Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
8
votes
3answers
329 views
Which authentication at the end of the Secure Remote Password protocol?
For the the client and server to prove to each other that they have the same premaster shared key, the original author suggests this:
M = H(A | B | K) -->
<-- H(A | M | K)
...
8
votes
5answers
170 views
Citations for inadvisability of globally unique password
I am looking for an authoritative source to back up my position in a disagreement over password policy.
I am having a disagreement with a client about the user identification/authentication process ...
8
votes
1answer
737 views
Password auditing
Most password policies require the password to be at least 8 characters long and contain symbols from at least 3 classes (lower case letters, upper case letters, numbers, other).
Problem is, that a ...
8
votes
2answers
479 views
Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email
Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance
MSFT even went to far as create ADMINSDUser rights to put ...
8
votes
3answers
988 views
Managing website passwords for small team
I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
8
votes
3answers
263 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
7
votes
4answers
819 views
Why does getting a password wrong takes more time than not
I type my password to login to Win or Linux.
Case 1: I get it right. Almost instant reaction.
Case 2: I misspelled it. It takes a while, and then rebounds.
Why does it takes longer to identify a ...
7
votes
6answers
1k views
Is denying login after incorrect attempts ineffective?
Generally denying logon attempts after X amounts of incorrect attempts for Y amount of tries is a very basic way to prevent bruteforce attempts or malicous logon attempts.
Yet, surely doing this is ...
7
votes
5answers
317 views
Oldest security feature still in active use
Beyond commonsense and physical access controls, is the system password the oldest still in active use security feature? By physical access, I mean for example leaving the system within a secure ...
7
votes
8answers
570 views
Is the following authentication scheme secure?
I was trying to design an authentication system that would make it much harder to guess a password via brute force, and reduce the risk to a user if the hashed password was stolen through a snooping ...
7
votes
3answers
406 views
It is possible that brute force attempts are successful before the worst case, correct?
When I read about a password being secure and stating that it would take X amount of week, years, etc. isn't that referring to the worst case?
What happens if the brute force method is successul in ...
7
votes
3answers
650 views
Generating random passwords by clicking randomly on the keyboard?
How secure is it to generate random strings/passwords manually for different purposes by just clicking randomly on the keyboard ?
I usually need random strings for salts and for passwords, and I ...
7
votes
4answers
2k views
How do online accounts get hacked?
How does your typical users run-of-the-mill Facebook/twitter/gmail/AIM/etc account get hacked? Is it simply a matter of a weak password? Are they typically the victim of phishing or other social ...
7
votes
2answers
1k views
Is it safe to store the password hash in a cookie and use it for “remember-me” login?
I want to store an encrypted string of the password hash in a cookie and use the hash to lookup the user and log them in (if they want to be remembered).
Is this safe? The password is one-way hashed ...
7
votes
4answers
1k views
What is a good practical (and sane) way to manage all your passwords for online sites?
I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords.
This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
7
votes
4answers
551 views
How to protect ftp account information in the source code of a program
I wrote a game which stores high score information on an ftp server.
In the the source code I need to write out the ftp link with the account name and password in it.
For example:
url = new ...
7
votes
5answers
542 views
Should passwords be truly random?
When generating a password, should it be "truly random" or should I make it a little less random by enforcing some rules?
If a password is generated at random, it could come out all-lowercase letters ...
7
votes
4answers
392 views
Is using a flash drive as a base for security a safe thing to do?
I'm developing some software for schools. I've found severe flaws with the current popular school LAN protection that I feel needs fixing so I plan on releasing my own software. One the those ...
7
votes
6answers
943 views
Facebook account keeps getting hacked, can't seem to figure out why or how?
One of my mate, she has a lot of friends on Facebook, uses it for marketing.
Her account keeps getting broken into. Her password gets reset and/or gets locked for changing resetting password too many ...
7
votes
5answers
379 views
Utility company does not hash passwords in the database
I had to use my utility company's online account information application and forgot the password. Going through the steps of resetting the password I was emailed the password in the open. I found this ...
7
votes
3answers
200 views
Is a password in the clipboard vulnerable to attacks?
I see situations where you may have to input the same password more than once. You may type it in a text editor and copy it to clipboard, to paste it two or more times.
In what scenarios this could ...
7
votes
6answers
559 views
Does repeating one word to form a password result in a similar pattern in its encrypted format?
If i use a single word to form a password by repeating it like the examples below:
securesecuresecuresecuresecuresecure
SeCuReSeCuReSeCuReSeCuReSeCuReSeCuReSeCuRe
...
7
votes
2answers
316 views
Should user be allowed to save password in browser?
The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
7
votes
3answers
155 views
If multi factor authentication is enabled, how should that affect self-service password reset?
Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required)
...
7
votes
4answers
189 views
When changing a password using a WebPage, must the old password be entered on the same screen?
There is a convention to always prompt for the old password on the same page as the one where the old password is being changed as shown below.
Is it acceptable from a security perspective to allow a ...
