Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
10
votes
4answers
401 views
Are there state-of-the-art techniques or theory specifically for attacking passphrases over passwords?
With passphrases becoming more and more common based on length being more important than complexity, I'm assuming there must be some work going on involving techniques aimed specifically at cracking / ...
9
votes
4answers
939 views
Demystifying Web Authentication (Stateless Session Cookies)
I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages.
Here is my first ...
1
vote
1answer
95 views
Pure SRP authentication without TLS
IF using a SRP for client/server application authentication without TLS. Will it be vulnerable to man-in-middle attack, since if using SRP, the public info doesn't really useful to calculate the ...
0
votes
3answers
652 views
Email hacking myth
I never believed that some one can actually hack an email that easy. If someone hacks an email it means he actually hacked the server and he will gain access to many emails not to mine only. Anyway ...
1
vote
1answer
64 views
Error using ncrack
I am trying to run a ncrack command of the following format
ncrack -P filePath1 filePath2 --user user1, user2, user3 ipAddress:port
and i get the following error
Does anybody know why do i get ...
-4
votes
2answers
163 views
Good Practice: Storing Passwords in general
I've got a totally theoretical question to you on today - what is the "best" practice for storing passwords? [Best in terms of security and performance]
Usually, especially PHP-Developers tend to ...
7
votes
6answers
558 views
Does repeating one word to form a password result in a similar pattern in its encrypted format?
If i use a single word to form a password by repeating it like the examples below:
securesecuresecuresecuresecuresecure
SeCuReSeCuReSeCuReSeCuReSeCuReSeCuReSeCuRe
...
2
votes
2answers
257 views
Why doesn't Microsoft implement salt on users passwords in Windows?
Pretty straightforward - So we use rainbow tables to get passwords of users out of hashes. So why won't Microsoft implement salt on the passwords in Windows to be hash(password+salt)?
Won't this ...
0
votes
0answers
34 views
Database hash for password field [duplicate]
I'm using a mysql database and am looking for a cryptographic hash method for a password with salt added to it. What would be the best hash method for this problem?
4
votes
4answers
299 views
Insecure to require numbers in passwords?
Earlier, I went to a site that required a number and special character, and it got me thinking – wouldn't that make the password easier to brute force? If you assume most passwords have around 12 ...
2
votes
1answer
323 views
Using John the Ripper to crack SHA hash w/ partial knowledge
Group, I have a SHA1 hash that I would like to brute-force. I have knowledge of several characters before and after the password (ie, if the hash is derived from "xxxpasswordyyy", I know both xxx and ...
3
votes
4answers
172 views
Securing opensource web application
I have an open source website. I need to add an admin section to the website which is accessible to only one person. To make it secure, I was thinking about providing a login page which checks if the ...
4
votes
1answer
151 views
Saved passwords (use case)
I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together.
Both the data and the password are encrypted ...
-4
votes
1answer
141 views
Secure Web application Password vault/manager [duplicate]
I would like to build an open source online password vault which allows users to securely store their passwords, like Keepass or roboform, but where a user can access their passwords through a ...
6
votes
2answers
245 views
Banning specific passwords?
There have been a couple of questions about enforcing good passwords, so I thought I'd add my own:
In addition to enforcing a minimum Shannon entropy, would it generally be a good practice to ...
3
votes
2answers
93 views
Fixing the high-bit problem in PHP's crypt() implementation
I'm working on a site that has to have compatibility with older versions of PHP, which suffer from a high-bit issue in the Blowfish crypt() implementation. Essentially, non-ASCII characters are not ...
2
votes
2answers
348 views
Salted hashes vs HMAC?
Most of discussions involving access credentials include references to "hashing salted passwords". Is this another way to referring to the HMAC algorithm or a totally different operation? Different or ...
4
votes
3answers
373 views
Encrypting user data using password and forgot my password
I am planning to do a web application which stores a lot of personal stuff (info, photos...). And to give users a sense of protection, I want to encrypt the data before storing it to the database.
...
7
votes
3answers
154 views
If multi factor authentication is enabled, how should that affect self-service password reset?
Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required)
...
8
votes
3answers
819 views
How can I mitigate the threat that DPAPick poses to my DPAPI protected data?
The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications).
DPAPick was presented at BlackHat ...
0
votes
2answers
286 views
Is there a way to find out how long it takes John the Ripper to crack a particular password?
I am looking to test/demonstrate things like: when the supplied wordlist contains "abc123" and pw="abc123" then John cracks the pw in 1/2 a second... but if word list does not contain "abc123" John ...
18
votes
9answers
2k views
Best password strength checker
In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or ...
6
votes
7answers
832 views
What chars should I not allow in passwords?
I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
22
votes
7answers
1k views
Is there a method of generating site-specific passwords which can be executed in my own head?
I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
8
votes
5answers
170 views
Citations for inadvisability of globally unique password
I am looking for an authoritative source to back up my position in a disagreement over password policy.
I am having a disagreement with a client about the user identification/authentication process ...
4
votes
6answers
1k views
Retrieving OSx Keychain passwords
I have a computer forensics style osx login.keychain file that I am trying to find the passwords from.
I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...
25
votes
9answers
3k views
How long should the password be?
