Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

5
votes
1answer
103 views

Reviews of Argon2

I am not a security guy but just curious about the things here. I have seen several people in various answers here talked about the password hashing competition. Now that the winner is announced, I ...
12
votes
4answers
1k views

Does an *additional* company-wide password offer any real security?

So, let's say a company has what could be referred to as an "access key". Each user has their own username and password, and there is an additional company-wide access key that people must input with ...
2
votes
1answer
72 views

Strength of variable-length generated password

I am contributing to the Word Sequencer plugin for KeePass password manager, which can generate diceware-style passwords using a high-quality PRNG. Something in particular I'm working on is estimating ...
1
vote
4answers
252 views

Complex password rules - is there any sense?

Let us assume that our system is well designed and it limits the amount of login errors so that brute force attach on the user interface is not possible. Say after 5 failed logins for an account the ...
20
votes
4answers
2k views

Is it safer to ssh as a privileged user than to ssh and sudo?

I came across this old paper, discussing the possibility of password length information being disclosed when usin SSH: Timing Analysis of Keystrokes and Timing Attacks on SSH. The paper has been ...
1
vote
0answers
172 views

Securely storing users PIN on Android with fingerprint authentication

I am have an Android app where the user can enter a pin specific to a particular phone to save them entering the full password. I'm now looking at the new fingerprint reader API on Android M where I ...
4
votes
2answers
713 views

I tried to break my WiFi: is 8 uppercase letter strong enough?

My Wi-Fi WPA-PSK password looked pretty weak: 8 uppercase letter. I have checked with another router from the same provider and the pattern is the same. To see how weak this is I tried to hack it ...
0
votes
1answer
53 views

Software activation “by phone” [closed]

I'm a software developer, and I would like to protect my application in an offline way, like many software do activating by phone. Following a screenshot taken from google images on what I would like ...
27
votes
8answers
3k views

Best way to administer all my passwords

I am trying to figure out what the best solution is to store different types of passwords: Personal passwords (my personal email, my company's email, all the services I use to buy things like ...
0
votes
2answers
145 views

How can a weak root password be compromised?

I use ubuntu for personal computing. I've read an advice in many questions here to have a strong root password. I don't understand what's wrong with a weak root password. After all we have to type ...
0
votes
0answers
90 views

Hydra command for cracking a webpage which uses <span> tag for failed login attempts

I'm trying to for crack a simple webform for testing hydra in Kali. When the webpage encounters a wrong username and password combination it pops up a message using the following html code:: ...
3
votes
2answers
171 views

Why is a bad idea to use a common password form?

I've heard that its a bad idea to create passwords based on a common form such as random letters appended with the start of a websites domain name. So for example a password to gmail might be ...
3
votes
3answers
107 views

how is strength of password calculated from standard keyboard patterns?

In password strength calculator is there an algorithm to determine the keyboard pattern? there could be thousands if not millions of patterns that could be generated with a standard qwerty keyboard. ...
1
vote
2answers
32 views

Rembering password on client (not database) [closed]

I am trying to implement the capability for my program (C++) to remember a user/password combination, so the user does not need to type it in again. Is there a secure way for my program to store ...
2
votes
1answer
126 views

How to store client login credentials?

My company has to constantly connect to remote server where there are numerous way to access, often via vpn and remote desktop connections, as well as SQL servers. There are over 50 clients that this ...
8
votes
4answers
2k views

Hashing passwords and dealing with duplicates

Currently my project still uses MD5 hashing to encrypt passwords. Yeah, I know. I'm planning to update the password system to use the newer password_hash and password_verify functions in PHP, which ...
2
votes
3answers
193 views

I didn't wipe my hard drive before I sold it. How would a criminal take advantage?

I just sold a Mac Mini, and I erased/formatted the hard drive before I turned it over, but I didn't wipe it securely (not wise, I know). How would a criminal take advantage of this fact? What is the ...
1
vote
2answers
129 views

Password Reset URL forwarding

If a previously registered user clicks on the password reset button during login, I want to send them an email with a reset password link. I have three queries: How to add an expiry date to the ...
2
votes
3answers
161 views

I have moved to OSX; what is the best way to self manage passwords?

