Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
4
votes
3answers
272 views
password complexity policy for non “English” passwords
In an internationalized application, what is the best practice for a policy on complexity of passwords? I am not having luck searching for the answer. Wikipedia lists these items for password ...
4
votes
4answers
1k views
Are there lists of most common words or ngrams used in passwords and passphrases?
I've been thinking about ways to focus brute forcing dictionary attacks on passwords and passphrases based on the assumption that certain words, combinations of letters, and combinations of words are ...
3
votes
7answers
233 views
Generate user a password instead of asking for one?
I'm trying to weigh the benefits of not allowing users to create their own passwords, but must pick out of a generated selection. Are there any examples of sites that have do use this approach?
...
3
votes
1answer
304 views
Non English password dictionaries
What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
2
votes
1answer
614 views
Please explain Time-step in Time-Based One-Time Password Algorithm
I am studying about OTPs (One Time Passwords). I have gone through all the methods: HOTP (HMAC-based One Time Password), TOTP (Time-based One Time Password)
I have no issues with HOTP. But according ...
2
votes
3answers
399 views
What is the recomended algorithm to create a key from a password?
In my new secret document encryption utility, the key for symmetric encryption = the hash of a random salt and a user provided password.
It is necessary to have a slow hash function in order to ...
2
votes
1answer
12k views
How long to brute-force WPA password?
Bob has a password (for his WPA encrypted wifi) which is 8 characters, all lowercase, and not a dictionary word.
Eve lives next door to Bob and wants to illegally hack his WPA. The number of ...
15
votes
4answers
630 views
If a website allows another person to get a list of the site's users passwords, how likely is it that the passwords are stored in cleartext?
We had an incident where some of our managers were given passwords for the people they supervise using a particular company website. Ostensibly it was done so the managers could check in on the users ...
13
votes
3answers
521 views
What can I do if my bank thinks my date of birth is “known only to me”?
My bank has recently replaced passwords with occasionally asking me information that is "known only to me". Such information includes my date of birth, postcode, and my mother’s maiden name.
...
10
votes
4answers
401 views
Are there state-of-the-art techniques or theory specifically for attacking passphrases over passwords?
With passphrases becoming more and more common based on length being more important than complexity, I'm assuming there must be some work going on involving techniques aimed specifically at cracking / ...
10
votes
2answers
307 views
What problems does this “recover account” procedure have?
On a website I run I have implemented this procedure for account recovery (forgotten password procedure). I would like to know whether there are any issues with it that I have not spotted, that make ...
8
votes
5answers
551 views
Using a weak password on a truecrypt volume
I have put together a portable apps USB stick for when I need to use random site computers, I also threw truecrypt on with an encrypted volume for some word documents.
The password I am using is ...
8
votes
6answers
556 views
Does prepending a salt to the password instead of inserting it in the middle decrease security?
I read somewhere that adding a salt at the beginning of a password before hashing it is a bad idea. Instead, the article claimed it is much more secure to insert it somewhere in the middle of the ...
8
votes
3answers
985 views
Managing website passwords for small team
I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
8
votes
3answers
329 views
Which authentication at the end of the Secure Remote Password protocol?
For the the client and server to prove to each other that they have the same premaster shared key, the original author suggests this:
M = H(A | B | K) -->
<-- H(A | M | K)
...
7
votes
6answers
558 views
Does repeating one word to form a password result in a similar pattern in its encrypted format?
If i use a single word to form a password by repeating it like the examples below:
securesecuresecuresecuresecuresecure
SeCuReSeCuReSeCuReSeCuReSeCuReSeCuReSeCuRe
...
7
votes
2answers
543 views
How does Google not care about “spaces” in Application-specific passwords?
I have recently setup "2-step verification" for my Google account.
One of the features is the ability to create "Application-specific passwords
" for devices that do not support the 2 step process. ...
7
votes
5answers
542 views
Should passwords be truly random?
When generating a password, should it be "truly random" or should I make it a little less random by enforcing some rules?
If a password is generated at random, it could come out all-lowercase letters ...
6
votes
3answers
275 views
An alternative to traditional passwords: is there some merit to this idea?
If you've got a website aimed at people that are not neccessarily technically proficient, letting new users choose their own password isn't very secure because of the simple fact that a lot of people ...
6
votes
2answers
350 views
Implementing Secure Remote Password: Constructing the verifier
The SRP protocol as described in RFC 2945 generates the password verifier:
x = SHA(<salt> | SHA(<username> | ":" | <raw password>))`
v = g^x % N
I have three questions: why use ...
5
votes
5answers
1k views
How can I avoid putting the database password in a perl script?
I have a cronned perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
5
votes
6answers
605 views
Does having a minimum number of digits improve password security?
