Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
0answers
47 views

How does restoring lost password with generated pin and help from service line work?

How does this procedure work: http://www2.schneider-electric.com/resources/sites/SCHNEIDER_ELECTRIC/content/live/FAQS/175000/FA175815/en_US/PLC%20Application%20-%20Forgot%20Password.pdf In short: ...
41
votes
3answers
8k views

Paypal sent an email addressing me with one of my old passwords as my name

I got this email from service@intl.paypal.com, with the title: Your account has been limited until we hear from you. I think this is a scam / spoof email because I don't see any notification in my ...
0
votes
2answers
210 views

Are passwords safe to send through POST, without SSL in a iOS app?

Is it safe to post passwords to my web server in this manner? NSURL *url=[NSURL URLWithString:@"http://mywebsite/test/register.php"]; NSData *postData = [post dataUsingEncoding:NSASCIIStringEncoding ...
2
votes
1answer
96 views

Hashed passwords for NTLM authentication

I understood that Windows users' password hashes can be exported very easily. Right? So my question is: If I can have the hashes of other user accounts (e.g. local users on my Windows machine), isn't ...
7
votes
1answer
281 views

How to stop password recovery attempts on accounts?

I am using social networking services such as My Banking GMail PayPal Facebook Twitter Google+ LinkedIn All of these services text messages me a six digit code to login from anywhere, even a ...
0
votes
1answer
94 views

Multi user symmetric key encryption

I realize SIMILAR questions have been asked before but I'm looking for certain specifics I can't seem to find elsewhere. The following question closely resembles mine but falls short for me on ...
6
votes
1answer
144 views

How important is a mysql password for localhost?

We can assume that if an attacker gained access to a web server running mysql that they would be capable of reading the scripts to determine the mysql password. If mysql only responds on localhost, ...
9
votes
6answers
2k views

Should I hash a password if it is randomly generated

The best practice is we should hash a user password using algorithms such as bcrpyt to protect the user, however, given the following conditions, is hashing in the backend still matters? the ...
0
votes
4answers
109 views

Password Hashing Without a Unique Salt

I have a question about password hashing. This is not a question about the the BEST POSSIBLE method of hashing passwords, but rather a more utilitarian question about what is sufficient to hash a ...
1
vote
3answers
105 views

Issuing password information by phone [duplicate]

We have a confidential portal for clients. Historically they have been identified face to face in person and handed a unique token number that is associated with their email address and allows them ...
0
votes
1answer
43 views

Is it safe to use the Keccak Algorithm to create the Key for a Serpent cipher?

I like to store some configuration but would encrypt them with the Serpent cipher. Is it safe to do this? When not, what is a better solution?
1
vote
2answers
120 views

Forced to use using 2-Step Authentication to keep online profiles safe?

I am starting to see a majority of services, websites, and social networks offering the 2-step Authentication like crazy now to protect their users. Also, after reading how the Twitter Account N was ...
2
votes
1answer
77 views

encfs and passwords

I notice that encfs fails to mount a filesystem when a wrong password is entered. However, this capability of detecting whether a password is right or wrong can allow brute-force attacks to be ...
2
votes
1answer
225 views

How do application specific passwords work in Google accounts? [duplicate]

I turned on 2-step verification and had to setup an application specific password for Outlook. I noticed the password generated is actually weaker than the one I had before turning on 2-step ...
1
vote
1answer
128 views

how to use hash passwords to retrieve keys from keystore or access database

How do I hash the password for a keystore? How do I then use the hash to retrieve something from keystore? Similarly, how do I use a hashed password for accessing the database? I have encrypted the ...
0
votes
2answers
66 views

cleartext passphrase for keystore

How is passphrase for a keystore to be stored? we have all passwords encrypted and the key to encrypt is stored in keystore , so how is the passphrase for the keystore to be stored? in clear text? if ...
2
votes
2answers
162 views

Is it important to use a slow hash in htpasswd?

It's my understanding that the purpose of .htpasswd files is to restrict access to some files in the server filesystem. If an attacker gains access to it, he probably has access to everything else ...
-3
votes
3answers
122 views

Hashing credentials. Is hash(email+password) secure enough?

I am working on a client server application where to identify each user I was thinking of storing a single database entry: hash(email + password) In my opinion, this is enough to stop some known ...
2
votes
3answers
193 views

I want to roll my personal cloud hosted Password Manager using pass. How secure/insecure would this be?

I've come to the conclusion that I need to up my security. I currently have a dozen memorized passwords I use for every device and website. I'm against Keypass/Lastpass due to having to trust they ...
0
votes
1answer
83 views

What are the implications of an overly-restrictive password policy? [duplicate]

I came across an interesting password policy online recently: "Please be sure to enter a password that meets the following criteria: must be 8 characters long must not be based on dictionary words ...
2
votes
2answers
201 views

Wifi Sniffing Prevention

I share my wifi with my brother. Recently I came to know he is sniffing on my browsing. Is there a way I can prevent him from sniffing on my browsing? PS: I can't afford VPN.
1
vote
1answer
87 views

Amazon Turk - How secure is it? Strange behavior

I just had this really strange experience with Amazon Turk, where suddenly I was logged into someone else's account. I was logged into the company's Turk account, left my computer for a while, ...
2
votes
2answers
124 views

Does my brokerage/bank use poor password security measures?

I'm no expert. Could someone please tell me if I'm overreacting? After the Heartbleed news broke, I changed a lot of passwords. Here's what I discovered when changing the password on my all-in-one ...
3
votes
2answers
210 views

What should I do when I need to store passwords for usage in 3rd party software?

