Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

4
votes
2answers
101 views

Should password recommendations be different for devices, networks, and internet?

I started using a password manager last year and updated nearly all of my internet accounts to super-strong, unique passwords, and that isn't a problem, cause I only access them from web browsers or ...
4
votes
0answers
153 views

Any problems with scrypt yet?

In the question Do any security experts recommend bcrypt for password storage? Thomas Pornin recommends the hashing function scrypt but saying it is "too new to be recommended on a general basis". ...
4
votes
4answers
214 views

how to check for duplicate passwords

Is it possible to check if like 100 people are using the same pasword? without risking anyones password getting out? I heard google does this, not allowing the user to set a password 1000 people are ...
0
votes
1answer
136 views

When bruteforcing a WiFi network password, Can that admin see it?

When bruteforcing a captured packet containing the encrypted password, can the owner/admin of the router see each auth attempt? I'm assuming you just encrypt each passphrase in the dictionary file and ...
3
votes
3answers
482 views

Rainbow Tables: What is the Reduction Used for?

This is a follow up from this answer. The answer is very good, and it put me to thinking and doing some research. I have found another good explanation on this site. At some point, the author says: ...
3
votes
5answers
262 views

Are all unsalted password hashes inherently insecure?

Maybe I'm missing something obvious... Are all passwords stored in common, unsalted hash algorithms able to be attacked via rainbow tables?
0
votes
1answer
92 views

Brute force attacks detection risks

I would like to ask if using brute force attacks on some websites or online services can be risky in any way for the hacker? Let's say that someone is using medusa tool to crack password on his ...
-1
votes
1answer
7k views

How to get a Network's WIFI Password through CMD? [closed]

I found that Wifi's Password can be retrived using the network and sharing wizard in Windows, And Technicaly theres no way to store Passwords/collection of bytes in the memory after switching/shutting ...
10
votes
3answers
821 views

Should an admin user be able to edit passwords?

For your typical web app, should an admin superuser have the right to edit a user's password, or should only that user have the right? (Even with edit ability, the admin would never see the current ...
0
votes
0answers
24 views

How rainbow table works? [duplicate]

I have roughly understand how a rainbow table works from http://en.wikipedia.org/wiki/Rainbow_table, but I am quite curious why there is a need of different reduction functions for each column for ...
2
votes
3answers
184 views

How do clients enroll using SRP?

From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
23
votes
4answers
3k views

What is the purpose of the “Password minimum age” setting?

What additional security can a "password minimum age" provide? For example: the user can change their password only after 24 hours have elapsed since the last password change.
5
votes
2answers
289 views

How will security need to be changed if we can crack password hashes in quasi-polynomial time?

If we suppose that we have access to some form of generalized password hacking/cracking that can somehow find an $n$-bit password in time $O(n^{\log n})$, is there need for alarm? This question ...
1
vote
1answer
66 views

Are there best practices concerning application account credentials?

I am looking for best practices concerning application account credentials. For example, suppose I got a corporate application which uses an Active Directory application user account to communicate ...
0
votes
1answer
92 views

Office password protection crack

would just like to have a check on the password protection/encryption of MS office 2007 and above. It is said that its not that easy to crack the password protection except by brute force, since 2007 ...
0
votes
1answer
73 views

How to use multiple charsets in hashcat

I wanted to use a brute force attack on hashcat but WPA/WPA2 networks are 8-64 characters long and they have multiple possibilities of a password. I was wondering if there was a way to use multiple ...
1
vote
1answer
47 views

How do you practically manage your never-use-personal-accounts-on-a-work-machine-ever double life, when your personal machine is a limited iOS device? [closed]

This is follow-up to Starting a new job after working at home for years. How to best protect data, secrets, and privacy in the workplace? The answer to that question is Follow company security ...
0
votes
1answer
87 views

Starting a new job after working at home for years. How to best protect data, secrets, and privacy in the workplace?

I have just started interviewing for new computer job after years of working from home. At home I feel very secure with how I protect myself from data loss and keeping my secrets secure. I backup ...
3
votes
2answers
315 views

Is fourteen characters long password really weak?

I've tried to sign in to Samsung Cyber Service Center1. Since I'm from Poland, at first I tried Polish version of that service. I have entered a password, that has: 6 numbers in total (in three ...
1
vote
1answer
58 views

Storing salt and hashed password [duplicate]

Is there a benefit to storing salt appended to hashed password in a single column of a table verses storing salt and hashed password in different columns of the table. The OWASP guide here ...
0
votes
2answers
129 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
62
votes
8answers
7k views

Is forcing users to use a strong password effective?

I am designing a service that would, among other things, store sensitive information. To ensure no unauthorized access of this information, it would be encrypted with a key derived from their password ...
-3
votes
2answers
46 views

Can I prevent brute forcing of hashed+salted user passwords without a dedicated validation server? [duplicate]

Salted hashes don't seem to offer any real protection for user passwords by itself. So long as a hacker has a quick way to check if a password is right or wrong, it's trivial to brute force it to view ...
216
votes
7answers
30k views

How to store salt?

Nowadays, if we expect to store user password securely, we need at least do the following thing $pwd=hash(hash($password) + salt) then store $pwd in your system instead of the real password. I have ...
0
votes
1answer
159 views

Can any App Store app access all of my passwords?

