Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
10
votes
3answers
1k views
Confused about (password) entropy
There seem to be many different 'kinds' of entropy. I've come across two different concepts:
A) The XKCD example of 'correcthorsebatterystaple". It has 44 bits of entropy because four words randomly ...
5
votes
3answers
93 views
What standards are there for mangaging high value passwords?
I am leading a small team at a start-up and I am facing a dilemma with high value passwords.
I am the only one on the team who knows all the key passwords for production servers, databases ... etc. ...
3
votes
3answers
602 views
Calculating complex password entropy?
Whenever I look at password entropy, the only equation I ever see is E = log2(R)*L, or alternatively E = log2(R^L), where E is password entropy, R is the range of available characters, and L is the ...
3
votes
3answers
287 views
What are the security implications of phone based keyless entry systems?
I have just been reading about Lockitron which promises to provide phone based keyless entry for the home. As great an idea as this sounds it strikes me that it could come along with some very serious ...
6
votes
3answers
251 views
Is it secure to use bcrypt-generated salt in cookie to serve as token in place of a password?
I have a (hobby) web site that runs only on SSL. The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to secure it as much as ...
6
votes
3answers
2k views
Why is Chrome asking for the application-specific password and my account's password every time?
I enabled Google's two-factor authentication and found it ironic that Google Chrome Sync requires #1 You account password, and #2 an application-specific password. First of all, don't applications ...
10
votes
1answer
387 views
XKCD #936: under what assumptions is 1000 guesses/second over a network plausible?
In XKCD #936, a rate of 1000 password guesses/second is proposed as a "plausible attack on a weak remote web service". Under what assumptions is this rate plausible? It seems much too high to me. I ...
4
votes
1answer
326 views
Can a Bitlocker To Go user pin be brute forced?
I have a external hard disk and protected a partition on it with Bitlocker To Go. I printed the recovery code but I lost it. I can't remember the user PIN either. If I could only know the first ...
5
votes
3answers
338 views
bcrypt: random salt vs computed salt
I'm pretty new to the whole password hashing business, so I might be missing something obvious.
I was looking at the bcrypt algorithm, in particular BCrypt.Net, and I was wondering if it wouldn't be ...
-1
votes
3answers
172 views
find password and iv of an encoded string knowing the decoded string
If I would know the clear and encoded versions of a string could I somehow find the password and.or iv that wore used to encode it?
Encoding done with open_ssl aes-128-cbc.
17
votes
6answers
788 views
Why do some sites prevent users from reusing their old passwords?
I have always wondered why it is that bad to reuse old passwords; it should not be the end of the world if we happen to use an old password that we previously used.
After all, I believe most of the ...
4
votes
1answer
407 views
Why does Microsoft limit password length? [duplicate]
Possible Duplicate:
Should I have a maximum password length?
According to a recent TNW article:
Microsoft doesn’t like long passwords. In fact, the software giant not
only won’t let ...
4
votes
1answer
192 views
How will security need to be changed if we can crack password hashes in quasi-polynomial time?
If we suppose that we have access to some form of generalized password hacking/cracking that can somehow find an $n$-bit password in time $O(n^{\log n})$, is there need for alarm?
This question ...
5
votes
5answers
1k views
How can I avoid putting the database password in a perl script?
I have a cronned perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
2
votes
1answer
173 views
Can I check if a work colleague logged into my user account on a shared computer?
I think that someone at work has logged onto my user account when I'm not in work and moved some files from my desk top to my work in progress. Can this happen? They may know my user name as this is ...
2
votes
1answer
76 views
What authentication threat data exists?
I recently read an article that said there was not much data on which authentication threat vectors were actually being exploited in the real world. Eg what percent of password theft was by ...
3
votes
3answers
417 views
sniff SSH password on the server
Is it possible on the server to log the password encoded by the remote user inside a log.
I want to make a honeypot to see the type of user/password used.
6
votes
5answers
381 views
Creating multiple secure and easy to remember passwords
I have recently developed a new web application which our clients log into using a username and password. As we're just rolling out this system, we'll be setting the usernames and passwords ourselves, ...
0
votes
1answer
154 views
How key_derivation and key_verification functions are implemented of a 7-zip archive's encryption mechanism?
I am curious about how password recovery works for password protected files. And I want to know the exact flow of the 7-zip encryption mechanism :) !!
7-zip uses the AES-256 encryption algorithm in ...
3
votes
1answer
143 views
DPAPI offline attack by cracking windows password?
I'm thinking of using DPAPI to protect configuration file information in my program. After doing some reading on it, it looks like it uses the user's Windows password as part of the encryption ...
13
votes
2answers
3k views
How secure is Windows 8's Picture Password login?
The final Windows 8 build has been released to manufacturing. One of the new features of Windows 8 is "Picture Password", where the end user logs on to Windows by clicking a specific pattern on the ...
1
vote
2answers
107 views
Is there a term for a “Master + extension” style password scheme?
I personally have (and preach) a password system using a "root" password shared amongst many passwords, plus a unique password component.
So for Gmail my password might be correcthorsebatterystaple + ...
2
votes
2answers
301 views
Password recovery tool over telnet or http basic auth
In my feeble attempt to secure my router, I disabled the service login and either
changed the "admin" login and the password, or
changed only the password for the "admin" login
Normally, I would ...
3
votes
8answers
540 views
Is this a good way to store passwords in a Web Application?
I've been tasked with finding a better way to store passwords and came up with this Algorithm. My understanding of Crypto is not strong enough but can someone check this please?
Inputs:
Username
...
6
votes
1answer
381 views
Store user passwords in NoSQL database?
I am currently coding the backend of a website and I have not come across an article where this is discussed. I want to store all my application data in MongoDB but I'd like to split out my sensitive ...
