Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
8
votes
2answers
1k views
How big salt should be?
I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2).
Having that in mind, how big salt should I use?
Should it be ...
8
votes
3answers
192 views
Should I restrict access to the username and passwords in a web app?
I'm starting to write my first serious web application and am thinking about how to store username and password information. There are plenty of articles detailing how storing plain text passwords is ...
8
votes
3answers
442 views
How can I promote good password practices in an organization that doesn't currently care about that?
I work with an organization that uses some very poor practices such as using default user accounts, default passwords (or passwords the same as user accounts), sharing password information between ...
8
votes
3answers
856 views
How can I mitigate the threat that DPAPick poses to my DPAPI protected data?
The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications).
DPAPick was presented at BlackHat ...
8
votes
2answers
2k views
Facebook API : App Secret - possible misuse
I've recently find out that by simple quick look into compiled code of one of our applications, you can get both App ID (API Key) and App Secret for Facebook API
I suppose that we should really keep ...
8
votes
2answers
1k views
What are the risks of storing passwords in a GPG encrypted file?
I currently store my passwords in a text file encrypted using GPG -e (specifying my own public key). When I want to lookup a password I'll do something like
gpg -d passwords.gpg | grep ...
8
votes
1answer
2k views
Can a dictionary attack crack a Diceware passphrase?
Everyone knows the words used in Diceware passwords (all 6^5 = 7776 words are published) -- they're all common words.
Everyone seems to know that we're not supposed to use dictionary words for ...
8
votes
3answers
335 views
Which authentication at the end of the Secure Remote Password protocol?
For the the client and server to prove to each other that they have the same premaster shared key, the original author suggests this:
M = H(A | B | K) -->
<-- H(A | M | K)
...
8
votes
5answers
170 views
Citations for inadvisability of globally unique password
I am looking for an authoritative source to back up my position in a disagreement over password policy.
I am having a disagreement with a client about the user identification/authentication process ...
8
votes
1answer
746 views
Password auditing
Most password policies require the password to be at least 8 characters long and contain symbols from at least 3 classes (lower case letters, upper case letters, numbers, other).
Problem is, that a ...
8
votes
2answers
514 views
Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email
Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance
MSFT even went to far as create ADMINSDUser rights to put ...
8
votes
3answers
1k views
Managing website passwords for small team
I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
8
votes
3answers
268 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
7
votes
4answers
824 views
Why does getting a password wrong takes more time than not
I type my password to login to Win or Linux.
Case 1: I get it right. Almost instant reaction.
Case 2: I misspelled it. It takes a while, and then rebounds.
Why does it takes longer to identify a ...
7
votes
6answers
1k views
Is denying login after incorrect attempts ineffective?
Generally denying logon attempts after X amounts of incorrect attempts for Y amount of tries is a very basic way to prevent bruteforce attempts or malicous logon attempts.
Yet, surely doing this is ...
7
votes
5answers
317 views
Oldest security feature still in active use
Beyond commonsense and physical access controls, is the system password the oldest still in active use security feature? By physical access, I mean for example leaving the system within a secure ...
7
votes
5answers
2k views
Email forgotten password or send reset link, both just as insecure?
I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
7
votes
8answers
580 views
Is the following authentication scheme secure?
I was trying to design an authentication system that would make it much harder to guess a password via brute force, and reduce the risk to a user if the hashed password was stolen through a snooping ...
7
votes
3answers
414 views
It is possible that brute force attempts are successful before the worst case, correct?
When I read about a password being secure and stating that it would take X amount of week, years, etc. isn't that referring to the worst case?
What happens if the brute force method is successul in ...
7
votes
3answers
654 views
Generating random passwords by clicking randomly on the keyboard?
How secure is it to generate random strings/passwords manually for different purposes by just clicking randomly on the keyboard ?
I usually need random strings for salts and for passwords, and I ...
7
votes
6answers
379 views
Cleartext password in HTML
Is there any problem with outputing a user's password to the HTML in an hidden field (see use case below before flaming xD)?
The use case is a registration form with two steps. The user fills in the ...
7
votes
2answers
1k views
Is it safe to store the password hash in a cookie and use it for “remember-me” login?
I want to store an encrypted string of the password hash in a cookie and use the hash to lookup the user and log them in (if they want to be remembered).
Is this safe? The password is one-way hashed ...
7
votes
4answers
2k views
What is a good practical (and sane) way to manage all your passwords for online sites?
I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords.
This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
7
votes
4answers
561 views
How to protect ftp account information in the source code of a program
I wrote a game which stores high score information on an ftp server.
In the the source code I need to write out the ftp link with the account name and password in it.
For example:
url = new ...
7
votes
4answers
401 views
Is using a flash drive as a base for security a safe thing to do?
I'm developing some software for schools. I've found severe flaws with the current popular school LAN protection that I feel needs fixing so I plan on releasing my own software. One the those ...