The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
3
votes
5answers
263 views
what are good requirements for a password
I'm making a website and I'm deciding on the password policy. What does make a good password? I really have no idea. I guess passwords should be at least 6 characters long.
EDIT: are there any ...
1
vote
1answer
85 views
What are my options for securely printing an OTP Scratchcard?
I want to print and distribute several One Time Passwords (OTPs) that can't be easily disclosed to a 3rd party in transit. (think the physical version of a TLS session for private secrets)
To me ...
5
votes
3answers
228 views
Use of rainbow tables with the NY Times hack?
The NY Times recently published a story about how they were hacked during a four month period. The hacks allegedly were carried out by part of the Chinese military.
One part of the story that ...
0
votes
3answers
114 views
What day-to-day activities can compromise a person's information security [closed]
Recently a car was stopped next to me at the traffic lights. The driver had his phone connected to the car's bluetooth and the conversation could be heard by me crystal clear in the next car - the ...
4
votes
3answers
368 views
Is using the same password for multiple TrueCrypted volumes safe?
I want to use TrueCrypt for encrypting multiple disk volumes.
Assume I use the default cryptographic algoritm (AES) and hash algorithm (RIPEMD-160) and that nobody can get my passwords through ...
7
votes
3answers
649 views
Generating random passwords by clicking randomly on the keyboard?
How secure is it to generate random strings/passwords manually for different purposes by just clicking randomly on the keyboard ?
I usually need random strings for salts and for passwords, and I ...
15
votes
5answers
955 views
From a security standpoint should users be asked to confirm their password when registering?
Is it advisable to have users re-type their password to confirm it's correct? On User Experience the general consensus seems to be no but I'm wondering if this has security ramifications?
EDIT: my ...
3
votes
2answers
265 views
How does processor architecture affect password hashing speed?
Does hashing speed vary significantly using different architectures (x86 vs ARM)?
Scenario
I am investigating the possibility of using a cluster of Raspberry Pi for cracking passwords hashed with ...
5
votes
3answers
248 views
Mutual authentication for humans
Is there any way for two people to securely authenticate each other without access to any special software (like PGP)? For example, when speaking over the phone or by sending SMSes to each other or ...
4
votes
3answers
207 views
Completely mimimise the possibility of my web hosting account being hacked
I've just moved web hosting providers and I want a fresh, secure start. To a certain extent, I don't mind what I have to do I'm just fed up my account being hacked or infected. I just wondered how to ...
6
votes
4answers
1k views
Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security?
14
votes
4answers
572 views
How to treat non-optional bad security questions?
Every once in a while I have to set up an account on a site that, while apparently at least not storing my password in plaintext, still force me to choose from a limited set of security questions that ...
0
votes
1answer
149 views
Due to which reason might a windows 7 password been reset to empty?
A user reports on monday he cannot access his windows 7 account anymore due to a "wrong password", which perfectly worked on friday. It turns out the password has been reset to empty for that account. ...
1
vote
1answer
194 views
I've heard that salt is not meant to be secret, but what if I made it secret? [duplicate]
Possible Duplicate:
Password Hashing add salt + pepper or is salt enough?
How to store salt?
Ok I have been studying a lot about password hashing lately. And I have a few questions. So I ...
2
votes
7answers
396 views
Is it possible to detect password length from hash? Does doubling your password add more security?
Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
25
votes
4answers
1k views
If email is insecure, why do we use it for password resets?
I found myself telling a coworker today "Email is insecure, that's why we developed our secure report application."
But then it struck me, Why is email considered insecure? If it is so insecure, why ...
0
votes
1answer
223 views
Retrieving saved password from Firefox on Linux [closed]
I know there are ways to get the cookies from browsers in Windows and retrieve and decrypt saved passwords from them. Is there a similar way to do so on CentOS?
0
votes
2answers
296 views
Can my ISP know my passwords
If I am using some proxy service, proxy service provider can know my passwords to my online accounts. In which case my ISP can filter my requests and get my passwords to my online accounts? And how ...
3
votes
2answers
200 views
is it easier to get the original password if you have multiple hashes of it?
Most users tipically use the same password for multiple applications. Let's say all of these applications hash the password in some way. Would it be easier for an attacker to get the original password ...
3
votes
0answers
275 views
Can an attacker guess my password length from a hash? [duplicate]
Possible Duplicate:
Possible to detect password length from hash? Is doubling your password adds more security?
Considering I do not provide him any personal information relating to it, are ...
2
votes
1answer
470 views
Security of bcrypt/sha256 key used with AES to encrypt a file
I'm looking to encrypt files using secure hashing and encryption algorithms in Python. Having used bcrypt in the past, I decided to use it for my passphrase calculator, then pass the output through ...
3
votes
1answer
201 views
Is this acceptable login security?
I was logging into a VM on a computer at work. The VM was Linux Debian 2.30.2.
I discovered that I could input my password, followed by garbage, and it would be accepted.
How is this considered ...
3
votes
4answers
186 views
When hashing passwords, is it okay to store the algorithm used right there in the database?
Since hashing password has become a hot topic recently, it is only natural to expect things to change and assume that some time down the road you might want to replace/tweak the algorithm used in your ...
