Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
0answers
96 views

Hydra command for cracking a webpage which uses <span> tag for failed login attempts

I'm trying to for crack a simple webform for testing hydra in Kali. When the webpage encounters a wrong username and password combination it pops up a message using the following html code:: ...
3
votes
2answers
176 views

Why is a bad idea to use a common password form?

I've heard that its a bad idea to create passwords based on a common form such as random letters appended with the start of a websites domain name. So for example a password to gmail might be ...
3
votes
3answers
111 views

how is strength of password calculated from standard keyboard patterns?

In password strength calculator is there an algorithm to determine the keyboard pattern? there could be thousands if not millions of patterns that could be generated with a standard qwerty keyboard. ...
1
vote
2answers
34 views

Rembering password on client (not database) [closed]

I am trying to implement the capability for my program (C++) to remember a user/password combination, so the user does not need to type it in again. Is there a secure way for my program to store ...
2
votes
1answer
142 views

How to store client login credentials?

My company has to constantly connect to remote server where there are numerous way to access, often via vpn and remote desktop connections, as well as SQL servers. There are over 50 clients that this ...
8
votes
4answers
2k views

Hashing passwords and dealing with duplicates

Currently my project still uses MD5 hashing to encrypt passwords. Yeah, I know. I'm planning to update the password system to use the newer password_hash and password_verify functions in PHP, which ...
3
votes
4answers
261 views

I didn't wipe my hard drive before I sold it. How would a criminal take advantage?

I just sold a Mac Mini, and I erased/formatted the hard drive before I turned it over, but I didn't wipe it securely (not wise, I know). How would a criminal take advantage of this fact? What is the ...
1
vote
2answers
139 views

Password Reset URL forwarding

If a previously registered user clicks on the password reset button during login, I want to send them an email with a reset password link. I have three queries: How to add an expiry date to the ...
2
votes
3answers
164 views

I have moved to OSX; what is the best way to self manage passwords?

I am going to go ahead and say that I have to trust at some level, therefore I choosing to trust first parties (Apple/Microsoft/etc) for the sake of this question. I used to use KeePass (database ...
1
vote
2answers
146 views

Keepass - password paranoia

How do I know that the Keepass app isn't behind the scenes at some point sending my master password over internet to some secret site whose job it is to collect them and use them for evil means?
6
votes
1answer
255 views

Why does OWASP recommend security questions?

I was reading the OWASP Forgot Password Cheat Sheet when I stumbled upon the recommendation to use security questions. There is even a dedicated page about what information to gather. Whenever I ...
10
votes
5answers
467 views

Two passwords provide better security than two-factor authentication?

While evaluating 1Password's new Teams service, I noticed rather curious absence of support for multifactor authentication. When asked about the lack of MFA, they replied: We use an Account Key ...
0
votes
1answer
51 views

Two reset password tokens used for the same reset password flow

I've a question regarding a forgotten password flow. Basically I'm sending the password reset token out-of-band to the user, and then the user sends it back with the first request via querystring, I ...
3
votes
3answers
86 views

Implement a passcode to authenticate app users [duplicate]

This question is related to this one. We're busy implementing 5 digit passcode authentication for our app (Android, iPhone), but we're running into a complexity. We're unsure how we can safely ...
5
votes
15answers
5k views

Preventing registered users from sharing passwords [closed]

Below is a proposal for dealing with a situation of website security. I am wondering whether it seems feasible, from both a technical and usability point of view. I want to make sure that the proposal ...
4
votes
0answers
21 views

How to securely send your user and hashed password to a server? [duplicate]

I'm making a user system for an app I'm developing, and I have a client side (the mobile app itself) and a server side (where the database remains) for it. The app sends get and post petitions to the ...
1
vote
0answers
76 views

How secure is Asus router latest framework function: “Added protection mechanism for GUI login brute-force attack for login username and password.”?

I have just updated my RT-N12 D1 router to the latest framework, and it has new function - "Added protection mechanism for GUI login brute-force attack for login username and password.". I Googled and ...
-1
votes
2answers
128 views

Using a password hash…as the password? [duplicate]

Ok, this is probably a really stupid idea, but I can't really see why it would be a bad idea. Maybe someone can enlighten me. Why couldn't you enter a password good hashing algorithm like bcrypt, ...
2
votes
1answer
100 views

Login on public Wi-Fi networks using HTTPS [duplicate]

Is it safe to log in to my e-mail account with my iPad's Safari through a public Wi-Fi network (let's suppose someone is eavesdropping the traffic) provided that the e-mail provider uses HTTPS?
0
votes
2answers
58 views

Is it insecure to temporarily save user's data in a session while they register?

My plan is to save the registration, as they go along so if they close the page by accident they will still have all of there information saved so they can continue it again. But my question is it ...
13
votes
2answers
336 views

Why is OpenID considered secure when password reuse is not?

OpenID allows you to use your e.g. Google/Facebook/Microsoft account to log into a third party website. It can be used to log into Stack Exchange. Why is this considered an acceptable practice, ...
72
votes
10answers
12k views

If I enter a password on the wrong site, should I consider it compromised?

I have recently started to make use of a password manager and good password practices. I have a different password for each site that I use. If I accidentally use the password from another site when ...
-1
votes
1answer
135 views

Is it okay to have a blank root password for MySQL if port 3306 is not forwarded?

I'm running a PHP server that will use the root account to access the database. However, the server is behind a router and port 3306 is not port forwarded. Is it okay to have a blank password for the ...
10
votes
4answers
383 views

Why do websites store passwords' hashes not their ciphertexts?

Every time we discuss passwords and hashing functions posters immediately bring up how hashing functions can be cracked and we should avoid MD5 .. etc Hence we have use strong passwords and salt and ...
5
votes
3answers
259 views

Did I miss any vulns here?

