Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

1
vote
3answers
121 views

Resetting passwords howto

I am currently in the process of designing a registration form for the users to register accounts. The accounts will contain a lot of personal information, so I want to ensure highest possible ...
-4
votes
2answers
211 views

in which format this code is encoded ? and how i decode it? [closed]

"jmHMRWncShQ%3D" this is my encoded text , i want to know that in which format , this text was encoded , and also want to know that how i decode these types of code ??? this password may be ...
3
votes
3answers
242 views

Could using a generated key from an online service be considered a risk?

With some colleagues we're having a debate regarding the randomkeygen.com website. I do think that there is a security risk using the generated keys of this (or any of this kind) website. Why ? ...
2
votes
2answers
106 views

Will deferring password choice until after account activation improve security?

About one year ago, for about two months, lots of user accounts with unverified login email address started to pile-up. All addresses belonged to @yahoo.com. It appears (don't know for sure) some ...
1
vote
0answers
58 views

How do I determine whether a Linux-based router still has the default password? [duplicate]

My goal is to check if the password used by admin is the default password. I work on a Linux-based router. I know the password is stored as a hashed value in /etc/passwd. In generic Linux machines, ...
2
votes
2answers
364 views

Username and password stored under form data in Chrome Dev Tools

When I record the network tab in Chrome Developer Tools when logging in to my site I find that the username and password are stored in plaintext under form data. You can also find it in Safari, ...
-1
votes
1answer
148 views

Is my hashing technique secure? [duplicate]

I am not sure if this is the best place to post this type of question. I have come up with function which, I believe, is a very secure method of hashing. (I could be completely wrong). Here's the ...
58
votes
10answers
17k views

Bad practice to have a “god” password?

Is it bad security practice to have a password that will allow you to access any user account on a website for support purposes? The password would be stored in a secure manner and would be super ...
0
votes
2answers
134 views

Any reason to use bcrypt, pbkdf2, scrpt for other things than passwords? [closed]

Let's say I want to hash some data, using SHA256, in order to prove I know something. Maybe it's my secret ID for something. In the real of passwords we have moved from hashing -> hashing+salt -> cpu ...
9
votes
3answers
471 views

Should I reject obviously poor passwords?

UPDATE: My questions and concerns below boil down to: "Should I reject obviously poor passwords like 'hellomydarling' or 'password'? My guess is yes and I want to know to what extent. I'm using a ...
-1
votes
1answer
182 views

Does password “strength” matter anymore? [duplicate]

In the early days we happily saved whatever password a person wanted to the database. Later we decided that passwords must include certain characteristics like numbers, upper and lower case and ...
2
votes
2answers
261 views

Pattern based password cracking

I need to select a project for this semester. I'm a second year uni student in Ethical Hacking and Countermeasures. My idea was to see if using some kind of pattern based password cracking can be more ...
1
vote
3answers
212 views

Sharing passwords through email can be considered insecure?

I'm responsible to create new accounts for some services on my job. Some of these service do not allow password change by the user, so in the case the user wants to change its password, he would need ...
0
votes
0answers
25 views

Are longer passwords more secure? [duplicate]

There are more and more sites claiming that long passwords which are chained words are not only easier to remember, but also more secure then short but obscure ones. Don't get me wrong: I totally get ...
0
votes
1answer
72 views

What is the best way to generate a password/pin like string using brute force method? [closed]

I have a string of 7 characters. I'm supposed to generate all the combinations. But some combinations are more likely than others, I would like the more likely ones to be generated first. If I ...
21
votes
4answers
2k views

What are spambots doing with unintelligible login attempts?

After constantly being under attack in phpBB, I created a new forum by hand, which successfully prevents spam bots from registering, and I get a report for every failed login attempt, telling me the ...
0
votes
1answer
190 views

Hashing Passphrase in Client-Side JavaScript Rather than Server-Side — Is it Viable?

