Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

6
votes
1answer
139 views

Are there any reliable estimates of the password cracking abilities of nation states?

For the purposes of evaluating a hashing algorithm against the threat of a nation state adversary, are there accepted estimates of the password cracking abilities of nation states - or is there an ...
4
votes
1answer
71 views

Resetting the admin password for an application

We have a enterprise application dealing with data. We have one super user (admin) that has the highest level of privileges. The application is not opensource. If some customer has forgotten the ...
8
votes
1answer
684 views

Password manager in not own device

I believe that password managers have a lot of advantages rather than remembering the passwords. So: its time to use them! But I don't want to lose the capability of using my passwords in devices I ...
3
votes
4answers
158 views

Password Policy: Issue random generated passwords / Let the user choose a password

I'm currently thinking about a new password policy. Originally I wanted the users to choose a password that is X digits long, contains numbers, special chars, lower and upper case,... but then I did ...
2
votes
0answers
63 views

Password cracking based on properties of target

Many people base their passwords on some characteristics or properties of their persona, which might not even be included in wordlists used for a dictionary attack. If one would put research into ...
4
votes
1answer
83 views

Password security and entropy - degeneracy question

I have written a short password generator which uses a mixture of words from a dictionary and randomly generated passwords, and I'm wondering if I did the entropy calculations correctly. Usually I use ...
2
votes
2answers
81 views

Prevent Plain-Text Passwords Output by a Script From Being Accessible in the Future

Let's say I have a Bash script that generates a password, creates a new user with that password, and then tells me what the password is: # Generate a password and set it to $PASSWORD PASSWORD=$(tr ...
1
vote
1answer
129 views

WordPress is asking for my FTP password to update. Is this official behavior or am I compromised?

I'm running a personal WordPress server and I have 3 pending updates: WP update from 4.2.2 to 4.3.1. Akismet plugin update to 3.1.5 which addresses XSS issues. Twenty-fifteen theme update. For ...
7
votes
1answer
790 views

“No password hashes loaded” John does not recognise my hashes

I am trying to learn how john works. I made a password-protected rar archive, and written that password inside a file named pass.txt. I used rar2john to build the hash: # more test.hash ...
3
votes
3answers
200 views

Help generating wordlist using crunch

I need to configure crunch so that it produces a wordlist with the following set of rules: Exactly 10 characters long Contains exactly 4 letters, which have to be a-f (all lowercase) Contains ...
6
votes
1answer
324 views

Gmail lets me use my old password

My university's email works through Gmail and I can log on to it either through my uni's website or in Gmail. I recently changed my password and I use it to log in to the schools secure WiFi, school ...
0
votes
2answers
142 views

How to check an open source product for password handling quality?

I just created an account on Magento Commerce, which is an online shop solution. During account creation, I entered a password. Personally I prefer longer, generated passwords that do not contain ...
3
votes
2answers
156 views

How to give “Forgot password” option for a password encrypted file?

I have created a utility that encrypts a file (.txt, .dox, so on...). The utility asks for a password from user at the time of file encryption. Problem Suppose a user has created 1000 encrypted ...
-2
votes
1answer
61 views

generating “non-dictionary” numeric passcodes [closed]

In case of numeric passcodes, e.g. for numeric locks on doors etc, anyone can agree "poor passwords" are ones with specific pattern, e.g. 1234, 1111, 2468, 1122, etc. (as well as ones that form a ...
1
vote
2answers
592 views

What would be the most efficient way of brute forcing a wifi key [duplicate]

I was wondering how can a brut force of my wifi be prevented so I want to know the best technique that can be used to brute force it first, so protection isn't my question. My question is: What brute ...
3
votes
3answers
247 views

Choosing a good password - again

There are many password-related questions in here, but I failed to find the answer to mine. I'm no expert so maybe I don't have the right keywords. Sorry for any duplicate for a possibly asked 100 ...
1
vote
3answers
389 views

What would be a good set of criteria to consider a password safe? [duplicate]

Nowadays we see many websites with a "security meter" for the password. I actually think this is a great feature since it gives the final user the sense of how insecure their password could be. I ...
2
votes
2answers
62 views

Could PKE be used as a better alternative to SRP for authentication?

