Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

7
votes
4answers
506 views

Reasonable way to store encrypted passwords in a webapp's database, Linux

This question is generally similar to past questions asked here, but I haven't seen one the relates to Linux. Case at hand: a PHP web app has a MySQL backend. As part of its functionality it accesses ...
1
vote
1answer
97 views

Is it posible to bypass BIOS password without owner knowing later on?

My laptop BIOS is password protected. Probably the password can be bypassed using some hardware and software means. But is it possible that somebody having access to laptop but not knowing the ...
0
votes
2answers
82 views

Password stretching using concatenation of hashes

I'm working on a simple file encryption tool. Basically, here's how my program works: password = get_user_typed_password() salt = uuid4() key = bcrypt(password + salt) cipher = AES(key) for block ...
4
votes
4answers
194 views

Why change password? [duplicate]

Why are there recommendations to change passwords with certain intervals? If I have a good password, e.g. a long wrongspelled odd sentence with a couple of special characters thrown in, why is the ...
0
votes
1answer
74 views

A fake phone tech changed my start up password. [closed]

I was duped into believing a phone caller was a computer tech. I allowed him remote access and when I refused to pay a fee at the end of all his changes he hung up. My start up now has an unknown ...
2
votes
3answers
2k views

A low tech yet secure way to keep track of passwords?

I use LastPass and love it. My girlfriend creates her own long, complex, unique, and thus difficult to remember passwords for every site. She frequently forgets them and has to rest the password. ...
15
votes
2answers
1k views

Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML

It's clear there there is no consistent set of features among any of the popular authentication providers. Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
10
votes
4answers
759 views

Forgetting passwords typed in too frequently

It has happened to me several times that I've become so used to typing in a password I can't consciously remember it and it's purely muscle memory. This is particularly true with complex passwords ...
1
vote
3answers
101 views

How to guarantee privacy on files that I store

I want to create an Android app where users from an office (typical use) can upload scanned documents to the app backend service for later use. e.g. A lawyer want to upload a sentence ...
-1
votes
1answer
584 views

Hydra bruteforce is giving wrong passwords. Can't seem to work any help? [closed]

Ok so what im actually trying to do is to bruteforce my own account on some website just to check myself . This is NOT for illegal steps or use , im trying to crack my OWN password , and im trying to ...
1
vote
4answers
144 views

How to store passphrase in this situation?

How to store a passphrase with a Java application that periodically needs access to its plaintext form? It is a strange situation, but I am wedged in it. If providing a decent security mechanism is ...
1
vote
1answer
119 views

how to pass credentials across applications securely?

To simplify the user experience , if we want to design a system such that the user login password for the desktop account itself can be shared with various applications like chat/email/skype etc. ...
2
votes
3answers
96 views

Limit attempt of user login against PBKDF2

I have been tasked been tasked by my boss to change the encryption system of our web application from MD5 to PBKDF2 as MD5/SHA1 has been shown to be breakable in recent years . I argued against it ...
-2
votes
2answers
63 views

How to make a strong password? [duplicate]

I always hear conflicting things. Should I use a long sentence? Or is this privy to dictionary attacks? Or should I use a long string of random alphanumeric garbage with upper/lowercase and ...
6
votes
2answers
372 views

Security risks of typing wrong password

I accidentally typed my root account password on my google account login, I know google keeps their website quite safe but this question came in mind: Is there a risk if you accidentally type in ...
1
vote
1answer
67 views

Security implications of setting the same password on private key and PKCS12/JKS?

Are there any negative security implications of setting the private key password (DSA in this case) as a PKCS12 (and then JKS) export password (instead of generating/inventing a new one)? My use case ...
0
votes
1answer
277 views

How to enable a http post form penetration test?

I don't get the correct results and I'm not sure what I'm doing wrong: $ ./hydra -l admin -x 3:9:a http://localhost http-post-form "/admin/login:j_username=^USER^&j_password=^PASS^:failed" -s ...
32
votes
2answers
1k views

Why does Google cripple the 2FA Google Authenticator PAM module?

If you enable 2FA for Google Apps the shared secret is 160 bits. The google_authenticator PAM module on the other hand seems to use 80 bits for the shared secret. According to RFC 4226: R6 - The ...
5
votes
3answers
13k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
3
votes
1answer
106 views

Should an administrator be able to turn off TFA for a user

We use Google Authenticator and SMS for two factor authentication. Should we allow the administrators of the site to turn off TFA for users? Google Auth uses SMS as backup option but SMS does not ...
-1
votes
1answer
673 views

Is my information secure when using Private Tunnel? [duplicate]

I am using Private Tunnel to do some tasks involving sensitive data like logging in to PayPal and online banking. Is my data safe or can it be retrieved by other users of the Private Tunnel service?
-1
votes
2answers
113 views

I don't understand how BIPS got hacked [closed]

http://www.networkworld.com/news/2013/112513-bitcoin-robbery-276352.html In this story we can see BIPS got hacked, but I don't get how it was hacked when it was offline because of the DDoS.
6
votes
2answers
382 views

Stolen Laptop - Next steps

My laptop (modded 2007 Macbook Pro) was stolen 2 days ago when I didn't pay attention to my backpack in a tourist spot in Europe and while I'm quite certain they won't have much use for it (the apple ...
2
votes
1answer
123 views

After having confirmed a computer is infected by a Botnet.

