Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

6
votes
2answers
1k views

Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?

SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet. I've read the information at it's Stanford University home page, the Wiki ...
5
votes
3answers
2k views

Can password-protected zip files be broken without brute force?

You have a zip file that you created with 7z to password-protect it with AES 128. Can a smart adversary extract the data only through brute force, or is the file vulnerable to other attacks - such as, ...
5
votes
8answers
2k views

Retrieving OSx Keychain passwords

I have a computer forensics style osx login.keychain file that I am trying to find the passwords from. I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...
4
votes
3answers
623 views

symetric key encryption vs hashing

This is a fascinating document: top 100 passwords from adobe breach I have a question about one part of it: However, thanks to Adobe choosing symmetric key encryption over hashing, selecting ...
1
vote
2answers
173 views

In what sense is Knock to Unlock safer than a password?

I've recently seen a youtube video, which is advertising an iphone app which will unlock your mac computer by knocking on your iphone. The ad is claiming that it is faster and safer than typing your ...
3
votes
2answers
61 views

Is honeywords different from k-anonymity?

Ari Juels and Ron Rivest propose a technqiue to strengthen password files called honeywords . Basically for each valid password they insert fake passwords (honeywords) and if somebody tries to ...
0
votes
0answers
38 views

Is using SHA2 to generate passwords good idea? [duplicate]

I am currently planning a service for users (mostly me and family) to store encrypted information on my server from a web interface without making this information easily available for anybody who ...
5
votes
2answers
261 views

Can I trust large companies like Google not to store failed password attempts?

Let's say, for example, that I accidentally entered my Microsoft account password instead of my Google account password when logging in to some Google web service. After getting an error message, I ...
0
votes
2answers
140 views

Why do some websites increase the number of characters in the password field when logging in?

Why do some websites (especially banking sites) display more characters in the password field than were actually typed? This is sometimes apparent just after clicking the login button.
14
votes
4answers
1k views

Looking for example of well-known app using unsalted hashes

Does anyone know of a well-known application that still uses unsalted hashes for password storage? I'm looking for an example for an upcoming lecture on Rainbow Tables, and I think it would add ...
2
votes
2answers
3k views

Is it safe to store password in PHP session?

I need to do some encryptions in the private zone of my website and I want to bcrypt the user's password. Is it safe to store the password in the session when user does the login, so that I can use ...
1
vote
1answer
92 views

Error using ncrack

I am trying to run a ncrack command of the following format: ncrack -P filePath1 filePath2 --user user1, user2, user3 ipAddress:port and I get the following error; Does anybody know why I'm ...
4
votes
2answers
182 views

Does the password you use to sign into a VPN determine the strength?

I subscribed to a VPN service and need to change the password. Does the password I use to log in determine the strength? For example should it be 64 characters long or can it be 10? I'm thinking of ...
7
votes
3answers
1k views

Is HTTPS and Basic Authentication secure enough for banking webservices (RESTful)?

I have been reading about SSL/TLS for the last few days and looks like it has never been practically cracked. Given SSL/TLS is used for all communications between client application and the server, ...
3
votes
4answers
342 views

How to tell if a site is securely storing passwords? [closed]

A site I frequent has a policy to make you change your password every 90 days. That's a cool policy, but I stumbled upon an old xkcd and facepalmed myself, because lots of doxing happens on this site. ...
8
votes
3answers
2k views

What are the risks of storing passwords in a GPG encrypted file?

I currently store my passwords in a text file encrypted using GPG -e (specifying my own public key). When I want to lookup a password I'll do something like gpg -d passwords.gpg | grep ...
4
votes
1answer
423 views

How is the iCloud keychain protected from unauthorized access?

With OS X Mavericks and iOS 7.0.3, Apple has introduced a new feature called iCloud keychain. During setup, you can choose an iCloud Security Code. This code is used when you want to grant access to ...
7
votes
2answers
522 views

Are the SS64.com password generators a good approach?

There are two password generators on ss64.com: The standard one The strong one How they work I made standalone versions of them, plus copy of the original HTML/Javascript versions, if you want to ...
1
vote
4answers
5k views

Recover Windows Server 2003 admin password through restricted user

OK, so here goes after a lot of trial and error: background: My client recently took over another firm. However, apparently the administrator passwords to the server (along with some other non-IT ...
4
votes
1answer
2k views

Vulnerability of Chrome's “Login Data” file after being orphaned from the host system

Suppose someone were to knick a "Login Data" file from a Windows computer's Google Chrome profile. They don't know the machine's user account password, but they may have some ideas as to what it ...
3
votes
1answer
178 views

How Secure Rooted or Jailbroken Devices are?

I am just wondering, but how can I harden the security of jailbroken or rooted devices? I understand that SD Card can be still accessible, but how could potential adversaries compromise for example ...
1
vote
3answers
209 views

How safe is it to provide my administrator account password for a 3rd party software: EasyUS Todo Backup?

I've been recently searching for a backup solution for my Windows desktop. That's when I came across this free software called EasyUS Todo Backup. (I know it's a mouthful but English doesn't seem to ...
3
votes
3answers
422 views

Tokenless REST API security concerns

I'm designing an API in PHP/MySQL that, by its design, will not store a user's password in the database and thus does not generate authorization tokens for the client to hold. The reason for this is ...
15
votes
4answers
5k views

Google Account: implications of using application-specific passwords

In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google ...
4
votes
1answer
156 views

Would re-salting passwords regularly in-/decrease security?

