Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

20
votes
6answers
2k views

Hash function change

I have user account passwords stored in a database using an unsafe (old) cryptographic hash function. What is the best/usual approach to changing password hash function? Only two ideas come to my ...
20
votes
4answers
2k views

Is it safer to ssh as a privileged user than to ssh and sudo?

I came across this old paper, discussing the possibility of password length information being disclosed when usin SSH: Timing Analysis of Keystrokes and Timing Attacks on SSH. The paper has been ...
20
votes
4answers
7k views

How is Gmail susceptible to brute-force attacks?

In the Atlantic article "Hacked!" it says: My wife’s password was judged as “strong” when she first chose it for use with Gmail. But it was a combination of two short English words followed by ...
20
votes
4answers
9k views

Google Account: implications of using application-specific passwords

In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google ...
20
votes
4answers
9k views

Password resets - what practices should web services follow?

Many of you may have seen How Apple and Amazon Security Flaws Led to My Epic Hacking, where a Wired reporter's Amazon, Apple, Gmail, and Twitter accounts were successfully hacked. The hacker followed ...
20
votes
4answers
7k views

Deleting a Java Object securely

I know that in order to delete a Java object I should use character array instead of String, since I can safely erase (rewrite the character array with other data) its content. This seems not to be ...
20
votes
4answers
1k views

Is it a bad idea for an information holder to e-mail a user their password?

A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...
20
votes
2answers
4k views

Why are passwords limited to 16 characters?

What is the reason that most websites limit to 16 characters? I would have thought the longer the password the more difficult it makes it for someone to crack it? Is it something to do with hash ...
20
votes
1answer
7k views

Can a dictionary attack crack a Diceware passphrase?

Everyone knows the words used in Diceware passwords (all 6^5 = 7776 words are published) -- they're all common words. Everyone seems to know that we're not supposed to use dictionary words for ...
20
votes
4answers
4k views

How secure is Snowden's MargaretThatcheris110%SEXY password?

In an extra from Edward Snowden's interview with John Oliver, Snowdon advises that a good password to use is one such as MargaretThatcheris110%SEXY.. Also, on the Errata Security blog, Robert Graham ...
19
votes
4answers
5k views

Would allowing shorter passwords sometimes be more secure?

Does the act of requiring certain criteria for passwords make them easier to brute-force? It's always seemed to me that when websites limit the use of "insecure" passwords, it might make it easier ...
19
votes
3answers
2k views

Why do some bank websites use passwords that are not case sensitive?

It was recently brought to my attention that a certain big bank website allows users to log in with passwords that are not case sensitive. After confirming this, I checked other websites I bank with ...
19
votes
4answers
975 views

Should I be concerned when a “Forgot Password?” tool sends my password in plaintext?

Some sites I have been a member of in the past don't go through the normal "Forgot Password?" process. Instead of e-mailing me a unique password reset link or something of the like, I have received ...
19
votes
2answers
5k views

Why is it always `HASH( salt + password )` that we recommend?

Browsing over this site, many forums, online articles, there's always one specific way we're suggesting to store a password hash: function (salt, pass) { return ( StrongHash(salt + pass) ) } But ...
19
votes
3answers
14k views

Router password vs MAC filtering?

I just bought a Galaxy S4, and it didn't connect to the WIFI in my house (I have a 14$ router). After a bit of testing, I've decided to leave my connection open without a password, but added the ...
19
votes
4answers
4k views

The registration confirmation email contains my password: do they keep it in plaintext?

I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
19
votes
5answers
1k views

Is it alright to tell everyone your encryption information?

I have an account in an online banking system and they have the FAQ with something like this: How secure is the <Online Banking System Name>? Each page you view and any information ...
19
votes
5answers
5k views

What is a good practical (and sane) way to manage all your passwords for online sites?

I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords. This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
19
votes
6answers
4k views

How to avoid scripts with hardcoded password? [duplicate]

I have some scripts on Ubuntu Linux machine that logs in to a database server to run some maintenance daily. To login to the database, I need a password and right now it is hardcoded in the script. ...
19
votes
3answers
3k views

Is a password in the clipboard vulnerable to attacks?

I see situations where you may have to input the same password more than once. You may type it in a text editor and copy it to clipboard, to paste it two or more times. In what scenarios this could ...
19
votes
2answers
6k views

How big should salt be?

I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2). Having that in mind, how big salt should I use? Should it be ...
19
votes
1answer
5k views

How to apply a pepper correctly to bcrypt?

Update: There is a better way to add a server side key, than using it as a pepper. With a pepper an attacker must gain additional privileges on the server to get the key. The same advantage we get ...
18
votes
6answers
3k views

Why do we ask for a user's existing password when changing their password?

In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
18
votes
8answers
3k views

Why should I hash passwords?

I've read that every good web application should hash passwords. I found many articles about hashing. So I started implementing hashing on my website and then I asked myself why should I do it? When a ...
18
votes
4answers
4k views

Should I implement incorrect password delay in a website or a webservice?

