Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

2
votes
1answer
849 views

How to download PHI PDF from a secure website to a secure, encrypted folder on Windows 7?

Objective: HIPAA compliance. Here is the process: Receive PDF File through secure website Open the PDF (Which involves downloading to some folder) No longer need PDF The Question: Is there any ...
1
vote
1answer
199 views

Stripping / appending characters from user password before hashing to conceal it forever?

I had this idea to permanently conceal user password by requiring minimum length then stripping certain characters. For example if the user password is secret123, the system will strip it down to ...
4
votes
2answers
817 views

Can key files be brute-forced like passwords?

Let's say you use a program like Truecrypt or Keepass which allows you to have a password + key file. I understand that passwords can be brute-forced/dictionary-attacked but is the same true for key ...
18
votes
3answers
9k views

Password in file .php

My connection.php file stores the credentials to connect to the database. <?php $objConnect = mysql_connect("localhost","username","password"); mysql_select_db("selectDB", $objConnect); ...
8
votes
4answers
419 views

Will passphrases always be secure?

In a world where most people used passphrases instead of passwords, wouldn't an attack that generates a random string of words (alternating between word delimiters) be similarly effective to a brute ...
2
votes
2answers
729 views

Using a tabula recta to store passwords

Reading an answer to another question ("Is there a method of generating site-specific passwords which can be executed in my own head?") I came across this link, describing a way to use a physical ...
-1
votes
4answers
171 views

pesudo random password

I post a question before about one password repeating to make it longer, now its a new way want to ask about, if take the word 'secure' and instead of repeating it put somenumbers between it, exp: ...
8
votes
3answers
3k views

Can ssh keyfile security be broken in a few hours if the file is exposed?

At this link there is a claim that if an RSA key has a strong passphrase security might be broken in a few hours if an attacker has the private key. Is there something weak about the security of RSA ...
16
votes
11answers
5k views

Best practice for password distribution

I am about to set up a new account on my Linux server for a user that lives in another state in the U.S. I can't think of a good way to get them this user their password. There must be a standard ...
1
vote
1answer
279 views

Securing communication

The problem: I have an open-source client (a Firefox add-on written in JavaScript) and a server containing somewhat sensible user information: username and user history (all from YouTube). The client ...
7
votes
4answers
5k views

How to implement a “Remember me” on a mobile app?

I would like to implement a "Remember Me" time-limited auto-login type feature on a mobile application (on Android). To start the app, the user must type in a username and password. For convenience, ...
4
votes
3answers
1k views

Are Three attempts to block login a good idea?

In the company that I work there is a security rule: If you enter your password 3 times wrong, your login will be blocked! Then I have to go to mainframe program and re-register my new password. ...
7
votes
3answers
5k views

What are some good ways to verify user identity for password resets?

I'm wondering how others verify the identity of users they're resetting passwords for. We currently try to speak to a manager at work, but it frustrates end users and seems like we don't trust them. ...
15
votes
3answers
948 views

What can I do if my bank thinks my date of birth is “known only to me”?

My bank has recently replaced passwords with occasionally asking me information that is "known only to me". Such information includes my date of birth, postcode, and my mother’s maiden name. ...
4
votes
1answer
1k views

Why does Windows 7 require a password hint during setup?

Correct me if I am wrong, but I think Windows 7 is the only operating system out there that requires a hint for the first user created on the system (have not had a chance to check out Windows 8 ...
2
votes
1answer
535 views

How can wireless router password encrypts data using WEP and WPA

How does the password that we enter (to connect to a wireless network) encrypt the data on the wireless network? Through my reading I am not sure if the password that we enter is the same as the ...
10
votes
3answers
1k views

If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?

In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the ...
2
votes
2answers
199 views

What are stolen passwords used for?

Say there is a line of business application which has username/password datatable in the DB. Personal email address is not stored, and usernames are assigned by an administrator. Someone gains access ...
3
votes
1answer
3k views

Please explain Time-step in Time-Based One-Time Password Algorithm

I am studying about OTPs (One Time Passwords). I have gone through all the methods: HOTP (HMAC-based One Time Password), TOTP (Time-based One Time Password) I have no issues with HOTP. But according ...
12
votes
1answer
3k views

How will security need to be changed if P=NP?

If we suppose that it is found that P=NP, how will security measures need to be changed? I'd like to know the major security measures that are affected, and how they would need to be changed. We can ...
-1
votes
1answer
180 views

How Does VMWare Protect Passwords? [closed]

I am interested what features VMWare uses to protect passwords inside the virtual machine.
5
votes
5answers
748 views

What are all of the issues with storing a cleartext password?

I know, I know, cleartext passwords are terrible and you should always store a hash! However, I'm interested in all of the issues with storing cleartext passwords so I can make a reasonably secure ...
2
votes
3answers
883 views

What is the recomended algorithm to create a key from a password?

In my new secret document encryption utility, the key for symmetric encryption = the hash of a random salt and a user provided password. It is necessary to have a slow hash function in order to ...
10
votes
5answers
730 views

Using a weak password on a truecrypt volume

I have put together a portable apps USB stick for when I need to use random site computers, I also threw truecrypt on with an encrypted volume for some word documents. The password I am using is ...
3
votes
2answers
2k views

How is WEP/WPA2 key derived?

When I was a kid, WEP had a 40 bit key. Later, they came out with a 128-bit key. But as we all know, WEP was so badly-designed that the RC4 key length didn't really matter much. Ignoring this, my ...
3
votes
1answer
492 views

Non English password dictionaries

What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
4
votes
1answer
2k views

How to implement WSS UsernameToken when password on the server is salted and hashed?

