Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

4
votes
3answers
17k views

Is it possible to brute force all 8 character passwords in an offline attack?

This article states: Brute-force techniques trying every possible combination of letters, numbers, and special characters had also succeeded at cracking all passwords of eight or fewer characters. ...
354
votes
11answers
69k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the ...
42
votes
4answers
5k views

Is it good practice to ban an IP address if too many login attempts are made from it?

Since an IP address does not necessarily represent a specific device, but probably a whole network/company/etc. does it at all make sense to block an IP address if there is a significant amount of ...
6
votes
1answer
354 views

Security of LastPass' password generator

I currently use LastPass for all of my password generation and management. After reading Diceware, I realized that LastPass' password generator might be insecure, as somebody could potentially ...
-2
votes
2answers
150 views

A Graphical Two-Step Authentication System [duplicate]

Changes made to system proposed in Two-factor authentication Without Mobile Phone: In previous system, shoulder surfing would reveal the user’s pre-decided image. In the current system, end image ...
2
votes
2answers
200 views

Storing lots of passwords that different levels of employees need access to

I am wondering what other people do for storing passwords. Our current model at my employer is fundamentally flawed in my opinion, so I am trying to see what other people do so I can select the best ...
4
votes
1answer
595 views

Is it a good idea to use two salts? [duplicate]

Is it a good idea to use two salts? This is implying that one would be unique to the user, and one would be unique to the server, using Bcrypt of course. So for example, if you're using Golang as ...
-2
votes
2answers
166 views

Password hashing and blowfish [duplicate]

What I'm about to say is probably going to make me look like an idiot but it's better to be wrong and learn than have unanswered questions. Ever since I started dealing with passwords I wondered what ...
0
votes
0answers
29 views

Best practise Managing Key Material Securely in Memory in android

I am aware of the issue of user entered pass phrases being left in memory if stored in Java Strings (due to String being immutable). Which takes me onto using char arrays. However, I am wondering if ...
2
votes
1answer
154 views

Is this a secure way to generate passwords at the command line?

Occasionally I need to generate a password while working at the Unix command line. I have the following alias in my zshrc: alias randpass='openssl rand -base64 32 | tr -d /=+ | cut -c -30' These ...
0
votes
1answer
123 views

Can Google's administrators be trusted with Google Authenticator? [duplicate]

Suppose there is an evil Google administrator who has full access to every server or network at Google. Will such a person be able to abuse the Google Authenticator technology to gain access to ...
3
votes
1answer
244 views

Best practices for passwords on registration?

I have a website which users register an account. On the registration field, the form fields are: Name Email Confirm email Username But there is no password field. When they hit submit, they are ...
1
vote
2answers
88 views

Hashing password with salt [duplicate]

I read from wiki: The attacker has access to both the hashed password and the salt, so when running the dictionary attack, the attacker can simply use the known salt when attempting to crack the ...
7
votes
7answers
2k views

Facebook account keeps getting hacked, can't seem to figure out why or how?

One of my mate, she has a lot of friends on Facebook, uses it for marketing. Her account keeps getting broken into. Her password gets reset and/or gets locked for changing resetting password too many ...
27
votes
7answers
3k views

What is a good way to authenticate a user to a smart phone?

What would be a good way to authenticate a user to a smart phone? By good, I mean that it is both secure, and user-friendly. Passwords don't seem to be the best fit because a password needs to be ...
6
votes
1answer
7k views

Why is it considered safe for services like Mint to store bank password?

My understanding is that, typically websites are recommended to store only hashes of passwords using one-way cryptographic hash function. This way, there is no way to retrieve the passwords even when ...
0
votes
1answer
51 views

MDM: Semi-Complex Password Implications [duplicate]

What would be the security implications if an organisation decided to impliment semi-complex passwords (one letter and one letter), and not fully complex. I'm thinking in terms of mobile devices and ...
4
votes
1answer
151 views

Is there a study on how many websites are saving passwords as plain text? [closed]

For a research paper about passwords, I am looking for a source that gives an actual estimation on how many websites save their user's passwords as plain text on their servers. Is there any study ...
3
votes
3answers
176 views

Is it good to not have keyboard-based sequences in our password generator?

If we have to write a password generator, is it a good idea to contain a "keyboard-based sequence" checker? So if the generated password is: asdf4%'Q!76342 Then this password will be rejected by ...
1
vote
1answer
85 views

Cracking office documents and other hashes using clusters? [closed]

I'm trying to figure out how I should go about testing this I just got donated 18 older hp systems that have 4 gigs of ram, and intel core 2 duo processors I believe that they are the ones that came ...
1
vote
2answers
127 views

Breaking mysql username and password form [closed]

I have two versions of a website. The first one has no security precautions against sql injections. So if I try something like: Username: hello_world Password: ' or ' 1=1 I'll be signed in as the ...
14
votes
6answers
2k views

What are the differences between an encryption seed and salt?

Today I had a hard time explaining the difference to a friend. I know seeds are used when generating "random" strings. And salts are used when providing different outcomes to a hash. What is a ...
3
votes
1answer
191 views

Security of Windows Screen Saver Password

How secure is the Windows screensaver password? Seeing that screen saver passwords are used in the corporate world, is there any way of bypassing the screen saver after it is already running? Could a ...
2
votes
4answers
3k views

LDAP vs MySQL for Usernames and Passwords

I understand the LDAP databases are more secure, but is it always necessary to use LDAP instead of MySQL for usernames and passwords?
21
votes
12answers
3k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...
5
votes
4answers
230 views

Should we be checking password restraints on log in forms?

