials. For example, suppose I got a corporate application which uses an Active Directory application user account to communicate ...
0
votes
0answers
80 views

Request for Google Password for Calendar Updates

A website that I trust (Delta Airlines) offers a link to add flight information to Google Calendar; that link opens a window asking for my Google login and password. Based on the advice in a similar ...
0
votes
1answer
30k views

How to get a Network's WIFI Password through CMD? [closed]

I found that Wifi's Password can be retrived using the network and sharing wizard in Windows, And Technicaly theres no way to store Passwords/collection of bytes in the memory after switching/shutting ...
0
votes
0answers
216 views

Is the password “Z” more secure than the password “a”? [duplicate]

Okay, I guess it's not possible to call one-letter-passwords "secure" - so let's compare ZZZZZZZZZZ with aaaaaaaaaa. Both are using the same character pool [A-z], so the number of combinations for a ...
0
votes
1answer
187 views

Is there any advantage in encrypting a password hash in my database?

I am hashing and storing the salt:hash of each user's password in our database. The web server is ASP.NET and the connection string to the database in web.config is encrypted using the IIS config ...
0
votes
1answer
127 views

Password for XLS files

I am not sure if this is right place to ask this question. I have created an xls file to store all my password in it. lately I have uploaded same file on Google Drive to access it from remote ...
0
votes
1answer
8k views

How do I hash a password in C#? [duplicate]

I assume that the best way to handle passwords for a website is I create a hash of the password and save that hash in my database. Then when someone tries to login, I do a hash of the password they ...
0
votes
0answers
119 views

drupal external authentication - how to handle password?

I need to implement an architecture someone else designed. They have a drupal as user interacting component, and an external authentication module. To authenticate, from drupal, username and ...
0
votes
2answers
364 views

Automated software hackers use to try passwords

Because of the eBay hacking, I had to go and look for other accounts that I have used the same password to change the passwords on those site as well. (I know that it's very bad to have same passwords ...
0
votes
0answers
25 views

Length-constant password comparison in scrypt? [duplicate]

E.g.: XORing the candidate against stored then comparing against 0. Do I need to worry? (my question is much in the same style as this question: Does bcrypt compare the hashes in ...
0
votes
1answer
58 views

CNN Money Portfolio and Heartbleed [duplicate]

Is/was CNN Money Portfolio ever vulnerable to heartbleed? It states 256 bit SSL bank level encryption on the website..
0
votes
0answers
1k views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
0
votes
2answers
171 views

If P=NP, what is still cryptographically secure? [duplicate]

I know, I know - "If P=NP" is a really large, high-impact assumption. But this is a hypothetical. I mean, clearly RSA (and similar methods of obfuscation) would likely become totally irrelevant - or ...
0
votes
0answers
31 views

Are longer passwords more secure? [duplicate]

There are more and more sites claiming that long passwords which are chained words are not only easier to remember, but also more secure then short but obscure ones. Don't get me wrong: I totally get ...
0
votes
2answers
197 views

Password management [duplicate]

I am work in small company. I am Java Developer and Sysadmin of remote servers. I have problem with store password from several servers. How to best way to manage passwords in company?
0
votes
1answer
184 views

Rainbowtable - Start with plain text [duplicate]

I know how to use rainbow tables. I've already read the other questions this topic here. Well but there is still one question left. As an attacker, I usually have a hash value of a password and ...
0
votes
0answers
765 views

Why do you need to login after you change a password? [duplicate]

I can't recall a website that after resetting my password I was automatically logged in, I had to type the password again - which seems quite silly. From a security perspective, why do websites do ...
0
votes
1answer
134 views

What is a preferred method of security-conscious creation of login cookies [duplicate]

Possible Duplicate: Is it safe to store the password hash in a cookie and use it for “remember-me” login? I am working on a webapp that uses localStorage alone ...
0
votes
0answers
242 views

What is the most secure way to recover password online? [duplicate]

Possible Duplicate: Can anyone provide references for implementing web application self password reset mechanisms properly? I have website which sends generated password to any person who ...
0
votes
1answer
1k views

What's the idea behind requiring users to change password periodically? [duplicate]

Possible Duplicate: How does changing your password every 90 days increase security? Some sites require users to change their password every x days. For example, at least 3 online banking ...
0
votes
3answers
151 views

Creating user and safely sending password

Assuming I currently use a safe way to salt-challenge-response-authentication-method, passwords are stored secured and all. I now question myself - how do users set the password? Meaning, they enter ...
0
votes
1answer
171 views

Lock Windows to a specific app

Is it possible, using some program or application, to lock Windows 7 so only a specific app can be used, for example Word, until a password is entered? Thanks!
0
votes
1answer
184 views

Secure way to encrypt (not hash) passwords?

I'm building a system that for reasons I'll outline below, can't used hashed passwords, but I'd still like to encrypt them so that it's as hard as possible to crack them, in the (unlikely) event the ...
-1
votes
3answers
596 views

My friend hashes passwords with SHA512 algorithm without salt. How do I convince him that he needs to add salt?

