Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

4
votes
2answers
259 views

How do I protect my passwords from WebBrowserPassView?

I just got shocked with what can be achieved with WebBrowserPassView. It basically shows every password I've saved in my browser (Chrome). I guess other users on my PC could get my passwords that ...
1
vote
1answer
30 views

Passing a hash of a secret to a server instead of the plain text

Instead of passing an authentication token or api key in an http header to a server in the plain text, what if I calculated its hash and passed the hash? This way even if a adversary intercepts the ...
7
votes
1answer
372 views

I stored a copy of my KeePass database on a portable hard drive and I lost the drive. Should I worry about that?

I've been using KeePass for years, and I have a lot of accounts. I need to access them anywhere I work, so I store one copy of my database on a portable hard drive. The drive isn't encrypted. The ...
1
vote
2answers
90 views

Registration Email Hijacking

(Please read the update at the end) I am trying to find out how to send user registration emails securely. I read answers on this question: I don't intend to send passwords in emails, but I was ...
6
votes
2answers
201 views

Migrating password db off MD5 by chaining MD5 and Bcrypt?

I have a legacy system currently storing unsalted MD5 passwords. Unfortunately, some other controls are not in place (like the ability to expire passwords) and I'm trying to upgrade my algorithm to ...
2
votes
2answers
114 views

Are there any examples of huge damages done by password leaks, or bad password management policies? [closed]

Everybody knows that a strong password is very important. However, I can't find any citable public example of any kind where a user or users suffered a heavy loss from using bad passwords, or their ...
3
votes
2answers
124 views

What scenario are 'extra' strong passwords and hashing algorithms actually protecting against?

Note: I completely understand the need for strong passwords & I understand that there is an issue of speed with hashing. I am just interested in better understanding the actual negative impact of ...
3
votes
5answers
637 views

Why can passwords be used to encrypt data, but are less strong for authentication?

Encryption software is often password based. Even if the adversary gets your computer they can't get the data without knowing the password, and bruteforcing is infeasible. Websites use passwords to ...
1
vote
1answer
53 views

How many possible randomly generated salts could be generated using PHP's password_hash() function?

I have two questions here: 1) How many possible randomly generated salts could be generated using PHP's password_hash() function? 2) According to php.net it states that the return value is a ...
3
votes
1answer
539 views

Recover password from .pfx file

I have an old Windows SmartClient application that is published with a signed certificate (a .pfx file). We want to extend the expiration date to more than one year. I've used a program called ...
2
votes
1answer
73 views

Password sent over TLS: threats other than TLS compromise?

One of my findings during a security audit was a password, sent as is over the network. As bad as it sounds, this happens only over HTTPS connection. Some authors suggested here that additional ...
1
vote
3answers
130 views

Why shouldn't I use an old password? [duplicate]

Some services like Google or Facebook forbid me to use a password that has already been use for the same account in the past. My question is, if this old password was never compromised (i.e it was ...
7
votes
1answer
87 views

What's the most secure way to circumvent encryption to enable password recovery?

I have a web app (which I've talked about here before). Users can use it to save people's contact details. These contact details are encrypted to ensure that they are difficult to get at if they're ...
7
votes
3answers
221 views

Authenticating a user via SMS

I'm involved in a project that's building a chat-bot that users can communicate with via SMS from their mobile phones. We'd like the users to be able to use the bot to do some basic account-management ...
3
votes
1answer
76 views

Creating accounts on sites with no security?

I'm sort of confused about security on some sites. Here on stackexchange.com, for example, seem to have no security normaly, but as you log in or create an account, it uses keyexchange and an ...
9
votes
1answer
152 views

Handling “forgot password” functionality with encrypted data without security questions

As a sort of follow-up to this question on handling password-reset functionality when dealing with encrypted user data, is there any good method for resetting a user's password in an encrypted web ...
24
votes
5answers
1k views

Would turning a Diceware phrase into a sentence decrease its security?

