Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

-1
votes
0answers
10 views

Queries on config.php and ArtifactResolutionService.php - SimpleSAMLPHP [migrated]

We are using SimpleSAMLPHP for SSO. In config.php file, datastore type is configured to be phpsession by default. Since this cant be used, next option is memcache. As we dont make use of memcache, ...
-1
votes
1answer
79 views

Do you consider PWGen safe to use?

Do you consider PWGen safe enough to use? What do you use to make truly random password. PWGen should be using "movement of your mouse" to make it really random, right?
-1
votes
2answers
126 views

Using a password hash…as the password? [duplicate]

Ok, this is probably a really stupid idea, but I can't really see why it would be a bad idea. Maybe someone can enlighten me. Why couldn't you enter a password good hashing algorithm like bcrypt, ...
-1
votes
1answer
229 views

TLS/SSL and password transmission

I am still getting confused with security topics. At the moment the advantages and disadvantages of some of authentication methods are still not very clear. According to OWASP Authentication Cheat ...
-1
votes
1answer
469 views

Why not use md5 auth mechanisms for IMAP over TLS?

I'm using Dovecot for IMAP connections. I've read a lot of tutorials on how to set up Dovecot, and a lot of them said to only allow: auth_mechanisms = plain login Why should I not allow *-md5 ...
-1
votes
1answer
72 views

ICloud and Quality Password [duplicate]

How many 'random' characters should my iCloud password be if it were going up against the BEST hackers and the best hacking software?
-1
votes
1answer
8k views

Is my information secure when using Private Tunnel? [duplicate]

I am using Private Tunnel to do some tasks involving sensitive data like logging in to PayPal and online banking. Is my data safe or can it be retrieved by other users of the Private Tunnel service?
-1
votes
2answers
220 views

What is the safest way that you could hash/encrypt a password? [duplicate]

What is the safest way that I could could hash/encrypt a password for my website?
-1
votes
2answers
850 views

Looking for safe, simple way to store passwords with PHP 5.2.17 [duplicate]

I've found many posts on StackOverflow and other sites using Google, but since security is always changing, and what was safe a few months ago not me anymore... I felt the need to ask on here. ...
-2
votes
5answers
540 views

Is this password hashing method secure?

I have made a custom hashing method to help make my users' passwords more secure if the database will be leaked. The encryption method is like this: A method takes an input of 1 character, gets the ...
-2
votes
3answers
331 views

Why is encryption bad for passwords?

We use PGP for almost everything and it's so infeasible to bruteforce that it's considered secure. This is the guiding principle beyond CryptoLocker. But for stuff like e-mail, SSH and HTTPS, it's ...
-2
votes
2answers
420 views

How to secure passwords when site is opensource [duplicate]

Possible Duplicate: How to securely hash passwords? How can I store passwords to have them secure? Right now the site use md5 md5, I was thinking about sha1+salt but if the source code for ...
-2
votes
2answers
163 views

How to securely transfer password from a registration page to the database [duplicate]

What steps must be followed to send password securely from the user registration page (i.e. client side) to the server over a non encrypted channel (http) when the user registers for the first time ...
-2
votes
2answers
964 views

How to secure a login.php file? [closed]

I have a hand built website, and am triying to build a cms/admin-panel, and my username and password, are not stored in a database, but, in a two setup file like seen below. index.php <?php ...
-2
votes
1answer
358 views

What are common problems that reveal PHP code? [closed]

What is the best method for securing PHP scripts that contain database passwords? From what I've read, PHP can be revealed when an error occurs and is not caught. Is there any way to reveal PHP by ...
-2
votes
1answer
224 views

Can Cain&Able Crack SSL? [closed]

I have been messing around with Cain and Able and used APR on another computer (also mine) to get a hashed version of my username and password for my yahoo e-mail account, but I seem to be lost as to ...
-2
votes
1answer
65 views

How can you set a wireless router password that nobody (including yourself) knows? [closed]

