Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
17
votes
7answers
2k views
Why don't people hash and salt usernames before storing them
Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext.
What I ...
4
votes
2answers
155 views
How secure are passwords that are set via IRC's /nicksrv?
I just registered a nickname on IRC and had to use a password to register it. Given that I've only used IRC, but never understood the P2P mechanics of it, I'd like to know:
Is the password I ...
1
vote
2answers
357 views
What should I do if I type my password in the address bar, or type password in google search?
When someone accidentally types his or her password in one of the following three locations and presses enter, what should they do?
username text box
address bar
Google search
What do you suggest, ...
2
votes
2answers
3k views
Excel 2007 Encryption Strength
With a strong password of 10+ characters, mixed case, etc... Is the encryption of a Excel 2007 document secure enough to create reasonably strong defense against a brute force attack?
What encryption ...
14
votes
3answers
14k views
How difficult to crack keepass master password?
How easily could someone crack my keepass .kdbx file if that person steals the file but never obtains the Master Password?
Is this a serious threat, or would a brute force attack require massive ...
7
votes
2answers
416 views
HMAC Based Request Signing - Storing the Salt
I'm working on a (non high security) project that currently isn't live but might go live at some point.
We have a REST API (implemented using Restlet and Neo4j) running on a server and an Android ...
37
votes
4answers
12k views
Password Hashing add salt + pepper or is salt enough?
Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding.
...
3
votes
2answers
626 views
Keepass client on Android (reliable one)
I need some advice to choose a Keepass client on Android phone which can synchronize using Dropbox.
As i keep all my passwords in one place, I would like to keep it safe. Is KeepassDroid client safe ...
6
votes
7answers
634 views
How can I prevent users from entering bad passwords in my web application?
There is a long discussion on whether it's the responsibility of the user or the system administrator to deal with the strength of the password. Obviously, the password is a very private thing, but ...
3
votes
3answers
147 views
What security factors should I take into consideration when selecting a bank?
I've gotten fed up with my bank and have made the decision to move all of my banking elsewhere. This is a rare occurrence for me and, I suspect, for other people as well. It represents an opportunity ...
2
votes
1answer
146 views
Updated list of bad/overused passwords [closed]
I am building a website, and I'd like to make sure the users don't put an overused password like password or password1.. or any of these
Is there a place that constantly analyzes hacked websites ...
4
votes
1answer
95 views
Is there such thing as a smart phone with auto-forget password feature?
Storing passwords to external services (e.g. corporate email servers) on smart phones is very insecure, since phones are more easily stolen. Has any vendor implemented a feature to only cache a ...
-1
votes
2answers
105 views
Can 2FA help handle mixed personal and business accounts after leaving a company?
I do not want a super administrator in Google Apps to log to my account after leaving company, so I enabled 2-step verification. He could login to many sites as me with just a link in "forget ...
2
votes
1answer
108 views
How to safely “remember” login information in a program [duplicate]
Possible Duplicate:
How to Securely Implement a “Remember Me” Feature?
I have a program that communicates with a server. The user must log in with the application which runs on their ...
2
votes
6answers
277 views
Does shuffling a hashed password increase its security?
I am making a web app and I'm now stuck on making the login secure. I'm thinking of adding a salt to a user-inputted password and then hash it. (md5 or sha for example)
and then I will reshuffle the ...
1
vote
1answer
130 views
Is there formal guidance that requires all sessions to be logged off when a user changes their password?
Often when an account is hacked, security guidance is to change your password. However I've noticed that changing a password sometimes isn't enough to log out of other sessions that are active.
Is ...
0
votes
0answers
31 views
Password recovery protocol for user account [duplicate]
Possible Duplicate:
Can anyone provide references for implementing web application self password reset mechanisms properly?
I need to create a password recovery mechanism for a user account ...
2
votes
1answer
500 views
Clarification on how rainbow tables work
If you goto : http://www.hanewin.net/encrypt/aes/aes-test.htm
for "Key in Hex" enter
00000000000000000000000000000056
for "Plaintext in Hex" enter
00000000000000000000000000000000
and click on ...
3
votes
5answers
540 views
Increased security with keepass
I am using keepass for securing passwords. I have a reasonable password, but if someone got hold of the file I am sure eventually they could brute force it.
I was thinking of using a key file as ...
0
votes
1answer
60 views
Credentials using AWS IAM
I have a server, which should provide temporary credentials to the client.
The credentials will be transmitted using HTTPS.
The client should be able to upload S3 files, as well as download them.
The ...
17
votes
6answers
1k views
Why do we ask for a user's existing password when changing their password?
In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
16
votes
5answers
1k views
Do non-keyboard characters make my password less susceptible to brute forcing?
I can put characters in my password for which there are no keys on a keyboard. On Windows, Alt+#### (with the numpad) inserts the character for whatever code you type in.
When I put this in a ...
18
votes
5answers
417 views
Hashed password storage with random salt
Ever since I've been making sites that require a user to log in with a username and password I've always kept the passwords somewhat secure by storing them in my database hashed with a salt phrase. ...
17
votes
9answers
1k views
Is a simple, but very long password a good password?
Is a password like
wwwwwwwwwwwwwwwwwwwwwwwww9
(25x 'w' and a number) secure? It would be easy to remember.
18
votes
5answers
1k views
How valuable is secrecy of an algorithm?
On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
4
votes
4answers
2k views
How to catch a gmail hacker/money-scammer? (in conversation with one right now!)
