Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

27
votes
5answers
5k views

Length of passwords that are rainbow table safe

With large computing power (like what you can get in the Amazon cloud for example) you can generate huge rainbow tables for passwords. There also seems to be some large rainbow tables reachable that ...
0
votes
1answer
82 views

How can I tell if my ISP account password is encrypted?

How can I be sure my ISP encrypts my account password? I found out accidentally that mine did not. I had called to report an interruption in service, and in the process of "troubleshooting", the ...
1
vote
0answers
79 views

Trusted Platform Module (TPM) secure password

I'm trying to set secure Trusted Platform Module (TPM) passwords on a network and would like to set it to the maximum length possible. How long can the TPM's password be? Is it limited by bits or by ...
42
votes
9answers
5k views

Can users make use of a password manager when banks tell them never to write passwords down?

Consider a user who wants to use a password manager for their banking passwords. Advice from banks usually says they should never write down their password. The user would be concerned about going ...
1
vote
2answers
152 views

How do I generate a word list from a known seed word? [duplicate]

I've lost my master password. Not all is lost as I know the original word that generated the password: It was generated by a random case switching for consonants and random vocal to numbers. For ...
2
votes
1answer
125 views

Should a space in a password count as a symbol when checking for complexity?

There is no doubt in my mind that spaces should be allowed in passwords. I see some websites disallow spaces, symbols in passwords and even enforce minimum length which seems t otally nonsensical to ...
1
vote
1answer
1k views

Why is it considered safe for services like Mint to store bank password?

My understanding is that, typically websites are recommended to store only hashes of passwords using one-way cryptographic hash function. This way, there is no way to retrieve the passwords even when ...
1
vote
1answer
54 views

Storing encryption passphrases in memory in Dalvik?

Given KeePassDroid, I'm considering some of the security implications of accessing KeePass databases on an Android device. In the native applications for Windows, OSX, and Linux, whenever the ...
2
votes
1answer
149 views

Is there more risk in changing administrator password locally vs from a centralized location?

I'm working on a mechanism to better handle group policy passwords in response to MS14-025. We formerly used this mechanism for setting the local admin account passwords on our workstations (primarily ...
0
votes
0answers
40 views

Is there a FIPS 181 like standard for random password generation with alphanumerical seed?

NIST recommends FIPS 181 as a random password generator for "easy to remember" passwords. As far as I understand the standard: it will generate a password that is lowercase, and with some ...
3
votes
1answer
69 views

SAML, and forcing a re-authentication

I have a use case forced upon me by industry regulation. I wish it wasn't there, but it is. A user logs in to my service, navigates around, etc. The user can perform many actions, but one of the ...
3
votes
4answers
228 views

Ethical brute force demo on a web login when knowing the password complexity requirements

We are currently having accounts compromised at a substantially high rate. Some in the organization believe that our password complexity requirements is enough to thwart brute force attacks. I wanted ...
38
votes
2answers
5k views

Is it good practice to ban an IP address if too many login attempts are made from it?

Since an IP address does not necessarily represent a specific device, but probably a whole network/company/etc. does it at all make sense to block an IP address if there is a significant amount of ...
1
vote
1answer
101 views

Is there anyway to generate a SAM file?

I was wondering if it is possible to create a windows SAM file. I already tried using chntpw but it seems like it only works under a Redhat based linux, ie I was able to blank/change a Windows 7 ...
1
vote
1answer
117 views

Exploiting Writeable SNMP

So, I've come across a couple of devices that are using default writable community names for SNMP such as 'private' (on windows machines) and 'Secret c0de' (on Brocade switches). I'm aware of the ...
15
votes
2answers
539 views

Can client-side hashing reduce the denial-of-service risk with slow hashes?

When storing user's passwords that you need to verify against (but not use as plaintext) the current state of the art is: Hash the password Use a salt Use a slow hash function - bcrypt, scrypt, etc. ...
4
votes
3answers
208 views

Why use Keepass, etc. if all your passwords are in one place?