I am going to go ahead and say that I have to trust at some level, therefore I choosing to trust first parties (Apple/Microsoft/etc) for the sake of this question. I used to use KeePass (database ...
1
vote
2answers
142 views

Keepass - password paranoia

How do I know that the Keepass app isn't behind the scenes at some point sending my master password over internet to some secret site whose job it is to collect them and use them for evil means?
6
votes
1answer
235 views

Why does OWASP recommend security questions?

I was reading the OWASP Forgot Password Cheat Sheet when I stumbled upon the recommendation to use security questions. There is even a dedicated page about what information to gather. Whenever I ...
10
votes
5answers
425 views

Two passwords provide better security than two-factor authentication?

While evaluating 1Password's new Teams service, I noticed rather curious absence of support for multifactor authentication. When asked about the lack of MFA, they replied: We use an Account Key ...
0
votes
1answer
50 views

Two reset password tokens used for the same reset password flow

I've a question regarding a forgotten password flow. Basically I'm sending the password reset token out-of-band to the user, and then the user sends it back with the first request via querystring, I ...
3
votes
3answers
82 views

Implement a passcode to authenticate app users [duplicate]

This question is related to this one. We're busy implementing 5 digit passcode authentication for our app (Android, iPhone), but we're running into a complexity. We're unsure how we can safely ...
5
votes
15answers
5k views

Preventing registered users from sharing passwords [closed]

Below is a proposal for dealing with a situation of website security. I am wondering whether it seems feasible, from both a technical and usability point of view. I want to make sure that the proposal ...
4
votes
0answers
21 views

How to securely send your user and hashed password to a server? [duplicate]

I'm making a user system for an app I'm developing, and I have a client side (the mobile app itself) and a server side (where the database remains) for it. The app sends get and post petitions to the ...
1
vote
0answers
69 views

How secure is Asus router latest framework function: “Added protection mechanism for GUI login brute-force attack for login username and password.”?

I have just updated my RT-N12 D1 router to the latest framework, and it has new function - "Added protection mechanism for GUI login brute-force attack for login username and password.". I Googled and ...
-1
votes
2answers
117 views

Using a password hash…as the password? [duplicate]

Ok, this is probably a really stupid idea, but I can't really see why it would be a bad idea. Maybe someone can enlighten me. Why couldn't you enter a password good hashing algorithm like bcrypt, ...
2
votes
1answer
100 views

Login on public Wi-Fi networks using HTTPS [duplicate]

Is it safe to log in to my e-mail account with my iPad's Safari through a public Wi-Fi network (let's suppose someone is eavesdropping the traffic) provided that the e-mail provider uses HTTPS?
0
votes
2answers
57 views

Is it insecure to temporarily save user's data in a session while they register?

My plan is to save the registration, as they go along so if they close the page by accident they will still have all of there information saved so they can continue it again. But my question is it ...
13
votes
2answers
324 views

Why is OpenID considered secure when password reuse is not?

OpenID allows you to use your e.g. Google/Facebook/Microsoft account to log into a third party website. It can be used to log into Stack Exchange. Why is this considered an acceptable practice, ...
72
votes
10answers
12k views

If I enter a password on the wrong site, should I consider it compromised?

I have recently started to make use of a password manager and good password practices. I have a different password for each site that I use. If I accidentally use the password from another site when ...
-1
votes
1answer
132 views

Is it okay to have a blank root password for MySQL if port 3306 is not forwarded?

I'm running a PHP server that will use the root account to access the database. However, the server is behind a router and port 3306 is not port forwarded. Is it okay to have a blank password for the ...
9
votes
4answers
318 views

Why do websites store passwords' hashes not their ciphertexts?

