Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

4
votes
1answer
77 views

Observable password inputs

An obvious problem with passwords is that if an observer sees a user enter it, then the user has lost the password secrecy. Some systems try to defend against this with dark screens or with shields ...
2
votes
3answers
472 views

Nmap http-brute - Supplying arguments for bruting via GET

I'm attempting to brute a site in my test lab with Nmap's http-brute nse, which has the URL structure https://192.168.101.6/api/auth?email=a@b.com&password=pass Unfortunately Nmap's official ...
0
votes
1answer
75 views

Can anyone help me build a combo file suitable for my problem? [closed]

I have a router model C1000A company: CenturyLink Actiontec I bought it through eBay, my problem is that I can not connect to the Settings page because I do not have the admin password (the password ...
24
votes
5answers
3k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
8
votes
2answers
2k views

Does bcrypt compare the hashes in “length-constant” time?

I saw this function slowEquals() while reading Salted Password Hashing - Doing it Right, which uses a byte-level xor comparison to avoid timing attacks. I was wondering whether this is what Bcrypt ...
2
votes
2answers
459 views

What are my options for securely printing an OTP Scratchcard?

I want to print and distribute several One Time Passwords (OTPs) that can't be easily disclosed to a 3rd party in transit. (think the physical version of a TLS session for private secrets) To me ...
1
vote
2answers
128 views

What is the real advantage of using a “more secure” algorithm like bcrypt for password hashing?

I read this article about password hashing using bcrypt as the recommended method. The advice is similar to what they're saying on hacker news about not using something like SHA2+salt. There are other ...
12
votes
4answers
2k views

Why use random salts?

I read this blogpost on how to store passwords in a database, the secure way. Elbert tells us to do this: Generate a random salt and include something random and the username in it. Hash this. Hash ...
0
votes
1answer
83 views

How to manage all the unlock codes for thousands of mobile devices (iPads)?

I need to manage (assign, store, notify, etc.) the unlock code for thousands of mobile devices (iPads). How to manage optimally this unlock code? Maintenance users should be able to access the unlock ...
85
votes
16answers
13k views

How to tell users that they shouldn't disclose their password over the phone to our help desk?

I work for a help desk, and we recently launched an online service where our members can log in. A problem we are having is that users who are calling us often ask us to confirm that the password ...
4
votes
4answers
779 views

Password hashing on frontend or backend? [duplicate]

I have a Java Server with Spring Boot and a JS Frontend in AngularJS. My teacher told me to use HTTPS for passwords, because I cannot hash them securely enough, that nobody can hack them. With ...
2
votes
2answers
237 views

Is this password inside a file secure? A security paradox

Preamble: I have been a long time lurker but first time poster to the Information Security site, so please be gentle with me. The Situation: I ran into a situation where I needed to securely store a ...
4
votes
3answers
160 views

Can a password be the same as its hash?

So me and my friend were pondering why passwords have a max length (and found the answer here) and I had an odd thought.. could a password be the same as its hash? I realize that salted hashes are ...
13
votes
4answers
2k views

How does correct grammar affect password security?

When using the XKCD password methodology, entropy is calculated solely on the basis of individual words, assuming that the individual words are independent. This is, of course, not necessarily a valid ...
16
votes
5answers
70k views

How to generate dictionary for a dictionary attack?

I need to crack my own password. Advantage is that I know possible characters and maximum length. What I need is to create a dictionary. The dictionary should contain all the combos of characters ...
0
votes
0answers
17 views

Receiving third-party credentials on AWS

In my previous question, I was trying to figure out how to store third-party passwords safely. Now it seems that they'll be sent to my AWS instance from another AWS instance. I imagine the transfer ...
4
votes
4answers
1k views

Laptop was stolen, they tried to log into my facebook from their location on my laptop

Can I get some advice on what I should do next? Laptop was stolen yesterday and they tried to log in my facebook today like 20 minutes ago.
3
votes
2answers
65 views

Is there any practical weakness to using MT19937 to generate passphrases?

Suppose I use MT19937 to choose random words out of (say) the Diceware word list. I know MT19937 is not considered a cryptographically secure PRNG, but Wikipedia suggests the weakness is rather ...
22
votes
3answers
2k views

How can we accurately measure a password entropy range?

I've given myself the task of writing code that determines the strength of a password, and really want to break out of a lot of already established ways we do that, as they're often lacking, not ...
3
votes
2answers
180 views

Is there known statistics of passwords used during brute force password attacks?

I have been reading quite a bit about brute force attacks and I am wondering whether the passwords that are used in such attacks should be kept around so as to later prevent my users from having those ...
9
votes
7answers
2k views

How to securely counter users from adding a single digit to their old password upon creating a new one? [duplicate]

Let's say that in the password policy the password history is defined to remember the last 10 passwords. I understand password history exists so that if a password is recovered from a compromised ...
28
votes
2answers
3k views

Is it possible for my password to have more than one password combination?

Can my password have more than one password combination? I read up on physical combination locks (the lock you open with numbers) and I learned that a combination lock can have about 40 or more ...
1
vote
1answer
248 views

Windows passwords: Blank/non-blank, admin/non-admin

What are the security concerns of the following user account setups on a normal Windows 7/8/10 desktop machine compared to: Using a non-privileged account with a password and having an admin account ...
2
votes
3answers
408 views

Why PHP password_hash does use blowfish intstead threefish?

I was wondering why PHP's hash_password function use blowfish instead of threefish. According to Bruce Schneider blowfish is outdated and He is recommending twofish or threefish. Is blowfish enough ...
5
votes
1answer
117 views

How to implement a password change policy when user's centralized password is in a lot of places?

