Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

4
votes
3answers
522 views

Password entry on OS X and keyloggers

There's several places in my ‘personal security infrastructure’ (is there a better phrase for that?) where I find myself typing very important passwords into text-fields on OS X (for instance, ...
-1
votes
1answer
95 views

Can I encrypt Windows' SAM file?

i recently learned that the SAM file in Windows is easily crackable, and even if an attacker couldn't find my password, there are tools that allow password removal, account elevation and even account ...
0
votes
0answers
126 views

Google account's password exposed after authorizing web apps to the account

Yesterday I registered accounts on some online storage websites. On that same day's afternoon, Google notified me about someone had has logged in using my Google account in US (clearly that's not ...
6
votes
1answer
141 views

Are there any reliable estimates of the password cracking abilities of nation states?

For the purposes of evaluating a hashing algorithm against the threat of a nation state adversary, are there accepted estimates of the password cracking abilities of nation states - or is there an ...
8
votes
1answer
684 views

Password manager in not own device

I believe that password managers have a lot of advantages rather than remembering the passwords. So: its time to use them! But I don't want to lose the capability of using my passwords in devices I ...
4
votes
1answer
71 views

Resetting the admin password for an application

We have a enterprise application dealing with data. We have one super user (admin) that has the highest level of privileges. The application is not opensource. If some customer has forgotten the ...
3
votes
4answers
160 views

Password Policy: Issue random generated passwords / Let the user choose a password

I'm currently thinking about a new password policy. Originally I wanted the users to choose a password that is X digits long, contains numbers, special chars, lower and upper case,... but then I did ...
2
votes
0answers
64 views

Password cracking based on properties of target

Many people base their passwords on some characteristics or properties of their persona, which might not even be included in wordlists used for a dictionary attack. If one would put research into ...
2
votes
2answers
87 views

Prevent Plain-Text Passwords Output by a Script From Being Accessible in the Future

Let's say I have a Bash script that generates a password, creates a new user with that password, and then tells me what the password is: # Generate a password and set it to $PASSWORD PASSWORD=$(tr ...
1
vote
5answers
851 views

Should BCRYPT be used for client-side password hashing

I am concerned about the use of bcrypt for client-side password generation. I am developing a password generation function to be used client-side, similar to PwdHash and PasswordMaker. Much has been ...
0
votes
2answers
142 views

How to check an open source product for password handling quality?

I just created an account on Magento Commerce, which is an online shop solution. During account creation, I entered a password. Personally I prefer longer, generated passwords that do not contain ...
6
votes
1answer
343 views

Gmail lets me use my old password

My university's email works through Gmail and I can log on to it either through my uni's website or in Gmail. I recently changed my password and I use it to log in to the schools secure WiFi, school ...
4
votes
2answers
342 views

Has a plaintext password ever been used in a court of law as evidence to a crime?

Regardless of how the password was obtained (decryption, bad hashing, confession): Are there any prior known cases where the contents of the password was used to prove motive or guilt? Or, looking ...
3
votes
2answers
31k views

Remove Password Protection from XLS Document

Similar to what is listed here, http://datapigtechnologies.com/blog/index.php/hack-into-a-protected-excel-2007-or-2010-workbook/, is there a way to remove the password from an XLS (Excel 2003) ...
6
votes
3answers
661 views

Is piping a `ssh-agent` signed message as a password secure?

There's an encrypted filesystem on a server I ssh into using public key authentication. Since a forwarded ssh-agent can deterministically sign a message (see also the ssh-agent protocol section ...
3
votes
2answers
156 views

How to give “Forgot password” option for a password encrypted file?

I have created a utility that encrypts a file (.txt, .dox, so on...). The utility asks for a password from user at the time of file encryption. Problem Suppose a user has created 1000 encrypted ...
-2
votes
1answer
62 views

generating “non-dictionary” numeric passcodes [closed]

In case of numeric passcodes, e.g. for numeric locks on doors etc, anyone can agree "poor passwords" are ones with specific pattern, e.g. 1234, 1111, 2468, 1122, etc. (as well as ones that form a ...
1
vote
2answers
595 views

What would be the most efficient way of brute forcing a wifi key [duplicate]

I was wondering how can a brut force of my wifi be prevented so I want to know the best technique that can be used to brute force it first, so protection isn't my question. My question is: What brute ...
3
votes
3answers
250 views

Choosing a good password - again

There are many password-related questions in here, but I failed to find the answer to mine. I'm no expert so maybe I don't have the right keywords. Sorry for any duplicate for a possibly asked 100 ...
16
votes
7answers
2k views

How different should my passwords be? [duplicate]

Suppose I use remember one long high entropy master password, and use variations of it for each of my passwords. Eg if I remember tSaF4nWeACVkUU4 as a master password and use tSaF4nWeACVkUU4t (with a ...
1
vote
3answers
389 views

What would be a good set of criteria to consider a password safe? [duplicate]

Nowadays we see many websites with a "security meter" for the password. I actually think this is a great feature since it gives the final user the sense of how insecure their password could be. I ...
34
votes
4answers
19k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first ...
2
votes
2answers
63 views

Could PKE be used as a better alternative to SRP for authentication?

If I understood SRP correctly, its weakpoint is during the registration of a user when sending the verifier to the server. Let's say the Server knows the PubKey(User) of the User and the User knows ...
2
votes
1answer
140 views

What is a key-hardened hash?

