Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
6
votes
3answers
207 views
How much added security do I really get with a longer key size?
Imagine I have a cipher which supports keys of 128, 192 or 256 bits. Suppose that there are no vulnerabilities in the cipher regardless of key length. I'm going to use it to encrypt something, and ...
6
votes
2answers
1k views
Dictionary Attack on Wifi
I know a few people with pretty weak passwords. What kind of systems exist to prevent dictionary attacks? Would it make sense to restrict the number of connection attempts in a certain timeframe?
...
6
votes
2answers
469 views
Is it better to hash n*x times in sha1 or n times in sha512 on the client side?
I already know I"m going to hash the user's password n times in either sha512 or n*x in sha1 before it is sent to the server. Once at the server, I'm going to use bcrypt set to use ~1/100th of a ...
6
votes
3answers
229 views
Increase the security of an already stored password hash
Right now we're using 1024 byte PBKDF2 with 256 byte user-specific salt and variable iterations. However, I would much prefer to be able to, perhaps once every year or two, to be able to flat out ...
6
votes
2answers
222 views
How to proceed if a new hash algorithm for passwords is introduced?
I have an e-mail address at a certain institution. A few days ago they sent me an e-mail (in German), which I'd like to paraphrase without revealing the institution:
Dear Madams and Sirs,
a ...
6
votes
3answers
194 views
What is the value in asking for a second password for sensitive operations?
When a user has logged in to a system using their primary password, is there any value in asking for a distinct second password when performing sensitive functions?
Does it provide any benefit over ...
6
votes
2answers
1k views
How big salt should be?
I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2).
Having that in mind, how big salt should I use?
Should it be ...
6
votes
3answers
160 views
Is there any conceivable reason to prevent a password change in an authentication system?
I connect to the VPN of another company with a company-specific username and password (they aren't giving everyone the same password to every company to access it or anything ridiculous like that.) ...
6
votes
5answers
791 views
Storing password hashes without a correlation to the user account
I read an interesting article about an alternative way to store password hashes ans was rather intrigued.
A better way to store password hashes?
The primary concept is having a large table full of ...
6
votes
4answers
930 views
Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security?
6
votes
2answers
1k views
Is LastPass' locally stored One-Time-Password recovery a security problem?
If you forget your LastPass master password then LastPass provides the possibility to recover access to your vault using a One-Time-Password (OTP) which is stored locally but is initially disabled.
...
6
votes
1answer
673 views
How will security need to be changed if P=NP?
If we suppose that it is found that P=NP, how will security measures need to be changed?
I'd like to know the major security measures that are affected, and how they would need to be changed. We can ...
6
votes
2answers
246 views
Should an admin user be able to edit passwords?
For your typical web app, should an admin superuser have the right to edit a user's password, or should only that user have the right? (Even with edit ability, the admin would never see the current ...
6
votes
3answers
199 views
Are there password/passphrase guessers/crackers which can utilize facts supplied about the target?
I was just reading a discussion about cracking passwords that said the person running the tool might know things about the target like the birthday of his first girlfriend's dog but the tool won't.
...
6
votes
3answers
614 views
Using Secure Remote Password without sending the username in the clear
To initiate a key exchange using the SRP protocol the client sends the username so the server can look up the salt and password verifier. Is there a simple way to change this so that an evesdropper ...
6
votes
3answers
251 views
Is it secure to use bcrypt-generated salt in cookie to serve as token in place of a password?
I have a (hobby) web site that runs only on SSL. The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to secure it as much as ...
6
votes
2answers
238 views
Is it proper to be prompted that I entered an old password
I changed my Facebook password a few days ago. Today, I entered the old password chronically, and saw the prompt:
Sorry! You Entered An Old Password
And even shows the date&time when I ...
6
votes
2answers
707 views
With PBKDF2, what is an optimal Hash size in bytes? What about the size of the salt?
