Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

3
votes
3answers
237 views

Is it ok for software to store passwords locally in plain-text?

There are already plenty of questions about what to do when websites store plain-text passwords. But this one is a little different. I use a piece of open-source (see below) software for playing ...
23
votes
2answers
3k views

Passwords in plaintext?

I'm doing some research on the App of my telephone operator. I started Burp Suite on my Mac in proxy mode, I opened up the App on my iPhone and started to sniff some traffic. I pressed the "login" ...
3
votes
3answers
498 views

Accepting other similar passwords when storing a salted, hashed password

If a website stores passwords as a salted hash, is it reasonable to accept similar passwords as correct? For example, given the password stackexchange, does it dramatically decrease security if the ...
3
votes
3answers
164 views

Where are the user credentials stored when remember password is selected?

Provided a user has chosen the remember me option while logged in last time into a web application,how does the web application server identifies the user next time when he logs in? The credentials ...
0
votes
3answers
230 views

Are windows users passwords easier to crack than linux?

If i set the same password in both linux and Windows, is it easier for a hacker to break the windows password? If so why and how can i create a windows password in the same security level as Linux?
7
votes
2answers
442 views

Does Outlook store plain-text passwords?

A long time ago when Microsoft changed my e-Mail from Hotmail to Outlook the password-interface said that I should only put in the first 16 chars of my password. But my password was longer before. So ...
-3
votes
2answers
422 views

How to secure a login.php file? [closed]

I have a hand built website, and am triying to build a cms/admin-panel, and my username and password, are not stored in a database, but, in a two setup file like seen below. index.php <?php ...
1
vote
1answer
100 views

Is there any advantage in encrypting a password hash in my database?

I am hashing and storing the salt:hash of each user's password in our database. The web server is ASP.NET and the connection string to the database in web.config is encrypted using the IIS config ...
15
votes
6answers
5k views

My IP address (with a NAS) is targeted by a hacker. What to do? Should I be worried?

I've noticed, based on the logging of my NAS, that my IP address is targeted by a hacker. I already took action by automaticly ban the IP address permanently after five unsuccesful login attemps. ...
1
vote
1answer
44 views

How can I hide proprietary elements of test data in tests that are automatically run?

I am writing automated tests for a web application that will be run periodically over night, and I am running into a moderate security issue. In order to make the tests thorough, I am hoping to ...
3
votes
2answers
117 views

Storing the password database on offline server

This password database resides on the authentication server which is connected to the Internet. My question is that if the password database is stored on different server than the machine connected ...
2
votes
1answer
1k views

How to crack SHA512 hexdigest passwords with John the Ripper?

I've been playing with John The Ripper (JtR) to try to crack/audit a salted password that was hashed with SHA-512, with 20 interactions according to the source (for the curious, this is a Rails app, ...
1
vote
1answer
56 views

Use TOTP to prevent simulating requests

I'm developing an API system which provides functionalities for a game. Currently, we are using HMAC to prevent simulating requests (let's say, prevent hackers from simulating the game) but because we ...
1
vote
1answer
72 views

Password for XLS files

I am not sure if this is right place to ask this question. I have created an xls file to store all my password in it. lately I have uploaded same file on Google Drive to access it from remote ...
2
votes
2answers
121 views

Password verification scheme (used in eg. MS Office) - more secure than just a hash?

Usual password verification schemes stores a salted password hash and the salt. If the hash is good and computational costly, it is considered secure. However an alternate version (used in Microsoft ...
28
votes
9answers
14k views

Feeding /dev/random entropy pool?

Which way of additionally feeding /dev/random entropy pool would you suggest for producing random passwords? Or, is there maybe a better way to locally create fully random passwords?
7
votes
3answers
6k views

Why is Chrome asking for the application-specific password and my account's password every time? [closed]

I enabled Google's two-factor authentication and found it ironic that Google Chrome Sync requires #1 You account password, and #2 an application-specific password. First of all, don't applications ...
-2
votes
1answer
56 views

Escape from <script> to cause a XSS (XSS when reflection is already under <script>) [duplicate]

I am trying my level best to solve this issue i am totally not able to create a XSS i still thinks it to be a vulnerability and i think it is exploitable. I am frustrated around it for 8 days . Please ...
-1
votes
1answer
680 views

How do I hash a password in C#? [duplicate]

I assume that the best way to handle passwords for a website is I create a hash of the password and save that hash in my database. Then when someone tries to login, I do a hash of the password they ...
2
votes
1answer
89 views

Global user override - Uncomfortable

We have recently started a project with a service provider who is a little old fashioned in their ways. They provide a product but don't market it particularly well, so we (as users of the product) ...
3
votes
2answers
98 views

entropy of two factor authentication

I have two independent authentication methods A and B with entropy a and b respectively. say compromise of A does not provide any information on B. Is entropy of two-factor authentication of A and B ...
14
votes
2answers
2k views

Linux password changed. Is this an attack or a hardware glitch?

My Linux (Ubuntu 12.04) password suddenly changed last night and I'm not sure if this is an attack or just a hardware/user error. This is on a personal/non-server box. Several strange events led up to ...
25
votes
6answers
21k views

Most secure password hash algorithm(s)?

What is/are currently the most cryptographically secure hashing algorithm(s)? (available in PHP) Speed is irrelevant, because I'm iterating the hash over a fixed time (rather than a fixed number of ...
7
votes
4answers
1k views

Gold Standard for password hashing

I've developing a web application that will be dealing with highly sensitive information and I want to ensure the hashing of passwords is gold standard. Ideally I'd go for per-user salted SHA512 ...
0
votes
3answers
2k views

What are the differences between dictionary attack and brute force attack?