I'm a firm proponent of using a password manager like Keepass to generate and store secure passwords. I also encourage others to do the same. But there's always one person who says they'll never use ...
0
votes
1answer
159 views

How compromised should I assume my computer is?

I had turned ssh on a while ago to do some remote work, and didn't turn it off (yes, I'm an idiot). I was just looking over some netstat info when I noticed someone had established an ssh session with ...
0
votes
2answers
99 views

How secure would this method be considered for password storage

Ok I am currently storing the passwords in most secure way I could think of. With use of Encryption and Hash. The passwords are first generated by user as plain-text with minimum length of 6 ...
0
votes
2answers
306 views

Automated software hackers use to try passwords

Because of the eBay hacking, I had to go and look for other accounts that I have used the same password to change the passwords on those site as well. (I know that it's very bad to have same passwords ...
1
vote
3answers
123 views

Touch tone phone username and password

I just got off the phone with Fidelity, who manage the health benefits for the company where I work. Before talking to a person, I was prompted to enter my username and password on the numeric keypad: ...
1
vote
1answer
173 views

Any reason I shouldn't be salting and hashing before putting through bCrypt?

I've been reading up on password storage and such, and have come to the conclusion that I need to be using bCrypt. I've got an implementation working correctly, but I'm wondering the best way to move ...
0
votes
2answers
81 views

Precise measurement of password complexity

I am thinking on a system, which measures the complexity of a password not based on its entropy or compressibility, but with a simply sophisticated method. The measurement of the ...
1
vote
1answer
104 views

Challenge-response login without storing a password equivalent

A problem with many challenge-response login systems is that the server has to store a password equivalent. For example, if the server stores SHA1(salt + password), and an attacker captures that hash, ...
3
votes
3answers
193 views

How can a site know about insecure password?

I received an email from my web host recently that informed me I had an "insecure" password on one of my email accounts and that I had to change it. Their definition of what a secure password is as ...
14
votes
2answers
1k views

How many passwords does the average user know?

Looking for research on the count and complexity of passwords that an average user is actively using. Note: Also, just to be clear, by research, this is not a request for you to respond with an ...
1
vote
2answers
91 views

What impact do the frequency of password resets have on password reuse?

Wondering if there's any research behind the most common password reset cycle I've seen of 90-days, and if there's any research that gives any insight into how to optimize password resets to reduce ...
1
vote
3answers
104 views

Is it possible to have a high confidence that a password is not being reused?

Have a few thoughts on the topic, but the general gist is if a user inputs a new password, is it possible to have a high confidence that a password is not being reused elsewhere? By elsewhere, I mean ...
0
votes
1answer
75 views

Should a Mobile app able to check what password is locally saved via a user facing feature?

I'm working at a company who is currently working to secure their mobile app (iOS native) by adding check points to security sensitive screens on the device (data is stored in the iOS keychain). User ...
169
votes
7answers
37k views

Why would you not permit Q or Z in passwords?

Jetblue's password requirements specify that, among other stringent requirements: Cannot contain a Q or Z I can't fathom a logical reason for this, unless it were say, extremely common for the ...
3
votes
0answers
375 views

A Google owned IP address accessed my outlook account [closed]

Today I got a warning from Microsoft saying that there was unusual activity on my account. Diving deeper I saw that there was a successful sign in from a Google owned IP address (according to ARIN). ...
3
votes
2answers
133 views

MySQL ENCRYPT salt is not random?

I know there's little reason to still use ENCRYPT() nowadays, what with bcrypt being almost ubiquitous and MySQL providing better hashes such as SHA1. But while dabbling with ENCRYPT() on MySQL ...
2
votes
1answer
417 views

Hydra bruteforce and JSON

I am having problems with Hydra and a JSON payload. The login request (intercepted with Fiddler), is the following: POST http://architectureservice.test.com/api/v1/login HTTP/1.1 Host: ...
3
votes
1answer
95 views

How does “Google password monitoring” work?