7
votes
6answers
968 views
Facebook account keeps getting hacked, can't seem to figure out why or how?
One of my mate, she has a lot of friends on Facebook, uses it for marketing.
Her account keeps getting broken into. Her password gets reset and/or gets locked for changing resetting password too many ...
7
votes
5answers
383 views
Utility company does not hash passwords in the database
I had to use my utility company's online account information application and forgot the password. Going through the steps of resetting the password I was emailed the password in the open. I found this ...
7
votes
3answers
227 views
Is a password in the clipboard vulnerable to attacks?
I see situations where you may have to input the same password more than once. You may type it in a text editor and copy it to clipboard, to paste it two or more times.
In what scenarios this could ...
7
votes
6answers
570 views
Does repeating one word to form a password result in a similar pattern in its encrypted format?
If i use a single word to form a password by repeating it like the examples below:
securesecuresecuresecuresecuresecure
SeCuReSeCuReSeCuReSeCuReSeCuReSeCuReSeCuRe
...
7
votes
2answers
324 views
Should user be allowed to save password in browser?
The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
7
votes
4answers
1k views
Is forcing users to change passwords useful?
In many places, there's a policy that force the user changing it's password once a few months. The logic here is, that even if the password have leaked somehow, it'll be abused only for a relatively ...
7
votes
3answers
166 views
If multi factor authentication is enabled, how should that affect self-service password reset?
Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required)
...
7
votes
4answers
301 views
Will passphrases always be secure?
In a world where most people used passphrases instead of passwords, wouldn't an attack that generates a random string of words (alternating between word delimiters) be similarly effective to a brute ...
7
votes
5answers
302 views
Is there any good reason not to salt/hash passwords you store?
Two organisations I frequently deal with (including my bank) ask me my password to authenticate myself with them... well... they ask for "random" characters from my password.
As I understand it, this ...
7
votes
2answers
246 views
Plain Text Password Reset Vulnerability
If I receive an email with a plain text generated password (in response to a password reset request), is this a vulnerability? The password expires after one use, in other words the user has to change ...
7
votes
2answers
328 views
Replacement for One Time Passwords (OTP)
OTP may known as new generation of password security techniques, but I want to know does it still safe enough after several years of appearance or it will deprecate soon? & what would be the ...
7
votes
2answers
394 views
Is there more to password hashing?
You have a plain text password and salt. The plain text password is assumed to be securely random and only known by the user and the salt is no secret and not necessarily unique but stored alongside ...
7
votes
3answers
304 views
Should I obfuscate passwords before hashing? Should I pre-hash them on the client? What about salts?
For fun, and in my spare time I'm creating a simple CMS for my own purposes (with hopes to release for wider use... later), using PHP. I'm currently working on the login scheme now, and have a few ...
7
votes
1answer
657 views
Would it make sense to use Bcrypt and PBKDF2 together?
I've read various opinions about whether Bcrypt or PDBKF2 is a better key derivation hashing method. The answer seems to depend on a lot of complicated factors that are not easy to analyze. Would ...
7
votes
2answers
256 views
What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?
I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
7
votes
5answers
387 views
Are we concentrating too much on password complexity?
As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
7
votes
2answers
809 views
With PBKDF2, what is an optimal Hash size in bytes? What about the size of the salt?
When creating a hash with PBKDF2, it allows the developer to choose the size of the hash. Is longer always better? Also, what about the size of the random salt? Should that be the same size as the ...
7
votes
2answers
417 views
HMAC Based Request Signing - Storing the Salt
I'm working on a (non high security) project that currently isn't live but might go live at some point.
We have a REST API (implemented using Restlet and Neo4j) running on a server and an Android ...
7
votes
1answer
226 views
Protecting emails in your database
It's common to encrypt passwords in the database, but I'm wondering what solutions are out there to protect emails in your database.
Not just from hacking, but from disgruntled employees or engineers ...
7
votes
3answers
1k views
Additional security of keyfile on top of a master password for KeePass
I use KeePass + Dropbox to manage and synchronize my passwords across my devices. This system works really great and I trust KeePass' security model.
However my biggest remaining concern is the ...
7
votes
4answers
541 views
If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?
In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the ...
7
votes
2answers
439 views
Encryption Algorithms with an error code for wrong password
I am looking for an encryption algorithm that would allow me to know if the password supplied is the correct one or not.
This question can be considered as a follow-up for Q. In particular the answer ...
7
votes
4answers
540 views
Calculating how secure my password is
I generally use gnuPG for encrypting my files. And as far as I know it's strength ultimately depends on the passphrase I use. So, I would like to know: how can I mathematically calculate how secure my ...
7
votes
2answers
567 views
How does Google not care about “spaces” in Application-specific passwords?
I have recently setup "2-step verification" for my Google account.
One of the features is the ability to create "Application-specific passwords
" for devices that do not support the 2 step process. ...
6
votes
7answers
850 views
What chars should I not allow in passwords?
I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