Can someone explain the major differences between a Brute force attack and a Dictionary attack. Does the term rainbow table has any relation with these?
1
vote
1answer
78 views

Predicting the Entropy of the entire Password Database

Suppose that the passwords created under some specific composition rule "C" is to be tested for the security. One of the way could be to conduct survey on x number of people and measure the average ...
3
votes
2answers
182 views

Is there a strong reason to salt and hash passwords when password reuse is not an issue?

I am dealing with a system (in development) that uses randomly generated (not user provided), unique, strings to authenticate services that will consuming an API. Right now, these strings are stored ...
2
votes
1answer
94 views

Can windows passwords be recovered from the windows pagefile?

I was reading reasons for clearing page files on workstations with one reason listed is that passwords can be stored in the pagefile and therefore should be cleared upon reboot in the case of somebody ...
-3
votes
1answer
84 views

What is the algorithm of bcrypt? [closed]

In many places I heard that people recommend to use the bcrypt algorithm to save passwords into database while creating web applications.I want to know what is the algorithm used to bcrypt a password ...
570
votes
21answers
113k views

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are ...
3
votes
2answers
107 views

One time passwords using Mobile phones [closed]

It is safe to assume that the majority of users accessing the internet also possess the mobile phones. So can we take advantage of this and relieve users of remembering any passwords. Instead of ...
0
votes
4answers
210 views

Security of a Random Password

i. If I choose random password of length say 15 from the alphabet set of size 94 i.e. from the search space of 94^15, is my password protected against all kind of threats? ii. Will there be any need ...
0
votes
2answers
73 views

Identifying Memorable Composition Rules [closed]

A single word can be transformed in so many ways to create the password. With any word of length l there are l! different permutations. Appending digits and symbols to the word create alphanumeric ...
0
votes
1answer
75 views

which password was paired with my gmail address

Recently media have reported that a file of about 5 million gmail address and password pairs was published on a Russian Bitcoin forum. A media article on the leak Other media have reported that the ...
4
votes
4answers
342 views

Does Windows have a built-in password store?

What passwords are stored in Microsoft Windows? How can I know what password are saved in computer?
1
vote
1answer
134 views

How does authentication work without OAuth in mobile apps?

I have a (Drupal) website that needs a companion mobile app for some stuff (quite customized, not just creating/viewing nodes). I know I can use OAuth for this, but I was wondering about alternatives ...
0
votes
2answers
66 views

Is my Password Hashing Secure or not?

I have recently created a code for hashing password. Can you please give your advice over the security of my code? The function takes a password, then converts it to a number. #include <string> ...
-1
votes
2answers
102 views

Simple Ciphers to Create Secure Passwords

A shift cipher shifts every letter of a word by "n" amount and creates new word. The number of possible keys in the shift cipher is equal the size of the alphabet set from which the word is derived. ...
0
votes
1answer
210 views

THC Hydra 16 Valid Passwords? [duplicate]

So when i do hydra -l Admin -P "rockyou.txt" -s 80 192.168.13.1 http-get / it doesnt work for me, it says all 16 passwords are valid, but none of them works, can anyone help me with this? I tried ...
1
vote
2answers
156 views

Longer passwords v/s Password Composition Rule [duplicate]

Password composition rule is being considered as a burden for the users and some experts are recommending the increase in the password length instead of enforcing users to comply with the composition ...
0
votes
1answer
88 views

Encrypting the salt with password [duplicate]

Salts are stored in the plain text and readily available with the hashed passwords if the password database is compromised. What if we encrypt the salt using password itself? Doesn't it make offline ...
16
votes
6answers
4k views

Is my custom password hashing algorithm insecure?

For all of my hobby web projects, I have coded a login system that these projects share. There is no critical data in these projects, the only critical data could be reused passwords. So I try to hash ...
0
votes
1answer
94 views

Requiring a pin instead of password for websites?

Curious if this could be a good alternative to passwords. On a website, user can choose to use a pin instead of password. If she does elect to do this (given option) from then on, her account asks for ...
7
votes
6answers
966 views

Storing password hashes without a correlation to the user account

I read an interesting article about an alternative way to store password hashes ans was rather intrigued. A better way to store password hashes? The primary concept is having a large table full of ...
4
votes
3answers
489 views

How can I find if my password has been posted online?

I have just received this email from AbeBooks.com: Hello AbeBooks Customer, This is an important message from AbeBooks.com. As part of our routine security monitoring, we have learned ...
15
votes
1answer
4k views

Can a dictionary attack crack a Diceware passphrase?

Everyone knows the words used in Diceware passwords (all 6^5 = 7776 words are published) -- they're all common words. Everyone seems to know that we're not supposed to use dictionary words for ...
0
votes
0answers
35 views

drupal external authentication - how to handle password?

I need to implement an architecture someone else designed. They have a drupal as user interacting component, and an external authentication module. To authenticate, from drupal, username and ...
2
votes
1answer
190 views

What are the typical ways to generate a One Time Password?

I'm looking for the typical ways to generate a One Time Password. I know about the HOTP and TOPT. But, in my case, the problem is that the "server" only has a display as interface and the ...
4
votes
2answers
198 views

XKCD-like passphrases to stdout

I'm trying to find a way to crack XKCD-like passphrases (correcthorsebatterystaple) from word dictionaries. Basically concatenate X number of words from a dictionary file. Right now it honestly ...
8
votes
4answers
2k views

Hacking computers, scifi or reality

I was watching The Girl with the Dragon Tattoo, and this female hacker was really good at hacking. My question is, how is it possible for her to crack passwords besides the brute force approach? I ...