When creating a hash with PBKDF2, it allows the developer to choose the size of the hash. Is longer always better? Also, what about the size of the random salt? Should that be the same size as the ...
6
votes
2answers
397 views
HMAC Based Request Signing - Storing the Salt
I'm working on a (non high security) project that currently isn't live but might go live at some point.
We have a REST API (implemented using Restlet and Neo4j) running on a server and an Android ...
6
votes
2answers
608 views
Stretching a hash, many iterations versus longer input string
I have been reading up on various password hashing schemes, for example the SHA-based Crypt proposed by Ulrich Drepper and used in some Linux versions.
A recurring theme here is to 'strengthen' or ...
6
votes
3answers
2k views
Why is Chrome asking for the application-specific password and my account's password every time?
I enabled Google's two-factor authentication and found it ironic that Google Chrome Sync requires #1 You account password, and #2 an application-specific password. First of all, don't applications ...
6
votes
3answers
316 views
Is it advisable to have a web browser remember login credentials?
I have a really long random password for my cellphone account and have it written down in a safe place. I only use it once a month and am considering having my browser remember it. Would there be any ...
6
votes
3answers
275 views
An alternative to traditional passwords: is there some merit to this idea?
If you've got a website aimed at people that are not neccessarily technically proficient, letting new users choose their own password isn't very secure because of the simple fact that a lot of people ...
6
votes
4answers
235 views
Is there any added security benefit to username complexity requirements?
I've come across several sites lately that have complexity requirements for usernames like "must be 8 characters long and contain at least 2 numbers". Is there any real added benefit to this from a ...
6
votes
2answers
349 views
Implementing Secure Remote Password: Constructing the verifier
The SRP protocol as described in RFC 2945 generates the password verifier:
x = SHA(<salt> | SHA(<username> | ":" | <raw password>))`
v = g^x % N
I have three questions: why use ...
6
votes
1answer
228 views
Reversible password storage obfuscation method for third-party login credentials
I have an internal business application, that as part of its functionality connects to a third-party app using login credentials specific to the user of my own app. These passwords are stored in a ...
6
votes
3answers
301 views
Is it OK to use the same password for a Linux login and the SSH private key?
I want to remotely log in to my Linux server with SSH. Public/private key authentication is more secure than password authentication, so I have disabled password-based authentication for SSH on my ...
6
votes
2answers
182 views
When, exactly, should old password reset tokens be deleted?
I'm trying to figure out best practices for working with password reset tokens.
Say a user initiates the password reset process and the are emailed the reset token and we store a hashed copy in the ...
6
votes
1answer
379 views
Store user passwords in NoSQL database?
I am currently coding the backend of a website and I have not come across an article where this is discussed. I want to store all my application data in MongoDB but I'd like to split out my sensitive ...
6
votes
4answers
1k views
Web browser password management security [duplicate]
Possible Duplicate:
How are browser saved passwords vulnerable?
How secure are the password managers that are built into modern web browsers?
Currently I use lastpass plugin as I believed ...
6
votes
2answers
531 views
Can a Firefox add-on or plug-in access the user's websites' saved passwords in decrypted mode?
Going deeper into the previous question on Firefox plugins and add-ons malaware risks: Could they potentially decode and capture the encrypted websites passwords saved in the browser?
6
votes
2answers
361 views
Production ready bcrypt implementation for .NET
Which, if any, .NET / C# bcrypt implementations are considered suitable for production environments?
I have seen CryptSharp and BCrypt.Net mentioned in answers to other questions but without any ...
5
votes
4answers
507 views
Password hashes should run md5 thousands of time: really?
I skimmed through How Companies Can Beef Up Password Security and I thought that several assertions were completely wrong, in particular:
Cryptographic hash (like md5) with salt are bad.
It isn't ...
5
votes
4answers
383 views
Doesn't imposing a minimum password length make the password weaker by reducing the number of possible combinations?
