Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

6
votes
3answers
76k views

Wordlists on Kali Linux?

I notice that in /usr/share/wordlists in Kali Linux (former Backtrack) there are some lists. Are they used to bruteforce something? Is there specific list for specific kind of attacks?
0
votes
2answers
93 views

Need some docs that say we shouldn't upper the string when saving it as a password [closed]

I'm trying to find on the Internet some manual, guide or policy secure about applications should not convert lower string to upper string to store as password I mean, don't make ...
2
votes
1answer
81 views

What is a key-hardened hash?

I've seen the term 'key hardened hash' used to describe a recommended way to tighten up password hashing. What does this mean? Can it just mean to use a pepper?
17
votes
6answers
2k views

What does “random” mean in the context of password creation?

Disclaimer: as you will see from my question I'm a total outsider in this subject, just very curious. I was wondering how easy it would be to crack a password-protected RAR5 file, and I found many ...
3
votes
3answers
161 views

Acceptably secure solution for users to log in with a short unique code only (no username)

I am creating a website whereby users are given an account by invitation only, and are sent a unique code by post. Users can then log in (at least the first time) by entering the code only. The goal ...
36
votes
11answers
28k views

Are password-protected ZIP files secure?

Following my answer. If I can list contents of password-protected ZIP file, check the file types of each stored file and even replace it with another one, without actually knowing the password, then ...
-2
votes
1answer
256 views

What are common problems that reveal PHP code? [closed]

What is the best method for securing PHP scripts that contain database passwords? From what I've read, PHP can be revealed when an error occurs and is not caught. Is there any way to reveal PHP by ...
0
votes
1answer
184 views

What kind of backdoor can be made after hacking wi-fi? [closed]

I'm interested to know if A hacks B's wifi password, what can A do to gain persistent access to the router even after B changes the wifi password? Secondly, how can we detect the backdoor and patch ...
21
votes
4answers
2k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
8
votes
3answers
2k views

SSH key auth, but still need password for sudo?

SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive ...
4
votes
2answers
364 views

LastPass login security

If LastPass does not store your master password, then how can you login to use their web app? Surely you must type it in, it is sent over using SSL, and then salted/hashed on the server-side, and ...
5
votes
3answers
1k views

Is GPG suitable as part of a password manager and generator?

I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
1
vote
3answers
149 views

How to transform an hash into a usable password?

I was reading about PwdHash and it inspired me to create a little project where you input a master password and an easy to remember alias into a password hash, like bcrypt, and then you get an hash. ...
7
votes
4answers
450 views

Decentralised password recovery

Are there good/established techniques for password/key recovery in situations without a centralised service? (Anything goes, but I'd prefer solutions that distribute the recovery information across ...
1
vote
1answer
73 views

Password sharing with spouse or mate (bulk-change shared passwords (via cloud service))? [closed]

I've read on New Scientist magazine that in 80% of all cases when people in a relationship share a place where they live one of the spouses knows the other's password, thus making the question I am ...
1
vote
2answers
237 views

Longer passwords vs Password Composition Rule [duplicate]

Password composition rule is being considered as a burden for the users and some experts are recommending the increase in the password length instead of enforcing users to comply with the composition ...
1
vote
3answers
133 views

Trouble understand login vulnerabilities

I'm testing my own web page with the following vulnerabilities. #1: Form escapes ' to \' So if a user tries to enter the following information: username: 'or'1=1 password: m username will ...
0
votes
1answer
46 views

Framework behind password reset mechanism

I have always seen those "Forgot password" links from web sites that requires some form of user login. Can I get a deeper understanding of how this works? What tools/framework do I need to use because ...
1
vote
1answer
789 views

Hydra sometimes fails against my own router known password

Hydra sometimes fails against my own router known password. Sometimes confirms it was found, and sometimes returns unusual error code (empty). What does this means? dione@saturno:~/misc$ hydra -l ...
1
vote
1answer
88 views

What is the safest way to encrypt a password that can be decrypted at a later time?

In a web app I'm building, I need to use Apple's AutoIngestion tool for iTunes Connect. In this tool it seems the only way to use it is to send a password in plain text. What would be the best ...
4
votes
3answers
504 views

SSH Public Key Authentication vs Username/password for API Access

I have a linux device that will be making periodic call to an API server, say everytime the system boots up. Everytime then it should authenticate itself and then do its thing. I can either store the ...
51
votes
9answers
10k views

Generic error message for wrong password or username - is this really helpful?

It is really common (and I would say it is some kind of security basic) to not show on the login page if the username or the password was wrong when a user tries to log in. One should show a generic ...
2
votes
0answers
32 views

sample/starter code to test for TRUSTe password requirements [closed]

Considering its a requirement for Truste certification I figure that the code to test for a password meeting Truste's password strength requirements has been written more than a few times. I was ...
2
votes
2answers
88 views

Does changing the default number of iterations in KeePass (or other encryption applications) increase security?

Inspired by this question about the difficulty of cracking a KeePass database, I'm wondering if changing the default number of iterations in an encryption application (e.g., KeePass) increases ...
51
votes
5answers
9k views

Is sending passwords through cellphone text messages secure?

Both the sender and the receiver deleted the text after it was sent, but is it still possible that it exists somewhere and that someone can get to it?
3
votes
2answers
146 views

Obscure username input on login forms?

