Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
3
votes
1answer
201 views
Is this acceptable login security?
I was logging into a VM on a computer at work. The VM was Linux Debian 2.30.2.
I discovered that I could input my password, followed by garbage, and it would be accepted.
How is this considered ...
1
vote
3answers
163 views
Is it a good idea to have a “master” password?
Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
-2
votes
3answers
146 views
What's the use of making users use digits, uppercase-lowercase combination password if the passwords are hashed?
Some websites, even the StackOverflow asks for atleast 1 digit, 1 uppercase character in the password so my question is does this really matter when the developer uses 1 way encryption algorithm to ...
2
votes
3answers
127 views
How to regain access to the server?
I have a Debian server with KVM available 24/7. It was recently broken into and its root password changed.
My hosting provider has restored my access and helped me change the password. But in the ...
3
votes
3answers
150 views
Methods for remembering passwords around the web
What's the least painful way to manage passwords for user accounts that you have on various sites?
I see only 3 options:
Password manager. Passwords can be different and strong, but the downside is ...
4
votes
2answers
755 views
openssl: recover key and IV by passphrase
A large amount of files were encrypted by
openssl enc -aes-256-cbc -pass pass:MYPASSWORD
Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
2
votes
7answers
393 views
Is it possible to detect password length from hash? Does doubling your password add more security?
Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
168
votes
13answers
27k views
Are passwords stored in memory safe?
I just realized that, in any language, when you save a password in a variable, it is stored as plain text in the memory.
I think the OS does its job and forbids processes from accessing each other's ...
2
votes
4answers
375 views
Looking for password manager in company
I was looking for solution everywhere, but maybe because lack of specialized words I can't find it.
I've got a problem in finding a program, but I don't know how to describe it in one word so I'll ...
2
votes
2answers
166 views
In this example why do they hash a randomly generated piece of salt before hashing it with the password?
From here, in the code return substr(sha1(mt_rand()),0,22); what is the point of taking the sha1 value? It is appended to the password and together they are hashed using Blowfish. Why not just append ...
4
votes
2answers
100 views
Does the password you use to sign into a VPN determine the strength?
I subscribed to a VPN service and need to change the password. Does the password I use to log in determine the strength? For example should it be 64 characters long or can it be 10? I'm thinking of ...
2
votes
1answer
131 views
Accessing encrypted data with multiple users
I'm building a web based, LDAP authenticated password manager for internal use.
We don't want to store the passwords in plain-text in the database, and we want multiple users to be able to access the ...
0
votes
1answer
132 views
Storing Private Keys Generated on Server with specific User's Password Securely
I am currently building a system (PHP Web Application Framework) that creates an RSA Key Pair for a user to allow other users to send secure information from one to another. The public key is ...
1
vote
1answer
112 views
Implementing Secure Remote Password with Remote Desktop Application
I had read the Secure Remote Password Protocol paper written by Tom Wu. This protocol is resistant to dictionary attacks. I have also go through some papers regarding to VNC attacks due to weak ...
0
votes
3answers
216 views
Is it possible to change the wifi password with a script?
I was wondering if it is possible to change the password for a wifi with a script instead of having to log-in to the routers firmware?
0
votes
3answers
100 views
Lowest possible threshold for smartphone app login
I am developing an iPhone/Android game app. Currently users must register USERNAME (3 chars min, letters only) + PASSWORD (8 chars min, ascii only) before allowed into the game.
Testing shows some ...
1
vote
3answers
940 views
Is bcrypt better than scrypt [duplicate]
Possible Duplicate:
Do any security experts recommend bcrypt for password storage?
I'm no security expert and do not pretend to be that's why I'm asking here. I write many PHP based ...
3
votes
2answers
214 views
Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password
I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects.
I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
2
votes
3answers
99 views
Alternatives to Common Password Retrieval
Wired wrote an article recently about the top tech fails of 2012 and to no surprise, the password was on the list, more specifically the way a user can retrieve their passwords.
What are some nifty ...
8
votes
4answers
309 views
How to evaluate the strength of a hashing algorithm?
At work the hashing algorithm we use for passwords appears to be bespoke. Obviously that's a pretty bad idea, but the management don't seem bothered.
The algorithm always produces 20 character long ...
3
votes
7answers
230 views
Generate user a password instead of asking for one?
I'm trying to weigh the benefits of not allowing users to create their own passwords, but must pick out of a generated selection. Are there any examples of sites that have do use this approach?
...
7
votes
4answers
527 views
Calculating how secure my password is
I generally use gnuPG for encrypting my files. And as far as I know it's strength ultimately depends on the passphrase I use. So, I would like to know: how can I mathematically calculate how secure my ...
3
votes
2answers
115 views
Doesn't adding requirements to a password, such as must contain 2 digits, decrease the strength? [duplicate]
Possible Duplicate:
Doesn’t imposing a minimum password length make the password weaker by reducing the number of possible combinations?
Doesn't any constraints added to a password policy ...
1
vote
4answers
143 views
Secure login feature with low CPU power
I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
7
votes
5answers
368 views
Are we concentrating too much on password complexity?
As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
3
votes
1answer
132 views
Is a One Time Password Scheme based on Diceware viable and secure?
I recently learned about diceware and was thinking about how it could possibly be used to create a one time password scheme. I'm thinking S/KEY is probably more appropriate, but would a system that ...