Google Apps has a feature to monitor users' password strength and notify administrator about it. Google help says: View the length of each user's password along with a graph showing its relative ...
3
votes
2answers
978 views

Is it a good idea to store Email addresses as hash only?

I am currently building a web service at http://write-math.com similar to http://detexify.kirelabs.org/ that should help users to get LaTeX code from drawn formulae. It is part of my bachelors thesis ...
1
vote
3answers
68 views

Is it ok to use the same password for many services with two-factor authentication?

Let's say that I've a relatively strong password, but I don't want to use many different passwords for each different service, and let's say that those services provide two-factor authentication using ...
8
votes
3answers
1k views

Logging “password with counter” use

When prompted to update their passwords after they've become stale (whether that's after 30, 60, 90 days — whatever is implemented by policy), many users simply increment the number that they may have ...
0
votes
0answers
50 views

How does restoring lost password with generated pin and help from service line work?

How does this procedure work: http://www2.schneider-electric.com/resources/sites/SCHNEIDER_ELECTRIC/content/live/FAQS/175000/FA175815/en_US/PLC%20Application%20-%20Forgot%20Password.pdf In short: ...
41
votes
3answers
8k views

Paypal sent an email addressing me with one of my old passwords as my name

I got this email from service@intl.paypal.com, with the title: Your account has been limited until we hear from you. I think this is a scam / spoof email because I don't see any notification in my ...
0
votes
2answers
233 views

Are passwords safe to send through POST, without SSL in a iOS app?

Is it safe to post passwords to my web server in this manner? NSURL *url=[NSURL URLWithString:@"http://mywebsite/test/register.php"]; NSData *postData = [post dataUsingEncoding:NSASCIIStringEncoding ...
2
votes
1answer
106 views

Hashed passwords for NTLM authentication

I understood that Windows users' password hashes can be exported very easily. Right? So my question is: If I can have the hashes of other user accounts (e.g. local users on my Windows machine), isn't ...
7
votes
1answer
302 views

How to stop password recovery attempts on accounts?

I am using social networking services such as My Banking GMail PayPal Facebook Twitter Google+ LinkedIn All of these services text messages me a six digit code to login from anywhere, even a ...
0
votes
1answer
101 views

Multi user symmetric key encryption

I realize SIMILAR questions have been asked before but I'm looking for certain specifics I can't seem to find elsewhere. The following question closely resembles mine but falls short for me on ...
6
votes
1answer
150 views

How important is a mysql password for localhost?

We can assume that if an attacker gained access to a web server running mysql that they would be capable of reading the scripts to determine the mysql password. If mysql only responds on localhost, ...
9
votes
6answers
2k views

Should I hash a password if it is randomly generated

The best practice is we should hash a user password using algorithms such as bcrpyt to protect the user, however, given the following conditions, is hashing in the backend still matters? the ...
0
votes
4answers
121 views

Password Hashing Without a Unique Salt

I have a question about password hashing. This is not a question about the the BEST POSSIBLE method of hashing passwords, but rather a more utilitarian question about what is sufficient to hash a ...
1
vote
3answers
105 views

Issuing password information by phone [duplicate]

We have a confidential portal for clients. Historically they have been identified face to face in person and handed a unique token number that is associated with their email address and allows them ...
0
votes
1answer
43 views

Is it safe to use the Keccak Algorithm to create the Key for a Serpent cipher?

I like to store some configuration but would encrypt them with the Serpent cipher. Is it safe to do this? When not, what is a better solution?
1
vote
2answers
122 views

Forced to use using 2-Step Authentication to keep online profiles safe?

I am starting to see a majority of services, websites, and social networks offering the 2-step Authentication like crazy now to protect their users. Also, after reading how the Twitter Account N was ...
2
votes
1answer
86 views

encfs and passwords

I notice that encfs fails to mount a filesystem when a wrong password is entered. However, this capability of detecting whether a password is right or wrong can allow brute-force attacks to be ...