Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

2
votes
2answers
201 views

Wifi Sniffing Prevention

I share my wifi with my brother. Recently I came to know he is sniffing on my browsing. Is there a way I can prevent him from sniffing on my browsing? PS: I can't afford VPN.
0
votes
1answer
83 views

What are the implications of an overly-restrictive password policy? [duplicate]

I came across an interesting password policy online recently: "Please be sure to enter a password that meets the following criteria: must be 8 characters long must not be based on dictionary words ...
53
votes
3answers
18k views

How can I create a password that says “SALT ME!” when hashed?

How can I create a password, which when directly hashed (without any salt) with md5 will return a string containing the 8 characters "SALT ME!". The hope is that a naive developer browsing through his ...
1
vote
1answer
87 views

Amazon Turk - How secure is it? Strange behavior

I just had this really strange experience with Amazon Turk, where suddenly I was logged into someone else's account. I was logged into the company's Turk account, left my computer for a while, ...
4
votes
4answers
419 views

Can't brute force password cracking somehow be throttled?

Online articles mention the importance of a strong password and suggest that hacking tools allows bad guys to attempt millions of passwords per second. I am wondering why OSes and websites and such ...
16
votes
1answer
3k views

How to apply a pepper correctly to bcrypt?

Update: There is a better way to add a server side key, than using it as a pepper. With a pepper an attacker must gain additional privileges on the server to get the key. The same advantage we get ...
2
votes
2answers
124 views

Does my brokerage/bank use poor password security measures?

I'm no expert. Could someone please tell me if I'm overreacting? After the Heartbleed news broke, I changed a lot of passwords. Here's what I discovered when changing the password on my all-in-one ...
1
vote
2answers
161 views

Which hashing algorithm is ideal for use on the web? [duplicate]

I am new here, and have poked around the site looking for an overview of which hash algorithm to use on the web and why. It seems to be the consensus that SHA-256 or other SHA-2 family algorithms are ...
0
votes
2answers
146 views

How different should passwords be?

It seems to be generally accepted the same password should not be used for different sites or devices. How different should passwords be? For example +_^gum<JW1 and +_^gum<JW2 are very similar. ...
5
votes
1answer
5k views

Recover Server 2008 R2 Domain Admin Password

So I did the ultimate silly thing: I lost my domain admin password for my Server 2008 R2 box. Sure, I could just re-install but that's going to be a huge pain. I tried rebooting with the Windows ...
1
vote
1answer
56 views

How do you manage credentials to multiple remote systems?

We are a vendor that provides software to the healthcare industry, and our application is locally hosted on customer infrastructure. As such, we are provided with VPN access in order to be able to ...
0
votes
1answer
684 views

What happens if you run out of password attempts?

In Samsung Knox, you have 20 password attempts. However, it is never explained what happens if you run out of attempts. Does it delete your Knox data, do you need to enter the recovery PIN or is it ...
1
vote
1answer
166 views

FIPS 140-2 C# Password Hash

Is the following algorithm, using RNGCryptoServiceProvider & Rfc2898DeriveBytes, sufficient to implement a FIPS 140-2 password hash on Windows Server 2008R2? var provider = new ...
4
votes
2answers
620 views

Does bcrypt compare the hashes in “length-constant” time?

I saw this function slowEquals() while reading Salted Password Hashing - Doing it Right, which uses a byte-level xor comparison to avoid timing attacks. I was wondering whether this is what Bcrypt ...
0
votes
0answers
24 views

Length-constant password comparison in scrypt? [duplicate]

E.g.: XORing the candidate against stored then comparing against 0. Do I need to worry? (my question is much in the same style as this question: Does bcrypt compare the hashes in ...
54
votes
12answers
9k views

How reliable is a password strength checker?

I've tested the tool from Microsoft available here which tests password strength and rates them. For a password such as "i am going to have lunch tonight", the tool rates it's strength as "BEST" and ...
2
votes
2answers
283 views

Chinese or “pinyin” wordlists for dictionary attacks

Background: I am currently trying to crack a salted md5 hash which I have recovered from an embedded device running busybox and manufactured in china. I have tried john the ripper using all of the ...
1
vote
1answer
79 views

Cracking encrypted SQB databases

I've recovered a .SQB SQL database backup file from a backup server and do not have the password. As I do not have the password available to me, I'm looking to determine what type of encryption is ...
13
votes
5answers
7k views

Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?

Justin Schuh defended Google's reasoning in the wake of this post detailing the "discovery" (sic) that passwords saved in the Chrome password manager can be viewed in plaintext. Let me just directly ...
4
votes
1answer
153 views

API to change passwords?

After I learned last week that the login data of some of my accounts was leaked, I had to change my passwords for more than 30 sites. That was tedious! As luck would have it, some days later we ...
12
votes
6answers
2k views

Do salts have to be random, or just unique and unknown?

First of all, my motive is to avoid storing the salt in the database as plain text. As far as this question is concerned, the salt is not stored in the database. After discussion in comments and in ...
1
vote
1answer
93 views

Hashing password for secure storage (generating salt)

I wanted to check if the following means of generating a hash for storage of a password was secure. I have an username and password combo. In order to generate a secure hash, I am doing the ...
6
votes
1answer
143 views

What happens if biometric data is stolen?