What are the (dis)advantages of re-salting a user's password regularly, e.g. weekly (or at their next login once week since the last re-salting)? The basic idea would be that users who regularly log ...
10
votes
5answers
748 views

Altering passwords before storing

Assume that I'm using bcrypt with a unique salt (or some other best practice) to hash user passwords before storing them in my database. Is there any security advantage to be gained by ...
6
votes
3answers
486 views

Security of the KWallet password encrypting application?

According to http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis/ , the KWallet password management system is quite weak, it uses key splitting, Blowfish 56, and no salt. The key ...
6
votes
7answers
728 views

How can I prevent users from using bad passwords in my web application?

There is a long discussion on whether it's the responsibility of the user or the system administrator to deal with the strength of the password. Obviously, the password is a very private thing, but ...
3
votes
1answer
140 views

S/Key as an alternative to UNIX passwords

There is this password system called S/Key I saw on the Internet. Can someone give me a brief description about S/Key and how it works? Can S/Key be an alternative solution to the UNIX password ...
4
votes
5answers
554 views

Alternatives to sending out passwords in plain text via e-mail?

One of my hosting providers is sending a new password in plain text per e-mail, on request. How insecure is this practice? What would be a good (more secure) alternative to this?
-1
votes
2answers
128 views

What is the safest way that you could hash/encrypt a password? [duplicate]

What is the safest way that I could could hash/encrypt a password for my website?
0
votes
1answer
351 views

Is this password hashing + salt method the most secure way possible? [duplicate]

I am just wondering what all the security experts think of my method for password hashing. I want to come up with a method I can use for all my future web development projects. First I create a ...
4
votes
3answers
432 views

Forgot Password? - sends email with plaintext password

A "reputable" education company that my university utilizes for it's Physics course online materials sent my plaintext password in an email after using the Forgot Password? tool. I know that this is ...
3
votes
2answers
269 views

comparing password hashing algorithms - PoC ideas?

OK so I just started working for a security consulting firm and we recommend SHA 256 (with salt) for password hashing because MD5 is too weak. I have read some brilliant answers (the list is too ...
28
votes
9answers
9k views

Are password-protected ZIP files secure?

Following my answer. If I can list contents of password-protected ZIP file, check the file types of each stored file and even replace it with another one, without actually knowing the password, then ...
10
votes
6answers
4k views

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
9
votes
4answers
483 views

How can I be secure with a global salt?

If I understood the basic of password hashing and storing, what we need are: a "strong" salt a "real" random salt a unique salt per password a password hashing function with a high CPU cost We ...
1
vote
3answers
294 views

Is Password Complexity required at all

For a web-site I'm using what I hope is the most secure password storage scheme I can find, which boils down to having a salt and hashed password stored in a database of contacts:- Byte[] ...
7
votes
4answers
3k views

HTTP Basic auth password storage more secure than Digest auth

If you are using SSL already, it appears Basic auth is the way to go since you can perform bcrypt with the password when you store it in the database, where as Digest auth only allows md5. As we know, ...
5
votes
1answer
437 views

What techniques do web services use to identify password theft?

I've noticed that some web services use a security scheme in which log-in attempts that have some unusual characteristics trigger extra authentication steps. For example when I try to login to my ...
0
votes
2answers
283 views

Authenticating users to Web Apps without sending password — can anyone suggest improvements?

I have been interested in implementing authentication method for a web app that is run in modern browsers, without having to send the password over the wire. Can anyone suggest improvements or even ...
-5
votes
2answers
2k views

I know the WPA-PSK secured wifi password, If I use the wifi, will I be caught? [closed]

I hacked the WPA-PSK secured wifi password from one of the wifi network. If they track their DHCP Client IP, will I be caught? If yes, how? By my computer name or IP address or MAC Address?
13
votes
2answers
2k views

What are the most common password salting methods?

I learned that the Sun guys used the login name as salt for password hashing. Is this a common approach? What are the most common salt values?
9
votes
1answer
302 views

Optimal variable sizes in the Secure Remote Password protocol

I am implementing the Secure Remote Password protocol: U = <username> --> <-- s = <salt from passwd file> a = random() A = g^a ...
6
votes
2answers
496 views

Implementing Secure Remote Password: Constructing the verifier

The SRP protocol as described in RFC 2945 generates the password verifier: x = SHA(<salt> | SHA(<username> | ":" | <raw password>))` v = g^x % N I have three questions: why use ...
15
votes
2answers
3k views

Why is it always `HASH( salt + password )` that we recommend?

Browsing over this site, many forums, online articles, there's always one specific way we're suggesting to store a password hash: function (salt, pass) { return ( StrongHash(salt + pass) ) } But ...
6
votes
3answers
868 views

Using Secure Remote Password without sending the username in the clear

To initiate a key exchange using the SRP protocol the client sends the username so the server can look up the salt and password verifier. Is there a simple way to change this so that an evesdropper ...
5
votes
1answer
210 views

Using Secure Remote Password without embedding the modulus

The SRP protocol as described by the author assumes that the large safe prime modulus and generator are embedded into the client and server rather than being transmitted as part of the protocol. ...
8
votes
5answers
378 views

Oldest security feature still in active use

Beyond commonsense and physical access controls, is the system password the oldest still in active use security feature? By physical access, I mean for example leaving the system within a secure ...
8
votes
3answers
369 views

has scrypt withstood the test of time?

I've always heard that scrypt was better than bcrpyt... because of memory causing GPU a very difficult time to crack. However, the notion always was that scrypt hadn't been tested, it was kind of a ...