Tagged Questions

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

1
vote
1answer
176 views

Is using MD5 in NTLMv2 protocol to store Windows passwords is secure?

I read that Windows (probably not new OSs but say, Windows Server 2008) stores passwords using Hashes using NTLMv2 protocol which uses MD5 hash function. My questions: MD5 is known to be insecure ...
0
votes
2answers
815 views

How many bits of entropy should I aim at for my password? [closed]

I mainly use 2 passwords: 1 is a 4 word full lowercase passphrase of 18 letters long which I use wherever possible. The other is basically 3 words and a digit with the first word in full uppercase and ...
1
vote
2answers
126 views

How can I analyze password recovery tokens?

All websites that support authenticated user interactions have a password recovery feature. Usually they will email the password reset link through which you can easily recover your account by typing ...
0
votes
2answers
301 views

Registration Password

Is it best to create an application that allows a user to sign up with username and email at the beginning and password once you click the generated email sent to you or should the password entering ...
1
vote
0answers
171 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
1
vote
0answers
52 views

Does whosthere.exe of pth toolkit have to run with administrative rights?

To see the users that are connected to the machine and they're pass hashes with Whosthere.exe, do I have to run it as an administrator?
0
votes
1answer
50 views

How does LM hash deal with passwords that are between 8 and 13 chars

If its 14 then it splits it to 7&7, but how about 13 characters? 7&6? How does it work?
-1
votes
4answers
214 views

How do big companies and wealthy people secure their information? And how can I secure mine?

I've recently had some success and traffic increase with an online business I own and due to that someone has hacked my domain email and twitter accounts. My bank password is the same and I just ...
2
votes
4answers
368 views

How does a system authenticate a user using a hash function, after it has been salted?

I don't really understand how salting works. I read the Wikipedia article, but I still don't understand how can a system authenticate a salted hash? Let's say a user chooses a password. It's randomly ...
0
votes
1answer
152 views

What are common problems that reveal PHP code? [closed]

What is the best method for securing PHP scripts that contain database passwords? From what I've read, PHP can be revealed when an error occurs and is not caught. Is there any way to reveal PHP by ...
3
votes
4answers
370 views

True?: “Nearly all encrypted passwords are stored with the last character in clear text”?

[S]ome passwords are gleaned by hacking into computers where intruders can find stored passwords. Those are stored in encrypted form, but there's software that can attack the encryption. Nearly ...
3
votes
4answers
296 views

When and where do I hash a password?

Say I have a client and a server. I want the user with the client to login to the server with a username and password combination. To login, they have to enter the right password which (when hashed) ...
3
votes
1answer
113 views

Webpage sent me my password in clear text can it be secure? [duplicate]

I registered for a webpage years ago and have been using it without issues, today I made some changes to my account and they sent me an email containing my username and password in clear text. I ...
2
votes
1answer
224 views

FIPS 140-2 C# Password Hash

Is the following algorithm, using RNGCryptoServiceProvider & Rfc2898DeriveBytes, sufficient to implement a FIPS 140-2 password hash on Windows Server 2008R2? var provider = new ...
3
votes
2answers
172 views

Why use PBKDF2 over multiple iterations of a another cryptographic hash function?

People often recommend PBKDF2 over using hash functions directly, but typically they compare PBKDF2 to a single unsalted hash. What advatages are there to using PBKDF2 over multiple iterations of a ...
1
vote
3answers
318 views

What are the possible rules to identify password sharing- to prevent fraud

I am trying to build correlation/ potential red flag rules to detect if passwords are being shared or stolen... the primary driver for this is guidance from our compliance team, that much of our ...
2
votes
2answers
307 views

Is this password generator safe?

128-bit entropy is required http://nxtra.org/nxt-client/js/passphrasegenerator.js With all new browsers (Chrome, Firefox, IE 11) it uses crypto.getRandomValues which should be safe, but with IE 10 ...
17
votes
1answer
1k views

Why does Facebook bother comparing old and new passwords?

An answer to this question says Facebook generates a bunch of password guesses to see if they hash the same as a previous version of the password. Why bother? If a service forces every password to ...
3
votes
1answer
188 views

Safe ways to store passwords without hashing them

I'm working on an email client for Windows, and to send emails, my application needs to have the email address and the password of that email address. When the user gives his password, I store it ...
123
votes
5answers
13k views

Does Facebook store plain-text passwords?

I was about to reset my Facebook password and got this error: Your new password is too similar to your current password. Please try another password. I assumed that Facebook stores only password ...
3
votes
1answer
198 views

File Vault 1 password from memory dump

I have a osx 10.9 machine with a File Vault1 encrypted user partition. I would like to remove the encryption, but I don't remember the "master key" which is the only way to remove encryption ...
0
votes
2answers
107 views

If P=NP, what is still cryptographically secure? [duplicate]

I know, I know - "If P=NP" is a really large, high-impact assumption. But this is a hypothetical. I mean, clearly RSA (and similar methods of obfuscation) would likely become totally irrelevant - or ...
-2
votes
2answers
2k views

Hydra https-form-post

I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives. This is what I have done so ...
2
votes
1answer
240 views

Passwordless login over email - security considerations

I'm proposing the use of a login system that sends a one-time login token (with high entropy) via email to the user. After using the token, the user receives another token via email and the previous ...
0
votes
2answers
85 views

Logging in after password reset email sent (but not acted on)

Should a user be allowed to request a password reset email and then log in (i.e. disregarding the reset email and using their existing password) or should the current account be locked until the ...
4
votes
2answers
114 views

Should I set different passwords for different Wi-Fi bands?