As we move toward a future where fingerprints might possibly replace passwords, I see one issue. While passwords can be stolen, they can be changed by the owner after being notified of the security ...
1
vote
1answer
418 views

What to do with .hash files when cracking WPA2

So, I'd say I'm one level above n00b. I've gotten to the point where I have accomplished a WPA Handshake (and saved the output as xxx-01.cap). I have also downloaded these hash tables (if that is the ...
0
votes
1answer
48 views

CNN Money Portfolio and Heartbleed [duplicate]

Is/was CNN Money Portfolio ever vulnerable to heartbleed? It states 256 bit SSL bank level encryption on the website..
5
votes
2answers
337 views

TPM- Symmetric key storage

I understand that the TPM can be used to store an unlimited number of keys. However I am left with a few questions: Presuming the TPM is connected on the LPC what protects the data travelling across ...
21
votes
4answers
9k views

Should I change all my passwords due to heartbleed [duplicate]

Should I change all of my online passwords due to the heartbleed bug? Edit: I found a list of vulnerable sites on GitHub and checked all my critical sites. Everything I was really concerned with ...
3
votes
1answer
1k views

Is it safe to sign in to Google with password from desktop app like BlueStacks? [closed]

BlueStacks is an android simulator for desktop. After installation it will ask you to login with your Google account to download and install android app from play-store. My question is "Is it safe to ...
0
votes
0answers
273 views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
0
votes
2answers
127 views

If bruteforcing a password goes aaa, AAA, aab, AAB, etc, all the way to ZZZ, wouldn't ZZZZZZ be the most secure password?

I'm only taking about security against bruteforce attacks. I assume that most crackers start at a and go up to zzzzzzz for as long as instructed (so it could be zzzzzzzzzzz if told so in the ...
0
votes
1answer
200 views

The Problem with Changing All Passwords for HeartBleed [duplicate]

One thing that's been bugging me in relation to the discovery of the Heartbleed OpenSSL flaw is the recommendation that everyone should run to their computers in a panic and change all of their ...
31
votes
8answers
3k views

Why improvising your own Hash function out of existing hash functions is so bad

I'm afraid I'll have tomatoes thrown at me for asking this old question, but here goes. After reading that cooking up your own password hash out of existing hashing functions is dangerous over and ...
3
votes
3answers
633 views

Encrypting passwords?

I am planning on creating a text file to store my passwords, so I only need to remember 1 password (at the moment, I have about 20 long/complex passwords in my mind, and am worried that I might forget ...
20
votes
4answers
6k views

How secure is Windows 8's Picture Password login?

The final Windows 8 build has been released to manufacturing. One of the new features of Windows 8 is "Picture Password", where the end user logs on to Windows by clicking a specific pattern on the ...
4
votes
1answer
209 views

Password Managers: encrypted database vs hashing strategy

I'm considering moving to a password-management strategy based on supergenpass or something similar. This is an alternative to other password managers where instead of having a database of passwords ...
8
votes
3answers
691 views

Is it safe to generate passwords online?

I usually generate strong passwords using various online tools. Some time ago I mentioned it to friend of mine and he looked at me as if my life was one big fail. Is it really so unsafe to generate ...
1
vote
1answer
222 views

I login to Stackoverflow (vulnerable) with Google (not vulnerable). Do I need to change my password? [duplicate]

According to this heartbleed mass test, Stack Overflow is vulnerable whereas google is not. I use my Google ID to logon to Stack Overflow (and some other sites). Do I need to change my password? In ...
16
votes
2answers
561 views

Bank accepts different password to the one that I set

I'm not particularly well versed in IT security so please bear with me. I recently discovered that my bank's online system will accept passwords that consist of the correct password, and a string of ...
1
vote
2answers
170 views

LastPass login security

If LastPass does not store your master password, then how can you login to use their web app? Surely you must type it in, it is sent over using SSL, and then salted/hashed on the server-side, and ...
44
votes
1answer
6k views

What should end-users do about Heartbleed?

What should one do about the Heartbleed OpenSSL exploit? mainly talks about what people running websites should do about Heartbleed. What should end-users of websites be doing? Do they need to ...
0
votes
1answer
54 views

Handling passwords in wicket

I have a form which contains a password field. In swing the getPassword() method returns a character array. After the password has been processed by my web application the array can be wiped to ...
0
votes
1answer
52 views

Is there an anti virus that protects processes from being injected code to?

As title says, is there an av that does that? And if not, is there any other program that protects processes like lsass in windows, apart from protected process utility in win8.1?
1
vote
0answers
107 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
1answer
97 views

Is there an equation to calculate the number of instances of a series of characters exist in a given key space?

If I'm using 16-18 character-length passwords with 94 different possible values-per-character (lower alphas, upper alphas, numbers, and special characters), is there an equation I can use to calculate ...
1
vote
0answers
58 views

Lock Windows to a specific app

Is it possible, using some program or application, to lock Windows 7 so only a specific app can be used, for example Word, until a password is entered? Thanks!
2
votes
1answer
149 views

How was the Xbox One password verification compromised?

So, we have this article: http://www.engadget.com/2014/04/04/xbox-live-five-year-old-hacker/ Apparently, using nothing but spaces the local account (with an obviously saved password... I hope) was ...
6
votes
4answers
268 views

Relationship of password strength and key strength

I have just started educating myself about cryptography, and while it is mostly making sense, a few things are still eluding me. One being: In systems that take a user's pass-word/-phrase in order to ...
2
votes
1answer
66 views

Safety while ciphering data

Say I wanted to encrypt some sensitive information with a symmetric algorithm using a program on a computer. Is it possible that a hacker could retrieve the data,salt, iteration, cipher, keysize while ...
1
vote
2answers
136 views

How could police identify digital contraband and charge someone if it's encrypted with keys?

For example, say I am transferring heavily-encrypted DVD/Blu-ray movies/game copies over the internet. However, I am using double or (+) encryption with keys required to decrypt the file using an ...
0
votes
1answer
136 views

Is using MD5 in NTLMv2 protocol to store Windows passwords is secure?

I read that Windows (probably not new OSs but say, Windows Server 2008) stores passwords using Hashes using NTLMv2 protocol which uses MD5 hash function. My questions: MD5 is known to be insecure ...