Some password systems will enforce at least X of a type of character - a common one I see is 'minimum 3 numeric characters'. As far as I understand, simply allowing certain character classes, like ...
5
votes
8answers
678 views
Does truncating the cryptographic hash make it impossible to crack?
I store password hashes in their full value for example, $h = sha256('foo') outputs 64 characters: 2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae
I store that directly in the ...
4
votes
4answers
705 views
Brute-force heuristics used in password cracking
Existing questions on this site discuss some of the heuristics used by password cracking tools to avoid doing a completely naive brute-force search (for example, "dictionary word with number ...
4
votes
2answers
394 views
Storing third-party auth info securely
Suppose there's a multi-user web application that requires access to user's mailbox (on third-party service, like gmail, etc.). This access needs to be persistent. Which means we'd have to store user ...
4
votes
6answers
1k views
Retrieving OSx Keychain passwords
I have a computer forensics style osx login.keychain file that I am trying to find the passwords from.
I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...
4
votes
0answers
1k views
Hints for safe passwords that are easy to remember [duplicate]
Possible Duplicate:
What is your way to create good passwords that can actually be remembered?
What are good hints to create passwords that are both safe and comfortable? By comfortable I ...
3
votes
2answers
100 views
Protecting Password Hashes with Store Procedures?
I was thinking about the recent (seemingly weekly) security breaches we've seen where millions of password hashes have been leaked and I was wondering how one might secure their site against a ...
3
votes
3answers
381 views
Can password-protected zip files be broken without brute force?
You have a zip file that you created with 7z to password-protect it with AES 128. Can a smart adversary extract the data only through brute force, or is the file vulnerable to other attacks - such as, ...
3
votes
4answers
186 views
When hashing passwords, is it okay to store the algorithm used right there in the database?
Since hashing password has become a hot topic recently, it is only natural to expect things to change and assume that some time down the road you might want to replace/tweak the algorithm used in your ...
3
votes
1answer
201 views
Is this acceptable login security?
I was logging into a VM on a computer at work. The VM was Linux Debian 2.30.2.
I discovered that I could input my password, followed by garbage, and it would be accepted.
How is this considered ...
3
votes
3answers
313 views
Unmasking passwords during sign up, is it a good idea?
I just read this article about unmasking passwords at sign up for usability reasons. On the surface it seems reasonable to me, but I'm wondering what additional security concerns that might generate, ...
3
votes
1answer
248 views
Password length limits in history of operating systems and popular web sites
I heard that many years ago for example passwords on linux systems were limited to 8 characters. Or rather, you could type in more than 8 characters, but only the first 8 characters mattered.
...
3
votes
2answers
119 views
What steps can you take to make offline cracking of SRP harder?
In the aftermath of the Blizzard hack, what steps can I take to make offline cracking of SRP more difficult?
My question assumes that your database is already gone and that you implemented SRP more ...
3
votes
2answers
229 views
What is considered a reasonably high iteration count?
I copy-pasted a function that implements the PBKDF2 hashing algorithm in PHP. The function asks for the amount of time that I would want it to loop in order to produce a hash.
Now, I'm wondering, ...
3
votes
6answers
595 views
What are the weaknesses of this password-generation-method? How can it be improved?
I recently came up with the problem, that I have much more accounts, than I'm able to remember passwords. I don't want to use a password-safe, because I cannot access it on another computer, I lose ...
2
votes
1answer
472 views
Security of bcrypt/sha256 key used with AES to encrypt a file
I'm looking to encrypt files using secure hashing and encryption algorithms in Python. Having used bcrypt in the past, I decided to use it for my passphrase calculator, then pass the output through ...
2
votes
1answer
118 views
Password checking in the context of symmetric encryption
It is my understanding that block ciphers like AES don't have any built-in mechanisms to verify data integrity upon decryption, although some modes of operation might provide that.
I played around ...
2
votes
0answers
68 views
How can a service shorten a password if it is not stored in plaintext? [duplicate]
Possible Duplicate:
How can Microsoft validate a shorter password on Microsoft accounts (MSDN)?
My Microsoft password was 18 characters long and when I updated to Outlook.com it started to ...
2
votes
4answers
274 views
Store a password to avoid user interaction
I am creating a windows service that sends email to a user. It uses a Gmail account to send the email, so it needs a password to access the account. It also needs to do this automatically, without ...
1
vote
1answer
144 views
Can accounts still be logged onto if Password Caching is not enabled?
This is kind of an extension of my other question.. If you were not storing any of the passwords locally (caching disabled), would a user some how still be able to circumvent around this security ...
-1
votes
3answers
173 views
find password and iv of an encoded string knowing the decoded string
If I would know the clear and encoded versions of a string could I somehow find the password and.or iv that wore used to encode it?
Encoding done with open_ssl aes-128-cbc.
