Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

11
votes
3answers
396 views

How to test if a browser add-on is safe

I came across this plug-in that started some alarm bells ringing. The add-on would help submit a website to web directories. The first 100 submissions are free, then you need to pay $20 via pay-pal ...
4
votes
3answers
941 views

Best password storage scheme for high entropy, unique passwords which is failure resistant [closed]

What is the best, most secure, easiest way to: store unique, strong passwords for every service which requires authentication make the system resistant (total loss of security is avoided, breaches ...
3
votes
2answers
855 views

How to make a certificate encrypted flash drive?

I was wondering if it possible to encrypt a flash drive (or any other external medium) using certificates instead of a password. The idea is to have a number of encrypted pendrives that can be used on ...
1
vote
2answers
264 views

Password system, possible solutions

I am trying to solve a problem with a password system. I need to figure out the probability of the password being guessed. If I have an 8-character alphanumeric password. it cannot be all #'s, ...
7
votes
2answers
7k views

Is it possible to speed up WPA/WPA2-PSK cracking using a rogue AP?

We know that WPA/WPA2-PSK uses a PTK (Pairwise Transient Key) for each client to encrypt the communication. This PTK is generated through the process known as 4-way handshake. As told in the related ...
10
votes
3answers
441 views

Is there any conceivable reason to prevent a password change in an authentication system?

I connect to the VPN of another company with a company-specific username and password (they aren't giving everyone the same password to every company to access it or anything ridiculous like that.) ...
3
votes
1answer
3k views

Are Windows password hashes salted with the user name?

I'll readily admit I'm pretty clueless when it comes to cryptography, so there may already be some false assumptions in the question title itself :-) Still, I "heard" that it is more secure to store ...
3
votes
1answer
153 views

What are the implications of omitting the username in Secure Remote Password's verifier?

I consider implementing a Secure Remote Password (SRP-6a) verifier that omits the username from the x key hash. The intention is to allow authentication with multiple alternate user identifiers such ...
6
votes
4answers
2k views

Password entropy in layman's terms

Entropy is a term used often in relation to password security and brute-force attacks, but it is a topic that can get complicated quickly. What is the best way to describe password entropy (what it is ...
3
votes
2answers
611 views

What is considered a reasonably high iteration count?

I copy-pasted a function that implements the PBKDF2 hashing algorithm in PHP. The function asks for the amount of time that I would want it to loop in order to produce a hash. Now, I'm wondering, ...
2
votes
1answer
260 views

Detecting Key Loggers

We know that key loggers are the most effective and most annoying means of getting compromised over login id/password on the web or any application.... and your whole privacy is breached. Is there ...
49
votes
5answers
11k views

Are GUIDs safe for one-time tokens?

I see a lot of sites use GUIDs for password resets, unsubscribe requests and other forms of unique identification. Presumably they are appealing because they are easy to generate, unique, ...
4
votes
2answers
1k views

Known Password Lengths and security considerations

Many people wil often brag about the length of their password, like "yeah nobody is ever going to crack my password cause its 22 characters long." I was thinking, if you knew the exact length of their ...
11
votes
2answers
383 views

How much security is compromised if we accept other characters as login (other than the original password)?

I've just realised that facebook accepts 3 forms of a password: Source: Facebook actually accepts three forms of your password: Your original password. Your original password with the ...
7
votes
2answers
3k views

Dictionary Attack on Wifi

I know a few people with pretty weak passwords. What kind of systems exist to prevent dictionary attacks? Would it make sense to restrict the number of connection attempts in a certain timeframe? ...
7
votes
3answers
964 views

It is possible that brute force attempts are successful before the worst case, correct?

When I read about a password being secure and stating that it would take X amount of week, years, etc. isn't that referring to the worst case? What happens if the brute force method is successul in ...
8
votes
3answers
2k views

time to crack file-encryption password - more than just iteration

I have often seen that takes x amount of time to crack a certain length password. But this just seems to be the amount of time it takes to iterate through all the possibilities. What about the time it ...
11
votes
5answers
780 views

Security of using passwords or even passphrases to encrypt files

Is it ever appropriate to use real-world passwords to encrypt files to be sent via unsecure means. By real world, I mean a password that is memorable and memorisable by a mere person? I am implying ...
14
votes
6answers
685 views

Primary Key as Salt?

Is it okay to use the primary key as the salt in a Users table? The only disadvantage that I can see is if the PK changes (unlikely), then the passwords break. What are your thoughts?
7
votes
2answers
958 views

Encryption Algorithms with an error code for wrong password

I am looking for an encryption algorithm that would allow me to know if the password supplied is the correct one or not. This question can be considered as a follow-up for Q. In particular the answer ...
14
votes
4answers
985 views

If a website allows another person to get a list of the site's users passwords, how likely is it that the passwords are stored in cleartext?

We had an incident where some of our managers were given passwords for the people they supervise using a particular company website. Ostensibly it was done so the managers could check in on the users ...
5
votes
2answers
1k views

Password History/Password policy

I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008). Where is password ...
29
votes
3answers
6k views

Password manager vs remembering passwords

I have always thought that you are not supposed to use a password manager but to keep your passwords in your head, but lately I have thought about the pros and cons of having a password manager. Some ...
12
votes
2answers
3k views

How secure is asking for specific characters of passwords instead of the entire thing?

In some password-authenticated sites, you are asked to enter a random selection of specific characters from your password rather than the whole word/phrase. For example, it might say 'Enter the 1st, ...
13
votes
2answers
232 views

Would suggesting a random passphrase during sign-up hurt overall security?