1
vote
3answers
164 views
At what point is password complexity “safe enough”
Obviously the best passwords will be highly complex randomly generated passwords stored in a password vault. For the average user though, this might be a slight overkill.
Assuming that the average ...
-2
votes
1answer
374 views
Changing user account passwords from PHP script - vulnerabilities? [closed]
I started a thread a while back asking for suggestions on a good (good=fairly secure) way to allow users to change their account passwords via a PHP script. (WHY? because on this particular server, I ...
1
vote
1answer
170 views
Is this a reasonable approach to “generating” passwords? [duplicate]
Possible Duplicate:
What is your way to create good passwords that can actually be remembered?
I am using a self-developed "template" for my own passwords (like Facebook, Gmail etc.)
I use ...
196
votes
9answers
20k views
Is my developer's home-brew password security right or wrong, and why?
Our developer, let's call him 'Dave', insists on using a home-brew script for hashing passwords. See Dave's proposal below.
We have already researched and adopted an industry standard protocol using ...
0
votes
1answer
141 views
Password protection of encryption and signature keys
I would like to store encrypted backup of text files on my computer. I'm developing a python script using Pycrypto to achieve that, based on this code to use the library. (current code)
The basic ...
2
votes
5answers
164 views
Is there value in storing passwords in their own table with encrypted or hashed keys?
The usual method for simple sites is to store a hash of a user's password right in their user record.
What if the password field is removed from the user table, and a password table is created? The ...
-3
votes
1answer
132 views
What is the highest limit of security in the biggest agencies of the world? [closed]
A general question clicks in my mind, that there are many ways to bypass the security.
So, what is the highest degree of security?
3
votes
2answers
189 views
Is there a site like plaintextoffenders.com that shames companies that force insecure passwords?
I recently came across http://plaintextoffenders.com/ and I liked the idea. I wondered if there was a similar site that shames websites that force insecure passwords?
I personally have a list of a ...
4
votes
2answers
142 views
How secure are passwords that are set via IRC's /nicksrv?
I just registered a nickname on IRC and had to use a password to register it. Given that I've only used IRC, but never understood the P2P mechanics of it, I'd like to know:
Is the password I ...
17
votes
7answers
2k views
Why don't people hash and salt usernames before storing them
Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext.
What I ...
1
vote
2answers
325 views
What should I do if I type my password in the address bar, or type password in google search?
When someone accidentally types his or her password in one of the following three locations and presses enter, what should they do?
username text box
address bar
Google search
What do you suggest, ...
6
votes
7answers
627 views
How can I prevent users from entering bad passwords in my web application?
There is a long discussion on whether it's the responsibility of the user or the system administrator to deal with the strength of the password. Obviously, the password is a very private thing, but ...
3
votes
3answers
135 views
What security factors should I take into consideration when selecting a bank?
I've gotten fed up with my bank and have made the decision to move all of my banking elsewhere. This is a rare occurrence for me and, I suspect, for other people as well. It represents an opportunity ...
3
votes
3answers
581 views
Choosing a session ID algorithm for a client-server relationship
I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
2
votes
1answer
134 views
Updated list of bad/overused passwords [closed]
I am building a website, and I'd like to make sure the users don't put an overused password like password or password1.. or any of these
Is there a place that constantly analyzes hacked websites ...
-1
votes
2answers
101 views
Can 2FA help handle mixed personal and business accounts after leaving a company?
I do not want a super administrator in Google Apps to log to my account after leaving company, so I enabled 2-step verification. He could login to many sites as me with just a link in "forget ...
1
vote
1answer
102 views
How to safely “remember” login information in a program [duplicate]
Possible Duplicate:
How to Securely Implement a “Remember Me” Feature?
I have a program that communicates with a server. The user must log in with the application which runs on their ...
0
votes
0answers
31 views
Password recovery protocol for user account [duplicate]
Possible Duplicate:
Can anyone provide references for implementing web application self password reset mechanisms properly?
I need to create a password recovery mechanism for a user account ...
2
votes
6answers
270 views
Does shuffling a hashed password increase its security?
I am making a web app and I'm now stuck on making the login secure. I'm thinking of adding a salt to a user-inputted password and then hash it. (md5 or sha for example)
and then I will reshuffle the ...
1
vote
1answer
128 views
Is there formal guidance that requires all sessions to be logged off when a user changes their password?
Often when an account is hacked, security guidance is to change your password. However I've noticed that changing a password sometimes isn't enough to log out of other sessions that are active.
Is ...
60
votes
13answers
5k views
VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?
I work for a company which has ~16,000 employees. Periodically, our VP of IT sends out a newsletter with "tech-tips" and misc IT stuff. The topic of this week's newsletter was "password security". ...
3
votes
5answers
505 views
Increased security with keepass
I am using keepass for securing passwords. I have a reasonable password, but if someone got hold of the file I am sure eventually they could brute force it.
I was thinking of using a key file as ...
2
votes
1answer
451 views
Clarification on how rainbow tables work
If you goto : http://www.hanewin.net/encrypt/aes/aes-test.htm
for "Key in Hex" enter
00000000000000000000000000000056
for "Plaintext in Hex" enter
00000000000000000000000000000000
and click on ...
18
votes
5answers
1k views
How valuable is secrecy of an algorithm?
On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
