Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

27
votes
11answers
6k views

One liner to create passwords in linux?

How do you create a readable password using bash with one line? What if i'm looking for 128 bits of entropy? EDIT By readable I mean the 94 printable ascii characters (without space). It can use ...
27
votes
5answers
7k views

Is Linux really that secure, with only root password denying external access?

While I was searching online for information about Linux security, the most typical explanation was: Linux is secure, because the root password is required to access the kernel and install new ...
27
votes
8answers
3k views

Best way to administer all my passwords

I am trying to figure out what the best solution is to store different types of passwords: Personal passwords (my personal email, my company's email, all the services I use to buy things like ...
27
votes
3answers
2k views

Does password-protecting a server's BIOS help in securing sensitive data?

I'm running a server of which I protected the BIOS with a password. One doesn't have to enter this password before booting, but before entering the BIOS setup. I just did this from routine. However, ...
27
votes
2answers
1k views

Does versioning an encrypted file make it less secure?

Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices. The kdb file in itself would be encrypted, but ...
27
votes
3answers
4k views

MD5 collision attacks: are they relevant in password hashing?

DISCLAIMER: This is not an endorsement of MD5 as a password hashing function. I know about parallelization, GPUs, and dedicated password hashing functions like bcrypt and scrypt. With that out of ...
26
votes
6answers
7k views

Are passwords that are manually typed in really unrecoverable from memory or disk?

As part of an increase in the security measures for our company, we're moving to making sure all password logins (databases, servers, etc), are done through a password prompt and never using stored ...
26
votes
8answers
3k views

Why is password hashing considered so important?

After reading this article, I can see the benefits of password hashing as a second layer of defence, in the event of an intruder gaining access to a password database. What I still don't understand is ...
26
votes
5answers
4k views

How does storing hash passwords work? [duplicate]

In usual network applications, that employ password hashing, is the user password hashed on client side before sending it to the server, or is it sent without hashing as encryption of plain text ...
26
votes
3answers
4k views

For an HTTPS web application, is it worthwhile to encrypt the password before POSTing it, to keep a MITM attacker from harversting it?

Our application has recently gone through penetration testing. The test found one critical security breach, which is essentially: The problem: Attacker sets up a WiFi spot. User enters our site ...
26
votes
12answers
8k views

How secure are passwords made of whole english sentences

I often read as an advice to build strong passwords, just to think about a sentence and then take the initial letters. For example take a nonsense sentence like "I watch Grey's Anatomy at 9.40" gives ...
26
votes
2answers
20k views

Why are GPUs so good at cracking passwords?

What is it about GPUs that lets them crack passwords so quickly? It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
26
votes
6answers
4k views

Why do some sites prevent users from reusing their old passwords?

I have always wondered why it is that bad to reuse old passwords; it should not be the end of the world if we happen to use an old password that we previously used. After all, I believe most of the ...
26
votes
5answers
5k views

Security impact of using a public password for free WiFi

We have a WiFi network that we want to be public and free. Does having a password that is known to everyone provide any additional security advantage to the people using this network as opposed to ...
26
votes
5answers
3k views

Should passwords be revealed in error message?

I am having pet-peeve with PHP's PDO class. As you can see on the Warning note: it reveals database password by default if an exception was not caught (when display errors is on which is a probable ...
26
votes
1answer
3k views

Facebook password lowercase and uppercase

Recently I logged into my Facebook account and then noticed that my caps lock was on. So I tried to log in again with and without capslock on. I got in both times. Then I tried to log in with the ...
26
votes
5answers
3k views

How can I choose a strong password that is easy use on a smartphone?

Typing on a smartphone is tedious. Special characters are the hardest; lowercase letters are generally the easiest. But even a long all-letter passphrase like "correct horse battery staple" is ...
26
votes
6answers
3k views

Are there secure alternatives to single-use password reset links?

We currently have what I believe to be a pretty standard scheme for dealing with password resets. Our reset links are single-use links: They expire immediately after they've been visited, even if the ...
25
votes
10answers
7k views

Two passwords for one account

Would it be a good idea if you had one account which would require two different passwords ? For example your login details were: email: example@gmail.com password 1: P4$$w0rd1 password 2: ...
25
votes
4answers
4k views

What to transfer? Password or its hash?

Let's say in my database I store passwords hashed with salt with a fairly expensive hash (scrypt, 1000 rounds of SHA2, whatever). Upon login, what should I transfer over the network and why? Password ...
25
votes
6answers
5k views

Source code as password

Passwords with a mixture of letters, numbers, and special characters are sometimes hard to remember. Is it secure to instead use a small amount of memorable source code as a 'passphrase'? As an ...
25
votes
3answers
18k views

Is bcrypt better than scrypt [duplicate]

Possible Duplicate: Do any security experts recommend bcrypt for password storage? I'm no security expert and do not pretend to be that's why I'm asking here. I write many PHP based ...
25
votes
6answers
3k views

Do spaces in a passphrase really add any more security/entropy?

I often see passphrase suggestions written as a sentence, with spaces. In that format are they more susceptible to a dictionary attack because each word is on it's own as opposed to a large unbroken ...
25
votes
10answers
6k views

Best password strength checker

In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or ...
24
votes
8answers
23k views

Why do people still use/recommend MD5 if it is cracked since 1996?

