Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
2
votes
1answer
141 views
Accessing encrypted data with multiple users
I'm building a web based, LDAP authenticated password manager for internal use.
We don't want to store the passwords in plain-text in the database, and we want multiple users to be able to access the ...
0
votes
1answer
149 views
Storing Private Keys Generated on Server with specific User's Password Securely
I am currently building a system (PHP Web Application Framework) that creates an RSA Key Pair for a user to allow other users to send secure information from one to another. The public key is ...
1
vote
1answer
123 views
Implementing Secure Remote Password with Remote Desktop Application
I had read the Secure Remote Password Protocol paper written by Tom Wu. This protocol is resistant to dictionary attacks. I have also go through some papers regarding to VNC attacks due to weak ...
0
votes
3answers
253 views
Is it possible to change the wifi password with a script?
I was wondering if it is possible to change the password for a wifi with a script instead of having to log-in to the routers firmware?
0
votes
3answers
101 views
Lowest possible threshold for smartphone app login
I am developing an iPhone/Android game app. Currently users must register USERNAME (3 chars min, letters only) + PASSWORD (8 chars min, ascii only) before allowed into the game.
Testing shows some ...
1
vote
3answers
1k views
Is bcrypt better than scrypt [duplicate]
Possible Duplicate:
Do any security experts recommend bcrypt for password storage?
I'm no security expert and do not pretend to be that's why I'm asking here. I write many PHP based ...
3
votes
2answers
242 views
Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password
I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects.
I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
2
votes
3answers
116 views
Alternatives to Common Password Retrieval
Wired wrote an article recently about the top tech fails of 2012 and to no surprise, the password was on the list, more specifically the way a user can retrieve their passwords.
What are some nifty ...
8
votes
4answers
321 views
How to evaluate the strength of a hashing algorithm?
At work the hashing algorithm we use for passwords appears to be bespoke. Obviously that's a pretty bad idea, but the management don't seem bothered.
The algorithm always produces 20 character long ...
3
votes
7answers
242 views
Generate user a password instead of asking for one?
I'm trying to weigh the benefits of not allowing users to create their own passwords, but must pick out of a generated selection. Are there any examples of sites that have do use this approach?
...
7
votes
4answers
544 views
Calculating how secure my password is
I generally use gnuPG for encrypting my files. And as far as I know it's strength ultimately depends on the passphrase I use. So, I would like to know: how can I mathematically calculate how secure my ...
3
votes
2answers
125 views
Doesn't adding requirements to a password, such as must contain 2 digits, decrease the strength? [duplicate]
Possible Duplicate:
Doesn’t imposing a minimum password length make the password weaker by reducing the number of possible combinations?
Doesn't any constraints added to a password policy ...
1
vote
4answers
149 views
Secure login feature with low CPU power
I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
7
votes
5answers
387 views
Are we concentrating too much on password complexity?
As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
3
votes
1answer
145 views
Is a One Time Password Scheme based on Diceware viable and secure?
I recently learned about diceware and was thinking about how it could possibly be used to create a one time password scheme. I'm thinking S/KEY is probably more appropriate, but would a system that ...
2
votes
3answers
171 views
At what point is password complexity “safe enough”
Obviously the best passwords will be highly complex randomly generated passwords stored in a password vault. For the average user though, this might be a slight overkill.
Assuming that the average ...
-2
votes
1answer
413 views
Changing user account passwords from PHP script - vulnerabilities? [closed]
I started a thread a while back asking for suggestions on a good (good=fairly secure) way to allow users to change their account passwords via a PHP script. (WHY? because on this particular server, I ...
1
vote
1answer
171 views
Is this a reasonable approach to “generating” passwords? [duplicate]
Possible Duplicate:
What is your way to create good passwords that can actually be remembered?
I am using a self-developed "template" for my own passwords (like Facebook, Gmail etc.)
I use ...
204
votes
9answers
21k views
Is my developer's home-brew password security right or wrong, and why?
Our developer, let's call him 'Dave', insists on using a home-brew script for hashing passwords. See Dave's proposal below.
We have already researched and adopted an industry standard protocol using ...
0
votes
1answer
146 views
Password protection of encryption and signature keys
I would like to store encrypted backup of text files on my computer. I'm developing a python script using Pycrypto to achieve that, based on this code to use the library. (current code)
The basic ...
2
votes
5answers
173 views
Is there value in storing passwords in their own table with encrypted or hashed keys?
The usual method for simple sites is to store a hash of a user's password right in their user record.
What if the password field is removed from the user table, and a password table is created? The ...
-3
votes
1answer
132 views
What is the highest limit of security in the biggest agencies of the world? [closed]
A general question clicks in my mind, that there are many ways to bypass the security.
So, what is the highest degree of security?
3
votes
2answers
192 views
Is there a site like plaintextoffenders.com that shames companies that force insecure passwords?
I recently came across http://plaintextoffenders.com/ and I liked the idea. I wondered if there was a similar site that shames websites that force insecure passwords?
I personally have a list of a ...
4
votes
2answers
156 views
How secure are passwords that are set via IRC's /nicksrv?
I just registered a nickname on IRC and had to use a password to register it. Given that I've only used IRC, but never understood the P2P mechanics of it, I'd like to know:
Is the password I ...
17
votes
7answers
2k views
Why don't people hash and salt usernames before storing them
Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext.
What I ...