Whilst researching another question, I've noticed that on OS X 10.9.4 there are many instances of Library/Keychains/login.keychain from ~ within the Data folder of what looks like apps from Apple App ...
12
votes
7answers
7k views

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
11
votes
2answers
686 views

How can I find out the password hashing schemes used by the specific Unix accounts I log in to?

Every day I ssh in to 3 or 4 independent Unix accounts. I have been regarding them as more or less "equivalently secure" on the grounds that I'm using ssh, but after learning of how much variety ...
11
votes
4answers
863 views

Does it indicate a bad password system to disallow certain characters in passwords?

When creating an account to the game League of Legends, the user's password must comply to a few rules. The one I'm concerned about is the "Must not contain slashes or spaces" one. The others are ...
1
vote
2answers
83 views

What is the evaluation criteria that a site uses for a password as strong , moderate or less secure

I have been in kind of jinx as to how a website decides on which password is highly vulnerable , strong etc . Lately my yahoo account was told to change password which I am using for long time as the ...
7
votes
4answers
1k views

password complexity policy for non “English” passwords

In an internationalized application, what is the best practice for a policy on complexity of passwords? I am not having luck searching for the answer. Wikipedia lists these items for password ...
7
votes
2answers
2k views

How do I block LinkedIn from extracting data from Microsoft Exchange Server?

LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click ...
1
vote
2answers
227 views

Can Hydra crack a flash-based login?

Is it possible to brute force a flash login with hydra? If not, what is a good tool to pen test a flash login?
10
votes
2answers
650 views

Password generation - too primitive?

A while ago (12 years old), I recognized my passwords weren't safe at all. Because I used the very same password everywhere, some grumpy admin could easily take over all my accounts (he got mail and ...
0
votes
0answers
90 views

THC-Hydra dictionary attack on JSP login form

I am trying to use Hydra to attack a JSP form but I have some confusion. Normally we use command something like this hydra -L list_user -P list_password HOST-ADDRESS http-post-form ...
-1
votes
2answers
4k views

Hydra https-form-post

I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives. This is what I have done so ...
2
votes
1answer
1k views

Hydra bruteforce and JSON

I am having problems with Hydra and a JSON payload. The login request (intercepted with Fiddler), is the following: POST http://architectureservice.test.com/api/v1/login HTTP/1.1 Host: ...
3
votes
1answer
162 views

Is it possible to retrieve SSH v2 credentials in a username/password authentication scheme?

I'm currently analysing a compromised network(root access has been gained to a workstation and logs show that it has been used for port scanning and service brute forcing attacks on the remaining ...
0
votes
1answer
96 views

How to store passwords to a remote web site?

Say I want to build a public API to access a website that doesn't have one. The website is protected by a standard username/password scheme and the API implementation will use scraping to get the data ...
1
vote
1answer
127 views

Email account password change via email-to-script

I host a mail server (postfix and dovecot) and I wish to set up a password change feature (especially useful when creating a new address provided with a temporary password). Does my scenario has ...
1
vote
0answers
31 views

THC-Hydra - one good pass = shows all valid [duplicate]

As in title. I'm testing my router security and I came up with problem. hydra 192.168.0.1 http-get-form "/:un=^USER^&pw=^PASS^:User Name or Password is incorrect." -L usernames -P passwords ...
0
votes
2answers
167 views

Is PassFace Authentication System secure?

In the passface authentication system, whether the passfaces are selected by the users or assigned by the system? Is such system secure? How is user's passface stored on the server side?
0
votes
4answers
116 views

Is secondary password (e.g.: pin) necessary?

I find some cases (especially in online games) that a software or website asks users to enter an additional password, such as 4 or 6 digit pin numbers, in addition to their original password. Most of ...
17
votes
5answers
2k views

Is sending plaintext passwords to a SQL Server database a security risk?

I have a database which has stored procedures which take plaintext passwords. It hashes them and inserts them into the DB. If an attacker has access to the DB connection, it is possible to intercept ...
14
votes
2answers
510 views

Concrete figures on password cracking in the wild

While password guessing is a science, not every attacker out there is up-to-date with the latest advances or cares to invest in GPUs or FPGAs. It's easy enough to test online password guessing ...
-2
votes
2answers
113 views

How much do unusual characters in passwords help?

If I use a system that allows all Unicode characters or a similarly large space for passwords, how much would using an unusual character help in practice (for example, ࡀ ,which I found under Mandaic ...
-1
votes
5answers
620 views

What if I develop my own hash algorithm to create strong passwords from easy ones?

I came up with this idea but I cant figure out if it's good or bad, maybe you can help. My goal is: I want to create extremely strong passwords for my main accounts (gmail, skype and so on). I want to ...
3
votes
2answers
118 views

John the Ripper not identifying a password contained in the username?

I have uploaded a screenshot of what exactly is going on, here: http://i.imgur.com/bJSv7C8.png I can see that single-crack mode includes a rule that looks at the username, and "slices" it to identify ...
0
votes
2answers
94 views

Why do web users still use password manglers though password is sent in ciphertext

There are many variations of password manglers. An example would be Hash( user password + secret key + domain site ) During website login authentication , passwords are sent in ciphertext from ...
1
vote
3answers
315 views

Cracking passwords after a pattern with John

So I am trying to find out how easy it is to crack a password using some great Linux tools. We all know about John as a password cracker and how great it is. But how about specifying a pattern. ...
9
votes
2answers
150 views

What concrete parameters can I change to make my passphrase-protected private gpg key more secure

There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever. Rather than ...