Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

2
votes
2answers
525 views

Practical steps for encrypting an encryption key for data stored in MySQL

So I'm working on my first project where user data is stored as encrypted using the user's password as (part of) the key. I have read many similar things about best practices, but the details seems to ...
1
vote
2answers
154 views

Password may not be similiar to last 5 passwords [duplicate]

SAP NetWeaver has a password policy to prevent your new password beeing similiar to the last 5 passwords. Are the passwords stored in plaintext to verify this? Or is something like a soundex value ...
5
votes
6answers
266 views

How secure is this process for creating passwords?

I've been research into how to be as secure as possible when it comes to password security for online services and websites. Obviously there are some big no no's like using dictionary words, using the ...
0
votes
1answer
95 views

Is Entropy all that matters in a Password? [duplicate]

My question is, is it more reliable having a password that is composed by words like FootballPractice more secure than using a password that has only 2 or 3 bits less, for example FootbalPractic , my ...
16
votes
5answers
5k views

Is an 80 bit password good enough for all practical purposes?

I know that asking how many bits of entropy comprise a strong password is rather like asking the length of a piece of string. But assuming the NSA is not on to you, and that it is hardly worthwhile ...
15
votes
3answers
5k views

Calculating password entropy?

Whenever I look at password entropy, the only equation I ever see is E = log2(RL) = log2(R) * L, where E is password entropy, R is the range of available characters, and L is the password length. I ...
2
votes
1answer
58 views

Remembering email in login form

After logging out Google remembers recently used email addresses in the login form so the user only needs to enter the password. See accounts.google.com. How secure is it? What factors should I ...
1
vote
1answer
70 views

Distinct error messages for wrong email / password

I want to continue discussion started in this question "Username and/or Password Invalid" - Why do websites show this kind of message instead of informing the user which one was wrong? but ...
2
votes
3answers
198 views

Parameters for PBKDF2 for password hashing

I use PBKDF2 with SHA-256 to store hashes of passwords. I use the following parameters: number of iterations desired = 1024 length of the salt in bytes = 16 length of the derived key ...
4
votes
4answers
399 views

If A Password Is Unique, Does It Really Matter How “Strong” It Is?

People seemed to find this "If a Password is Super-Strong Does it Matter if It's Unique" question very interesting, but it actually reminded me that the converse question is interesting, too: If you ...
0
votes
1answer
29 views

Creating secure random output that is repeatable across machines [duplicate]

I'm having trouble figuring out a solution to this problem. Basically what i am trying to do is create random data that can be repeated across multiple machines by a user but is also secure from ...
12
votes
2answers
4k views

Estimating the size of a rainbow table

What are rainbow tables and how are they used? Gives a very precise answer about what rainbow tables are and how they are used. I had always confused hash-tables and rainbow tables. My question is ...
8
votes
7answers
374 views

Strong password vs. restriction on number of attempts

To begin with, I am considering the password protection of standard internet services like Gmail or Dropbox. They often force users to choose a "strong" password, that is many characters, including ...
2
votes
2answers
118 views

Exclude passwords with repeating letters

It would cut down a lot of time of the brute force attack if some of those passwords like "aaaaaa" wouldn't appear. How can this be achieved in Hydra or some other brute force software?
2
votes
4answers
128 views

Justifying strong 1st factor in the context of multi factor authentication — beyond passwords

I am wondering if you need strong 1st factor (for theoretical correctness, please note it is the knowledge factor -- not necessarily a password, but definitely also includes strong passwords)? What ...
-2
votes
3answers
337 views

Why is encryption bad for passwords?

We use PGP for almost everything and it's so infeasible to bruteforce that it's considered secure. This is the guiding principle beyond CryptoLocker. But for stuff like e-mail, SSH and HTTPS, it's ...
3
votes
2answers
70 views

Securely generate a rng seed using a small number

I'm trying to figure out a secure method to generate a rng seed to a rng using a small pin number that is 5 digits. The issue that i can see with this is an attacker could very easily just loop ...
1
vote
1answer
95 views

How much more difficult does it become to crack a password when appending a 5-digit pin?