It's still commonly recommended way of hashing passwords, even if it's insecurity had been proven in 1996 Therefore we suggest that in the future MD5 should no longer be implemented in ...
24
votes
6answers
2k views

Online password managers

Can online password managers be used for storing and managing passwords? I mean from the security point of view. I understand that those systems can be different and some deserves more trust than the ...
24
votes
4answers
6k views

What is the purpose of the “Password minimum age” setting?

What additional security can a "password minimum age" provide? For example: the user can change their password only after 24 hours have elapsed since the last password change.
24
votes
10answers
7k views

Intel How Strong is Your Password page, good advice?

I came across this Intel How Strong is Your Password? page which estimates how strong your password is. It has some advice on choosing better passwords including that you should use multiple ...
24
votes
3answers
5k views

Security of LastPass + YubiKey

I'm looking at password manager solutions and came across LastPass. I see they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What are ...
24
votes
10answers
6k views

Password Management within an Organisation

Within an organisation there are many passwords such as those for root accounts on servers, hosting accounts, router logins and other such things, that need to be kept track of. I know in some ...
24
votes
4answers
7k views

How secure is NOPASSWD in passwordless sudo mode?

On all our boxes we have ssh access via keys. All keys are password protected. At this moment the sudo mode is not passwordless. Because the number of VMs are growing in our setup, we investigate the ...
24
votes
5answers
3k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
24
votes
1answer
7k views

Can a dictionary attack crack a Diceware passphrase?

Everyone knows the words used in Diceware passwords (all 6^5 = 7776 words are published) -- they're all common words. Everyone seems to know that we're not supposed to use dictionary words for ...
24
votes
5answers
1k views

Would turning a Diceware phrase into a sentence decrease its security?

Diceware passphrase lengths are on the rise - up to six or seven words now. The old adage that passphrases are easier to remember may be true for shorter phrases, but six truly random words can be ...
24
votes
5answers
37k views

How secure is WD MyPassport lock

I have a WD My Passport hard drive. There is an option that allows you to lock your hard drive with a password. How secure is this lock? They don't give details about the encryption algorith or the ...
24
votes
5answers
2k views

Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?

I just wanted to know if you can increase the cost (iterations) of those two algorithms off-line. I want to increase the cost every year of my users passwords. One solution is to recalculate them ...
24
votes
2answers
1k views

Can client-side hashing reduce the denial-of-service risk with slow hashes?

When storing user's passwords that you need to verify against (but not use as plaintext) the current state of the art is: Hash the password Use a salt Use a slow hash function - bcrypt, scrypt, etc. ...
23
votes
7answers
9k views

Why don't people hash and salt usernames before storing them

Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext. What I ...
23
votes
5answers
2k views

When hashing passwords, is it ok to use the hashed password as the salt?

I don't like this idea. But I can not come up with a technical argument against it. Can somebody explain it to me? The basic idea is: $passwd = 'foo'; $salt = hash($passwd); $finalHash = hash($passwd ...
23
votes
4answers
5k views

Why did Richard Stallman recommend not to use passwords for wireless networks? [closed]

In a short interview, Richard Stallman recommends not to put passwords on your wireless network. In the OS Revolution documentary he also mentions how he's disliked passwords ever since his job at MIT ...
23
votes
3answers
3k views

Should I have a maximum password length?

I'm creating a webapp, and part of my authentication method is password length. Should I put one in place? (say, 50 characters?) Or should I just put a minimum length (Currently at 6). Are there ...
23
votes
4answers
20k views

Possible to use both private key and password authentication for ssh login?

It seems that they are mutually exclusive, as disabling one gives me the other, and vice versa. Two-factor auth for my ssh servers sounds really nice, so is there any way to accomplish this?
23
votes
1answer
2k views

Why does Facebook bother comparing old and new passwords?

An answer to this question says Facebook generates a bunch of password guesses to see if they hash the same as a previous version of the password. Why bother? If a service forces every password to ...
23
votes
2answers
3k views

Passwords in plaintext?

I'm doing some research on the App of my telephone operator. I started Burp Suite on my Mac in proxy mode, I opened up the App on my iPhone and started to sniff some traffic. I pressed the "login" ...
23
votes
4answers
12k views

Confused about (password) entropy

There seem to be many different 'kinds' of entropy. I've come across two different concepts: A) The XKCD example of 'correcthorsebatterystaple". It has 44 bits of entropy because four words randomly ...
23
votes
4answers
2k views

Should I be worried if I accidentally entered my password in a username field?

Occasionally I will fail to hit Tab properly when entering a username/password combination. This results in me submitting username "myUsername$ecretPa$$word" along with a blank password. I always ...
23
votes
4answers
4k views

How secure is Snowden's MargaretThatcheris110%SEXY password?

In an extra from Edward Snowden's interview with John Oliver, Snowdon advises that a good password to use is one such as MargaretThatcheris110%SEXY.. Also, on the Errata Security blog, Robert Graham ...
22
votes
13answers
4k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...
22
votes
4answers
9k views

Should I change all my passwords due to heartbleed [duplicate]

Should I change all of my online passwords due to the heartbleed bug? Edit: I found a list of vulnerable sites on GitHub and checked all my critical sites. Everything I was really concerned with ...
22
votes
5answers
4k views

Does too long a salt reduce the security of a stored password hash?

Suppose we have passwords that are statistically 7-8 characters long. Is appending a 200 character long salt less secure than a 5 character salt, because of the similar hash function inputs? I was ...