Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

2
votes
2answers
110 views

Log User In Automatically After Clicking Account Activation Email

Scenario: Forum account registrations, user must click an activation email after they sign up e.g. they create an account with username, email, password, and an email is sent to the email they select. ...
3
votes
1answer
79 views

Using the password, among other values, as key data in two-factor authentication

I'm writing an implementation and a thesis about two-factor authentication, and am currently doing some research. I'm currently looking at an implementation for deterministically generating a ...
5
votes
3answers
166 views

How to mitigate heartbleed like attacks prior to zero day

Whenever sensitive data such as a password is used on a server it resides in memory for a short time. Given that security flaws like heartbleed exist which have the ability to 'bleed' memory for their ...
2
votes
4answers
124 views

Is it a good idea to to use secure_hashing_function(mypassword.url) as my password? [duplicate]

Like many users it's very difficult for me to use a different password for every website I have an account with. It does not matter how complex my password is if ONE naive website stored it in clear ...
5
votes
1answer
971 views

Should I be worried about brute-forcing passwords that encrypts AES?

I am building an application that needs to locally store sensitive data, that is encrypted using the sha256 of a password provided by the user. It uses AES for encryption. I am worried that some ...
5
votes
1answer
281 views

YubiKey or Google authenticator?

I'm using lastpass and I would like to implement a 2FA in my account, but I don't know which one is the most secure, a software authenticator such as google authenticator or an USB device as Yubikey. ...
0
votes
1answer
196 views

Is it possible to recover a Diskcryptor volume password?

Must admit to being dumb: I have encrypted one partition from my external hard drive with the AES-Twofish-Serpent algorithm and used a key file with a password. My PC ran into a problem and now the ...
0
votes
1answer
90 views

Can you do a client and server side encryption [duplicate]

I am creating a PHP website where users, among other things, can login and do administrative stuff. For their passwords i use password_hash($password) and to later verify with it, I use ...
1
vote
2answers
141 views

Does using NATO's phonetic alphabet increase password strength?

Given an alphanumeric password intended to be strong yet easy to remember, we change each alphabetic character by its NATO alphabet counterpart (e.g. 'cat' becomes 'charliealphatango'). I understand ...
-1
votes
1answer
37 views

Quantum Computation and its threats [duplicate]

Since Quantum Computers has potential to become super computers of next generation. will that make cryptography obsolete..?
2
votes
2answers
72 views

Password generation based on hash of master password + suffix?

Is this [1] a secure and reasonable way to generate a unique password for login on various websites? echo -n my_strong_master_password#website.com | sha1sum Of course, if my system is compromised ...
4
votes
3answers
298 views

Can using emojis make someone's password safer?

I was just thinking about this the other day, after reading about making safe passwords, you have a few options: The first would be, adding numbers, or something other than just a word ...
41
votes
10answers
7k views

What type of pattern should I use for my passwords?

I have a lot of accounts and until some time ago I used an universal password for all of them. Right now I have a different password for every account depending on the website name that I am logging ...
1
vote
1answer
207 views

Hiding database passwords for classic ASP connection strings

Looking at some old classic ASP sites which could do with a bit of tightening up. The SQL server database connection string has the password in clear text within an include file on the server. ...
2
votes
1answer
102 views

OTP on the same device being used to login

I've seen mobile apps use two factor authentication by sending an SMS to the mobile phone. However, if I've stolen someone's phone, where is the security advantage? I can understand it if it's used in ...
-2
votes
1answer
109 views

How MD5 and salt algorithms come into play if the attacker uses curl?

When the user logs into any site, they supply a username ('user01') and password ('password123') into a form then submit. The user has no idea what their hashed password value is that is stored in the ...
1
vote
1answer
460 views

VeraCrypt: Is it possible to change the password after an encrypted container has been created?

I would like to know whether it is possible to change the password after an encrypted container has been created? The password I chose was a bit weak, and I would like to be able to modify it without ...
7
votes
2answers
220 views

Is it easier to crack a ZIP file than a 7z archived file given they have the same password?

I am interested in knowing if either of them is easier to crack than the other because of inherent flaws.
3
votes
1answer
454 views

Using MySQL 'encrypt' / crypt() to store passwords?

I've been tasked with deploying a FTP instance with a MySQL backend for storing user logins. Looking online I found Pure-FTPD, which on paper is great. However documentation states it only allows ...
7
votes
2answers
233 views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of ...
3
votes
2answers
75 views

Would using a password already hashed+salted be secure?

Some basic principles of password security: Hash it and use a salt The people storing the password should never be able to see what the password is, just the hash This hash should be difficult to ...
1
vote
1answer
39 views

If You Use Secure Sites with Extended Validation Certificates How Much Do You Still Have To Worry About Phishing Sites Impersonating Them?

Was mulling over the issue of protecting users from password-stealing phishing sites when an interesting question that hadn't occurred to me before popped into my head: Let's say that I decide to ...
1
vote
2answers
93 views

What would typically be considered an acceptable string entropy for passwords?

I have gained interest in creating a way to check password strength (think password strength meters - yes - another one). I've found many ways to award a score on a policy driven approach (one ...
-1
votes
1answer
123 views

Can I encrypt Windows' SAM file?

i recently learned that the SAM file in Windows is easily crackable, and even if an attacker couldn't find my password, there are tools that allow password removal, account elevation and even account ...
1
vote
1answer
222 views

custom input format for hashcat

I am doing a password strength audit (I have permission). I'm using Hashcat. It supports formats like sha-256(password.salt) and sha-256(salt.password) but my hashes are generated by ...
42
votes
4answers
3k views

Is using bcrypt on existing SHA1 hashes good enough when switching password implementation?