I have a desktop WPF application which authenticates with Dynamics CRM 2011. I ask for the username and password of the user and use them to connect to Dynamics CRM 2011 using ...
1
vote
2answers
161 views

Which hashing algorithm is ideal for use on the web? [duplicate]

I am new here, and have poked around the site looking for an overview of which hash algorithm to use on the web and why. It seems to be the consensus that SHA-256 or other SHA-2 family algorithms are ...
53
votes
3answers
18k views

How can I create a password that says “SALT ME!” when hashed?

How can I create a password, which when directly hashed (without any salt) with md5 will return a string containing the 8 characters "SALT ME!". The hope is that a naive developer browsing through his ...
0
votes
2answers
146 views

How different should passwords be?

It seems to be generally accepted the same password should not be used for different sites or devices. How different should passwords be? For example +_^gum<JW1 and +_^gum<JW2 are very similar. ...
1
vote
1answer
56 views

How do you manage credentials to multiple remote systems?

We are a vendor that provides software to the healthcare industry, and our application is locally hosted on customer infrastructure. As such, we are provided with VPN access in order to be able to ...
0
votes
0answers
24 views

Length-constant password comparison in scrypt? [duplicate]

E.g.: XORing the candidate against stored then comparing against 0. Do I need to worry? (my question is much in the same style as this question: Does bcrypt compare the hashes in ...
2
votes
2answers
737 views

NTLM/LM Hashes on Domain Controller

I've noticed that when extracting password hashes from a domain controller (using Elcomsoft proactive password auditor) sometimes I'll get LM and NTLM hashes and other times I'll only get NTLM hashes. ...
1
vote
1answer
79 views

Cracking encrypted SQB databases

I've recovered a .SQB SQL database backup file from a backup server and do not have the password. As I do not have the password available to me, I'm looking to determine what type of encryption is ...
1
vote
1answer
93 views

Hashing password for secure storage (generating salt)

I wanted to check if the following means of generating a hash for storage of a password was secure. I have an username and password combo. In order to generate a secure hash, I am doing the ...
0
votes
1answer
48 views

CNN Money Portfolio and Heartbleed [duplicate]

Is/was CNN Money Portfolio ever vulnerable to heartbleed? It states 256 bit SSL bank level encryption on the website..
1
vote
1answer
416 views

What to do with .hash files when cracking WPA2

So, I'd say I'm one level above n00b. I've gotten to the point where I have accomplished a WPA Handshake (and saved the output as xxx-01.cap). I have also downloaded these hash tables (if that is the ...
6
votes
1answer
143 views

What happens if biometric data is stolen?

As we move toward a future where fingerprints might possibly replace passwords, I see one issue. While passwords can be stolen, they can be changed by the owner after being notified of the security ...
3
votes
1answer
384 views

Decrypt Passwords based on using a user's password

I am creating a database to store our client's information at work (a heritage center specializing in DNA based genealogy). Once the results of a test come back, we have people that use the ...
1
vote
1answer
54 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
3
votes
1answer
1k views

Is it safe to sign in to Google with password from desktop app like BlueStacks? [closed]

BlueStacks is an android simulator for desktop. After installation it will ask you to login with your Google account to download and install android app from play-store. My question is "Is it safe to ...
0
votes
0answers
272 views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
2
votes
2answers
283 views

Chinese or “pinyin” wordlists for dictionary attacks

Background: I am currently trying to crack a salted md5 hash which I have recovered from an embedded device running busybox and manufactured in china. I have tried john the ripper using all of the ...
0
votes
2answers
127 views

If bruteforcing a password goes aaa, AAA, aab, AAB, etc, all the way to ZZZ, wouldn't ZZZZZZ be the most secure password?

I'm only taking about security against bruteforce attacks. I assume that most crackers start at a and go up to zzzzzzz for as long as instructed (so it could be zzzzzzzzzzz if told so in the ...
0
votes
2answers
208 views

Securing passwords for REST Authentication

first post on sec so go easy. I'm developing a REST application using the Spring Framework, as as part of the requirements, we have to secure the different functions of the system to different user ...
3
votes
3answers
633 views

Encrypting passwords?

I am planning on creating a text file to store my passwords, so I only need to remember 1 password (at the moment, I have about 20 long/complex passwords in my mind, and am worried that I might forget ...
4
votes
1answer
209 views

Password Managers: encrypted database vs hashing strategy

I'm considering moving to a password-management strategy based on supergenpass or something similar. This is an alternative to other password managers where instead of having a database of passwords ...
1
vote
1answer
222 views

I login to Stackoverflow (vulnerable) with Google (not vulnerable). Do I need to change my password? [duplicate]

According to this heartbleed mass test, Stack Overflow is vulnerable whereas google is not. I use my Google ID to logon to Stack Overflow (and some other sites). Do I need to change my password? In ...
4
votes
1answer
153 views

API to change passwords?

After I learned last week that the login data of some of my accounts was leaked, I had to change my passwords for more than 30 sites. That was tedious! As luck would have it, some days later we ...
3
votes
1answer
119 views

Windows Scheduled Task passwords

When you create a Scheduled Task in Windows, it gives you the option of running the task as a different user, including saving the password. How secure is the password that is stored?
0
votes
1answer
200 views

The Problem with Changing All Passwords for HeartBleed [duplicate]

One thing that's been bugging me in relation to the discovery of the Heartbleed OpenSSL flaw is the recommendation that everyone should run to their computers in a panic and change all of their ...
0
votes
1answer
52 views

Is there an anti virus that protects processes from being injected code to?

As title says, is there an av that does that? And if not, is there any other program that protects processes like lsass in windows, apart from protected process utility in win8.1?
0
votes
1answer
54 views

Handling passwords in wicket

I have a form which contains a password field. In swing the getPassword() method returns a character array. After the password has been processed by my web application the array can be wiped to ...