Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

13
votes
6answers
8k views

Is PBKDF2-based System.Cryptology.RFC2898DeriveBytes() “better” for Unicode Password hashing than traditional methods?

When is it appropriate to use RFC2898DeriveBytes versus a typical hash? Update I now understand that a KDF is typically used to create a symmetric key for possible use in encrypting a stream. I ...
13
votes
6answers
2k views

Does prepending a salt to the password instead of inserting it in the middle decrease security?

I read somewhere that adding a salt at the beginning of a password before hashing it is a bad idea. Instead, the article claimed it is much more secure to insert it somewhere in the middle of the ...
13
votes
3answers
2k views

Known characters in passwords?

I generate passwords for everything that requires security using the following method: ksoviero@ksoviero-Latitude-E7440:~$ head -c 16 /dev/urandom | base64 gorv/cp+lSiwiEfKck2dVg== 256^16 ...
13
votes
5answers
3k views

Is this idea for a password manager secure? If so, why doesn't anybody use it? [closed]

I've been thinking of a problem with usual password managers: although they do provide better security than manually using passwords, there's a central database that can get lost, get compromised, ...
13
votes
5answers
2k views

Can sites which check your password as you type pose a security risk?

Some sites that I use check my password as I type it into the login (not registration) form. So, for example, to begin with I might have: Username: sapi ✓ Password: passw × and by the time I've ...
13
votes
3answers
12k views

Can password-protected zip files be broken without brute force?

You have a zip file that you created with 7z to password-protect it with AES 128. Can a smart adversary extract the data only through brute force, or is the file vulnerable to other attacks - such as, ...
13
votes
3answers
1k views

What is a good enough salt for a SaltedHash?

Since I'm hashing all passwords with each their own salt, is there a benefit to the salt being really random, or would an incremental counter or a guid be good enough? Also, is there a benefit of ...
13
votes
3answers
10k views

Is HTTPS and Basic Authentication secure enough for banking webservices (RESTful)?

I have been reading about SSL/TLS for the last few days and looks like it has never been practically cracked. Given SSL/TLS is used for all communications between client application and the server, ...
13
votes
3answers
15k views

Choosing a session ID algorithm for a client-server relationship

I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
13
votes
3answers
2k views

Is it safe to generate passwords online?

I usually generate strong passwords using various online tools. Some time ago I mentioned it to a friend of mine and he was shocked that I do such dangerous thing. Is it really so unsafe to generate ...
13
votes
2answers
294 views

Why is OpenID considered secure when password reuse is not?

OpenID allows you to use your e.g. Google/Facebook/Microsoft account to log into a third party website. It can be used to log into Stack Exchange. Why is this considered an acceptable practice, ...
13
votes
6answers
3k views

What is the simplest safe way to convey a password to another person? [duplicate]

What is the easiest way for two people – neither of whom are computer specialists and cannot meet in person – to send a password for an encrypted file that is attached to an email? The two simplest ...
13
votes
3answers
4k views

Is it truly possible to store passwords securely, but be able to see the password?

Every place I looked, people recommended that storing passwords via encryption is like storing passwords in plain text. But every place I've looked, everyone recommends using a password manager like ...
13
votes
2answers
2k views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
13
votes
3answers
759 views

How to manage team passwords?

How do most teams handle the storage of passwords, in particular the required changes when team members leave ? Right now, we use a centrally stored encrypted file but the thought of changing 100's ...
13
votes
4answers
6k views

SSH key auth, but still need password for sudo?

SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive ...
13
votes
2answers
214 views

Would suggesting a random passphrase during sign-up hurt overall security?

I've been looking for ways to improve security and security awareness for both internal and external clients and I happened upon the idea of generating a one-time, random "password suggestion" on the ...
13
votes
2answers
9k views

Bypassing the BIOS password

Are there any reliable methods that allow an attacker to bypass a BIOS password, or alter BIOS settings without entering the password? A few ideas come to mind: The old battery trick (remove ...
13
votes
4answers
736 views

How does correct grammar affect password security?