I have a quick question regarding password cracking. Lets say you append a 5 digit pin on the end of your password. An example would be instead of a password of "password" it would be "password12345"....
1
vote
1answer
71 views

Why is the password field blanked in the registration form if the validation fail? [duplicate]

Is it really a problem if you send back the password when the validation fail on a registration form? I understand that the html that is sent back could be cached on the computer of the person ...
36
votes
15answers
7k views

Why do people think that this is bad way to hash passwords?

Well, please tell me, what's wrong with this code: $password = "hello"; $password = md5($password); for($i=1;$i<20;$i++){ $password = md5($password); } It's exactly the same as this one: ...
-1
votes
1answer
45 views

What are the exclusions for using a very long and random password? [closed]

It is a good practise to always use long (63 character) and random passwords. Question: But what are the exclusions? Can someone mention cases? Example: when console login is needed (so not via ...
1
vote
2answers
76 views

Using emoticons in passwords

I'm coming up with a password to use for my banking website, XKCD style. Furthermore, I'm considering adding in an emoticon (say, a <3) How many bits of entropy does an emoticon add to my ...
1
vote
0answers
115 views

Can password hashing both client side and on the back end improve security if we don't necessarily trust the server? [duplicate]

I want to know if it ever makes sense to hash a password client side and rehash it again on the back end. I've not seen this done before which makes me suspicious as to whether it really does add ...
3
votes
5answers
333 views

How should I store a physical written copy of my password? [duplicate]

I can employ all the fancy encryption and the randomest of passwords to my hard drive, but it won't do me any good if I don't remember how to log in. It seems sensible to write down my password, then....
0
votes
1answer
149 views

Brute force a hard drive when most of the password is known

I need to access a hard drive that is encrypted with LUKS. The password provided is incorrect, however it is only incorrect by a character or so. The password itself is very strong and above 30 ...
1
vote
0answers
64 views

Is that a way break Linux user password by bypassing grub protected?

The best way to delve into others Linux machine is by editing the grub. Many will start by, editing the line ro quite splash as rw init=/bin/bash during the startup (usually by pressing button e on ...
1
vote
2answers
143 views

Is it a good idea to combine words from different languages to increase a password's strength? [duplicate]

I was thinking of a way to generate a password that is easy to remember, but hard to crack, like the famous "correct horse battery staple" suggested by XKCD, also discussed here, and I've realized I'...
1
vote
1answer
111 views

My iTunes account got hacked and someone used it to buy in-app purchase. How could that happen? [closed]

The account was hacked, I found out in my credit card statement and Apple support gave me refund which is nice. I wonder how it happened, and if there are even more serious risks that I don't know. ...
20
votes
6answers
5k views

What is a good practical (and sane) way to manage all your passwords for online sites?

I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords. This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
5
votes
2answers
367 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
-2
votes
2answers
185 views

How to securely transfer password from a registration page to the database [duplicate]

What steps must be followed to send password securely from the user registration page (i.e. client side) to the server over a non encrypted channel (http) when the user registers for the first time on ...
7
votes
2answers
3k views

Does the Kerberos KDC know the users' plaintext passwords?

In http://www.freebsd.org/doc/handbook/kerberos5.html section 15.7.8.3 “The KDC is a Single Point of Failure” you can read: By design, the KDC must be as secure as the master password database is ...
4
votes
2answers
192 views

Location of Password Hashes on a Windows Local Machine?

"Where are the two locations that user's password hashes are stored on a local windows machine?" My place of business asked me this question. I know that the SAM stores password hashes, where would ...
82
votes
10answers
13k views

New Gmail login system—going against conventional wisdom?

