Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
1answer
90 views

Checking a salted hash against known password?

I've created a mysql dump of my users and passwords and awked them into a presentable form: Passwords: '...
9
votes
3answers
1k views

Client-side BCrypt, store salt and hash separately in MySQL database [duplicate]

I’m developing an Android app with a MySQL database for storing user login credentials. I’m using jBCrypt for hashing passwords before storing them in the database. On registration, the password is ...
9
votes
2answers
290 views

How to create dictionary to prevent weak passwords?

I've been tasked with adding a "dictionary check" against user's passwords to prevent weak passwords. Unfortunately, that is about as much guidance as I've been given and I need some help deciphering ...
32
votes
7answers
5k views

How to prevent username and password matches when changing a username?

Let's say that I have a system where one of the security requirements is preventing users from choosing a password that matches their username. Usernames are not case sensitive but the passwords are. ...
3
votes
1answer
105 views

Unable to completely enforce password policy

PCI DSS has a few requirements regarding the password policy (like remember last four passwords, change password every 90 days, use at least seven numeric and alphabetic characters and more). These ...
0
votes
1answer
25 views

Principal Password in Kerberos KDC database

Is there a way for me to merge a bank account number, fingerprint image and IMEI of a phone into a single entity that I could possibly use as a password in the Kerberos KDC to uniquely identity a ...
0
votes
1answer
80 views

Is there a way to securely check if a password is one of the most used ones?

So lets's say that a user wants to register to some website. For whatever reason, I want to not allow that password if it is one of the top 100 passwords used on my site (So I'm not checking against ...
5
votes
3answers
223 views

How can I prove that my software is secure for those who are interested to install it?

I've written a password locker program for Microsoft Windows that encrypts its contents to the local machine. The only way to get the data out is with the encryption key the user knows. It uses the ...
2
votes
2answers
65 views

Would a multilingual Diceware password be more secure than a monolingual one? [duplicate]

I've been reading up on Diceware recently, and I'm wondering if using a mix of languages would make it even more secure. On the face of it, it would force a potential attacker to consider an even ...
0
votes
2answers
112 views

Password based Asymmetric Key generation

I am looking for a password based key derivation scheme that results in an asymmetric key pair. I have worked with PBKDF and its variants but could not come up with any way of generating a key pair. I ...
1
vote
2answers
205 views

Pin delivery: SMS, mail, or pin mailer?

Imagine a scenario where a 4-digit pincode needs to be delivered securely to an end-user. Several possibilities exists: Pin mailer (this seems to be standard according to ISO 9564-1) SMS Email Email ...
2
votes
1answer
157 views

How might a PIN based Web authentication scheme work?

I'm interested in implementing PIN based authentication for a web application, similar to what Facebook provides in their mobile web site. Here is the user flow: User visits the site for the first ...
0
votes
0answers
36 views

What is a straightforward way to brute force CLI applications?

This is a question to maybe more CTF-experienced guys among you. I wonder how you generally brute force a simple CLI application. For example if you have an application which tells you a user's data ...
1
vote
2answers
71 views

Custom word list generation for a specific web domain

I am looking for a tool that generates a set of word lists based on the words it finds on the pages of a particular web domain. This question has an answer that generates permuted word lists starting ...
7
votes
3answers
572 views

1Password for team how secure it is?

I would like to ask you opinion about how secure is the 1Passowrd for Teams. For someone who doesn't know how 1Password - Personal use - works here a summary: You create a master password (hard to ...
1
vote
3answers
177 views

Are longer passwords safer even if the encryption/database security used is compromised?