Consider the following hypothetical situation: On a Macbook, A hacker can view the screen of your machine (and may have a keylogger installed). It is impossible to remove them even by reinstalling ...
-2
votes
1answer
68 views

Password complexity policy and practicality [closed]

If you are a user and your company implements a password policy that says your password must have at least 8 characters, at least 1 number, at least one alphabet and at least 1 special character, ...
-2
votes
1answer
63 views

generating “non-dictionary” numeric passcodes [closed]

In case of numeric passcodes, e.g. for numeric locks on doors etc, anyone can agree "poor passwords" are ones with specific pattern, e.g. 1234, 1111, 2468, 1122, etc. (as well as ones that form a ...
-2
votes
2answers
441 views

Password hashing and blowfish [duplicate]

What I'm about to say is probably going to make me look like an idiot but it's better to be wrong and learn than have unanswered questions. Ever since I started dealing with passwords I wondered what ...
-2
votes
2answers
257 views

A Graphical Two-Step Authentication System [duplicate]

Changes made to system proposed in Two-factor authentication Without Mobile Phone: In previous system, shoulder surfing would reveal the user’s pre-decided image. In the current system, end image ...
-2
votes
1answer
352 views

How long does it take to break 128-bit key

Hmm, I was asking myself how to compute if we were given one day to try all possible keys for a 32-bit symmetric cypher, how long would it take us to break 128-bit key? My calculations suggest: ...
-2
votes
1answer
113 views

How MD5 and salt algorithms come into play if the attacker uses curl?

When the user logs into any site, they supply a username ('user01') and password ('password123') into a form then submit. The user has no idea what their hashed password value is that is stored in the ...
-2
votes
4answers
444 views

Getting password cracking time and byte storage from bruteforce?

I am stuck with this question, you can see it in the picture I have included below. PARTS (a and b) I know a-z will be 26^8, A-Z will be 26^8 guesses, and 0-9 will be 10^8 guesses. But I can't relate ...
-2
votes
1answer
158 views

Salt and password [closed]

Reading the doc for setting the password, the command is : python -c "import crypt; print crypt.crypt('password', '\$6\$SALTsalt')" SALTsalt is the 8-character crpytographic salt. Valid characters in ...
-2
votes
1answer
70 views

Escape from <script> to cause a XSS (XSS when reflection is already under <script>) [duplicate]

I am trying my level best to solve this issue i am totally not able to create a XSS i still thinks it to be a vulnerability and i think it is exploitable. I am frustrated around it for 8 days . Please ...
-2
votes
1answer
1k views

LophtCrack version 6.0.12 is not auditing my Administrator password [closed]

I am using LophtCrack on my Windows 8 OS. I was testing my password strength and the problem I am seeing it is not working. It doesn't reveal my Admin password, I've run the process for half an hour. ...
-2
votes
3answers
297 views

Password security : complexity and length [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? I've read that there is many solutions available to crack passwords. Reading these tips, I can ...
-3
votes
2answers
923 views

Good Practice: Storing Passwords in general

I've got a totally theoretical question to you on today - what is the "best" practice for storing passwords? [Best in terms of security and performance] Usually, especially PHP-Developers tend to ...
-3
votes
3answers
2k views

What's the use of making users use digits, uppercase-lowercase combination password if the passwords are hashed?

Some websites, even the StackOverflow asks for atleast 1 digit, 1 uppercase character in the password. Does this really matter when the developer uses a password-hash algorithm to store the passwords ...
-3
votes
1answer
2k views

Retrieve Admin Password from router [closed]

There is a way to retrieve a router admin password without hard reset? I'm loggen on LAN and know username and local ip address... TKS
-3
votes
2answers
83 views

Can I prevent brute forcing of hashed+salted user passwords without a dedicated validation server? [duplicate]

Salted hashes don't seem to offer any real protection for user passwords by itself. So long as a hacker has a quick way to check if a password is right or wrong, it's trivial to brute force it to view ...
-3
votes
2answers
2k views

Is pixel based image encryption secure?

