Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

18
votes
6answers
4k views

How to avoid scripts with hardcoded password? [duplicate]

I have some scripts on Ubuntu Linux machine that logs in to a database server to run some maintenance daily. To login to the database, I need a password and right now it is hard-coded in the script. ...
18
votes
7answers
936 views

Are common passwords at particular risk?

The question Should we disallow common passwords like “password” and “12345”? on User Experience immediately made me think that these common passwords were extremely dangerous not because they are ...
18
votes
3answers
9k views

Password in file .php

My connection.php file stores the credentials to connect to the database. <?php $objConnect = mysql_connect("localhost","username","password"); mysql_select_db("selectDB", $objConnect); ...
18
votes
5answers
1k views

Is there any legal reason to save a cleartext password?

I called customer service of a well known company and discovered that the operator had the ability to view my website password in clear text on her screen. I asked her about this and she defended the ...
18
votes
3answers
5k views

MySQL OLD_PASSWORD cryptanalysis?

The password hash used for MySQL passwords prior to version 4.1 (now called OLD_PASSWORD()) seems like a very simple ad-hoc hash, without salts or iteration counts. See e.g an implementation in ...
18
votes
3answers
4k views

How secure is 7z encryption?

I have a text file in which I store all my bank details. I compress and encrypt it with 7-Zip using the following parameters: Compression parameters: Archive format: 7z Compression level: ...
18
votes
1answer
1k views

Does a maximum length of password mean non-hashed storage?

When a system requires a password between say 6 and 20 characters in length, does it mean the password is stored without using a hashing function, and that the mysql-field (or similar) is 20 ...
18
votes
5answers
685 views

What concrete parameters can I change to make my passphrase-protected private gpg key more secure

There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever. Rather than ...
17
votes
7answers
2k views

Taking password letters not whole one, is this secure? [duplicate]

I found a site which is taking password letters from their users not the whole password. Is this secure? Or do they have saved password as salted hash (MD5)?
17
votes
2answers
7k views

How Does A Random Salt Work? [duplicate]

I don't understand how using a random salt for hashing passwords can work. Perhaps random salt refers to something other than hashing passwords? Here is my thought process: The salt is used to add ...
17
votes
4answers
1k views

How to treat non-optional bad security questions?

Every once in a while I have to set up an account on a site that, while apparently at least not storing my password in plaintext, still force me to choose from a limited set of security questions that ...
17
votes
6answers
2k views

What does “random” mean in the context of password creation?

Disclaimer: as you will see from my question I'm a total outsider in this subject, just very curious. I was wondering how easy it would be to crack a password-protected RAR5 file, and I found many ...
17
votes
4answers
13k views

Is it possible to securely store passwords using reversible encryption?

Everyone says that you need to use a non-reversible hash when you store passwords so that even if your database is leaked, the passwords themselves are still safe. I'm wondering if there is anyway to ...
17
votes
5answers
3k views

Is sending plaintext passwords to a SQL Server database a security risk?

I have a database which has stored procedures which take plaintext passwords. It hashes them and inserts them into the DB. If an attacker has access to the DB connection, it is possible to intercept ...
17
votes
2answers
2k views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
17
votes
2answers
11k views

Facebook API : App Secret - possible misuse

I've recently find out that by simple quick look into compiled code of one of our applications, you can get both App ID (API Key) and App Secret for Facebook API I suppose that we should really keep ...
17
votes
2answers
596 views

Bank accepts different password to the one that I set

I'm not particularly well versed in IT security so please bear with me. I recently discovered that my bank's online system will accept passwords that consist of the correct password, and a string of ...
17
votes
6answers
6k views

Managing website passwords for small team

I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
17
votes
2answers
3k views

How secure is Keychain on OS X?

Keychain is a built-in app on OS X that stores all of the user credentials, and allows for one to keep encrypted notes in an easily accessible way. Does anyone know how secure Keychain is? I know ...
17
votes
2answers
2k views

Essential things to think about before outsourcing authentication with OpenID, OAuth, or SAML

It's clear there there is no consistent set of features among any of the popular authentication providers. Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
16
votes
6answers
5k views

Is my custom password hashing algorithm insecure?

For all of my hobby web projects, I have coded a login system that these projects share. There is no critical data in these projects, the only critical data could be reused passwords. So I try to hash ...
16
votes
3answers
7k views

Is it possible to get the salt if I have the hash and original password?

Is it possible to get the salt if I have the hash and original password? My gut feeling is no, but would it be impossible or will it just take very long?
16
votes
7answers
6k views

My IP address (with a NAS) is targeted by a hacker. What to do? Should I be worried?

I've noticed, based on the logging of my NAS, that my IP address is targeted by a hacker. I already took action by automaticly ban the IP address permanently after five unsuccesful login attemps. ...
16
votes
3answers
784 views

Is it OK to tell your password to an admin? [duplicate]

Possible Duplicate: From a security point : Is it OK to tell your password to an admin? I am working in a small company (20 employees) as a senior SW engineer. After having some email ...
16
votes
5answers
5k views

Is an 80 bit password good enough for all practical purposes?