Let me preface this that I am having a lot of trouble wording my question. Hopefully my description will help clarify. I have always wondered if long passwords actually provide you any more security ...
1
vote
1answer
168 views

Is Trillian application unsafe? (Got “Someone has your password” message from Google)

Trying to connect to GoogleTalk from the Trillian app for Android (a universal instant messenger app), I got denied even with the correct password. Then Google e-mailed me saying that my password is ...
1
vote
2answers
160 views

Password may not be similiar to last 5 passwords [duplicate]

SAP NetWeaver has a password policy to prevent your new password beeing similiar to the last 5 passwords. Are the passwords stored in plaintext to verify this? Or is something like a soundex value ...
0
votes
1answer
102 views

Is Entropy all that matters in a Password? [duplicate]

My question is, is it more reliable having a password that is composed by words like FootballPractice more secure than using a password that has only 2 or 3 bits less, for example FootbalPractic , my ...
1
vote
1answer
72 views

Distinct error messages for wrong email / password

I want to continue discussion started in this question "Username and/or Password Invalid" - Why do websites show this kind of message instead of informing the user which one was wrong? but ...
2
votes
1answer
58 views

Remembering email in login form

After logging out Google remembers recently used email addresses in the login form so the user only needs to enter the password. See accounts.google.com. How secure is it? What factors should I ...
0
votes
1answer
30 views

Creating secure random output that is repeatable across machines [duplicate]

I'm having trouble figuring out a solution to this problem. Basically what i am trying to do is create random data that can be repeated across multiple machines by a user but is also secure from ...
5
votes
6answers
277 views

How secure is this process for creating passwords?

I've been research into how to be as secure as possible when it comes to password security for online services and websites. Obviously there are some big no no's like using dictionary words, using the ...
8
votes
7answers
389 views

Strong password vs. restriction on number of attempts

To begin with, I am considering the password protection of standard internet services like Gmail or Dropbox. They often force users to choose a "strong" password, that is many characters, including ...
3
votes
2answers
72 views

Securely generate a rng seed using a small number

I'm trying to figure out a secure method to generate a rng seed to a rng using a small pin number that is 5 digits. The issue that i can see with this is an attacker could very easily just loop ...
1
vote
1answer
98 views

How much more difficult does it become to crack a password when appending a 5-digit pin?

I have a quick question regarding password cracking. Lets say you append a 5 digit pin on the end of your password. An example would be instead of a password of "password" it would be "password12345"....
1
vote
1answer
71 views

Why is the password field blanked in the registration form if the validation fail? [duplicate]

Is it really a problem if you send back the password when the validation fail on a registration form? I understand that the html that is sent back could be cached on the computer of the person ...
8
votes
3answers
2k views

Why can't the FBI copy the contents of an iPhone they are trying to crack?

Making the news rounds now is a story about the courts ordering Apple to disable the automatic deletion of data after 10 failed password guesses. What I don't understand is, why doesn't the FBI just ...
-1
votes
1answer
45 views

What are the exclusions for using a very long and random password? [closed]

It is a good practise to always use long (63 character) and random passwords. Question: But what are the exclusions? Can someone mention cases? Example: when console login is needed (so not via ...
1
vote
2answers
79 views

Using emoticons in passwords

I'm coming up with a password to use for my banking website, XKCD style. Furthermore, I'm considering adding in an emoticon (say, a <3) How many bits of entropy does an emoticon add to my ...
-2
votes
3answers
339 views

Why is encryption bad for passwords?

We use PGP for almost everything and it's so infeasible to bruteforce that it's considered secure. This is the guiding principle beyond CryptoLocker. But for stuff like e-mail, SSH and HTTPS, it's ...
1
vote
0answers
117 views

Can password hashing both client side and on the back end improve security if we don't necessarily trust the server? [duplicate]

I want to know if it ever makes sense to hash a password client side and rehash it again on the back end. I've not seen this done before which makes me suspicious as to whether it really does add ...
3
votes
5answers
346 views

How should I store a physical written copy of my password? [duplicate]

I can employ all the fancy encryption and the randomest of passwords to my hard drive, but it won't do me any good if I don't remember how to log in. It seems sensible to write down my password, then....
0
votes
1answer
165 views

Brute force a hard drive when most of the password is known

I need to access a hard drive that is encrypted with LUKS. The password provided is incorrect, however it is only incorrect by a character or so. The password itself is very strong and above 30 ...
1
vote
0answers
67 views

Is that a way break Linux user password by bypassing grub protected?