I would like to implement password changing in an organization but they have the domain controller/LDAP passwords "all over the place". They have the passwords in a lot of places, for example, in ...
1
vote
1answer
49 views

Is Windows 10 [Password protection on wakeup] set to 'Required' relevant when machine is asleep?

I like to just hit the spacebar and have the machine ready without the extra fuss (many times a day.) No one untrusted has physical access to the machine, but it wakes up at ~3am and does updates and ...
-2
votes
1answer
65 views

How can you set a wireless router password that nobody (including yourself) knows? [closed]

Consider the following hypothetical situation: On a Macbook, A hacker can view the screen of your machine (and may have a keylogger installed). It is impossible to remove them even by reinstalling ...
10
votes
1answer
670 views

Is disabling sudo password prompt a security risk?

I was reading the this question over on Ask Ubuntu and they suggest adding the following line to etc/sudoers so that you're not prompted to enter your password each time you run sudo %admin ...
10
votes
2answers
10k views

How can I find if my password has been posted online?

I have just received this email from AbeBooks.com: Hello AbeBooks Customer, This is an important message from AbeBooks.com. As part of our routine security monitoring, we have learned ...
4
votes
2answers
240 views

Storing server generated passwords

There are some applications that generate passwords for you. Consider a case where you sign in via Facebook, the application (let's call it NEWAPP) verifies your sign in on the server using FB tokens ...
1
vote
1answer
68 views

Storing credentials for desktop app

I have desktop application written in C# with three user roles and some predefined users. It is also possible to create another users or change passwords to predefined users. App has to work offline ...
5
votes
3answers
167 views

How to mitigate heartbleed like attacks prior to zero day

Whenever sensitive data such as a password is used on a server it resides in memory for a short time. Given that security flaws like heartbleed exist which have the ability to 'bleed' memory for their ...
393
votes
5answers
133k views

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
23
votes
4answers
5k views

Why did Richard Stallman recommend not to use passwords for wireless networks? [closed]

In a short interview, Richard Stallman recommends not to put passwords on your wireless network. In the OS Revolution documentary he also mentions how he's disliked passwords ever since his job at MIT ...
1
vote
0answers
34 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
16
votes
7answers
6k views

My IP address (with a NAS) is targeted by a hacker. What to do? Should I be worried?

I've noticed, based on the logging of my NAS, that my IP address is targeted by a hacker. I already took action by automaticly ban the IP address permanently after five unsuccesful login attemps. ...
1
vote
1answer
105 views

Copy-and-pasting plaintext data from encrypted container

Suppose we have sensitive information stored in plaintext within a dm-crypt/VeraCrypt encrypted file and this information is copy-and-pasted by a user into a web browser after decrypting (this could ...
11
votes
2answers
3k views

Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email

Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance MSFT even went to far as create ADMINSDUser rights to put ...
1
vote
1answer
251 views

custom input format for hashcat

I am doing a password strength audit (I have permission). I'm using Hashcat. It supports formats like sha-256(password.salt) and sha-256(salt.password) but my hashes are generated by ...
-2
votes
1answer
69 views

Password complexity policy and practicality [closed]

If you are a user and your company implements a password policy that says your password must have at least 8 characters, at least 1 number, at least one alphabet and at least 1 special character, ...
0
votes
2answers
279 views

Is this hash function safe?

Below is the hash function implementation of the roguewave library. It returns a 32 bit hash. The core operation is A = B ^ ((C << 5) | (C >> 27)). Is this hash safe to use as a password check ...
31
votes
8answers
5k views

Do non-keyboard characters make my password less susceptible to brute forcing?

I can put characters in my password for which there are no keys on a keyboard. On Windows, Alt+#### (with the numpad) inserts the character for whatever code you type in. When I put this in a ...
6
votes
4answers
761 views

Can't brute force password cracking somehow be throttled?

Online articles mention the importance of a strong password and suggest that hacking tools allows bad guys to attempt millions of passwords per second. I am wondering why OSes and websites and such ...
-1
votes
2answers
45 views

What could be a suitable solution to single factor authorization worksheet bank password circulation with no control?

Passwords for various banks are written in an excel sheet and this excel sheet is password protected. However, there is no control on circulation of this sheet, for many banks only single factor ...
5
votes
1answer
197 views

Router sends password plaintext: is this a serious vulnerability?

Today I went to go & reset my router, but forgot the account password for the ISP. On the (extremely) off-chance of the password being present in the 'Password' field, I went to the appropriate ...
38
votes
9answers
27k views

Feeding /dev/random entropy pool?

Which way of additionally feeding /dev/random entropy pool would you suggest for producing random passwords? Or, is there maybe a better way to locally create fully random passwords?
3
votes
1answer
79 views

Security problems with password-less SSH

Is there any downside of configuring password-less SSH authentication? Although it is very handy and secure, if someone gets access to my system with my account and there is password-less ...
3
votes
1answer
635 views

How to read the key3.db file?

The file key3.db contains the key that is used to encrypt the Firefox passwords stored in logins.json file. I don't use master password in Firefox, but according to this article, my passwords are ...
22
votes
1answer
1k views

How does Firefox encrypt passwords without selecting Master Password?

I know that the file logins.json contains all my encrypted passwords in Firefox browser. How does Firefox encrypt these passwords if I don't use the 'Master Password' option? Does this mean key3.db ...
48
votes
5answers
9k views

How can I know that developers will be ethical and not record my password in plaintext

I am not asking why hashing should be done. Instead, I want to know how to prevent that developers record user passwords to hack their user's other accounts, especially their email. Couldn't they ...