7
votes
4answers
299 views
Will passphrases always be secure?
In a world where most people used passphrases instead of passwords, wouldn't an attack that generates a random string of words (alternating between word delimiters) be similarly effective to a brute ...
7
votes
4answers
1k views
Is forcing users to change passwords useful?
In many places, there's a policy that force the user changing it's password once a few months. The logic here is, that even if the password have leaked somehow, it'll be abused only for a relatively ...
7
votes
3answers
176 views
Plain Text Password Reset Vulnerability
If I receive an email with a plain text generated password (in response to a password reset request), is this a vulnerability? The password expires after one use, in other words the user has to change ...
7
votes
2answers
324 views
Replacement for One Time Passwords (OTP)
OTP may known as new generation of password security techniques, but I want to know does it still safe enough after several years of appearance or it will deprecate soon? & what would be the ...
7
votes
2answers
386 views
Is there more to password hashing?
You have a plain text password and salt. The plain text password is assumed to be securely random and only known by the user and the salt is no secret and not necessarily unique but stored alongside ...
7
votes
2answers
1k views
What are the risks of storing passwords in a GPG encrypted file?
I currently store my passwords in a text file encrypted using GPG -e (specifying my own public key). When I want to lookup a password I'll do something like
gpg -d passwords.gpg | grep ...
7
votes
1answer
2k views
Can a dictionary attack crack a Diceware passphrase?
Everyone knows the words used in Diceware passwords (all 6^5 = 7776 words are published) -- they're all common words.
Everyone seems to know that we're not supposed to use dictionary words for ...
7
votes
3answers
295 views
Should I obfuscate passwords before hashing? Should I pre-hash them on the client? What about salts?
For fun, and in my spare time I'm creating a simple CMS for my own purposes (with hopes to release for wider use... later), using PHP. I'm currently working on the login scheme now, and have a few ...
7
votes
1answer
617 views
Would it make sense to use Bcrypt and PBKDF2 together?
I've read various opinions about whether Bcrypt or PDBKF2 is a better key derivation hashing method. The answer seems to depend on a lot of complicated factors that are not easy to analyze. Would ...
7
votes
2answers
238 views
What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?
I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
7
votes
5answers
378 views
Are we concentrating too much on password complexity?
As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
7
votes
1answer
221 views
Protecting emails in your database
It's common to encrypt passwords in the database, but I'm wondering what solutions are out there to protect emails in your database.
Not just from hacking, but from disgruntled employees or engineers ...
7
votes
3answers
1k views
Additional security of keyfile on top of a master password for KeePass
I use KeePass + Dropbox to manage and synchronize my passwords across my devices. This system works really great and I trust KeePass' security model.
However my biggest remaining concern is the ...
7
votes
4answers
525 views
If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?
In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the ...
7
votes
2answers
433 views
Encryption Algorithms with an error code for wrong password
I am looking for an encryption algorithm that would allow me to know if the password supplied is the correct one or not.
This question can be considered as a follow-up for Q. In particular the answer ...
7
votes
4answers
530 views
Calculating how secure my password is
I generally use gnuPG for encrypting my files. And as far as I know it's strength ultimately depends on the passphrase I use. So, I would like to know: how can I mathematically calculate how secure my ...
7
votes
2answers
543 views
How does Google not care about “spaces” in Application-specific passwords?
I have recently setup "2-step verification" for my Google account.
One of the features is the ability to create "Application-specific passwords
" for devices that do not support the 2 step process. ...
6
votes
7answers
834 views
What chars should I not allow in passwords?
I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
6
votes
4answers
910 views
Password entropy in layman's terms
Entropy is a term used often in relation to password security and brute-force attacks, but it is a topic that can get complicated quickly. What is the best way to describe password entropy (what it is ...
6
votes
5answers
2k views
Email forgotten password or send reset link, both just as insecure?
I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
6
votes
3answers
670 views
Tools helps: First time cracking passwords
I am trying to crack passwords on two Windows member servers (2003 and 2008). There is no Active Directory. Each user seems to use the same password across servers, workstations, etc. I have access to ...
6
votes
7answers
627 views
How can I prevent users from entering bad passwords in my web application?
There is a long discussion on whether it's the responsibility of the user or the system administrator to deal with the strength of the password. Obviously, the password is a very private thing, but ...
6
votes
4answers
320 views
Is storing answers to security questions in plain text bad form?
If the input for the security question is completely digital, should the answer to a security question be hashed (or at least encrypted) on the authentication server?
6
votes
6answers
316 views
Cleartext password in HTML
Is there any problem with outputing a user's password to the HTML in an hidden field (see use case below before flaming xD)?
The use case is a registration form with two steps. The user fills in the ...
6
votes
4answers
3k views
Are the iPhone “connect the dots” passwords secure?
A popular way to login to iPhones and other phones is to use a "connect the dots" password. For those unfamiliar, it looks something like this:
Is this kind of passwords secure from brute force ...
