Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
10
votes
7answers
417 views
Does adding dictionary words to passwords weaken them?
This might sound like a stupid question, but hear me out. If I'm encrypting my financial information and sensitive data via a program like TrueCrypt, the strength of the password is going to matter a ...
10
votes
3answers
1k views
Confused about (password) entropy
There seem to be many different 'kinds' of entropy. I've come across two different concepts:
A) The XKCD example of 'correcthorsebatterystaple". It has 44 bits of entropy because four words randomly ...
10
votes
2answers
284 views
How much security is compromised if we accept other characters as login (other than the original password)?
I've just realised that facebook accepts 3 forms of a password:
Source:
Facebook actually accepts three forms of your password:
Your original password.
Your original password with the ...
10
votes
1answer
387 views
XKCD #936: under what assumptions is 1000 guesses/second over a network plausible?
In XKCD #936, a rate of 1000 password guesses/second is proposed as a "plausible attack on a weak remote web service". Under what assumptions is this rate plausible? It seems much too high to me. I ...
10
votes
3answers
3k views
Is a password protected PDF file safe for bank statement attachments?
My bank emails my monthly statement to me in a password protected PDF attachment. Is this a secure method of transmitting something as sensitive as bank statement?
10
votes
3answers
427 views
How much information about the reason for an unsuccessful login should a web application give?
After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application ...
10
votes
4answers
2k views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
10
votes
5answers
908 views
How secure is the SRP that Blizzard uses to protect passwords?
Blizzard very recently announced that their network was compromised, but they assure users in their statement that the password information that the attackers had access to was saved in a secure way:
...
10
votes
2answers
617 views
Bypassing the BIOS password
Are there any reliable methods that allow an attacker to bypass a BIOS password, or alter BIOS settings without entering the password?
A few ideas come to mind:
The old battery trick (remove ...
10
votes
2answers
288 views
Zip file with two password
I used this command to password protect a zip file on Linux :
zip -P 9000 hash.zip hash.py
and it creates the zip file just fine, then I wrote a program to test every possible password on it from 1 ...
10
votes
2answers
267 views
How insecure is PowerShell Web Access?
Windows Server 2012 comes with a new feature that allows you to administrate the server via a PowerShell command line in any modern browser including Smartphones.
This sounds cool and scary at the ...
10
votes
2answers
929 views
Tamper-proof BIOS password & settings storage with Trusted Platform Module?
In the olden days, one could trivially bypass BIOS passwords on most PCs by removing the BIOS battery and clearing the CMOS.
My question is: On modern PCs equipped with a Trusted Platform Module ...
10
votes
5answers
296 views
What is the best way to hand out passwords to a widely spread diverse employee base?
I have a problem I need to solve - specifically, how to hand out passwords to people in a variety of locations, and with a wide variety of access.
I've thought of some options, but there are ...
9
votes
8answers
664 views
Password management/synchronization?
Is there a good enough service I could run on my own home (Linux) server that I could use for storing/accessing/synchronizing passwords so they could be available for me from multiple ...
9
votes
3answers
463 views
Do users of non-latin character languages suffer from spyware and trojans?
Do Chinese, Japanese, other languages that can't be represented in ASCII get their passwords stolen? I figure there can't be some sort of bruteforce attack software for them, right? Their characters ...
9
votes
3answers
777 views
What is a good enough salt for a SaltedHash?
Since I'm hashing all passwords with each their own salt, is there a benefit to the salt being really random, or would an incremental counter or a guid be good enough? Also, is there a benefit of ...
9
votes
3answers
1k views
Cracking MS-CACHE v2 hashes using GPU
As most people here will know, Windows caches domain/AD credentials in a format known as MS-Cache v2. Obviously, these would be excellent passwords to gain during a penetration test when local access ...
9
votes
6answers
595 views
Are password reset links that don't expire a security risk?
I am currently working on a password reset flow. We have decided to go with a password reset link being emailed to the user's registered email and allowing them to follow that and input a new ...
9
votes
4answers
4k views
Is it possible to securely store passwords using reversible encryption?
Everyone says that you need to use a non-reversible hash when you store passwords so that even if your database is leaked, the passwords themselves are still safe. I'm wondering if there is anyway to ...
9
votes
4answers
939 views
Demystifying Web Authentication (Stateless Session Cookies)
I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages.
Here is my first ...
9
votes
5answers
624 views
Is it worth the effort to store FTP passwords encrypted?
I have a project to build a system that needs to push files to multiple third-party FTP servers. I have asked these third parties to provide a more secure interface; all have declined. So now I have ...
9
votes
2answers
2k views
What are the most common password salting methods?
I learned that the Sun guys used the login name as salt for password hashing. Is this a common approach?
What are the most common salt values?
9
votes
2answers
634 views
Is there any advantage of bcrypt over multiple iterations of SHA-x/MD5?
I know that a good password hashing algorithm should be slow. MD5, SHA256, etc. are fast. So I've been adding multiple iterations of SHA-256 hashing to my web apps (around 50000). Getting the hash of ...
9
votes
2answers
421 views
My bank makes me enter my password using the mouse. What's up with that?
Internet banking login process for Westpac requires user to enter the password using the mouse. It's annoying, what's up with that? Is it just to try and stop keyloggers on public computers or is ...
9
votes
2answers
538 views
How secure is asking for specific characters of passwords instead of the entire thing?
In some password-authenticated sites, you are asked to enter a random selection of specific characters from your password rather than the whole word/phrase. For example, it might say 'Enter the 1st, ...