Today I discovered something incredibly stupid - my friend hashes user passwords with sha512 algorithm without a salt. I immediately raised this issue to him but he said he wants to see anyone crack a ...
-1
votes
4answers
171 views

pesudo random password

I post a question before about one password repeating to make it longer, now its a new way want to ask about, if take the word 'secure' and instead of repeating it put somenumbers between it, exp: ...
-1
votes
1answer
248 views

Is my hashing technique secure? [duplicate]

I am not sure if this is the best place to post this type of question. I have come up with function which, I believe, is a very secure method of hashing. (I could be completely wrong). Here's the ...
-1
votes
1answer
1k views

Changing user account passwords from PHP script - vulnerabilities? [closed]

I started a thread a while back asking for suggestions on a good (good=fairly secure) way to allow users to change their account passwords via a PHP script. (WHY? because on this particular server, I ...
-1
votes
3answers
2k views

Gmail, Yahoo, Hotmail , and so on; How do they check the content of an attached password-protected archived file like Winrar?

How is it possible that mailing systems like Gmail, Yahoo, and Hotmail are able to check the content of an attached password-protected archived file like WINRAR, if the password cannot be guessed, ...
-1
votes
3answers
685 views

find password and iv of an encoded string knowing the decoded string

If I would know the clear and encoded versions of a string could I somehow find the password and.or iv that wore used to encode it? Encoding done with open_ssl aes-128-cbc.
-1
votes
1answer
4k views

How can I avoid sending passwords in plain text when logging into a website?

Suppose that I login to a website. When I type my personal data, aka, password and email, the password is sent in clear text to the server, correct? Then, a network card in promiscuous mode can ...
-1
votes
4answers
355 views

How do big companies and wealthy people secure their information? And how can I secure mine?

I've recently had some success and traffic increase with an online business I own and due to that someone has hacked my domain email and twitter accounts. My bank password is the same and I just ...
-1
votes
3answers
409 views

help me about salting passwords

Eve has just discovered and decrypted the file that associates each userid with its 32-bit random salt value, and she has also discovered and decrypted the password file, which contains the ...
-1
votes
1answer
286 views

Password sending through network [duplicate]

In case of no TLS/SSL available, why can't I use the hash of the password (SHA512) as the key to encrypt the password (with out any salt) to send through the network ? MITM attacks I can understand, ...
-1
votes
2answers
14k views

Recover Windows Server 2003 admin password through restricted user

OK, so here goes after a lot of trial and error: background: My client recently took over another firm. However, apparently the administrator passwords to the server (along with some other non-IT ...
-1
votes
1answer
81 views

CRC-96(ZIP) decryption

Is there a way to decrypt CRC-96 encrypted string? I am testing a web application which stores the password in the database in CRC-96 encrypted format.
-1
votes
2answers
75 views

Creating secure passwords [duplicate]

I have been tasked with writing a random password generator to be used on a series of throw away accounts. In this scenario, the accounts need to be very secure and will be deleted after a single day ...
-1
votes
2answers
42 views

What could be a suitable solution to single factor authorization worksheet bank password circulation with no control?

Passwords for various banks are written in an excel sheet and this excel sheet is password protected. However, there is no control on circulation of this sheet, for many banks only single factor ...
-1
votes
3answers
120 views

Best way to securely send passwords from an application to a user operated server

I have the following situation: A user sets up a server that will have to receive login details. Other users then create accounts and login to this server. All this happens only over LAN. I'm ...
-1
votes
2answers
136 views

How much do unusual characters in passwords help?

If I use a system that allows all Unicode characters or a similarly large space for passwords, how much would using an unusual character help in practice (for example, ࡀ ,which I found under Mandaic ...
-1
votes
1answer
505 views

After salting my passwords, are they protected against dictionary attacks? [duplicate]

I use sha1() to hash my users passwords, but recently a friend told me that if someone get the hash then they could use dictionary attack and he recommended using salts. I implemented a random salt ...
-1
votes
2answers
134 views

Can 2FA help handle mixed personal and business accounts after leaving a company?

I do not want a super administrator in Google Apps to log to my account after leaving company, so I enabled 2-step verification. He could login to many sites as me with just a link in "forget ...
-1
votes
1answer
132 views

Is it okay to have a blank root password for MySQL if port 3306 is not forwarded?

I'm running a PHP server that will use the root account to access the database. However, the server is behind a router and port 3306 is not port forwarded. Is it okay to have a blank password for the ...
-1
votes
1answer
148 views

client side and server side hash password [duplicate]

Another question about client or server side password hashing, I know. After reading many other post about this topic I'm still a little confused and not completely sure what is the best, because I ...
-1
votes
3answers
99 views

What does one call the strategy of using “pre-password transforms” as passwords?

Suppose that instead of using, say, Google, let me in! as my Google password, I used some consistent transform of this string, say ZWE1NjMyNm? What search keywords would be helpful to search for ...
-1
votes
2answers
160 views

Simplest way of hashing a password with multiple different hash algorithms [closed]

I have a list of plaintext passwords that I would like to hash with various different hash algorithms (for educational purposes). As a minimum I would like to obtain hashes under MD5, SHA1, SHA256, ...