Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

1
vote
3answers
132 views

Protecting wireless network

My wireless network protected under WPA-PSK/WPA2-PSK protocol. Is there a good reason to change the default user/password for the router management interface? What would it take for an hacker to ...
1
vote
1answer
63 views

Is it possible to hash bcrypt passwords more securely?

I'm wondering if it's possible to increase the work factor of an already encrypted bcrypt password. e.g. I have a password that was encrypted with a work factor of 5, is it possible to increase the ...
1
vote
2answers
67 views

Is it bad to use the same sequence of characters in each password?

A friend of mine purposed a method of making passwords where each has the same base and added to it is something indirectly related to the site or product being signed into. For example all passwords ...
11
votes
5answers
472 views

Security of carrying passwords on person

While in college I decided to have a randomly generated 16 character password. I used parts of that password in various sites. However, one of the sites was compromised so I had to change my password. ...
2
votes
2answers
149 views

Appropriate way to encrypt passwords/financial info?

I am in the process of creating a file/files containing all of my logins/password info for various accounts. In the event of my untimely demise this file would be sent to the appropriate party(s). ...
5
votes
3answers
2k views

HMACSHA512 versus Rfc2898DeriveBytes for password hash

We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key The salt is 64 char randomly generated string. We allocated 2048 length on the database for the hashed base64 string ...
3
votes
3answers
101 views

How to simply and efficiently generate different keys from one password?

I saw here that using the same key to encrypt and mac (in that order) a message could eventually be unsafe. What is the best way to generate two different keys from the same password (using a PBKDF ...
3
votes
3answers
219 views

Could using a generated key from an online service be considered a risk?

With some colleagues we're having a debate regarding the randomkeygen.com website. I do think that there is a security risk using the generated keys of this (or any of this kind) website. Why ? ...
1
vote
0answers
59 views

How secure is a Python Pyro daemon for storing a password?

I am using the Pyro package to create a daemon which will, upon startup, prompt for a password, and then the daemon will store that password as long as it is running. Other scripts will then make a ...
10
votes
2answers
537 views

Password generation - too primitive?

A while ago (12 years old), I recognized my passwords weren't safe at all. Because I used the very same password everywhere, some grumpy admin could easily take over all my accounts (he got mail and ...
0
votes
3answers
88 views

Resetting passwords howto

I am currently in the process of designing a registration form for the users to register accounts. The accounts will contain a lot of personal information, so I want to ensure highest possible ...
1
vote
0answers
58 views

How do I determine whether a Linux-based router still has the default password? [duplicate]

My goal is to check if the password used by admin is the default password. I work on a Linux-based router. I know the password is stored as a hashed value in /etc/passwd. In generic Linux machines, ...
280
votes
13answers
45k views

What technical reasons are there to have low maximum password lengths?

I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites I actually care about ...
2
votes
2answers
97 views

Will deferring password choice until after account activation improve security?

About one year ago, for about two months, lots of user accounts with unverified login email address started to pile-up. All addresses belonged to @yahoo.com. It appears (don't know for sure) some ...
-4
votes
2answers
70 views

in which format this code is encoded ? and how i decode it? [closed]

"jmHMRWncShQ%3D" this is my encoded text , i want to know that in which format , this text was encoded , and also want to know that how i decode these types of code ??? this password may be ...
4
votes
8answers
845 views

Is this a good way to store passwords in a Web Application?

I've been tasked with finding a better way to store passwords and came up with this Algorithm. My understanding of Crypto is not strong enough but can someone check this please? Inputs: Username ...
1
vote
2answers
144 views

Username and password stored under form data in Chrome Dev Tools

When I record the network tab in Chrome Developer Tools when logging in to my site I find that the username and password are stored in plaintext under form data. You can also find it in Safari, ...
-1
votes
1answer
126 views

Is my hashing technique secure? [duplicate]

I am not sure if this is the best place to post this type of question. I have come up with function which, I believe, is a very secure method of hashing. (I could be completely wrong). Here's the ...
21
votes
4answers
6k views

Standards for encrypting passwords in configuration files?

My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they ...
2
votes
2answers
183 views

Pattern based password cracking

I need to select a project for this semester. I'm a second year uni student in Ethical Hacking and Countermeasures. My idea was to see if using some kind of pattern based password cracking can be more ...
10
votes
8answers
2k views

What chars should I not allow in passwords?

I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
0
votes
2answers
110 views

Any reason to use bcrypt, pbkdf2, scrpt for other things than passwords? [closed]

Let's say I want to hash some data, using SHA256, in order to prove I know something. Maybe it's my secret ID for something. In the real of passwords we have moved from hashing -> hashing+salt -> cpu ...
-1
votes
1answer
99 views

Does password “strength” matter anymore? [duplicate]

In the early days we happily saved whatever password a person wanted to the database. Later we decided that passwords must include certain characteristics like numbers, upper and lower case and ...
1
vote
2answers
221 views

Authorization in offline application

I'm working on a machine which needs to store usernames and passwords for the various operators, technicians, and engineers that may be using and configuring it. It is important that some functions be ...
3
votes
3answers
269 views

If I use a good Master Password in Firefox, is security improved when I Remember Passwords instead of re-type?

In the old days I would emphasize that people should not select the remember passwords option because (besides the fact you tend to forget what the browser remembers) a bad guy could could display the ...
1
vote
3answers
182 views

Sharing passwords through email can be considered insecure?