My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
2
votes
4answers
471 views
iOS app - hash user password in-app or on-server?
I'm working on an iOS app that will also have a web component. When a user creates an account, their password will be salted and hashed. I already have the hashing algorithm working on the web-side.
...
3
votes
6answers
292 views
Is there a table that compares hashing algorithms by speed, relatively (machine independent)
As far as I understood*, one of the major criteria when choosing a password / salt hashing algorithm is it's speed. To prevent brute force attacks, a slower algorithm is better (and also makes it more ...
-2
votes
6answers
347 views
Are passwords made up from concatenating a few foreign words better than shorter random characters?
Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example:
"pussiMeansCatInEskimo"
"caballoMeansHorse"
"CatIsGatto"
"SalopeMeansBitch"
...
5
votes
3answers
327 views
Web Hosting companies asking for password in plain text
Recently, on live chat, a representative of a web hosting company (will not disclose the company name for liability issues), asked me for my password to the server in plain text in order to verify the ...
15
votes
4answers
552 views
My credit union is reducing its maximum password length to 10 characters
I just received an email from my credit union saying they are redesigning their online banking service and that I will need to change my password by October 22 to conform to the new limit of 10 ...
11
votes
4answers
3k views
Google Account: implications of using application-specific passwords
In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google ...
2
votes
2answers
149 views
How should you store a password that needs to be retrieved as plaintext? [duplicate]
Possible Duplicate:
How should passwords be stored if they must be recoverable?
I have created an API for a site that doesn't provide any form of API. For the API to do anything with the ...
2
votes
1answer
87 views
What's the best way to enumerate log/sign in attempts?
For sign in via a website, what is the best way to count the number of attempts that is:
least vulnerable to tampering
reliable
quick
The system would:
use HTTPS throughout the sign on phase (at ...
0
votes
3answers
216 views
Key stretching an hash
if I implement an function which hashes the first half of my password with MD5 and the second half with SHA2 and MD5. Is there a security issue when I put these two hashes together to a 64 character ...
15
votes
12answers
2k views
Why do we even use passwords / passphrases next to biometrics?
In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...
2
votes
3answers
174 views
Passwords In Securing Network Devices
I don't do anything with corporate IT and networking, but I know enough to handle and get networks going. Anyway, something I ran into in my travels when it comes to the occasions of working on ...
3
votes
1answer
74 views
SRP: Can the client authenticate using only the stored hash?
Based on the description of SRP, it seems that it would be possible for a client application to cache the hashed password x and reuse it for subsequent authentifications. The actual password p doesn't ...
0
votes
0answers
391 views
John the Ripper Jumbo Compilation Errors on Backtrack [closed]
Any ideas on the compiling errors? I'm on BT5R2. (also, side note, anyone know how to contact via the openwall community? I looked and didn't see a way)
make clean linux-x86-opencl
rm -f ../run/john ...
5
votes
3answers
157 views
Does a 'reset password' website facility give away too much information?
If a website has a reset password facility (which will e-mail the account holder a reset link), does this facility reveal too much information by allowing someone to probe who holds an account by ...
1
vote
2answers
196 views
Is dual control password is a feasible way to secure against unauthorized login?
I see that some organizations practice dual control password especially when it comes to critical system logins, etc. Is it feasible to implement such policy considering certain trade off such as ...
3
votes
2answers
329 views
Is piping a `ssh-agent` signed message as a password secure?
There's an encrypted filesystem on a server I ssh into using public key authentication. Since a forwarded ssh-agent can deterministically sign a message (see also the ssh-agent protocol section ...
8
votes
2answers
2k views
Facebook API : App Secret - possible misuse
I've recently find out that by simple quick look into compiled code of one of our applications, you can get both App ID (API Key) and App Secret for Facebook API
I suppose that we should really keep ...
48
votes
12answers
2k views
How do you log in from an unsecured computer?
Suppose that you are on a cybercafe, at a friend's home or at your work office, and you need to log in on a site, but you feel that the the computer can not be trusted (e.g. your friend isn't ...
12
votes
6answers
3k views
Is AES encrypting a password with itself more secure than SHA1?
This isn't really a practical question, but more a question of curiosity. I heard a CS professor recommend stepping up from md5ing passwords not to SHA1, but to AES encrypting the password using ...
2
votes
1answer
177 views
Is there a better way to take advantage of current 'approved', 'proven', and memory/cpu-expensive algorithms while using salts and peppers?
I've read about the concepts presented in these two questions:
Pre-hash password before applying bcrypt to avoid restricting password length
Would it make sense to use Bcrypt and PBKDF2 together?
I ...
5
votes
1answer
354 views
Practices for storing username/password in Web applications
I have read the following question: Storing password in Java application but I don't find the answers useful for my case.
So here is my question somehow related to that. I have a Java Web application ...
17
votes
4answers
553 views
Should I be concerned when a “Forgot Password?” tool sends my password in plaintext?
Some sites I have been a member of in the past don't go through the normal "Forgot Password?" process. Instead of e-mailing me a unique password reset link or something of the like, I have received ...
26
votes
7answers
952 views
Who is responsible for the strength of user's passwords?
Who is responsible for a user's password's strength? Is it us (developers, architects, etc.) or the user?
As a web developer, I've frequently wondered whether I should enforce the minimal password ...
3
votes
3answers
437 views
sniff SSH password on the server
Is it possible on the server to log the password encoded by the remote user inside a log.
I want to make a honeypot to see the type of user/password used.
