Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
1
vote
3answers
271 views
Differences between brute forcing access versus decrypting password files or databases
I was just reading about how it's better to use bcrypt to protect passwords instead of saving password hashes in databases, and that got me thinking about other aspects that hackers work on that I had ...
1
vote
3answers
163 views
Is it a good idea to have a “master” password?
Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
7
votes
2answers
324 views
Replacement for One Time Passwords (OTP)
OTP may known as new generation of password security techniques, but I want to know does it still safe enough after several years of appearance or it will deprecate soon? & what would be the ...
2
votes
3answers
127 views
How to regain access to the server?
I have a Debian server with KVM available 24/7. It was recently broken into and its root password changed.
My hosting provider has restored my access and helped me change the password. But in the ...
-1
votes
6answers
279 views
Using passwords made of words
People say don't use passwords in the dictionary but if you use two words isn't it alright? Dictionaries have at least 10,000 entries so just two words will be 100,000,000 possibilities (and that's ...
3
votes
3answers
1k views
Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password?
Given an option , which one should I choose , a HMAC for storing a password securely or a bcrypt or scrypt library?
3
votes
2answers
222 views
Is the password hash better when you concatenate the password and username?
Is the password hash (with bcrypt) better when You concatenate the username with password?
For example:
$this->hash($username . $password);
and
$this->hash($password);
Last time I used ...
3
votes
3answers
150 views
Methods for remembering passwords around the web
What's the least painful way to manage passwords for user accounts that you have on various sites?
I see only 3 options:
Password manager. Passwords can be different and strong, but the downside is ...
4
votes
2answers
751 views
openssl: recover key and IV by passphrase
A large amount of files were encrypted by
openssl enc -aes-256-cbc -pass pass:MYPASSWORD
Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
4
votes
3answers
2k views
How to crack password hashed using SSHA?
Is it possible to crack a password hashed using SSHA if I know the salt? How can I do it?
13
votes
3answers
1k views
Should security question answers be case-sensitive?
Question
In the case of security questions being used to reset an account password, what is considered best practice for handling case-sensitivity on the security question answers?
Scenario
An ...
2
votes
3answers
100 views
Clarification on an email about a security breach
I got the following email from a forum I was subscribed to:
It is our duty to inform you that there has been a security breach on
the server that Doom10 was being hosted on. It doesn't seem like ...
5
votes
2answers
139 views
Can a HSM be used to make password hashing stronger?
Say a database server has a HSM which is in use for encrypting (reversibly of course) credit card numbers. Is there any way a HSM could be used to add strength to a password hashing scheme? (Or are ...
6
votes
2answers
707 views
With PBKDF2, what is an optimal Hash size in bytes? What about the size of the salt?
When creating a hash with PBKDF2, it allows the developer to choose the size of the hash. Is longer always better? Also, what about the size of the random salt? Should that be the same size as the ...
1
vote
3answers
171 views
For what do I hash user passwords with PDKDF2 when the user data is stored in the same database?
I'm hashing the passwors of my users with PDKDF2 right now. A user can gain access to his account with his password. When the user is logged in he can edit his personal information and do other stuff ...
2
votes
4answers
375 views
Looking for password manager in company
I was looking for solution everywhere, but maybe because lack of specialized words I can't find it.
I've got a problem in finding a program, but I don't know how to describe it in one word so I'll ...
1
vote
3answers
244 views
Using only password to authenticate user (no “username” field)
I am creating a client access system, to allow manage invoices, make payments, access information about their products and information/functionality alike.
Supposedly there are less than 1000 ...
2
votes
2answers
166 views
In this example why do they hash a randomly generated piece of salt before hashing it with the password?
From here, in the code return substr(sha1(mt_rand()),0,22); what is the point of taking the sha1 value? It is appended to the password and together they are hashed using Blowfish. Why not just append ...
16
votes
3answers
964 views
Is there any advantage to splitting a password?
I've been reading about the LANMAN (LM) hash and I'm curious about a particular part of the algorithm.
The LM hash is computed as follows:
The user’s ASCII password is converted to uppercase.
...
4
votes
2answers
100 views
Does the password you use to sign into a VPN determine the strength?
I subscribed to a VPN service and need to change the password. Does the password I use to log in determine the strength? For example should it be 64 characters long or can it be 10? I'm thinking of ...
4
votes
3answers
147 views
Is using encryption the only viable option to thwart password sniffing?
I'm using HTTPS Everywhere on my browser to chose SSL versions of websites when available, but many sites don't offer a secure version. Is SSL the only viable option to thwart password/clear text ...
2
votes
1answer
130 views
Accessing encrypted data with multiple users
I'm building a web based, LDAP authenticated password manager for internal use.
We don't want to store the passwords in plain-text in the database, and we want multiple users to be able to access the ...
0
votes
1answer
131 views
Storing Private Keys Generated on Server with specific User's Password Securely
I am currently building a system (PHP Web Application Framework) that creates an RSA Key Pair for a user to allow other users to send secure information from one to another. The public key is ...
1
vote
1answer
111 views
Implementing Secure Remote Password with Remote Desktop Application
I had read the Secure Remote Password Protocol paper written by Tom Wu. This protocol is resistant to dictionary attacks. I have also go through some papers regarding to VNC attacks due to weak ...