I'm responsible to create new accounts for some services on my job. Some of these service do not allow password change by the user, so in the case the user wants to change its password, he would need ...
481
votes
23answers
88k views

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are ...
0
votes
0answers
25 views

Are longer passwords more secure? [duplicate]

There are more and more sites claiming that long passwords which are chained words are not only easier to remember, but also more secure then short but obscure ones. Don't get me wrong: I totally get ...
-3
votes
2answers
316 views

How to secure a login.php file? [closed]

I have a hand built website, and am triying to build a cms/admin-panel, and my username and password, are not stored in a database, but, in a two setup file like seen below. index.php <?php ...
0
votes
1answer
53 views

What is the best way to generate a password/pin like string using brute force method? [closed]

I have a string of 7 characters. I'm supposed to generate all the combinations. But some combinations are more likely than others, I would like the more likely ones to be generated first. If I ...
0
votes
1answer
117 views

Hashing Passphrase in Client-Side JavaScript Rather than Server-Side — Is it Viable?

Yet another salting-and-hashing-for-web-sites question has been left on the doormat of Information Security's StackExchange. The oft-mentioned approach for website password-handling is to use a ...
0
votes
2answers
83 views

RatticDB for passwords is not encrypted. Is this good approach?

I am looking for a password application for storing passwords, and RatticDB have a web interface and SSH access is planned, which are exactly the features I am looking for. However, they write that ...
0
votes
1answer
163 views

About password_hash() in PHP and storing (part of) its salt outside DB

So, i learned that new in PHP 5.5 is password-hash() which works much like crypt(). Which is more secure (slower) than md5() or sha1(). The result string is algo+hash+salt, which can be passed as-is ...
2
votes
2answers
161 views

Dual Authorization (Social Auth 2.0)

Can you see any obvious challenges to requiring 2+ users to confirm authentication requests using an association such as a friendship type of relationship. A practical application would be an ...
4
votes
1answer
62 views

Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks?

Does the Oracle Database Built-in Password Protections prevent pass-the-hash or replay attacks? Reading the "What Are the Oracle Database Built-in Password Protections?" from ...
1
vote
6answers
212 views

Does including the username in a password make it less secure?

Many registration forms prevent you from choosing a password that includes your username. Is it a reasonable restriction from security standpoint? I can see that if your username is "foobar" and ...
6
votes
3answers
440 views

Is it proper to be prompted that I entered an old password

I changed my Facebook password a few days ago. Today, I entered the old password chronically, and saw the prompt: Sorry! You Entered An Old Password And even shows the date&time when I ...
0
votes
1answer
6k views

Unsolicited Password Request from Facebook

Today I have received 3 emails to my three different addresses, one with Google, one with MSN, and one with my company. All emails were sent from password+kjdmiikvhppi at facebookmail.com email ...
2
votes
2answers
77 views

How do clients enroll using SRP?

From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
1
vote
1answer
206 views

New to security, is php password_hash() good enough?

This is the first time I've had to handle personnel information and I want to make sure I have a good amount of security. I will be storing users' emails and passwords for their accounts on a MySQL ...
11
votes
6answers
2k views

Managing website passwords for small team

I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
14
votes
4answers
384 views

Does two-factor authentication reduce the need for a long password?

I've recently enabled 2-factor auth on a number of web apps, mostly using Google Authenticator. Does this mean that the importance of a strong password on each site is reduced? I would prefer to use ...
28
votes
7answers
4k views

Why isn't open WiFi encrypted?

As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
1
vote
2answers
111 views

Use of pwgen with sha1 to create recreatable passwords

I'm looking at using Theodore T'so's pwgen (on linux/ubuntu) with its sha1 (-H) feature to generate passwords that I should be able to recreate later using the same file and seed. I briefly looked ...
1
vote
1answer
2k views

Is it possible to brute force all 8 character passwords in an offline attack?

This article states: Brute-force techniques trying every possible combination of letters, numbers, and special characters had also succeeded at cracking all passwords of eight or fewer characters. ...
7
votes
4answers
4k views

Regulations that specify password length?

I have read: PCI DSS 1.2 SOX 404 AR 25-2 ISO 27001 But only PCI DSS specifies a minimum password length. Are there any other regulations that dictate password lengths for any industry? NIST ...
3
votes
8answers
390 views

Generate user a password instead of asking for one?

I'm trying to weigh the benefits of not allowing users to create their own passwords, but must pick out of a generated selection. Are there any examples of sites that use this approach? Workflow ...
0
votes
1answer
100 views

Is a simple Whirlpool hash with random salt secure enough? [duplicate]

I've been working on a site that requires users to login. It's written in PHP with MySQL, and passwords are stored as Whirlpool hashes with a salt (source code later). However, security sites or ...
2
votes
4answers
212 views

Best practice for forgot password form, ok to leak that a given e-mail is invalid

On our forgot password reset form, is it ok to leak that a given e-mail address entered is invalid? Or should we always just return success and check your e-mail, even if the e-mail is not valid. I ...
1
vote
2answers
285 views

Should I decode a base64 password before hashing for storage?

My server gets base64 encoded passwords from the client, and I am going to hash them for storage in a credentials table. Should I decode the password and hash the clear text password, or just hash ...