The best way to delve into others Linux machine is by editing the grub. Many will start by, editing the line ro quite splash as rw init=/bin/bash during the startup (usually by pressing button e on ...
1
vote
2answers
221 views

Is it a good idea to combine words from different languages to increase a password's strength? [duplicate]

I was thinking of a way to generate a password that is easy to remember, but hard to crack, like the famous "correct horse battery staple" suggested by XKCD, also discussed here, and I've realized I'...
1
vote
1answer
146 views

My iTunes account got hacked and someone used it to buy in-app purchase. How could that happen? [closed]

The account was hacked, I found out in my credit card statement and Apple support gave me refund which is nice. I wonder how it happened, and if there are even more serious risks that I don't know. ...
1
vote
2answers
163 views

Security concerns of running auto-login script on server-side?

I would like to fetch data from a website to do data analysis on a server. Username and password are required for login to the website. Therefore I will need to run an auto-login script on the server. ...
-2
votes
2answers
214 views

How to securely transfer password from a registration page to the database [duplicate]

What steps must be followed to send password securely from the user registration page (i.e. client side) to the server over a non encrypted channel (http) when the user registers for the first time on ...
4
votes
2answers
209 views

Location of Password Hashes on a Windows Local Machine?

"Where are the two locations that user's password hashes are stored on a local windows machine?" My place of business asked me this question. I know that the SAM stores password hashes, where would ...
0
votes
0answers
32 views

Passwords vs keys in cryptography? Which is stronger and safer? [duplicate]

Maybe it isn’t correct question, but how to compare passwords and keys in cryptography? Symmetric encryption, e.g. AES, usually encrypts data with passwords, and all public-key cryptography use open ...
3
votes
1answer
107 views

Can I Prevent Internet Explorer from Storing Login Requests in Memory?

Using Internet Explorer 11 I have been able to login to HTTPS web applications by providing a username and password and then subsequently logout. Whilst the browser process is running I can then dump ...
1
vote
1answer
130 views

How can one securely hash passwords server side while avoiding DoS?

It is generally recommended that one use a slow hash function to hash passwords. However, does this create a DoS risk?
2
votes
3answers
159 views

Verify password hashed with nonce when the password is already hashed on the server?

I found this picture in the Wikipedia nonce article: To avoid sending the password in clear text and prevent replay attacks, the password is hashed together with one random number from the server (...
1
vote
3answers
154 views

why not use hashed password as password [duplicate]

Why dont we use our mobile phone tho hash a password and then enter the hash on a website as the password ? This way the password for the website would be much more complex. Would this even increase ...
1
vote
1answer
89 views

What password based key derivation does PKCS #12 use?

I would like to make a note that I have read all of rfc 7292. I am trying to decrypt encrypted private key in a pkcs#12 pfx file. The private key is enveloped within pkcs#8 shrouded key bag. The ...
0
votes
5answers
323 views

What is the safest way to store passwords in a company for the case when the CISO leaves?

What is the best and safest way to store passwords in a company to ensure nothing is lost when the CISO leaves. I know this might be subjective and there isn't THE best way. But I'm curious about your ...
71
votes
11answers
14k views

Will typing my password twice make it more secure? Or typing each character twice?

If I type my password twice (like: PwdThingPwdThing), OR type every character twice (like: PPwwddTThhiinngg) will that make it substantially more secure than it already is? Assume that it is already ...
-5
votes
3answers
88 views

how to know the way in which password was encrypted [closed]

i have a encrypted password basically hashed i don't know what it is some thing like 11dfb34b27f539a5e785b68e529fd470 and i know the password i.e., the plain text but i want to know the way that how ...
1
vote
2answers
106 views

Isn't oAuth weaker than traditional passwords

I understand the need for oauth for programmatic access to apis, etc. whereas passwords are used for more human-level authentication. However when we store passwords, we (hopefully) salt + hash them. ...