Diceware passphrase lengths are on the rise - up to six or seven words now. The old adage that passphrases are easier to remember may be true for shorter phrases, but six truly random words can be ...
6
votes
2answers
154 views

Is it good to store passwords in a separate table/database and manage them in a separate process?

I'm quite a newbie at systems architecture and security so I just want to check that this plan makes sense. I'm building a web app and I need to store a password for each user. I've already read ...
20
votes
4answers
2k views

When encrypting cloud-stored data, is it acceptable to use the user's account password?

I'm developing a web service that stores sensitive personal information (such as telephone numbers, addresses, full names, and email addresses) in a database, such that it can be accessed from ...
0
votes
1answer
305 views

How long will it take to break a salted password?

Let's say that I have a system where all passwords must be 8 characters long and each character can be any 32 different values. All my passwords are hashed with a salt. I can test 64 passwords per ...
2
votes
2answers
120 views

Where to store a pepper?

Assuming you're using a pepper in your password hashing, where should it be stored? I know you shouldn't store it in the database since it can easily be found there during a dump and the idea is to ...
0
votes
1answer
101 views

How to conceal a computer in operation with a separate logon password? [closed]

Goal: Disallow people physically near the computer to see its operations. No password to start the computer. But, I'd like to conceal the screen after startup and all programs loaded. Because of the ...
-1
votes
2answers
81 views

Creating secure passwords [duplicate]

I have been tasked with writing a random password generator to be used on a series of throw away accounts. In this scenario, the accounts need to be very secure and will be deleted after a single day ...
81
votes
10answers
10k views

Is there a threshold for a password so long it doesn't get any more secure or even becomes insecure?

I always hear "A long password is good, a longer password is better". But is there such a thing as a "Password is so long it is becoming unsafe" or "Password is long enough, making it longer won't ...
4
votes
1answer
101 views

Is it possible to use parallelism when computing a key derivation function for a single password/key?

Suppose I have an AES-256 encrypted file, and I want to derive the key using PBKDF2 and a given salt with a large number of rounds (say 1 million), but I'm limited by user tolerance for UI lag when ...
-10
votes
6answers
190 views

Is the password FFFFFggggg&&&&&22222 safe from being guessed? [closed]

It is 20 characters long, mixes alphanumeric and special symbols. It is one among ** 20.
7
votes
2answers
1k views

philosophical: restricting the password space increases security

This is more of a philosophical question. Suppose that you are trying to choose a good password for a particular online service, say your bank's e-banking service. Now the bank has some restrictions ...
51
votes
4answers
5k views

Why submit a website to plaintext offenders?

I've read this question and to quote from the accepted answer Besides that, by submitting the site to plaintext offenders, you will provide a third-party point of view, which might help your case....
4
votes
3answers
129 views

Is emailing a password recovery code as bad as emailing a password in plain text? [duplicate]

I am creating a mobile app where my password recovery feature involves sending a password recovery code (randomly generated string) to the user's email address. They get the code, then enters it ...
8
votes
2answers
135 views

How can I enforce strong password policy with non-technical user base?

I've been using zxcvbn to enforce strong passwords for a service where break-ins would cause considerable problems. However, the service is only viable if many users sign up. We've found that users ...
3
votes
3answers
111 views

Is it insecure to reveal if a password is being used for another account after a set period of time?

Password reuse can be considered a pandemic of security. The obvious way to fix this is to encourage people to use password managers, but (comparatively) few people actually do. My idea is to have ...
-1
votes
1answer
108 views

Do you consider PWGen safe to use?

Do you consider PWGen safe enough to use? What do you use to make truly random password. PWGen should be using "movement of your mouse" to make it really random, right?
141
votes
5answers
10k views

What to do if stuck with website that has poor security?