I recently took a beating in a Security Engineer interview and I did not get any specific feedback on how I did. I'd like to re-ask the question to the community so I can polish up on these elements. ...
79
votes
8answers
9k views

Why should you redirect the user to a login page after a password reset?

The OWASP Forgot Password Cheat Sheet suggests: Whenever a successful password reset occurs, the session should be invalidated and the user redirected to the login page I'm failing to understand ...
1
vote
2answers
204 views

Is Linux getting less or more secure? [closed]

The famous so-called virus-and-hacker-free Mac is a thing of the past: As it gets more popular it gets more vulnerabilities. Will Linux be the same at some point in time? Is it getting less of more ...
3
votes
1answer
33 views

Adding HTTPS API to legacy hardware system that uses short numeric passwords

I work with a hardware system that traditionally authenticates users by the entry of a short numeric password on a physical keypad. Despite the small password entropy, this system has proven to be ...
0
votes
0answers
36 views

Is it appropriate to request a bounty for finding exploit on major site? [duplicate]

Long story short, I found an easily reproducible, very easy, and honestly embarrassing exploit on a major (yes, major) financial institution's online banking site today. It's not directly tied to ...
2
votes
2answers
127 views

Log User In Automatically After Clicking Account Activation Email

Scenario: Forum account registrations, user must click an activation email after they sign up e.g. they create an account with username, email, password, and an email is sent to the email they select. ...
3
votes
1answer
80 views

Using the password, among other values, as key data in two-factor authentication

I'm writing an implementation and a thesis about two-factor authentication, and am currently doing some research. I'm currently looking at an implementation for deterministically generating a ...
5
votes
3answers
167 views

How to mitigate heartbleed like attacks prior to zero day

Whenever sensitive data such as a password is used on a server it resides in memory for a short time. Given that security flaws like heartbleed exist which have the ability to 'bleed' memory for their ...
2
votes
4answers
132 views

Is it a good idea to to use secure_hashing_function(mypassword.url) as my password? [duplicate]

Like many users it's very difficult for me to use a different password for every website I have an account with. It does not matter how complex my password is if ONE naive website stored it in clear ...
5
votes
1answer
977 views

Should I be worried about brute-forcing passwords that encrypts AES?

I am building an application that needs to locally store sensitive data, that is encrypted using the sha256 of a password provided by the user. It uses AES for encryption. I am worried that some ...
5
votes
1answer
350 views

YubiKey or Google authenticator?

I'm using lastpass and I would like to implement a 2FA in my account, but I don't know which one is the most secure, a software authenticator such as google authenticator or an USB device as Yubikey. ...
0
votes
1answer
224 views

Is it possible to recover a Diskcryptor volume password?

Must admit to being dumb: I have encrypted one partition from my external hard drive with the AES-Twofish-Serpent algorithm and used a key file with a password. My PC ran into a problem and now the ...
0
votes
1answer
100 views

Can you do a client and server side encryption [duplicate]

I am creating a PHP website where users, among other things, can login and do administrative stuff. For their passwords i use password_hash($password) and to later verify with it, I use ...
1
vote
2answers
143 views

Does using NATO's phonetic alphabet increase password strength?

Given an alphanumeric password intended to be strong yet easy to remember, we change each alphabetic character by its NATO alphabet counterpart (e.g. 'cat' becomes 'charliealphatango'). I understand ...
-1
votes
1answer
39 views

Quantum Computation and its threats [duplicate]

Since Quantum Computers has potential to become super computers of next generation. will that make cryptography obsolete..?
2
votes
2answers
75 views

Password generation based on hash of master password + suffix?

Is this [1] a secure and reasonable way to generate a unique password for login on various websites? echo -n my_strong_master_password#website.com | sha1sum Of course, if my system is compromised ...
4
votes
3answers
305 views

Can using emojis make someone's password safer?

I was just thinking about this the other day, after reading about making safe passwords, you have a few options: The first would be, adding numbers, or something other than just a word ...
41
votes
10answers
7k views

What type of pattern should I use for my passwords?

I have a lot of accounts and until some time ago I used an universal password for all of them. Right now I have a different password for every account depending on the website name that I am logging ...
1
vote
1answer
249 views

Hiding database passwords for classic ASP connection strings

Looking at some old classic ASP sites which could do with a bit of tightening up. The SQL server database connection string has the password in clear text within an include file on the server. ...
2
votes
1answer
104 views

OTP on the same device being used to login

I've seen mobile apps use two factor authentication by sending an SMS to the mobile phone. However, if I've stolen someone's phone, where is the security advantage? I can understand it if it's used in ...
-2
votes
1answer
113 views

How MD5 and salt algorithms come into play if the attacker uses curl?

When the user logs into any site, they supply a username ('user01') and password ('password123') into a form then submit. The user has no idea what their hashed password value is that is stored in the ...
1
vote
1answer
545 views

VeraCrypt: Is it possible to change the password after an encrypted container has been created?

I would like to know whether it is possible to change the password after an encrypted container has been created? The password I chose was a bit weak, and I would like to be able to modify it without ...
7
votes
2answers
244 views

Is it easier to crack a ZIP file than a 7z archived file given they have the same password?

I am interested in knowing if either of them is easier to crack than the other because of inherent flaws.
3
votes
1answer
495 views

Using MySQL 'encrypt' / crypt() to store passwords?

I've been tasked with deploying a FTP instance with a MySQL backend for storing user logins. Looking online I found Pure-FTPD, which on paper is great. However documentation states it only allows ...
7
votes
3answers
270 views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of ...
3
votes
2answers
75 views

Would using a password already hashed+salted be secure?

Some basic principles of password security: Hash it and use a salt The people storing the password should never be able to see what the password is, just the hash This hash should be difficult to ...