I know that asking how many bits of entropy comprise a strong password is rather like asking the length of a piece of string. But assuming the NSA is not on to you, and that it is hardly worthwhile ...
16
votes
3answers
17k views

openssl: recover key and IV by passphrase

A large amount of files were encrypted by openssl enc -aes-256-cbc -pass pass:MYPASSWORD Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
16
votes
5answers
70k views

How to generate dictionary for a dictionary attack?

I need to crack my own password. Advantage is that I know possible characters and maximum length. What I need is to create a dictionary. The dictionary should contain all the combos of characters ...
16
votes
11answers
5k views

Best practice for password distribution

I am about to set up a new account on my Linux server for a user that lives in another state in the U.S. I can't think of a good way to get them this user their password. There must be a standard ...
16
votes
5answers
3k views

The AES Crypt implementation hashes a password 8192 times to generate the key. Is this necessary?

I'm considering encrypting some small files (hundreds of kb apiece) using the AES Crypt reference implementation. Looking at the source, it seems that the encryption key is derived from the IV and the ...
16
votes
3answers
7k views

Is a HMAC-ed password is more secure than a bcrypt-ed or scrypt-ed password?

Given an option , which one should I choose , a HMAC for storing a password securely or a bcrypt or scrypt library?
16
votes
3answers
1k views

Storing passwords in reversible form - a genuine use-case

What's wrong with you, you crazy fool, you're not supposed to be able to retrieve a password in plain text! I know. Hear me out. Assume I've got a service that's similar to Mint.com. For those that ...
16
votes
7answers
2k views

How different should my passwords be? [duplicate]

Suppose I use remember one long high entropy master password, and use variations of it for each of my passwords. Eg if I remember tSaF4nWeACVkUU4 as a master password and use tSaF4nWeACVkUU4t (with a ...
16
votes
4answers
1k views

Does two-factor authentication reduce the need for a long password?

I've recently enabled 2-factor auth on a number of web apps, mostly using Google Authenticator. Does this mean that the importance of a strong password on each site is reduced? I would prefer to use ...
16
votes
4answers
365 views

Are malicious relying parties able to abuse OpenID logins?

if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me? Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
16
votes
2answers
4k views

What's wrong with storing private keys in the cloud?

I know this sounds like a dumb question, but whats wrong with it? Assuming that all private data is encrypted (by the client) using PBE AES256, then is this scheme more vulerable than storing keys on ...
16
votes
4answers
1k views

How are browser saved passwords vulnerable?

Most browsers offer to save the password after entering it on many logon pages. What types of vulnerabilities are there for such saved passwords. I'm interested in what ways malware on web pages ...
16
votes
4answers
8k views

SSH key auth, but still need password for sudo?

SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive ...
15
votes
7answers
855 views

To salt, or not to salt? [duplicate]

Possible Duplicate: Why is using salt more secure? Why would salt not have prevented LinkedIn passwords from getting cracked? Recently I decided that I wanted to learn more about web ...
15
votes
11answers
3k views

Should I know my users passwords so I can check they can logon? [duplicate]

I have an issue with support for a system and I don't know what approach to take. It boils down to the question: Should I know my users passwords so that I can check with certainty that a ...
15
votes
8answers
3k views

What chars should I not allow in passwords?

I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
15
votes
3answers
3k views

Is it a bad idea to add random characters to user ID and password?

I've heard people say again and again that you shouldn't implement your own security algorithm, and I'd like to ask you if I'm breaking this rule. I'm creating a traditional client-server application ...
15
votes
5answers
1k views

Is it legal to log passwords from failed logins?

Is it legal to store/log mistyped passwords? How many of you have seen this happen in a log file or DB?
15
votes
2answers
2k views

Password and Generated number - How does it work?

In my company, they don't allow accessing the company email or servers from outside the company network. To access the email from outside the network, you have to use: Username, password and a number ...
15
votes
7answers
3k views

Password management/synchronization?

Is there a good enough service I could run on my own home (Linux) server that I could use for storing/accessing/synchronizing passwords so they could be available for me from multiple ...
15
votes
6answers
4k views

Do salts have to be random, or just unique and unknown?

First of all, my motive is to avoid storing the salt in the database as plain text. As far as this question is concerned, the salt is not stored in the database. After discussion in comments and in ...
15
votes
7answers
372 views

Is a “security measure” that doesn't provide a security benefit actually harmful?

If a security measure is implemented that doesn't provide any additional security benefit, can it be considered harmful? As an example, consider a login page where the user is asked to enter their ...
15
votes
3answers
953 views

What can I do if my bank thinks my date of birth is “known only to me”?

My bank has recently replaced passwords with occasionally asking me information that is "known only to me". Such information includes my date of birth, postcode, and my mother’s maiden name. ...
15
votes
3answers
11k views

Is HTTPS and Basic Authentication secure enough for banking webservices (RESTful)?

I have been reading about SSL/TLS for the last few days and looks like it has never been practically cracked. Given SSL/TLS is used for all communications between client application and the server, ...
15
votes
6answers
44k views

Recommend Length for Wi-FI PSK?

I currently have a network set up with WPA2 and AES encryption, the password is 8 characters long but was randomly generated and contains no dictionary words. However I'm concerned about the ...
15
votes
2answers
1k views

How does varying character type increase strength of password?

When creating a new password, people often recommend you use both uppercase and lowercase characters, numbers, and symbols. How does adding any of these increase the strength of a password? There ...