I have a student loan account with a company, not the biggest company but big enough to where they should have their act together. Today I couldn't remember my password to log into my account ...
4
votes
5answers
326 views

Recommended level of password complexity for Keepass

I want to start using a Keepass master password that I can easily remember. Let's take this sentence: I really hate blue mountains, and let's make it one password: ireallyhatebluemountains. Is this ...
3
votes
1answer
63 views

Membership.GeneratePassword

I am looking for a method to generate a onetime password for provisioning purposes in ASP.NET-MVC. I came across the Membership.GeneratePassword which is in the System.Web.Security namespace. Is this ...
4
votes
1answer
82 views

Is limiting/cutting password-length without notice insecure?

I have encountered that our linux system cuts the length of every password to a certain length, after that length every additional character seems to be ignored. Does this make our linux system more ...
3
votes
3answers
190 views

Prevent password reusing across different sites

I'm generally against too strict or complex rules to accept passwords (rules like "It must contain at least one upper-case character, one number and one symbol" and things like that, see also XKCD #...
4
votes
1answer
154 views

Is using OAuth for login less or more secure than maintaining your own passwords?

Pros: The complexity in managing passwords is maintained by a company with stronger security policy. Let's assume they secure passwords properly. The user doesn't have to maintain yet another ...
3
votes
1answer
49 views

Single randomly generated passphrase for both identity and authentication

There are questions about using a password only to identify and authenticate a user, rather than an email address or username plus password: Why do we authenticate by prompting a user to enter both ...
1
vote
1answer
54 views

What are the advantages of a ZKP authentication system?

So, I read somewhere that Zero Knowledge Proof based authentication is good because it makes sure that the server does not store your password and neither is your password being transmitted over the '...
3
votes
4answers
219 views

Are limited length passwords a security risk? [duplicate]

I found a webpage where users can be registered. However, it seems that the length of the password must be between 6 to 12 characters. Is that a security risk?
0
votes
0answers
15 views

Are excessively strong password requirements counter-productive? [duplicate]

Some sites have strong requirements. E.g. Your new password must: be at least 8 characters long (longer passwords are more secure) contain at least 1 uppercase character contain at least 1 ...
2
votes
1answer
69 views

php's password_hash with system wide salt [duplicate]

I'm thinking about using password_hash function for generating password hashes. I have read that own salts shouldn't be generated and instead use the default one that the function generates. Own salts ...
1
vote
2answers
72 views

How can i Identify and use hash function given enough text and their hash?

So, I have this old program currently in use, as i have access to the database i have adopted all data i need except the user passwords.. Now users will provide me with the plain text password and ...
2
votes
2answers
98 views

When is a group password for a closed circle of users acceptable?

I am developing a tool for a company, that takes some technical data and creates PDF reports. In the tool you have several text fields, which get filled by the database. If the user wants to, he can ...
6
votes
1answer
179 views

When I register on a website, is there a way to know whether or not the site admin will be able to see my password? [duplicate]

It seems to me that whenever I register on a website, there is absolutely no guarantee that the administrator will not be able to decrypt and view my password (if they even bother encrypting my ...
4
votes
1answer
93 views

Android auto complete and passwords

I have an Android phone and when I enter a password in a password field (bank application or other), the auto complete system proposes to complete the password. I expected password not to be saved by ...
64
votes
13answers
9k views

Should I allow browsers to remember my passwords and synchronize them?

I wonder, how wise is it to allow Chrome and Firefox to a) remember the passwords b) synchronize them? My gut tells me that if it's not man in the middle who can intercept them, but Google and Mozilla ...
0
votes
1answer
90 views

Checking a salted hash against known password?

I've created a mysql dump of my users and passwords and awked them into a presentable form: Passwords: '...
9
votes
3answers
1k views

Client-side BCrypt, store salt and hash separately in MySQL database [duplicate]

I’m developing an Android app with a MySQL database for storing user login credentials. I’m using jBCrypt for hashing passwords before storing them in the database. On registration, the password is ...