1
vote
2answers
358 views
What should I do if I type my password in the address bar, or type password in google search?
When someone accidentally types his or her password in one of the following three locations and presses enter, what should they do?
username text box
address bar
Google search
What do you suggest, ...
6
votes
7answers
634 views
How can I prevent users from entering bad passwords in my web application?
There is a long discussion on whether it's the responsibility of the user or the system administrator to deal with the strength of the password. Obviously, the password is a very private thing, but ...
3
votes
3answers
148 views
What security factors should I take into consideration when selecting a bank?
I've gotten fed up with my bank and have made the decision to move all of my banking elsewhere. This is a rare occurrence for me and, I suspect, for other people as well. It represents an opportunity ...
5
votes
3answers
773 views
Choosing a session ID algorithm for a client-server relationship
I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
3
votes
1answer
148 views
Updated list of bad/overused passwords [closed]
I am building a website, and I'd like to make sure the users don't put an overused password like password or password1.. or any of these
Is there a place that constantly analyzes hacked websites ...
-1
votes
2answers
106 views
Can 2FA help handle mixed personal and business accounts after leaving a company?
I do not want a super administrator in Google Apps to log to my account after leaving company, so I enabled 2-step verification. He could login to many sites as me with just a link in "forget ...
2
votes
1answer
109 views
How to safely “remember” login information in a program [duplicate]
Possible Duplicate:
How to Securely Implement a “Remember Me” Feature?
I have a program that communicates with a server. The user must log in with the application which runs on their ...
0
votes
0answers
31 views
Password recovery protocol for user account [duplicate]
Possible Duplicate:
Can anyone provide references for implementing web application self password reset mechanisms properly?
I need to create a password recovery mechanism for a user account ...
2
votes
6answers
277 views
Does shuffling a hashed password increase its security?
I am making a web app and I'm now stuck on making the login secure. I'm thinking of adding a salt to a user-inputted password and then hash it. (md5 or sha for example)
and then I will reshuffle the ...
1
vote
1answer
130 views
Is there formal guidance that requires all sessions to be logged off when a user changes their password?
Often when an account is hacked, security guidance is to change your password. However I've noticed that changing a password sometimes isn't enough to log out of other sessions that are active.
Is ...
61
votes
13answers
5k views
VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?
I work for a company which has ~16,000 employees. Periodically, our VP of IT sends out a newsletter with "tech-tips" and misc IT stuff. The topic of this week's newsletter was "password security". ...
3
votes
5answers
541 views
Increased security with keepass
I am using keepass for securing passwords. I have a reasonable password, but if someone got hold of the file I am sure eventually they could brute force it.
I was thinking of using a key file as ...
2
votes
1answer
504 views
Clarification on how rainbow tables work
If you goto : http://www.hanewin.net/encrypt/aes/aes-test.htm
for "Key in Hex" enter
00000000000000000000000000000056
for "Plaintext in Hex" enter
00000000000000000000000000000000
and click on ...
18
votes
5answers
1k views
How valuable is secrecy of an algorithm?
On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
2
votes
4answers
475 views
iOS app - hash user password in-app or on-server?
I'm working on an iOS app that will also have a web component. When a user creates an account, their password will be salted and hashed. I already have the hashing algorithm working on the web-side.
...
3
votes
6answers
293 views
Is there a table that compares hashing algorithms by speed, relatively (machine independent)
As far as I understood*, one of the major criteria when choosing a password / salt hashing algorithm is it's speed. To prevent brute force attacks, a slower algorithm is better (and also makes it more ...
17
votes
6answers
1k views
Why do we ask for a user's existing password when changing their password?
In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
9
votes
6answers
669 views
Are password reset links that don't expire a security risk?
I am currently working on a password reset flow. We have decided to go with a password reset link being emailed to the user's registered email and allowing them to follow that and input a new ...
2
votes
2answers
149 views
How should you store a password that needs to be retrieved as plaintext? [duplicate]
Possible Duplicate:
How should passwords be stored if they must be recoverable?
I have created an API for a site that doesn't provide any form of API. For the API to do anything with the ...
2
votes
1answer
87 views
What's the best way to enumerate log/sign in attempts?
For sign in via a website, what is the best way to count the number of attempts that is:
least vulnerable to tampering
reliable
quick
The system would:
use HTTPS throughout the sign on phase (at ...
0
votes
3answers
216 views
Key stretching an hash
if I implement an function which hashes the first half of my password with MD5 and the second half with SHA2 and MD5. Is there a security issue when I put these two hashes together to a 64 character ...
17
votes
9answers
1k views
Is a simple, but very long password a good password?
Is a password like
wwwwwwwwwwwwwwwwwwwwwwwww9
(25x 'w' and a number) secure? It would be easy to remember.
19
votes
11answers
967 views
Is it safe to use a weak password as long as I have two-factor authentication?
I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
3
votes
1answer
74 views
SRP: Can the client authenticate using only the stored hash?
Based on the description of SRP, it seems that it would be possible for a client application to cache the hashed password x and reuse it for subsequent authentifications. The actual password p doesn't ...
0
votes
0answers
391 views
John the Ripper Jumbo Compilation Errors on Backtrack [closed]
Any ideas on the compiling errors? I'm on BT5R2. (also, side note, anyone know how to contact via the openwall community? I looked and didn't see a way)
make clean linux-x86-opencl
rm -f ../run/john ...