Not (necessarily) a duplicate of: Should both user ID and Password be masked for online banking? Definitely not a duplicate of: Should usernames be kept secret? I can sense your finger on the "mark ...
-2
votes
4answers
162 views

Getting password cracking time and byte storage from bruteforce?

I am stuck with this question, you can see it in the picture I have included below. PARTS (a and b) I know a-z will be 26^8, A-Z will be 26^8 guesses, and 0-9 will be 10^8 guesses. But I can't relate ...
0
votes
1answer
143 views

What can hacker do, if he knows my SALTED password?

for example, in any website (WORDPRESS or etc..) they store passwords in database, using SALT mehtod (as i know)... for example: $P$dfwegfwegewgIT03.wewefefweg if hacker got this password and ...
13
votes
3answers
5k views

Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password?

Given an option , which one should I choose , a HMAC for storing a password securely or a bcrypt or scrypt library?
1
vote
3answers
100 views

Password reset question answer complexity

I need to implement a password reset feature for a system that will be controlled by a security question and answer pair. The problem is that I can't guarantee I'll have a valid e-mail address or cell ...
4
votes
3answers
1k views

Why do some websites force users to come up with difficult passwords?

I can't understand why we commonly force users to come up with difficult to remember passwords. * Your password must contain at least one number, one uppercase character, and one special ...
2
votes
2answers
287 views

Temporarily save failed logins password hashes for using against brute force attack

My question is about online brute force attacks, that try to authenticate in the website. 1) For the first case if the requests are coming from the same ip, I think this are relatively easy as after ...
0
votes
1answer
92 views

Different password for each login - based on some variable

This might sound a silly question, but I was thinking this as and extra option(which is not required) mainly for advanced users, who want to protect their accounts even more. Lets consider that other ...
90
votes
6answers
32k views

Password Hashing add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
3
votes
2answers
124 views

Is there any point in using two step authentication if you have strong passwords?

If you are in the habit of using strong passwords (randomly generated by password manager) is there any point in using two step authentication? Assuming that 99% of the time that when you enter a ...
3
votes
2answers
115 views

Why would you decouple your resource and login servers?

As described on this link, OAuth specifies that a login server and a resource server should be decoupled. The idea is that if one of your resource servers gets hacked, no password data is lost. All ...
88
votes
12answers
12k views

Technology that can survive a “Rubber-Hose attack”

In the documentary film Citizenfour, Edward Snowden says about documents: I'm comfortable in my technical ability to protect [documents]. I mean you could literally shoot me or torture me and ...
5
votes
2answers
122 views

Share root access without sharing password

I am looking for a way to share admin privileges on some hosts without providing the admin password. From his link, I was thinking of using a primary host from which every user can sudo -u user to ...
1
vote
3answers
459 views

Who should I give my password to [duplicate]

I've got a dilemma, should I give my password to my local IT help desk (I am seeing them face to face, and I know that they work for the same company as myself). They want to perform a routine ...
0
votes
1answer
53 views

MD5 before PBKDF2 on legacy software

I am mantaining a legacy software that uses MD5 in the following way: The client asks for a 16 byte salt when authenticating an account. The server generates a 16 byte salt, links it to the account ...
6
votes
3answers
225 views

Image file as password alternative

I seek guidance on interesting issue. Recently I've been searching for password alternatives, not because of the security, but to be more user-friendly. In one of my projects user receives 128 bits ...
22
votes
4answers
7k views

How secure is Windows 8's Picture Password login?

The final Windows 8 build has been released to manufacturing. One of the new features of Windows 8 is "Picture Password", where the end user logs on to Windows by clicking a specific pattern on the ...
3
votes
1answer
300 views

Why do major sites(Facebook, Google, etc) still send passwords unhashed? [duplicate]

QUICK SUMMARY: It seems like modern websites, for security's sake, should all have the client hash their own passwords before sending them to the server, who will rehash them, in order to avoid ...
1
vote
3answers
121 views

cleartext passphrase for keystore

How is passphrase for a keystore to be stored? we have all passwords encrypted and the key to encrypt is stored in keystore , so how is the passphrase for the keystore to be stored? in clear text? if ...
16
votes
5answers
956 views

At what length does a password stop making sense?

I'm going to recommend that our users start using a password manager and start creating strong random passwords. Though I don't know what size of a password to recommend. Is it possible for a ...
2
votes
2answers
249 views

Is plain text over https really a good idea? [duplicate]

Sending plain text passwords over https is quite secure, the traffic is encrypted, making eavesdropping virtually impossible. However, once on the server side, it is still plain text. Of course, ...
2
votes
1answer
429 views

Is Google's password recovery by entering an old password a bad practice?

When you try and recover your password on Google, you will eventually stumble across this screen, and it made me wonder: Isn't this type of password recovery from Google essentially the same as ...
0
votes
0answers
23 views

KeePassX and Dropbox [duplicate]

I am currently using KeePassX on Linux to allow me to have a different strong password for each website. With this program there comes two major inconveniences: I lose access to everything in the case ...
0
votes
1answer
116 views

Secure way to encrypt (not hash) passwords?

I'm building a system that for reasons I'll outline below, can't used hashed passwords, but I'd still like to encrypt them so that it's as hard as possible to crack them, in the (unlikely) event the ...
19
votes
4answers
950 views

Should I be concerned when a “Forgot Password?” tool sends my password in plaintext?

Some sites I have been a member of in the past don't go through the normal "Forgot Password?" process. Instead of e-mailing me a unique password reset link or something of the like, I have received ...