Yet another salting-and-hashing-for-web-sites question has been left on the doormat of Information Security's StackExchange. The oft-mentioned approach for website password-handling is to use a ...
0
votes
1answer
485 views

About password_hash() in PHP and storing (part of) its salt outside DB

So, i learned that new in PHP 5.5 is password-hash() which works much like crypt(). Which is more secure (slower) than md5() or sha1(). The result string is algo+hash+salt, which can be passed as-is ...
2
votes
5answers
230 views

Password Recovery - what if user can't complete 2nd step?

I'm thinking out my password recovery logic for an ecommerce system. Some backround: Passwords are stored using bcrypt, password recovery involves the standard reset link, which then can be used to ...
2
votes
2answers
88 views

How do clients enroll using SRP?

From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
2
votes
1answer
493 views

New to security, is php password_hash() good enough?

This is the first time I've had to handle personnel information and I want to make sure I have a good amount of security. I will be storing users' emails and passwords for their accounts on a MySQL ...
1
vote
2answers
164 views

Use of pwgen with sha1 to create recreatable passwords

I'm looking at using Theodore T'so's pwgen (on linux/ubuntu) with its sha1 (-H) feature to generate passwords that I should be able to recreate later using the same file and seed. I briefly looked ...
15
votes
4answers
482 views

Does two-factor authentication reduce the need for a long password?

I've recently enabled 2-factor auth on a number of web apps, mostly using Google Authenticator. Does this mean that the importance of a strong password on each site is reduced? I would prefer to use ...
2
votes
6answers
3k views

Hardware USB Key to Reset Any Windows Password

This tool requires physical access of course, and there are many things you can do once you have physical access, but this peaked my curiosity. The tool in question: ...
1
vote
1answer
209 views

Is a simple Whirlpool hash with random salt secure enough? [duplicate]

I've been working on a site that requires users to login. It's written in PHP with MySQL, and passwords are stored as Whirlpool hashes with a salt (source code later). However, security sites or ...
3
votes
4answers
360 views

Best practice for forgot password form, ok to leak that a given e-mail is invalid

On our forgot password reset form, is it ok to leak that a given e-mail address entered is invalid? Or should we always just return success and check your e-mail, even if the e-mail is not valid. I ...
16
votes
2answers
557 views

Bank accepts different password to the one that I set

I'm not particularly well versed in IT security so please bear with me. I recently discovered that my bank's online system will accept passwords that consist of the correct password, and a string of ...
1
vote
1answer
115 views

Is it posible to bypass BIOS password without owner knowing later on?

My laptop BIOS is password protected. Probably the password can be bypassed using some hardware and software means. But is it possible that somebody having access to laptop but not knowing the ...
0
votes
2answers
99 views

Password stretching using concatenation of hashes

I'm working on a simple file encryption tool. Basically, here's how my program works: password = get_user_typed_password() salt = uuid4() key = bcrypt(password + salt) cipher = AES(key) for block ...
0
votes
1answer
582 views

What happens if you run out of password attempts?

In Samsung Knox, you have 20 password attempts. However, it is never explained what happens if you run out of attempts. Does it delete your Knox data, do you need to enter the recovery PIN or is it ...
4
votes
4answers
233 views

Why change password? [duplicate]

Why are there recommendations to change passwords with certain intervals? If I have a good password, e.g. a long wrongspelled odd sentence with a couple of special characters thrown in, why is the ...
0
votes
1answer
75 views

A fake phone tech changed my start up password. [closed]

I was duped into believing a phone caller was a computer tech. I allowed him remote access and when I refused to pay a fee at the end of all his changes he hung up. My start up now has an unknown ...
1
vote
3answers
254 views

RatticDB for passwords is not encrypted. Is this good approach?