I'm currently trying to write a web service for customer and requirement is to use WS Security. On their server side, they have passwords stored as SHA-1(salt+password). According to WSS spec, ...
3
votes
2answers
998 views

Efficient and simple way of securing home pc with hardware token

I am looking for a simple but reasonably safe way to secure my home pc (and laptop, nas, etc.) with a hardware token. I would like the system to be secure, but practical enough to be used on a day to ...
6
votes
3answers
661 views

Is it OK to use the same password for a Linux login and the SSH private key?

I want to remotely log in to my Linux server with SSH. Public/private key authentication is more secure than password authentication, so I have disabled password-based authentication for SSH on my ...
4
votes
0answers
121 views

Dealing with systems that store/send passwords in plain-text [duplicate]

Possible Duplicate: What to do about websites that store plain text passwords When using a system as it was designed to be used, and the system provides proof that it is storing and/or ...
10
votes
2answers
1k views

Should user be allowed to save password in browser?

The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
10
votes
3answers
10k views

Security of passwords remembered by Windows

Does Windows XP or Windows 7 encrypt saved passwords? I'm assuming that the user uses local password to logon. The user then uses his own computer to connect to server in work and sets the "remember ...
4
votes
3answers
3k views

Reverse-engineering one-time passwords for two-factor authentication systems

Given a one-time password generator that is time-based (such as Google Authenticator), how many instances of (time, PIN) pairs would one need to significantly weaken the algorithm to a point where one ...
2
votes
1answer
760 views

Token Based Authentication & Pass-the-hash Attacks

Do token-based authentication solutions (such as RSA SecurID) mitigate tools like incognito and/or pass-the-hash tools?
10
votes
5answers
586 views

Utility company does not hash passwords in the database

I had to use my utility company's online account information application and forgot the password. Going through the steps of resetting the password I was emailed the password in the open. I found this ...
21
votes
5answers
3k views

Is my bank storing my password in plain text? [duplicate]

My bank (and every bank I've come across) only ever asks for individual characters from my password when logging in. Is my bank storing my password in plain text?
2
votes
1answer
514 views

Best security algorith for storing passwords [duplicate]

Possible Duplicate: Which password hashing method should I use? I want the best cryptography algorithm for storing passwords in database, which one should I use and how can I implement ...
8
votes
1answer
599 views

Protecting emails in your database

It's common to encrypt passwords in the database, but I'm wondering what solutions are out there to protect emails in your database. Not just from hacking, but from disgruntled employees or engineers ...
3
votes
1answer
4k views

What algorithm/encryption type does Gmail use for security?

In the wake of the recent database hacks, i.e. Sony, Gawker, etc.. where the hackers have access to the hashed usernames and passwords, i've been more keen in paying attention to the sites and ...
2
votes
2answers
161 views

How can I protect a client's mirror of the server's database?

The scenario is as follows: There are clients that users can access and work with. These clients can be online or offline. There is a central database on a server, holding all the authorization ...
5
votes
3answers
468 views

Is it safe or even common to cache bcrypt checks in-memory

In a web application that (as a side effect of implementing the password anti-pattern) stores passwords, one recommendation is to bcrypt to store them (or computationally expensive one-way salted ...
4
votes
1answer
456 views

Thoughts on creating unscalable conditions to brute force even small passwords?

I stumbled upon something called "scrypt" which claims to add fixed time/space complexity requirements into password-based key derivation. Quoting from their page: A simple password-based encryption ...
4
votes
1answer
3k views

Rainbow tables, generation and lookup, preferably using GPU

1a) What software can I use to generate my own rainbow tables, preferably software that can utilize CUDA or ATI Stream? One of the reasons I want to make my own, is that I want to use a specific ...
4
votes
4answers
1k views

Store a password to avoid user interaction

I am creating a windows service that sends email to a user. It uses a Gmail account to send the email, so it needs a password to access the account. It also needs to do this automatically, without ...
9
votes
4answers
905 views

Is using a flash drive as a base for security a safe thing to do?

I'm developing some software for schools. I've found severe flaws with the current popular school LAN protection that I feel needs fixing so I plan on releasing my own software. One the those ...
4
votes
1answer
1k views

Is a public known password protected Wifi more secure than one without a password?

When connecting to a public Wifi from a café for example, some don't use a password and some do. If they do use a password it is often publicly known to everybody around. Does having a password on ...
4
votes
0answers
1k views

Hints for safe passwords that are easy to remember [duplicate]

Possible Duplicate: What is your way to create good passwords that can actually be remembered? What are good hints to create passwords that are both safe and comfortable? By comfortable I ...
4
votes
2answers
416 views

How does one make password easily forgettable?

Is there any phycological research that appears relevant to making passwords easily forgettable under adverse circumstances? Circumstances might include when under duress, after some duration of ...
3
votes
2answers
613 views

Can a survey website viewed in Firefox trick the user into sending stored passwords?

Firefox stores passwords (I am not referring to the Master Password feature) and I would like to know if a survey website can steal those passwords. I was typing a URL and perhaps I mistyped it and ...
11
votes
3answers
396 views

How to test if a browser add-on is safe

I came across this plug-in that started some alarm bells ringing. The add-on would help submit a website to web directories. The first 100 submissions are free, then you need to pay $20 via pay-pal ...