I thought the strength of a password depended on the total number of possible combinations. Therefore, allowing longer passwords should be safer because you then have more possibilities. But why do ...
5
votes
7answers
466 views
How easy is it to find a password in a huge text file?
Say that my password is PASSWORD1 I have a 10MB jumbled text file. I hide my password in two parts in the text, between > and < so I can find it myself. Then I put the 2 parts together and add the ...
5
votes
6answers
354 views
What is the use of password encryption?
Why do we encrypt passwords? Is it to protect the password from eavesdropping? to protect the password after saving it in database? both? or for some other reason?
5
votes
8answers
671 views
Does truncating the cryptographic hash make it impossible to crack?
I store password hashes in their full value for example, $h = sha256('foo') outputs 64 characters: 2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae
I store that directly in the ...
5
votes
5answers
1k views
What password cracking software is commonly used?
I am curious to know how secure my passwords are.
What password cracking software is commonly used?
Preferably open source.
EDIT: I am actually looking to crack my passwords used on services I ...
5
votes
4answers
304 views
Why using random salts?
I read this blogpost on how to store passwords in a database, the secure way. Elbert tells us to do this:
Generate a random salt and include something random and the username in it. Hash this.
Hash ...
5
votes
3answers
243 views
How can Microsoft validate a shorter password on Microsoft accounts (MSDN)?
I recently ran across this when logging into MSDN. (I saw this screen after typing my initial credentials.)
I have a 20+ digit password, however there's apparently a new requirement for Microsoft ...
5
votes
4answers
3k views
Brute force vs other methods of recovering passwords from shadow file
Do you know any good approach for de-hashing/actually bruteforcing hashed passwords in the shadow file?
On various operating systems, any good solutions/methods/programs.
Or is it better to upload ...
5
votes
3answers
248 views
Mutual authentication for humans
Is there any way for two people to securely authenticate each other without access to any special software (like PGP)? For example, when speaking over the phone or by sending SMSes to each other or ...
5
votes
6answers
598 views
Does having a minimum number of digits improve password security?
Some password systems will enforce at least X of a type of character - a common one I see is 'minimum 3 numeric characters'. As far as I understand, simply allowing certain character classes, like ...
5
votes
3answers
163 views
Should we be checking password restraints on log in forms?
We have many restraints we put on users when they set up their password. These restraints include password length, characters they can or cannot use, the use of numbers and letters, capitalization ...
5
votes
2answers
333 views
Requiring regular password change but storing previous paswords?
My bank requires me to change my password regularly but then they can detect if my password was used before. They probably store the old password (possibly hashed) in order to detect it. I think this ...
5
votes
3answers
2k views
Regulations that specify password length?
I have read:
PCI DSS 1.2
SOX 404
AR 25-2
ISO 27001
But only PCI DSS specifies a minimum password length.
Are there any other regulations that dictate password lengths for any industry?
NIST ...
5
votes
2answers
1k views
What algorithms are best be cracked by GPU?
What algorithms are best being attacked by a GPU powered password cracker?
For example, I heard that md5crypt that is being used in unix shadow file, is not the best choice for GPU cracking because it ...
5
votes
4answers
2k views
How to implement a “Remember me” on a mobile app?
I would like to implement a "Remember Me" time-limited auto-login type feature on a mobile application (on Android). To start the app, the user must type in a username and password. For convenience,
...
5
votes
3answers
2k views
With ASIC bitcoin miners, should SHA256 be considered insecure for password hashing?
I'm sure everyone here has seen the rise and further rise of bitcoin. The process used for mining bitcoin is basically "let's brute force an SHA256 hash that is less than this amount"
That being ...
5
votes
3answers
315 views
I don't see how “-salt” in the openssl command line tool enhances security at all
I do this to encrypt a single file:
openssl aes-256-cbc -a -salt -in file.txt -out file.enc
and then type in some regular plaintext password.
I do not understand how -salt enhances the security of ...