I have encrypted an image using pixel encryption method. I just used a bmp image for that. What I did is, I retrieved each pixel value from the image and obtained the value of red, green and blue ...
-3
votes
1answer
127 views

What is the algorithm of bcrypt? [closed]

In many places I heard that people recommend to use the bcrypt algorithm to save passwords into database while creating web applications.I want to know what is the algorithm used to bcrypt a password ...
-3
votes
1answer
42 views

Which encryption technique should be used for users name and passwords in my notebook [duplicate]

i writing all my passwords and users names on my notebook emails,amazons,facebook. and i have really Nosy little's brothers that will probably look at my notebook when i am not around, which ...
-3
votes
3answers
325 views

Hashing credentials. Is hash(email+password) secure enough?

I am working on a client server application where to identify each user I was thinking of storing a single database entry: hash(email + password) In my opinion, this is enough to stop some known ...
-3
votes
1answer
71 views

How do I get the password knowing part of it and the length [closed]

I'm new to all this, I'm trying to use Hash Suite to find a password with a word + 2 numbers. I know what the word is but not the numbers but I also know the length of the passwords ... What do I have ...
-3
votes
1answer
414 views

What type of hash is this MD4(MD4(($pass)).(strtolower($username))) [closed]

Can I decrypt this hash? Domain Cached Credentials: MD4(MD4(($pass)).(strtolower($username)))
-3
votes
1answer
82 views

Make password list with crunch [closed]

I want to make some password list like this : A4B9D It should has these : 5 characters first, third, and fifth characters are letters (A to Z) second and forth characters are numbers (0 to 9) ...
-3
votes
2answers
1k views

Time it takes to crack a password on site like yahoo [closed]

I have a question. If you were using a password brute force/dictionary attack utility on a site like yahoo or another site, how long would it take to crack a password like Jah13Wootiang if Wootiang is ...
-3
votes
2answers
195 views

How to make a strong password? [duplicate]

I always hear conflicting things. Should I use a long sentence? Or is this privy to dictionary attacks? Or should I use a long string of random alphanumeric garbage with upper/lowercase and ...
-3
votes
1answer
979 views

What are some good user login/authentication libraries or protocols to use with Python on Google App Engine? [closed]

I've read elsewhere (http://forums.udacity.com/questions/6028436/bcrypt-not-suitable-for-pythongae) that bcrypt is not suitable for use on Google App Engine. What are some good ways to create a user ...
-3
votes
1answer
120 views

Why should I use the VPN? [closed]

Does a Virtual Private Network (VPN) provide an encrypted connection from outside networks or from ISPs to the internal network?
-4
votes
7answers
2k views

Are passwords made up from concatenating a few foreign words better than shorter random characters? [duplicate]

Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example: "pussiMeansCatInEskimo" "caballoMeansHorse" "CatIsGatto" "SalopeMeansBitch" ...
-4
votes
1answer
483 views

Why don't we do dual password instead of forgot password?

You can see the link "Forgot Password?" nearby almost all login form. Since passwords are completely protected from outside access, I come up with this question. I accept that the forgot password ...
-4
votes
2answers
379 views

Inform someone about a hacked account [closed]

I'm not a hacker but recently I was able to get someone's email password. I want to teach him a lesson to be careful when using internet and to pay attention to his passwords but I have some problems: ...
-4
votes
2answers
469 views

How do I construct a rainbow table to crack a 6 character password? [closed]

Given the hash: 491c290affbf5436f0fc0584ccefb2 how do I construct a rainbow table to crack this password?
-4
votes
1answer
94 views

Time-based password change [closed]

I have created this script and it runs great, but important questions remain. Is this script useful and secure? Does it have any possible problem or weakness? root@010010:/# ls -la ...
-4
votes
1answer
638 views

Feasibility of brute-force on online password [closed]

I am familiar with how offline brute-force attacks work. But for online accounts, assuming no social engineering, how feasible is it to brute-force attack a password? For example, is this dependent ...
-4
votes
1answer
2k views

Good Password Length [duplicate]

If you are looking to be careful and your passwords include all the types of characters, what is the ideal password length?