1
vote
1answer
70 views
tools automating logins/hashes grabbing
Lets assume I have access to the windows machine.
I want to grab raw info about logins/hashes from both system and installed apps, dump and analyze it later.
I could manually dump things like SAM ...
3
votes
2answers
287 views
Best practice for password-protecting a secret key
What approaches are generally accepted for generating a password-protected symmetric key?
My intuition is to generate and store a random string of appropriate length as the password-protected key, ...
9
votes
2answers
578 views
Estimating the size of a rainbow table
What are rainbow tables and how are they used? Gives a very precise answer about what rainbow tables are and how they are used. I had always confused hash-tables and rainbow tables. My question is ...
8
votes
2answers
1k views
Facebook API : App Secret - possible misuse
I've recently find out that by simple quick look into compiled code of one of our applications, you can get both App ID (API Key) and App Secret for Facebook API
I suppose that we should really keep ...
5
votes
3answers
325 views
How does KeePass master key derivation increase security?
I don't understand how KeePass key derivation increases the security of the password db at all.
First I'll try to explain what I understood from the key derivation described here. I'll use some pseudo ...
10
votes
2answers
603 views
Bypassing the BIOS password
Are there any reliable methods that allow an attacker to bypass a BIOS password, or alter BIOS settings without entering the password?
A few ideas come to mind:
The old battery trick (remove ...
4
votes
3answers
357 views
Tracking stolen laptop which has a login password
I have been reading about solutions that track your computer in case of missing. Since I'm using Ubuntu 12.04, the best option would be prey for me, but I'm open to other suggestions.
The question is ...
3
votes
0answers
77 views
How should I manage my passwords? [duplicate]
Possible Duplicate:
What is a good practical (and sane) way to manage all your passwords for online sites?
So even if I come up with memorable passwords like "correct horse battery staple," ...
2
votes
2answers
83 views
Is this login authentication safe?
I have been thinking of a way to authenticate users so as to pick out the users using cracked versions of my game from the people who have actually bought it. I came up with this idea:
The client ...
2
votes
1answer
431 views
Should we block all plaintext authentication and require authentication over an encrypted channel?
Should we configure our servers to require the authentication happen over an encrypted channel and block all methods of unencrypted, plaintext authentication over?
I recently configured my servers to ...
6
votes
2answers
238 views
Is it proper to be prompted that I entered an old password
I changed my Facebook password a few days ago. Today, I entered the old password chronically, and saw the prompt:
Sorry! You Entered An Old Password
And even shows the date&time when I ...
2
votes
2answers
781 views
Help understanding basic user authentication with salts and hashing
I for some reason am not understanding how to execute a secure authentication between client and server for a user. I've read many resources, and I understand how to use the hashing and salting tools, ...
3
votes
2answers
5k views
Remove Password Protection from XLS Document
Similar to what is listed here, http://datapigtechnologies.com/blog/index.php/hack-into-a-protected-excel-2007-or-2010-workbook/, is there a way to remove the password from an XLS (Excel 2003) ...
5
votes
2answers
335 views
Requiring regular password change but storing previous paswords?
My bank requires me to change my password regularly but then they can detect if my password was used before. They probably store the old password (possibly hashed) in order to detect it. I think this ...
6
votes
2answers
361 views
Production ready bcrypt implementation for .NET
Which, if any, .NET / C# bcrypt implementations are considered suitable for production environments?
I have seen CryptSharp and BCrypt.Net mentioned in answers to other questions but without any ...
0
votes
1answer
57 views
What is a preferred method of security-conscious creation of login cookies [duplicate]
Possible Duplicate:
Is it safe to store the password hash in a cookie and use it for “remember-me” login?
I am working on a webapp that uses localStorage alone ...
0
votes
0answers
124 views
How to create a portable password storage [closed]
I want to have a portable way to store my passwords and key pairs. While I know that this already exists e.g. as Apps for iOS or Android and counterparts for OS X or Windows which can sync and ...
3
votes
1answer
87 views
Password hashing on a load balancing setup
I've been doing some research into password hashing implementations and would like to know if it's feasible to have two servers hash passwords to the same database?
I've come across the Bcrypt.net ...
4
votes
2answers
165 views
Did I miss anything when checking for passwords?
I was provided with a "challenge" forensics image of 2MB in size (floppy); they provide the disk image and want you to uncover as many passwords as you can find. I downloaded the image and dd'd it to ...
14
votes
6answers
742 views
Hash function change
I have user account passwords stored in a database using an unsafe (old) cryptographic hash function.
What is the best/usual approach to changing password hash function? Only two ideas come to my ...
4
votes
1answer
200 views
Should password hashes be encrypted or HMACed?
Assume I am hashing user passwords with PBKDF2, bcrypt, scrypt, or some other secure key derivation function.
Are there:
tangible security benefits,
precedents, and
respected research
for ...
3
votes
1answer
214 views
How strong are google's Application-specific passwords? [duplicate]
Possible Duplicate:
Google Account: implications of using application-specific passwords
In 2-step verification of google accounts, we need to use the Application-specific passwords ...
4
votes
2answers
171 views
How to prove a password guessing theory from Matt Bishop's book “Introduction to Computer Security”
First, this is not a homework problem. This is a problem from Matt Bishop's book "Introduction to Computer Security" which was used as one of the textbooks for a Computer Security class I took last ...
1
vote
4answers
291 views
Security implications of using a OAuth-enabled password manager
I've resisted the idea of password managers for a long time. Bringing together passwords for all your online accounts in one place that is only protected by difficult-to-remember master password ...
2
votes
3answers
101 views
How to make an outbound request to users to update their passwords?
Clearly it works best if the request to update a password happens as a response to an inbound request to access a known system, but how do you make an outbound request to users to update their ...