I'm working on improving a CMS where the current implementation of storing password is just sha1(password). I explained to my boss that doing it that way is incredibly insecure, and told him that we ...
1
vote
0answers
144 views

Google account's password exposed after authorizing web apps to the account

Yesterday I registered accounts on some online storage websites. On that same day's afternoon, Google notified me about someone had has logged in using my Google account in US (clearly that's not ...
5
votes
2answers
288 views

Keeping passwords out of source code

Secrets should not be in source code and in version control because of two reasons: External threat: An attacker can exploit a vulnerability to get access to files/source of your ...
2
votes
1answer
78 views

LastPass Key Derivation Security Question

I have done some research about password managers and of course stumbled upon LastPass. There are plenty of questions and answers about the security of LastPass, but as far as I am aware none of them ...
6
votes
1answer
160 views

Are there any reliable estimates of the password cracking abilities of nation states?

For the purposes of evaluating a hashing algorithm against the threat of a nation state adversary, are there accepted estimates of the password cracking abilities of nation states - or is there an ...
4
votes
1answer
72 views

Resetting the admin password for an application

We have a enterprise application dealing with data. We have one super user (admin) that has the highest level of privileges. The application is not opensource. If some customer has forgotten the ...
7
votes
1answer
696 views

Password manager in not own device

I believe that password managers have a lot of advantages rather than remembering the passwords. So: its time to use them! But I don't want to lose the capability of using my passwords in devices I ...
3
votes
4answers
164 views

Password Policy: Issue random generated passwords / Let the user choose a password

I'm currently thinking about a new password policy. Originally I wanted the users to choose a password that is X digits long, contains numbers, special chars, lower and upper case,... but then I did ...
2
votes
0answers
74 views

Password cracking based on properties of target

Many people base their passwords on some characteristics or properties of their persona, which might not even be included in wordlists used for a dictionary attack. If one would put research into ...
3
votes
1answer
99 views

Password security and entropy - degeneracy question

I have written a short password generator which uses a mixture of words from a dictionary and randomly generated passwords, and I'm wondering if I did the entropy calculations correctly. Usually I use ...
2
votes
2answers
101 views

Prevent Plain-Text Passwords Output by a Script From Being Accessible in the Future

Let's say I have a Bash script that generates a password, creates a new user with that password, and then tells me what the password is: # Generate a password and set it to $PASSWORD PASSWORD=$(tr ...
1
vote
1answer
141 views

WordPress is asking for my FTP password to update. Is this official behavior or am I compromised?

I'm running a personal WordPress server and I have 3 pending updates: WP update from 4.2.2 to 4.3.1. Akismet plugin update to 3.1.5 which addresses XSS issues. Twenty-fifteen theme update. For ...
7
votes
1answer
2k views

“No password hashes loaded” John does not recognise my hashes

I am trying to learn how john works. I made a password-protected rar archive, and written that password inside a file named pass.txt. I used rar2john to build the hash: # more test.hash ...
3
votes
4answers
349 views

Help generating wordlist using crunch

I need to configure crunch so that it produces a wordlist with the following set of rules: Exactly 10 characters long Contains exactly 4 letters, which have to be a-f (all lowercase) Contains ...
6
votes
1answer
599 views

Gmail lets me use my old password

My university's email works through Gmail and I can log on to it either through my uni's website or in Gmail. I recently changed my password and I use it to log in to the schools secure WiFi, school ...
0
votes
2answers
146 views

How to check an open source product for password handling quality?

I just created an account on Magento Commerce, which is an online shop solution. During account creation, I entered a password. Personally I prefer longer, generated passwords that do not contain ...
3
votes
2answers
179 views

How to give “Forgot password” option for a password encrypted file?

I have created a utility that encrypts a file (.txt, .dox, so on...). The utility asks for a password from user at the time of file encryption. Problem Suppose a user has created 1000 encrypted ...
-2
votes
1answer
63 views

generating “non-dictionary” numeric passcodes [closed]

In case of numeric passcodes, e.g. for numeric locks on doors etc, anyone can agree "poor passwords" are ones with specific pattern, e.g. 1234, 1111, 2468, 1122, etc. (as well as ones that form a ...
1
vote
2answers
634 views

What would be the most efficient way of brute forcing a wifi key [duplicate]

I was wondering how can a brut force of my wifi be prevented so I want to know the best technique that can be used to brute force it first, so protection isn't my question. My question is: What brute ...
3
votes
3answers
258 views

Choosing a good password - again

There are many password-related questions in here, but I failed to find the answer to mine. I'm no expert so maybe I don't have the right keywords. Sorry for any duplicate for a possibly asked 100 ...
1
vote
3answers
404 views

What would be a good set of criteria to consider a password safe? [duplicate]

Nowadays we see many websites with a "security meter" for the password. I actually think this is a great feature since it gives the final user the sense of how insecure their password could be. I ...
2
votes
2answers
78 views

Could PKE be used as a better alternative to SRP for authentication?

If I understood SRP correctly, its weakpoint is during the registration of a user when sending the verifier to the server. Let's say the Server knows the PubKey(User) of the User and the User knows ...
2
votes
1answer
152 views

What is the entropy of a password made with pwgen?

pwgen is a unix utility that generates "memorable" passwords randomly. The man page says the entropy is lower than truly random passwords with the same specification. What is the actual entropy of a ...
1
vote
1answer
281 views

Teamviewer and remote logins

Not sure if this has been asked before (a cursory search doesn't show anything), so I figure here is a sensible place to ask. Say I am remotely controlling my desktop at home via Teamviewer. Now ...
2
votes
1answer
559 views

Can I know somehow if my password hash is known?

Is there a secure way to know if my password's hash is publicly known on the internet? First I tried to search for it in Hashes.org (http://hashes.org/search.php), but then I suspected, that if it ...