We have many restraints we put on users when they set up their password. These restraints include password length, characters they can or cannot use, the use of numbers and letters, capitalization ...
8
votes
3answers
1k views

What are the security implications of using TOTP for single factor authentication?

(Note: I am not actually planning to do this. This question is strictly theoretical.) TOTP is commonly used as the second factor in Two Factor Authentication. It is an open standard with available ...
2
votes
1answer
82 views

HMACs that have the same key and message

im using HMACSHA256 to generate the hash of password and store it. the objective here is to just authenticate users, i.e - save their hashed passwords, and validate users whenever needed using the ...
2
votes
2answers
191 views

Combining SCRYPT + a short crc

I'm considering using SCRYPT for password storage. (I'm open to PBKDF2 as well, or bcrypt by itself). The issue is that I don't want this to become a potential point for a DDOS attack, given the ...
6
votes
5answers
44k views

How to generete dictionary for brute force attack?

I need to crack my own password. Advantage is that I know possible characters and maximum length. What I need is to create dictionary for brute force attack. Dictionary should contain all the combos ...
0
votes
2answers
338 views

Hashing request - What type of hash this?

I have a text which is hashed using several layers of hashing. The final hash looks like 2E55A1DD65AB839E62362DEF86D329D7. What type of hashing can it be? How can I find out what kind of hash sum I do ...
1
vote
3answers
93 views

How to compare passwords with duplicate password

On Steam, the gaming client, I have this habit of creating multiple "smurf" accounts. I have a randomly-generated, unique password, and I decided to use the same password for all of my multiple ...
0
votes
0answers
20 views

Chrome/Youtube says incorrect certificate for host? [duplicate]

Why my Youtube always ask me: Incorrect certificate for host. The server presented a certificate that doesn't match built-in expectations. These expectations are included for certain, high-security ...
15
votes
3answers
3k views

Is it a bad idea to add random characters to user ID and password?

I've heard people say again and again that you shouldn't implement your own security algorithm, and I'd like to ask you if I'm breaking this rule. I'm creating a traditional client-server application ...
51
votes
8answers
4k views

Is it OK to tell your password to your company's sysadmin?

I'm working in a small company (20 employees) as a senior software engineer. After having problems with my email, our newly employed IT administrator asked me to write my user password to someone in ...
0
votes
2answers
64 views

How does RealVNC Enterprise Know My System Credential?

After the installation of RealVNC on a Windows computer, the default login username and password via VNC is the same as the system username and password. Can anyone tell me how RealVNC can access such ...
0
votes
3answers
114 views

When to set security questions for a web application?

For enhanced security, we can use security questions and use them as a means for users to reset forgotten passwords or as an additional means for authenticating. When would we be the right time to ...
2
votes
3answers
196 views

is it feasible to improve the entropy of XKCD #936 by using a larger dictionary?

XKCD #936 uses a limited subset of the English language, only 2000 words. I just looked it up, and the English language has over a million words, a sizeable subset of those having special characters, ...
1
vote
1answer
1k views

John the Ripper - Calculating brute force time to crack password

I'm using incremental mode (brute force) mode in John the Ripper to crack Linux MD5 passwords. I'm trying to calculate the time it will take to run through all combinations of 12 passwords (with 12 ...
12
votes
5answers
2k views

What is the best way to transmit password hash over unreliable TLS?

I have TLS connection between my server and client. I have no certificate, so the connection is susceptible to the Man-in-the-middle attack. I fear that attacker could intercept the password hash ...
347
votes
21answers
65k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
2
votes
1answer
172 views

Crackstation “Secure Salted Password” Java example - is it really secure?

I'm making an auth service so I've been looking for some good Java/Groovy implementations of password + salt hashing. I've found this article on crackstation along with a code example and decided to ...
28
votes
5answers
3k views

Are passwords comprised of key sequences on a keyboard any less secure than the same characters but jumbled up?

Here are two passwords: 5678%^&*tyuiTYUI and 8^tyU75%*IuY6T&i Both have the same number of characters and in each the characters are identical, the only difference is that the first ...
1
vote
1answer
42 views

Can a PKCS12 file be distributed over insecure channel?

Is the PKCS12 only as secure as the password protecting private keys ? Can I distribute the p12 file over an insecure channel ?
2
votes
1answer
123 views

Is it a good idea to expire passwords after a time relative to their security?

If a user has to change their password ever so often, is it a good thing to check it against zxcvbn or similar library and assign a expiration date relative to the risk of the hash being cracked?
25
votes
6answers
7k views

Are passwords that are manually typed in really unrecoverable from memory or disk?

As part of an increase in the security measures for our company, we're moving to making sure all password logins (databases, servers, etc), are done through a password prompt and never using stored ...
349
votes
12answers
58k views

What technical reasons are there to have low maximum password lengths?

I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites where I actually care ...
0
votes
1answer
120 views

Can I get rid of storing user secrets by using OpenID, and what do I need to store?

What information do you have to keep about a user to be an OpenID consumer? I want to use OpenID to let users register and authenticate on my system. So while I'm at it I want to not duplicate ...
2
votes
3answers
1k views

Store password locally. Where? How to pass it securely?

I'm developing an application. The user must enter his credentials which will be sent to the server. If the user opens the application a second time he shouldn't need to enter them again - credentials ...
0
votes
2answers
57 views

Is authenticating via the database secure

Sorry for this probably noobish question. So far, I've read password comparison/verification is implicitly understood to be made on the application layer and not in the database. For example in PHP, ...