I've seen the term 'key hardened hash' used to describe a recommended way to tighten up password hashing. What does this mean? Can it just mean to use a pepper?
2
votes
1answer
124 views

What is the entropy of a password made with pwgen?

pwgen is a unix utility that generates "memorable" passwords randomly. The man page says the entropy is lower than truly random passwords with the same specification. What is the actual entropy of a ...
6
votes
3answers
613 views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as last pass store passwords in plain text (or hash values that can then be decrypted with the master password) in memory after a user logs into the ...
2
votes
1answer
197 views

Teamviewer and remote logins

Not sure if this has been asked before (a cursory search doesn't show anything), so I figure here is a sensible place to ask. Say I am remotely controlling my desktop at home via Teamviewer. Now ...
2
votes
2answers
110 views

Using “Literal” Passwords

Many people, including my friends, use passwords that sound exactly how they sound when responding to a question about what the password is. For example, if person X asks person Y what the password to ...
3
votes
1answer
479 views

Can I know somehow if my password hash is known?

Is there a secure way to know if my password's hash is publicly known on the internet? First I tried to search for it in Hashes.org (http://hashes.org/search.php), but then I suspected, that if it ...
1
vote
2answers
214 views

Website sent me my new password (after reset) in clear text [duplicate]

I was resetting my password on a website and the website emailed me a new password in plain text rather than giving me a reset link to change the password myself. I logged back in and changed the ...
3
votes
3answers
130 views

Are there risks associated with a strong password reuse for disk encryption?

I understand the risks of password reuse when we share the password with 3rd parties as perfectly discussed under this question: Is password reuse a problem if the password is very strong? However I ...
2
votes
1answer
121 views

How to “Pass the hash” when LM hash is disabled?

I ran the NTLM_stealer metasploit module and ended up with the following results: LMHASH:Disabled NTHASH:008940f335e9b2ddc182bb5b960a0c5bad0b125cbee3cf84 I was wondering if there is way to ...
3
votes
1answer
118 views

How to safely reuse passwords in variation?

Remembering a lot of passwords is difficult. A lot of people use the same or a small set of passwords for everything. Of course, this is very unsafe. If such a password a password is stolen, the ...
7
votes
2answers
987 views

Does Outlook store plain-text passwords?

A long time ago when Microsoft changed my e-Mail from Hotmail to Outlook the password-interface said that I should only put in the first 16 chars of my password. But my password was longer before. So ...
5
votes
5answers
418 views

Should I set a password for 'root'@'localhost' in MySQL?

The 'root'@'localhost' MySQL account can only be accessed by someone currently on the server hosting the MySQL server. Assuming that only the person or persons who are in charge of the MySQL server ...
5
votes
1answer
221 views

Correct way of encrypting user passwords

I have a scenario where user entered passwords need to be stored for later use. I cannot use hashing because I need to get the original password for later use. For example, consider an email sender ...
2
votes
3answers
258 views

Is it possible to make cracking a password pointless to an attacker with database access?

I've been reading information on making passwords secure, but what are the reasons an attacker would want to put effort into getting the original password? If an attacker does indeed have a copy of ...
5
votes
2answers
14k views

What happens if an attacker steals my phone's IMEI number?

I have some questions regarding IMEI numbers and data and identity theft. While searching online I have found many conflicting answers regarding this topic and would like some clarification if ...
20
votes
8answers
9k views

On two-step login forms, why is it the login name and not the password that's asked first?

There are several login forms (e.g. Google's) on the internet where you first enter your login name and then, once that's submitted, you get to enter your password. One of the advantages of this is, ...
1
vote
2answers
151 views

Questions about user authentication over REST API

I'm now trying to implement user authentication on my android app. I, however, have a few questions. I use a REST API. How do I safely request and send data to and from the phone? I'm assuming that I ...
82
votes
8answers
12k views

If a provider sees the last 4 characters of my password, can they see it in full?

I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
63
votes
11answers
9k views

Is there any way my password is hashed, if I'm only ever asked to provide 5 out of many characters? [duplicate]

There is a system that, on a login form, presents about 40 boxes for password letters (to hide password's actual length), and only random ones (the same amount each time) are editable. Explanation is ...
4
votes
2answers
125 views

How does Google or any other social media sites know what password I've used previously?

When I ask to change my password, Google sometimes doesn't allow identical passwords to ones that I've used before. Is there a reason why this happens?
1
vote
1answer
71 views

HMAC password reset link and replay attacks

I like the look of this technique for sending password reset links: https://neosmart.net/blog/2015/using-hmac-signatures-to-avoid-database-writes/ (TLDR: don't store token in database. Send password ...
1
vote
1answer
84 views

Recover 7zip password with partial password matching [duplicate]

I encrypted some files using 7z with AES-256 + file name encryption. The compression level was Ultra, method: LZMA. The password I regularly use is 16 digits. Now the file is not opening. I guess one ...
16
votes
4answers
1k views

Should I be worried if I accidentally entered my password in a username field?

Occasionally I will fail to hit Tab properly when entering a username/password combination. This results in me submitting username "myUsername$ecretPa$$word" along with a blank password. I always ...
0
votes
0answers
69 views

Why do websites limit what special characters you use in a password? [duplicate]

Bank of America, to give just one example, only lets you use certain special characters in your password - # and ( and ), but not $. (This is not a complete list, they allow more than that, but it's ...
18
votes
7answers
6k views

Are password reset links that don't expire a security risk?

I am currently working on a password reset flow. We have decided to go with a password reset link being emailed to the user's registered email and allowing them to follow that and input a new ...
33
votes
3answers
5k views

Is using the username encrypted with the password as key a good password storage scheme?

On web applications I build I don't hash the passwords. Instead I symmetrically encrypt the username using the user's password and store the result in the password field. I use RijndaelManaged on ...
4
votes
2answers
168 views

Does adding a random character to a pseudo-randomly generated password improve entropy significantly?

I'm asking a practical question. I was taught computers are bad at generating random data. Does this mean password generators, such as the one built into Keepass, suck? If yes, then would it help for ...