And having found a server IP that is controlling it. How can I find out the log-in credentials this client uses to log in to a IRC channel / server webpage / control panel. I have found out a python ...
0
votes
1answer
84 views

Banking platform accepts password containing subset of real password [duplicate]

How would it be possible that if my password was 123abc that my bank also accepts something like 123abc12? Isn't that an extreme security flaw? If the password was hashed and salted, wouldn't the ...
16
votes
3answers
3k views

Security of LastPass + YubiKey

I'm looking at password manager solutions and came across LastPass. I see they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What are ...
4
votes
2answers
134 views

Is it ok to email someone their password from a newly created account? [duplicate]

I have a pretty standard registration form. One thing I've decided to do away with is the requirement to enter the password twice, for usability reasons. In order to mitigate the increased risk of ...
9
votes
4answers
440 views

Password security

I was requested at the login page of a website to first change my password. After typing in a new password, the web page told me the new password did not differ enough from the previous one. Does this ...
0
votes
2answers
516 views

How does Authy works?

I think I knew how does two-factor authentication works. I enter the password. Server generate random number and send me it me by sms. I enter this number. Server check number I entered with ...
1
vote
0answers
57 views

How to safely use a Key Derivation Function to secure private data - need guidance

I have some secure data created in my client app which I wish to store on the server as backup for the user. The user already has a password to authenticate with the server. The password is never ...
3
votes
1answer
199 views

is 'mysql_real_escape_string' enough

Recently on stackoverflow I've seen many discussions that mysql_*_escape_string is deprecated and instead recommending PDO. The way I've been doing it was to allow only letters and ' in the name field ...
0
votes
1answer
74 views

Question about a “Password Space” definition

I am currently reading the "Green Book" (http://csrc.nist.gov/publications/secpubs//rainbow/std002.txt) of the "Rainbow Series" and have a question on chapter "C.4 Password Space". From this ...
0
votes
2answers
92 views

Using the same base string for a password in several different logins [duplicate]

It is clear to me that using the same password for different websites is a bad idea because if an attacker manages to get a hold of your password, then he can gain access to the other websites in ...
0
votes
3answers
91 views

Best way to store passwords for a LAN tool?

I am making an app in Python for linux as a front end to the router (to automate some tasks). But I need to log in to the router before I can do any operations on it and since it uses a http-auth I ...
1
vote
3answers
147 views

S/MIME doesn't protect against a stolen password, right?

We're setting up S/MIME so that we can send encrypted emails. However, I have a bit of a stupid (and maybe obvious) question... If someone steals a password for either the sender or the receiver, ...
2
votes
1answer
75 views

Does it make sense to use two factor authentication with password protected wp-admin folder?

I've finished building my wordpress website and now, I'm concerned about the security of the website. To improve security, I'm using Google two factor authentication plugin while also ...
2
votes
3answers
1k views

Microsoft password email reset link leads to different url?

...I am really annoyed and unsettled by the password reset email I just received from Microsoft. What should I think of this? My email client correctly told me that the underlying url is not the same ...
0
votes
1answer
128 views

Why is there a “show password” functionality in some login forms? [duplicate]

I've noticed that on a lot of login forms in websites and applications that there is a "show password" check box. Why? I myself have seen some hacks that an attacker could hack the input password box. ...
32
votes
10answers
4k views

Is there any point in using 'strong' passwords?

Let's say I'm setting up a new account on a website. Should I bother using a strong password? My reasoning is this: Password strength is a rough measure of how long it would take to brute-force my ...
4
votes
2answers
741 views

How does processor architecture affect password hashing speed?

Does hashing speed vary significantly using different architectures (x86 vs ARM)? Scenario I am investigating the possibility of using a cluster of Raspberry Pi for cracking passwords hashed with ...
257
votes
13answers
52k views

Are passwords stored in memory safe?

I just realized that, in any language, when you save a password in a variable, it is stored as plain text in the memory. I think the OS does its job and forbids processes from accessing each other's ...
4
votes
4answers
358 views

Is it a good idea to have a “master” password?

Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
1
vote
3answers
143 views

Cracking passwords after a patteren with ex. John

So i am trying to find out how easy it is to crack a password using some great Linux tools. We all know about John as a password cracker and how great it is. But how about specifying a patteren. ...
1
vote
0answers
20 views

How is password character validation in 3D secure is implemented? [duplicate]

We have a website which stores hashed passwords in the database. During logins we hash the password entered by user and compare two hashes. This is quite standard so far. Our client which is in ...
28
votes
7answers
1k views

How do I educate others about social engineering?

One of my friends used to boast about how long his passwords are. One day, I decided to play a prank and social-engineered it out of him. I was pretty surprised as to how effortless the entire ...
2
votes
3answers
251 views

Can't brute force password cracking somehow be throttled?

Online articles mention the importance of a strong password and suggest that hacking tools allows bad guys to attempt millions of passwords per second. I am wondering why OSes and websites and such ...
-4
votes
2answers
185 views

Inform someone about a hacked account [closed]

I'm not a hacker but recently I was able to get someone's email password. I want to teach him a lesson to be careful when using internet and to pay attention to his passwords but I have some problems: ...
55
votes
21answers
9k views

How can I avoid my password being harvested by key loggers from internet cafes?

During traveling, especially in poor countries, sometimes you are going to need to use the internet at an internet cafe and you really can't be sure whether anyone has installed anything to listen to ...
4
votes
1answer
78 views

Would siloing passwords into their own locked down schema improve security?

First off, I don't know how hackers get at an entire password table and steal them. I don't know if the owners of the website are to blame or what, but I am wondering if it involves logging into the ...
3
votes
1answer
254 views

Salt usage for Spring security?

I use the Spring security for Java web applications and I have written an authenticationprovider which is working without salt and now I want to either add salt or alternatively use the builtin ...