I am looking for a password application for storing passwords, and RatticDB have a web interface and SSH access is planned, which are exactly the features I am looking for. However, they write that ...
10
votes
4answers
790 views

Forgetting passwords typed in too frequently

It has happened to me several times that I've become so used to typing in a password I can't consciously remember it and it's purely muscle memory. This is particularly true with complex passwords ...
1
vote
3answers
117 views

How to guarantee privacy on files that I store

I want to create an Android app where users from an office (typical use) can upload scanned documents to the app backend service for later use. e.g. A lawyer want to upload a sentence ...
-1
votes
1answer
1k views

Hydra bruteforce is giving wrong passwords. Can't seem to work any help? [closed]

Ok so what im actually trying to do is to bruteforce my own account on some website just to check myself . This is NOT for illegal steps or use , im trying to crack my OWN password , and im trying to ...
1
vote
4answers
156 views

How to store passphrase in this situation?

How to store a passphrase with a Java application that periodically needs access to its plaintext form? It is a strange situation, but I am wedged in it. If providing a decent security mechanism is ...
1
vote
1answer
195 views

how to pass credentials across applications securely?

To simplify the user experience , if we want to design a system such that the user login password for the desktop account itself can be shared with various applications like chat/email/skype etc. ...
7
votes
4answers
680 views

Reasonable way to store encrypted passwords in a webapp's database, Linux

This question is generally similar to past questions asked here, but I haven't seen one the relates to Linux. Case at hand: a PHP web app has a MySQL backend. As part of its functionality it accesses ...
2
votes
3answers
107 views

Limit attempt of user login against PBKDF2

I have been tasked been tasked by my boss to change the encryption system of our web application from MD5 to PBKDF2 as MD5/SHA1 has been shown to be breakable in recent years . I argued against it ...
1
vote
2answers
381 views

Should I decode a base64 password before hashing for storage?

My server gets base64 encoded passwords from the client, and I am going to hash them for storage in a credentials table. Should I decode the password and hash the clear text password, or just hash ...
-2
votes
2answers
79 views

How to make a strong password? [duplicate]

I always hear conflicting things. Should I use a long sentence? Or is this privy to dictionary attacks? Or should I use a long string of random alphanumeric garbage with upper/lowercase and ...
6
votes
2answers
410 views

Security risks of typing wrong password

I accidentally typed my root account password on my google account login, I know google keeps their website quite safe but this question came in mind: Is there a risk if you accidentally type in ...
1
vote
1answer
102 views

Security implications of setting the same password on private key and PKCS12/JKS?

Are there any negative security implications of setting the private key password (DSA in this case) as a PKCS12 (and then JKS) export password (instead of generating/inventing a new one)? My use case ...
0
votes
1answer
617 views

How to enable a http post form penetration test?

I don't get the correct results and I'm not sure what I'm doing wrong: $ ./hydra -l admin -x 3:9:a http://localhost http-post-form "/admin/login:j_username=^USER^&j_password=^PASS^:failed" -s ...
3
votes
3answers
457 views

If I use a good Master Password in Firefox, is security improved when I Remember Passwords instead of re-type?

In the old days I would emphasize that people should not select the remember passwords option because (besides the fact you tend to forget what the browser remembers) a bad guy could could display the ...
-1
votes
1answer
2k views

Is my information secure when using Private Tunnel? [duplicate]

I am using Private Tunnel to do some tasks involving sensitive data like logging in to PayPal and online banking. Is my data safe or can it be retrieved by other users of the Private Tunnel service?
-1
votes
2answers
118 views

I don't understand how BIPS got hacked [closed]

http://www.networkworld.com/news/2013/112513-bitcoin-robbery-276352.html In this story we can see BIPS got hacked, but I don't get how it was hacked when it was offline because of the DDoS.
2
votes
1answer
138 views

After having confirmed a computer is infected by a Botnet.

And having found a server IP that is controlling it. How can I find out the log-in credentials this client uses to log in to a IRC channel / server webpage / control panel. I have found out a python ...
0
votes
1answer
98 views

Banking platform accepts password containing subset of real password [duplicate]

How would it be possible that if my password was 123abc that my bank also accepts something like 123abc12? Isn't that an extreme security flaw? If the password was hashed and salted, wouldn't the ...