I've been looking for ways to improve security and security awareness for both internal and external clients and I happened upon the idea of generating a one-time, random "password suggestion" on the ...
5
votes
1answer
29k views

How long to brute-force WPA password?

Bob has a password (for his WPA encrypted wifi) which is 8 characters, all lowercase, and not a dictionary word. Eve lives next door to Bob and wants to illegally hack his WPA. The number of ...
10
votes
3answers
2k views

Cryptographic Security of Dynamically Generated, Non-Random Salts

So when it comes to security, when I have an idea that seems good, but no one else seems to be doing, I try to assume that I'm overlooking something obvious or otherwise significant. This is one such ...
12
votes
5answers
887 views

Should passwords be truly random?

When generating a password, should it be "truly random" or should I make it a little less random by enforcing some rules? If a password is generated at random, it could come out all-lowercase letters ...
8
votes
4answers
841 views

Doesn't imposing a minimum password length make the password weaker by reducing the number of possible combinations?

I thought the strength of a password depended on the total number of possible combinations. Therefore, allowing longer passwords should be safer because you then have more possibilities. But why do ...
4
votes
1answer
735 views

How can I manage multiple sets of passwords accessible by different users? [duplicate]

Possible Duplicate: Sharing passwords and credentials between founders and employees I use KeePass for my personal passwords. I would want to use it for my business, too, but the only way ...
39
votes
2answers
14k views

I just send username and password over https. Is this ok?

When a user's logging in to my site, they send their username and password to me over https. Besides the ssl, there's no special obfuscation of the password - it lives in memory in the browser in the ...
2
votes
2answers
347 views

Company sending Master passwords in unencrypted emails

If a company has terrible security policies like letting people email password in cleartext emails, what to do if they reject all fair minded advice?
18
votes
5answers
1k views

Is there any legal reason to save a cleartext password?

I called customer service of a well known company and discovered that the operator had the ability to view my website password in clear text on her screen. I asked her about this and she defended the ...
12
votes
4answers
1k views

MS-SQL Password Storage

What would be your recommendation for replacement of an MD5 hash approach to password storage within an MS-SQL database be?
5
votes
4answers
2k views

Brute-force heuristics used in password cracking

Existing questions on this site discuss some of the heuristics used by password cracking tools to avoid doing a completely naive brute-force search (for example, "dictionary word with number ...
1
vote
1answer
120 views

What function(s) to be used to generate Salt on Windows Mobile 6

I am looking for THE or a real function I can use to generate salt for my mobile app on Windows Mobile. In case I am not abusing in this request but in the future I plan as well the same app for ...
7
votes
8answers
1k views

Is the following authentication scheme secure?

I was trying to design an authentication system that would make it much harder to guess a password via brute force, and reduce the risk to a user if the hashed password was stolen through a snooping ...
6
votes
3answers
1k views

Attack vectors for brute-forcing website passwords

When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
23
votes
3answers
3k views

Should I have a maximum password length?

I'm creating a webapp, and part of my authentication method is password length. Should I put one in place? (say, 50 characters?) Or should I just put a minimum length (Currently at 6). Are there ...
15
votes
2answers
3k views

Tamper-proof BIOS password & settings storage with Trusted Platform Module?

In the olden days, one could trivially bypass BIOS passwords on most PCs by removing the BIOS battery and clearing the CMOS. My question is: On modern PCs equipped with a Trusted Platform Module ...
6
votes
3answers
393 views

Are there password/passphrase guessers/crackers which can utilize facts supplied about the target?

I was just reading a discussion about cracking passwords that said the person running the tool might know things about the target like the birthday of his first girlfriend's dog but the tool won't. ...
6
votes
4answers
6k views

Are the iPhone “connect the dots” passwords secure?

A popular way to login to iPhones and other phones is to use a "connect the dots" password. For those unfamiliar, it looks something like this: Is this kind of passwords secure from brute force ...
15
votes
2answers
1k views

How does varying character type increase strength of password?

When creating a new password, people often recommend you use both uppercase and lowercase characters, numbers, and symbols. How does adding any of these increase the strength of a password? There ...
17
votes
4answers
13k views

Is it possible to securely store passwords using reversible encryption?

Everyone says that you need to use a non-reversible hash when you store passwords so that even if your database is leaked, the passwords themselves are still safe. I'm wondering if there is anyway to ...
8
votes
4answers
2k views

Web browser password management security [duplicate]

Possible Duplicate: How are browser saved passwords vulnerable? How secure are the password managers that are built into modern web browsers? Currently I use lastpass plugin as I believed ...
6
votes
2answers
385 views

Is cascading cryptographic algorithm better than using a single one?

Am I wrong to think that scrypt(bcrypt(password)) would be better than using sole (s|b)crypt? Especially when considering two different key for the two algorithms. I am also interested in some ...
9
votes
2answers
6k views

Why limit passwords to ascii printable characters? [duplicate]

Possible Duplicate: Do non-keyboard characters make my password less susceptible to brute forcing? Every article on password security that I read tells people to make the password more ...
0
votes
2answers
926 views

Best ways to store a password Server side [closed]

I was using Lotus Notes today and I realized that the program asks password is encrypted in many ways. even without access to the stored passwords notes I can say that they are at least as recorded in ...
5
votes
4answers
5k views

Brute force vs other methods of recovering passwords from shadow file

Do you know any good approach for de-hashing/actually bruteforcing hashed passwords in the shadow file? On various operating systems, any good solutions/methods/programs. Or is it better to upload ...
16
votes
3answers
784 views

Is it OK to tell your password to an admin? [duplicate]

Possible Duplicate: From a security point : Is it OK to tell your password to an admin? I am working in a small company (20 employees) as a senior SW engineer. After having some email ...