Every time we discuss passwords and hashing functions posters immediately bring up how hashing functions can be cracked and we should avoid MD5 .. etc Hence we have use strong passwords and salt and ...
5
votes
3answers
257 views

Did I miss any vulns here?

I recently took a beating in a Security Engineer interview and I did not get any specific feedback on how I did. I'd like to re-ask the question to the community so I can polish up on these elements. ...
79
votes
8answers
9k views

Why should you redirect the user to a login page after a password reset?

The OWASP Forgot Password Cheat Sheet suggests: Whenever a successful password reset occurs, the session should be invalidated and the user redirected to the login page I'm failing to understand ...
1
vote
2answers
201 views

Is Linux getting less or more secure? [closed]

The famous so-called virus-and-hacker-free Mac is a thing of the past: As it gets more popular it gets more vulnerabilities. Will Linux be the same at some point in time? Is it getting less of more ...
3
votes
1answer
32 views

Adding HTTPS API to legacy hardware system that uses short numeric passwords

I work with a hardware system that traditionally authenticates users by the entry of a short numeric password on a physical keypad. Despite the small password entropy, this system has proven to be ...
0
votes
0answers
36 views

Is it appropriate to request a bounty for finding exploit on major site? [duplicate]

Long story short, I found an easily reproducible, very easy, and honestly embarrassing exploit on a major (yes, major) financial institution's online banking site today. It's not directly tied to ...
2
votes
2answers
107 views

Log User In Automatically After Clicking Account Activation Email

Scenario: Forum account registrations, user must click an activation email after they sign up e.g. they create an account with username, email, password, and an email is sent to the email they select. ...
3
votes
1answer
79 views

Using the password, among other values, as key data in two-factor authentication

I'm writing an implementation and a thesis about two-factor authentication, and am currently doing some research. I'm currently looking at an implementation for deterministically generating a ...
5
votes
3answers
166 views

How to mitigate heartbleed like attacks prior to zero day

Whenever sensitive data such as a password is used on a server it resides in memory for a short time. Given that security flaws like heartbleed exist which have the ability to 'bleed' memory for their ...
2
votes
4answers
124 views

Is it a good idea to to use secure_hashing_function(mypassword.url) as my password? [duplicate]

Like many users it's very difficult for me to use a different password for every website I have an account with. It does not matter how complex my password is if ONE naive website stored it in clear ...
5
votes
1answer
971 views

Should I be worried about brute-forcing passwords that encrypts AES?

I am building an application that needs to locally store sensitive data, that is encrypted using the sha256 of a password provided by the user. It uses AES for encryption. I am worried that some ...
5
votes
1answer
267 views

YubiKey or Google authenticator?

I'm using lastpass and I would like to implement a 2FA in my account, but I don't know which one is the most secure, a software authenticator such as google authenticator or an USB device as Yubikey. ...
0
votes
1answer
183 views

Is it possible to recover a Diskcryptor volume password?

Must admit to being dumb: I have encrypted one partition from my external hard drive with the AES-Twofish-Serpent algorithm and used a key file with a password. My PC ran into a problem and now the ...
0
votes
1answer
87 views

Can you do a client and server side encryption [duplicate]

I am creating a PHP website where users, among other things, can login and do administrative stuff. For their passwords i use password_hash($password) and to later verify with it, I use ...
1
vote
2answers
141 views

Does using NATO's phonetic alphabet increase password strength?

Given an alphanumeric password intended to be strong yet easy to remember, we change each alphabetic character by its NATO alphabet counterpart (e.g. 'cat' becomes 'charliealphatango'). I understand ...
-1
votes
1answer
37 views

Quantum Computation and its threats [duplicate]

Since Quantum Computers has potential to become super computers of next generation. will that make cryptography obsolete..?
2
votes
2answers
71 views

Password generation based on hash of master password + suffix?

Is this [1] a secure and reasonable way to generate a unique password for login on various websites? echo -n my_strong_master_password#website.com | sha1sum Of course, if my system is compromised ...