0
votes
3answers
100 views
Lowest possible threshold for smartphone app login
I am developing an iPhone/Android game app. Currently users must register USERNAME (3 chars min, letters only) + PASSWORD (8 chars min, ascii only) before allowed into the game.
Testing shows some ...
0
votes
3answers
216 views
Is it possible to change the wifi password with a script?
I was wondering if it is possible to change the password for a wifi with a script instead of having to log-in to the routers firmware?
60
votes
13answers
5k views
VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?
I work for a company which has ~16,000 employees. Periodically, our VP of IT sends out a newsletter with "tech-tips" and misc IT stuff. The topic of this week's newsletter was "password security". ...
4
votes
4answers
1k views
Are there lists of most common words or ngrams used in passwords and passphrases?
I've been thinking about ways to focus brute forcing dictionary attacks on passwords and passphrases based on the assumption that certain words, combinations of letters, and combinations of words are ...
3
votes
2answers
213 views
Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password
I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects.
I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
1
vote
3answers
933 views
Is bcrypt better than scrypt [duplicate]
Possible Duplicate:
Do any security experts recommend bcrypt for password storage?
I'm no security expert and do not pretend to be that's why I'm asking here. I write many PHP based ...
4
votes
3answers
1k views
Possible to use both private key and password authentication for ssh login?
It seems that they are mutually exclusive, as disabling one gives me the other, and vice versa. Two-factor auth for my ssh servers sounds really nice, so is there any way to accomplish this?
9
votes
6answers
585 views
Are password reset links that don't expire a security risk?
I am currently working on a password reset flow. We have decided to go with a password reset link being emailed to the user's registered email and allowing them to follow that and input a new ...
2
votes
5answers
164 views
Is there value in storing passwords in their own table with encrypted or hashed keys?
The usual method for simple sites is to store a hash of a user's password right in their user record.
What if the password field is removed from the user table, and a password table is created? The ...
2
votes
3answers
99 views
Alternatives to Common Password Retrieval
Wired wrote an article recently about the top tech fails of 2012 and to no surprise, the password was on the list, more specifically the way a user can retrieve their passwords.
What are some nifty ...
4
votes
4answers
389 views
Do password complexity requirements reduce security by limiting search space?
I've read that password complexity requirements make passwords easier to guess via brute force attack. The reason for this is that the complexity requirement actually reduce the search space for brute ...
8
votes
4answers
309 views
How to evaluate the strength of a hashing algorithm?
At work the hashing algorithm we use for passwords appears to be bespoke. Obviously that's a pretty bad idea, but the management don't seem bothered.
The algorithm always produces 20 character long ...
1
vote
3answers
164 views
At what point is password complexity “safe enough”
Obviously the best passwords will be highly complex randomly generated passwords stored in a password vault. For the average user though, this might be a slight overkill.
Assuming that the average ...
1
vote
4answers
142 views
Secure login feature with low CPU power
I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
3
votes
7answers
230 views
Generate user a password instead of asking for one?
I'm trying to weigh the benefits of not allowing users to create their own passwords, but must pick out of a generated selection. Are there any examples of sites that have do use this approach?
...
7
votes
4answers
527 views
Calculating how secure my password is
I generally use gnuPG for encrypting my files. And as far as I know it's strength ultimately depends on the passphrase I use. So, I would like to know: how can I mathematically calculate how secure my ...
3
votes
2answers
115 views
Doesn't adding requirements to a password, such as must contain 2 digits, decrease the strength? [duplicate]
Possible Duplicate:
Doesn’t imposing a minimum password length make the password weaker by reducing the number of possible combinations?
Doesn't any constraints added to a password policy ...
7
votes
5answers
368 views
Are we concentrating too much on password complexity?
As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
20
votes
1answer
2k views
Are there more modern password hashing methods than bcrypt and scrypt?
This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt.
What I'm wondering is if there are any ...
35
votes
4answers
4k views
Recommended # of iterations when using PKBDF2-SHA256?
I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
3
votes
1answer
131 views
Is a One Time Password Scheme based on Diceware viable and secure?
I recently learned about diceware and was thinking about how it could possibly be used to create a one time password scheme. I'm thinking S/KEY is probably more appropriate, but would a system that ...
20
votes
5answers
1k views
Is it common practice to log rejected passwords?
While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
15
votes
7answers
383 views
To salt, or not to salt? [duplicate]
Possible Duplicate:
Why is using salt more secure?
Why would salt not have prevented LinkedIn passwords from getting cracked?
Recently I decided that I wanted to learn more about web ...
7
votes
4answers
1k views
What is a good practical (and sane) way to manage all your passwords for online sites?
I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords.
This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
-2
votes
1answer
374 views
Changing user account passwords from PHP script - vulnerabilities? [closed]
I started a thread a while back asking for suggestions on a good (good=fairly secure) way to allow users to change their account passwords via a PHP script. (WHY? because on this particular server, I ...
2
votes
2answers
309 views
Do OpenPGP/GnuPG apply slow hash to password when encrypting/decrypting key?
Password space is quiet small. Therefore slow hash should be applied to password before using it for encryption.
Should slow hash function (like bcrypt) be applied to password before using it with ...