With arguments expressed in this answer, there is a few seconds delay between user enters an incorrect password and when he/she actually learns, that password was incorrect. This security solution is ...
18
votes
6answers
1k views

Appropriate password requirements for a login (OpenID) service/provider/delegate/thing

This is with regards* to Stack Exchange's upcoming OpenID provider (and in particular, discussion about password requirements). Currently, password requirements are: Must contain 3 of: lower case ...
18
votes
4answers
2k views

My credit union is reducing its maximum password length to 10 characters

I just received an email from my credit union saying they are redesigning their online banking service and that I will need to change my password by October 22 to conform to the new limit of 10 ...
18
votes
7answers
931 views

Are common passwords at particular risk?

The question Should we disallow common passwords like “password” and “12345”? on User Experience immediately made me think that these common passwords were extremely dangerous not because they are ...
18
votes
5answers
991 views

Is there any legal reason to save a cleartext password?

I called customer service of a well known company and discovered that the operator had the ability to view my website password in clear text on her screen. I asked her about this and she defended the ...
18
votes
7answers
6k views

Are password reset links that don't expire a security risk?

I am currently working on a password reset flow. We have decided to go with a password reset link being emailed to the user's registered email and allowing them to follow that and input a new ...
18
votes
3answers
7k views

Password in file .php

My connection.php file stores the credentials to connect to the database. <?php $objConnect = mysql_connect("localhost","username","password"); mysql_select_db("selectDB", $objConnect); ...
18
votes
3answers
5k views

MySQL OLD_PASSWORD cryptanalysis?

The password hash used for MySQL passwords prior to version 4.1 (now called OLD_PASSWORD()) seems like a very simple ad-hoc hash, without salts or iteration counts. See e.g an implementation in ...
18
votes
1answer
1k views

Does a maximum length of password mean non-hashed storage?

When a system requires a password between say 6 and 20 characters in length, does it mean the password is stored without using a hashing function, and that the mysql-field (or similar) is 20 ...
18
votes
2answers
10k views

Facebook API : App Secret - possible misuse

I've recently find out that by simple quick look into compiled code of one of our applications, you can get both App ID (API Key) and App Secret for Facebook API I suppose that we should really keep ...
18
votes
5answers
619 views

What concrete parameters can I change to make my passphrase-protected private gpg key more secure

There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever. Rather than ...
17
votes
5answers
2k views

From a security standpoint should users be asked to confirm their password when registering?

Is it advisable to have users re-type their password to confirm it's correct? On User Experience the general consensus seems to be no but I'm wondering if this has security ramifications? EDIT: my ...
17
votes
7answers
2k views

Taking password letters not whole one, is this secure? [duplicate]

I found a site which is taking password letters from their users not the whole password. Is this secure? Or do they have saved password as salted hash (MD5)?
17
votes
4answers
17k views

Possible to use both private key and password authentication for ssh login?

It seems that they are mutually exclusive, as disabling one gives me the other, and vice versa. Two-factor auth for my ssh servers sounds really nice, so is there any way to accomplish this?
17
votes
4answers
1k views

How to treat non-optional bad security questions?

Every once in a while I have to set up an account on a site that, while apparently at least not storing my password in plaintext, still force me to choose from a limited set of security questions that ...
17
votes
6answers
2k views

What does “random” mean in the context of password creation?

Disclaimer: as you will see from my question I'm a total outsider in this subject, just very curious. I was wondering how easy it would be to crack a password-protected RAR5 file, and I found many ...
17
votes
3answers
2k views

How secure is 7z encryption?

I have a text file in which I store all my bank details. I compress and encrypt it with 7-Zip using the following parameters: Compression parameters: Archive format: 7z Compression level: ...
17
votes
5answers
3k views

Is sending plaintext passwords to a SQL Server database a security risk?

I have a database which has stored procedures which take plaintext passwords. It hashes them and inserts them into the DB. If an attacker has access to the DB connection, it is possible to intercept ...
17
votes
2answers
592 views

Bank accepts different password to the one that I set

I'm not particularly well versed in IT security so please bear with me. I recently discovered that my bank's online system will accept passwords that consist of the correct password, and a string of ...
17
votes
6answers
5k views

Managing website passwords for small team

I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
17
votes
2answers
2k views

Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML

It's clear there there is no consistent set of features among any of the popular authentication providers. Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
16
votes
6answers
5k views

Is my custom password hashing algorithm insecure?

For all of my hobby web projects, I have coded a login system that these projects share. There is no critical data in these projects, the only critical data could be reused passwords. So I try to hash ...
16
votes
7answers
10k views

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
16
votes
3answers
6k views

Is it possible to get the salt if I have the hash and original password?

Is it possible to get the salt if I have the hash and original password? My gut feeling is no, but would it be impossible or will it just take very long?
16
votes
7answers
6k views

My IP address (with a NAS) is targeted by a hacker. What to do? Should I be worried?

I've noticed, based on the logging of my NAS, that my IP address is targeted by a hacker. I already took action by automaticly ban the IP address permanently after five unsuccesful login attemps. ...
16
votes
3answers
754 views

Is it OK to tell your password to an admin? [duplicate]

Possible Duplicate: From a security point : Is it OK to tell your password to an admin? I am working in a small company (20 employees) as a senior SW engineer. After having some email ...