If I understood SRP correctly, its weakpoint is during the registration of a user when sending the verifier to the server. Let's say the Server knows the PubKey(User) of the User and the User knows ...
2
votes
1answer
124 views

What is the entropy of a password made with pwgen?

pwgen is a unix utility that generates "memorable" passwords randomly. The man page says the entropy is lower than truly random passwords with the same specification. What is the actual entropy of a ...
2
votes
1answer
196 views

Teamviewer and remote logins

Not sure if this has been asked before (a cursory search doesn't show anything), so I figure here is a sensible place to ask. Say I am remotely controlling my desktop at home via Teamviewer. Now ...
3
votes
1answer
471 views

Can I know somehow if my password hash is known?

Is there a secure way to know if my password's hash is publicly known on the internet? First I tried to search for it in Hashes.org (http://hashes.org/search.php), but then I suspected, that if it ...
2
votes
2answers
108 views

Using “Literal” Passwords

Many people, including my friends, use passwords that sound exactly how they sound when responding to a question about what the password is. For example, if person X asks person Y what the password to ...
2
votes
4answers
247 views

If A Password Is Unique, Does It Really Matter How “Strong” It Is?

People seemed to find this "If a Password is Super-Strong Dose it Matter if It's Unique" question very interesting, but it actually reminded me that the converse one is interesting, too: If you use a ...
3
votes
3answers
126 views

Are there risks associated with a strong password reuse for disk encryption?

I understand the risks of password reuse when we share the password with 3rd parties as perfectly discussed under this question: Is password reuse a problem if the password is very strong? However I ...
3
votes
1answer
118 views

How to safely reuse passwords in variation?

Remembering a lot of passwords is difficult. A lot of people use the same or a small set of passwords for everything. Of course, this is very unsafe. If such a password a password is stolen, the ...
59
votes
9answers
11k views

Is password reuse a problem if the password is very strong?

I always read that using the same password on multiple sites is a risk. I'm wondering what is the real reason for this? In my case, I use the same password on multiple sites everywhere. My password ...
2
votes
1answer
120 views

How to “Pass the hash” when LM hash is disabled?

I ran the NTLM_stealer metasploit module and ended up with the following results: LMHASH:Disabled NTHASH:008940f335e9b2ddc182bb5b960a0c5bad0b125cbee3cf84 I was wondering if there is way to ...
1
vote
2answers
149 views

Questions about user authentication over REST API

I'm now trying to implement user authentication on my android app. I, however, have a few questions. I use a REST API. How do I safely request and send data to and from the phone? I'm assuming that I ...
4
votes
2answers
125 views

How does Google or any other social media sites know what password I've used previously?

When I ask to change my password, Google sometimes doesn't allow identical passwords to ones that I've used before. Is there a reason why this happens?
1
vote
1answer
65 views

HMAC password reset link and replay attacks

I like the look of this technique for sending password reset links: https://neosmart.net/blog/2015/using-hmac-signatures-to-avoid-database-writes/ (TLDR: don't store token in database. Send password ...
0
votes
0answers
69 views

Why do websites limit what special characters you use in a password? [duplicate]

Bank of America, to give just one example, only lets you use certain special characters in your password - # and ( and ), but not $. (This is not a complete list, they allow more than that, but it's ...
1
vote
1answer
83 views

Recover 7zip password with partial password matching [duplicate]

I encrypted some files using 7z with AES-256 + file name encryption. The compression level was Ultra, method: LZMA. The password I regularly use is 16 digits. Now the file is not opening. I guess one ...
16
votes
4answers
1k views

Should I be worried if I accidentally entered my password in a username field?