My new router supports both the 2.4 and the 5 Ghz bands, and it obviously allows me to set a different password for each of them. Now, since cracking just one of the two means that the attacker would ...
6
votes
4answers
303 views

Relationship of password strength and key strength

I have just started educating myself about cryptography, and while it is mostly making sense, a few things are still eluding me. One being: In systems that take a user's pass-word/-phrase in order to ...
3
votes
2answers
245 views

What are the benefits to a two-page login system for a webapp?

I have noticed many website going to a two-page (not two-factor) login system - where you enter your username on page 1 and click submit, and then enter your password on page two and click submit. ...
11
votes
1answer
425 views

Is the Litecoin Scrypt hashing technique a threat to hashed passwords?

The Bitcoin alternative, Litecoin uses a different algorithm to protect the block chain, namely Scrypt (not Sha256). Given that GPU accelerators exists, and ASICS are due to be released, does the ...
15
votes
3answers
552 views

Storing passwords in reversible form - a genuine use-case

What's wrong with you, you crazy fool, you're not supposed to be able to retrieve a password in plain text! I know. Hear me out. Assume I've got a service that's similar to Mint.com. For those that ...
2
votes
3answers
130 views

Are some passwords more vulnerable to password crackers?

Suppose I have a password made of n alphabetic characters. An attacker is given the hashed password and will attempt a brute force attack on cracking it. I can envision a naive password cracker ...
1
vote
2answers
181 views

Storing database password in application

Let's say my application connects to my database. This requires me to have the username and database in my config as follows: postgresql://scott:tiger@localhost/mydatabase I have an automated ...
1
vote
0answers
216 views

entropy of FIPS-181 automated password generator

From wikipedia article on password strength: NIST recommends 80-bits for the most secure passwords Is there any estimation of entropy for FIPS-181 automated password generator? Recommended ...
3
votes
2answers
179 views

How does my bank knows my second and forth chars of my password [duplicate]

I see that the new login mechanism used by some banks in UK and also used by visa debit authentication is to ask for three random characters from your password at login (for example second, ninth and ...
4
votes
1answer
112 views

Why is it bad encrypt to with plain passwords as encryption key?

It's my understanding that using "normal" passwords, such as an easy to remember sentence, is bad practice. Is that because such a string will not be random enough, or something else? From Ruby's ...
3
votes
3answers
202 views

How is a “commonly used password” determined?

When I try to create a virtual machine on Azure, and use the password P@ssw0rd I get an error message saying The password you provided is too common. Now, from my basic understanding, a provider ...
1
vote
3answers
1k views

Is Salt, IV and Key necessary when encrypting password in a database using AES? If so, how should they be used?

Imagine I have a website with user accounts. I want to authenticate users, so I need to know if the password they provide matches the one stored in my database. To protect the passwords from prying ...
2
votes
1answer
127 views

Given a hash, salt, charset and password length, how do you get the password without brute-forcing it?

I got that question on an exercise and I'm not sure what to answer. Without conventional brute-forcing and without a rainbow table, how could I find out the password? An improved brute-force ...
5
votes
3answers
540 views

Does it make any sense to alter a hashed password? [duplicate]

I've always wondered if it would make any sense to put fake characters into a hashed password? For example this is my password: 1234 and after hashing the password , this is the result: abcd Then ...
2
votes
3answers
223 views

What is wrong with a confirmation page displaying my password?

I just registered for a race and the confirmation page gave me the creeps. See below for a screenshot with fake data. I know nothing about internet security. Other than the obvious fact that if I ...
6
votes
1answer
207 views

Why does my bank bother asking basic personal questions to log in to online banking?

To log into my online banking, I have to answer a basic personal question such as "What is your mother's maiden name" or "What is your grandfather's middle name", as well as enter a one-time code from ...
3
votes
1answer
177 views

How can I store information securely when I can't use crypt or a hash?

I'm creating an application for Google Glass (technically it's Glassware, but whatever). The user will do the following steps when going through setup for the Glassware: Go to my website, redirected ...
-2
votes
1answer
173 views

How long does it take to break 128-bit key

Hmm, I was asking myself how to compute if we were given one day to try all possible keys for a 32-bit symmetric cypher, how long would it take us to break 128-bit key? My calculations suggest: ...
0
votes
2answers
255 views

How do you protect strings in code from users decompiling them and seeing them [duplicate]

For an example say we have an application such as a client based application which connects to an API using an api key. We are saying for this purpose there is no OAuth. How would a string or in this ...
7
votes
5answers
2k views

How can one secure a password/key in source code [duplicate]

If there is a need for source code to have a password in it, how should this be secured? This is purely an example, but say there is an app that is using an API, and you don't want to expose ...
1
vote
1answer
248 views

Why does Debian security guide recommend md5 hashed passwords?

I am reading the Debian Security How-To and came across a section that I found odd: it recommends to use md5 hashes for /etc/shadow passwords ...
2
votes
2answers
184 views

Locality Sensitive Hash (LSH) function to approximately match old passwords

Recently, I ran across a website that requires me to change my password after X number of days had passed since I had last created one. Intelligently, the service made sure that the password did not ...
6
votes
5answers
876 views

Is storing plaintext passwords for email accounts any less bad? [duplicate]

I recently found out that the company I use for shared hosting stores passwords for email accounts in plaintext (they mentioned this to me incidentally, while troubleshooting another issue). They're a ...
0
votes
1answer
291 views

How could be my skype password stolen? [closed]

My skype password was recently changed. I've changed it back and found it in the internet on hacker's site. My password is pc-generated, like as2fZ12v. How did they manage to hack it, if I've never ...
-1
votes
1answer
220 views

Why don't we do dual password instead of forgot password?

You can see a link Forgot Password? nearby almost all login form. As I mentioned in question, Since passwords are completely protected from outside access unless owner reveal, I come up with this ...