9
votes
3answers
241 views
How to test if a browser add-on is safe
I came across this plug-in that started some alarm bells ringing. The add-on would help submit a website to web directories. The first 100 submissions are free, then you need to pay $20 via pay-pal ...
9
votes
4answers
387 views
How should I tell an organisation that they are vulnerable when I wasn't given permission to check?
I was recently at a village hall (in the UK), some distance from where I live, for a party. I noticed that they had unsecured wi-fi with an SSID of NETGEAR. I assumed it was free wi-fi for users of ...
9
votes
3answers
982 views
Why are passwords limited to 16 characters?
What is the reason that most websites limit to 16 characters?
I would have thought the longer the password the more difficult it makes it for someone to crack it?
Is it something to do with hash ...
9
votes
3answers
3k views
Security of passwords remembered by Windows
Does Windows XP or Windows 7 encrypt saved passwords?
I'm assuming that the user uses local password to logon.
The user then uses his own computer to connect to server in work and sets the "remember ...
9
votes
1answer
774 views
How to apply a pepper correctly to bcrypt?
For hashing passwords in a database, i would like to add a pepper to the hash function. Of course this pepper will be additionally to the unique salt.
The reason why i want to add a pepper is, that ...
9
votes
2answers
583 views
Estimating the size of a rainbow table
What are rainbow tables and how are they used? Gives a very precise answer about what rainbow tables are and how they are used. I had always confused hash-tables and rainbow tables. My question is ...
9
votes
1answer
210 views
Optimal variable sizes in the Secure Remote Password protocol
I am implementing the Secure Remote Password protocol:
U = <username> -->
<-- s = <salt from passwd file>
a = random()
A = g^a ...
8
votes
8answers
848 views
Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?
I don't know why do we authenticate by prompting the user to enter both username and password.
In my mental model, prompting password only suffices.
The reason is as follows:
Assume there are x ...
8
votes
6answers
555 views
Does prepending a salt to the password instead of inserting it in the middle decrease security?
I read somewhere that adding a salt at the beginning of a password before hashing it is a bad idea. Instead, the article claimed it is much more secure to insert it somewhere in the middle of the ...
8
votes
6answers
909 views
Is putting every username and password for our organization in a giant Google spreadsheet a spectacularly bad idea?
Our startup has something like 100 usernames and passwords to keep track of, and we can't keep track of all of them. Would putting all of them in a Google spreadsheet shared amongst ourselves be a ...
8
votes
6answers
694 views
Cracking long Windows XP passwords
Completing an assignment for my Ethical Hacking unit at University at the moment and the first task I have is to crack some passwords.
Decided to use backtrack to crack some passwords from a Windows ...
8
votes
6answers
330 views
How can I ensure that default passwords are no longer in use?
There are two situations in which 'default' passwords get used on a network:
A new user is registered. In her registration pack, along with her new username, e-mail address and so on is her initial ...
8
votes
6answers
11k views
Is howsecureismypassword.net safe to use?
Is it safe to enter my real passwords to test them?
I mean, are the entered passwords being recorded/transmitted to someone else?
8
votes
4answers
942 views
Passwords - any statistics on user behavior?
I'm looking for analyses of how users choose and use passwords. I'm sure there are many resources out there that analyze user passwords. For instance, I've seen many people analyze dumps of password ...
8
votes
5answers
551 views
Using a weak password on a truecrypt volume
I have put together a portable apps USB stick for when I need to use random site computers, I also threw truecrypt on with an encrypted volume for some word documents.
The password I am using is ...
8
votes
3answers
1k views
time to crack file-encryption password - more than just iteration
I have often seen that takes x amount of time to crack a certain length password. But this just seems to be the amount of time it takes to iterate through all the possibilities. What about the time it ...
8
votes
3answers
902 views
Password in file .php
My connection.php file stores the credentials to connect to the database.
<?php
$objConnect = mysql_connect("localhost","username","password");
mysql_select_db("selectDB", $objConnect);
...
8
votes
3answers
1k views
Hacking computers, scifi or reality
I was watching The Girl with the Dragon Tattoo, and this female hacker was really good at hacking. My question is, how is it possible for her to crack passwords besides the brute force approach? I ...
8
votes
4answers
312 views
How to evaluate the strength of a hashing algorithm?
At work the hashing algorithm we use for passwords appears to be bespoke. Obviously that's a pretty bad idea, but the management don't seem bothered.
The algorithm always produces 20 character long ...
8
votes
6answers
4k views
One Time Passwords. Using OTP at Windows, Ubuntu and internet sites
my question is this:
Is there a way (software,hardware/token or web-ware) to use One Time Passwords in the following scenarios:
Logon to my pc/laptop (windows or ubuntu)
Logon to sites with OTP ...
8
votes
2answers
1k views
How big salt should be?
I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2).
Having that in mind, how big salt should I use?
Should it be ...
8
votes
3answers
185 views
Should I restrict access to the username and passwords in a web app?
I'm starting to write my first serious web application and am thinking about how to store username and password information. There are plenty of articles detailing how storing plain text passwords is ...
8
votes
3answers
439 views
How can I promote good password practices in an organization that doesn't currently care about that?
I work with an organization that uses some very poor practices such as using default user accounts, default passwords (or passwords the same as user accounts), sharing password information between ...
8
votes
3answers
819 views
How can I mitigate the threat that DPAPick poses to my DPAPI protected data?
The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications).
DPAPick was presented at BlackHat ...
8
votes
2answers
1k views
Facebook API : App Secret - possible misuse
I've recently find out that by simple quick look into compiled code of one of our applications, you can get both App ID (API Key) and App Secret for Facebook API
I suppose that we should really keep ...