Occasionally I will fail to hit Tab properly when entering a username/password combination. This results in me submitting username "myUsername$ecretPa$$word" along with a blank password. I always ...
0
votes
2answers
98 views

How much more secure would using alt codes in a password make it? [duplicate]

My friend and I were talking about how fast computers could potentially brute force a password these days. I came up with the idea of using letters from a foreign alphabet to use in your password, ...
0
votes
1answer
105 views

Why does healthcare.gov exclude some special characters from passwords?

The site does not allow the following characters: = ?<> ( ) ‘ " / \ & It also limits maximum password length to 20 characters. This makes me suspicious that they might be being stored in ...
1
vote
1answer
54 views

What is a viable time-frame for links that expire? [closed]

Links that expire can be found anywhere from Email Verification to Password Reset procedures, I understand in most cases this is considered "security theater", but wanted to know what a viable ...
0
votes
0answers
163 views

Best way to store a password in a text file

We have a WebLogic server (WLS_APP) with a lot of web applications, we also have an Oracle Service Bus (WLS_OSB) with a lot of services deployed on it. We have these services aggregated in proxy ...
5
votes
1answer
220 views

Correct way of encrypting user passwords

I have a scenario where user entered passwords need to be stored for later use. I cannot use hashing because I need to get the original password for later use. For example, consider an email sender ...
1
vote
2answers
98 views

Email used to log in but doesn't have to be unique. Issues?

I've moved onto a project where they are implementing a system whereby a user's email address can be used multiple times by different people - i.e. users can sign up as many times as they want with an ...
1
vote
0answers
39 views

Key stretching approaches

I've seen that a number of key stretching algorithms and they involved increasing the number of operations needed to compute the key(i.e. the number of rounds within a hash function). But, I wonder if ...
4
votes
2answers
167 views

Does adding a random character to a pseudo-randomly generated password improve entropy significantly?

I'm asking a practical question. I was taught computers are bad at generating random data. Does this mean password generators, such as the one built into Keepass, suck? If yes, then would it help for ...
33
votes
3answers
5k views

Is using the username encrypted with the password as key a good password storage scheme?

On web applications I build I don't hash the passwords. Instead I symmetrically encrypt the username using the user's password and store the result in the password field. I use RijndaelManaged on ...
63
votes
11answers
9k views

Is there any way my password is hashed, if I'm only ever asked to provide 5 out of many characters? [duplicate]

There is a system that, on a login form, presents about 40 boxes for password letters (to hide password's actual length), and only random ones (the same amount each time) are editable. Explanation is ...
2
votes
3answers
257 views

Is it possible to make cracking a password pointless to an attacker with database access?

I've been reading information on making passwords secure, but what are the reasons an attacker would want to put effort into getting the original password? If an attacker does indeed have a copy of ...
1
vote
0answers
70 views

Customized approach to protect plaintext passwords/usernames in database table?

I'm in the process of building an app to let users sign up, connect their many email accounts (like Gmail) to the site, and allow email-related activities... like sending an email (please don't ask or ...
5
votes
2answers
606 views

Should I password protect all my archives from cloud?

I am a student and I didn't care a lot about my passwords strength and my files until now. Now I am thinking about having a backup for all my files in cloud. Questions: Should I password protect ...
17
votes
3answers
2k views

How secure is 7z encryption?

I have a text file in which I store all my bank details. I compress and encrypt it with 7-Zip using the following parameters: Compression parameters: Archive format: 7z Compression level: ...
5
votes
4answers
979 views

Passphrase - what is it exactly?

Well, according to Wikipedia, this is a passphrase; A passphrase is a sequence of words or other text used to control access to a computer system, program or data. A passphrase is similar to a ...
13
votes
4answers
720 views

How does correct grammar affect password security?

When using the XKCD password methodology, entropy is calculated solely on the basis of individual words, assuming that the individual words are independent. This is, of course, not necessarily a valid ...
3
votes
1answer
487 views

Correct way to generate password salts in PHP 5.3 on Linux given my constraints?

In examining our database storage of hashed passwords with salts, I note a high rate of salt collisions, i.e., there are far too many cases where two table rows have the same salt stored. One ...