I noticed that the new gmail login asks for username first, and then confirms if such username exists, before asking for password input. Does this not go against conventional security wisdom to not ...
0
votes
0answers
32 views

Passwords vs keys in cryptography? Which is stronger and safer? [duplicate]

Maybe it isn’t correct question, but how to compare passwords and keys in cryptography? Symmetric encryption, e.g. AES, usually encrypts data with passwords, and all public-key cryptography use open ...
27
votes
3answers
2k views

Does password-protecting a server's BIOS help in securing sensitive data?

I'm running a server of which I protected the BIOS with a password. One doesn't have to enter this password before booting, but before entering the BIOS setup. I just did this from routine. However, ...
71
votes
11answers
14k views

Will typing my password twice make it more secure? Or typing each character twice?

If I type my password twice (like: PwdThingPwdThing), OR type every character twice (like: PPwwddTThhiinngg) will that make it substantially more secure than it already is? Assume that it is already ...
3
votes
1answer
101 views

Can I Prevent Internet Explorer from Storing Login Requests in Memory?

Using Internet Explorer 11 I have been able to login to HTTPS web applications by providing a username and password and then subsequently logout. Whilst the browser process is running I can then dump ...
1
vote
1answer
78 views

What password based key derivation does PKCS #12 use?

I would like to make a note that I have read all of rfc 7292. I am trying to decrypt encrypted private key in a pkcs#12 pfx file. The private key is enveloped within pkcs#8 shrouded key bag. The ...
2
votes
3answers
134 views

Verify password hashed with nonce when the password is already hashed on the server?

I found this picture in the Wikipedia nonce article: To avoid sending the password in clear text and prevent replay attacks, the password is hashed together with one random number from the server (...
0
votes
5answers
314 views

What is the safest way to store passwords in a company for the case when the CISO leaves?

What is the best and safest way to store passwords in a company to ensure nothing is lost when the CISO leaves. I know this might be subjective and there isn't THE best way. But I'm curious about your ...
1
vote
3answers
152 views

why not use hashed password as password [duplicate]

Why dont we use our mobile phone tho hash a password and then enter the hash on a website as the password ? This way the password for the website would be much more complex. Would this even increase ...
8
votes
5answers
44k views

Is it possible to brute force all 8 character passwords in an offline attack?

This article states: Brute-force techniques trying every possible combination of letters, numbers, and special characters had also succeeded at cracking all passwords of eight or fewer characters. ...
139
votes
16answers
18k views

Is the BBC’s advice on choosing a password sensible?

In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows. Step 1: Choose an artist (a recording artist I presume) Lets choose as an example ...
24
votes
10answers
8k views

Intel How Strong is Your Password page, good advice?

I came across this Intel How Strong is Your Password? page which estimates how strong your password is. It has some advice on choosing better passwords including that you should use multiple ...
19
votes
3answers
3k views

Why do some bank websites use passwords that are not case sensitive?

It was recently brought to my attention that a certain big bank website allows users to log in with passwords that are not case sensitive. After confirming this, I checked other websites I bank with ...
99
votes
14answers
18k views

Why did customer services say using symbols in a password is insecure?

I am using an online service that I recently had to reset my password because I forgot it. When I went to change password I wanted to use one with a symbol !@£$%^&*(). When I clicked "confirm ...
-5
votes
3answers
85 views

how to know the way in which password was encrypted [closed]

i have a encrypted password basically hashed i don't know what it is some thing like 11dfb34b27f539a5e785b68e529fd470 and i know the password i.e., the plain text but i want to know the way that how ...
1
vote
2answers
100 views

Isn't oAuth weaker than traditional passwords

I understand the need for oauth for programmatic access to apis, etc. whereas passwords are used for more human-level authentication. However when we store passwords, we (hopefully) salt + hash them. ...
48
votes
7answers
4k views

Is the option to jump to blanks in password fields a security risk?

Using Ctrl + ← / →, it's a common behavior across different operating systems to jump from word to word (or from blank to blank) in text input fields. Now I've discovered that this also applies on ...