When using the XKCD password methodology, entropy is calculated solely on the basis of individual words, assuming that the individual words are independent. This is, of course, not necessarily a valid ...
13
votes
2answers
1k views

Can a Firefox add-on or plug-in access the user's websites' saved passwords in decrypted mode?

Going deeper into the previous question on Firefox plugins and add-ons malware risks: Could a Firefox add-on potentially decode and capture the encrypted websites' passwords saved in the browser?
13
votes
4answers
3k views

How can I make sure password hashing is secure on computers while not being prohibitively slow on mobile devices?

I'm new to cryptography and its implementations. I'm designing an Android app where an user enters a password to retrieve some encrypted data. After some research on possible solutions I ended up with ...
12
votes
5answers
2k views

What is the best way to transmit password hash over unreliable TLS?

I have TLS connection between my server and client. I have no certificate, so the connection is susceptible to the Man-in-the-middle attack. I fear that attacker could intercept the password hash ...
12
votes
4answers
1k views

Does an *additional* company-wide password offer any real security?

So, let's say a company has what could be referred to as an "access key". Each user has their own username and password, and there is an additional company-wide access key that people must input with ...
12
votes
8answers
3k views

What chars should I not allow in passwords?

I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
12
votes
7answers
2k views

Why don't we reward users who choose strong passwords? [closed]

Suppose there is a web property that has some sort of reward system or commodity that its users desire. It could be reputation on Stack Exchange-like sites, rank badges on message boards, or add-on ...
12
votes
5answers
8k views

How do online accounts get hacked?

How does your typical users run-of-the-mill Facebook/twitter/gmail/AIM/etc account get hacked? Is it simply a matter of a weak password? Are they typically the victim of phishing or other social ...
12
votes
4answers
3k views

Handling passwords in a web application

I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client ...
12
votes
3answers
4k views

How can I prevent someone from accessing a Windows XP system via boot disk?

Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one: ...
12
votes
3answers
1k views

Should I reject obviously poor passwords?

UPDATE: My questions and concerns below boil down to: "Should I reject obviously poor passwords like 'hellomydarling' or 'password'? My guess is yes and I want to know to what extent. I'm using a ...
12
votes
4answers
2k views

Is it “standard” to SMS passwords?

When I get credentials for a new machine, my company will often send the login id in email, then SMS (or sometimes Skype msg) the password. This is obviously in order to separate the login and ...
12
votes
2answers
3k views

How secure is asking for specific characters of passwords instead of the entire thing?

In some password-authenticated sites, you are asked to enter a random selection of specific characters from your password rather than the whole word/phrase. For example, it might say 'Enter the 1st, ...
12
votes
5answers
869 views

Should passwords be truly random?

When generating a password, should it be "truly random" or should I make it a little less random by enforcing some rules? If a password is generated at random, it could come out all-lowercase letters ...
12
votes
5answers
1k views

If a bank says they do not have my login and password info, is that true? [closed]

After an investigation on their part, the bank simply states that if someone accessed my accounts via internet banking, (and a simswap) I was the one who didn't secure my login and password info. I ...
12
votes
2answers
1k views

Is there any advantage of bcrypt over multiple iterations of SHA-x/MD5?

I know that a good password hashing algorithm should be slow. MD5, SHA256, etc. are fast. So I've been adding multiple iterations of SHA-256 hashing to my web apps (around 50000). Getting the hash of ...
12
votes
4answers
1k views

Forgetting passwords typed in too frequently

It has happened to me several times that I've become so used to typing in a password I can't consciously remember it and it's purely muscle memory. This is particularly true with complex passwords ...
12
votes
4answers
1k views

MS-SQL Password Storage

What would be your recommendation for replacement of an MD5 hash approach to password storage within an MS-SQL database be?
12
votes
3answers
1k views

Should an admin user be able to edit passwords?

For your typical web app, should an admin superuser have the right to edit a user's password, or should only that user have the right? (Even with edit ability, the admin would never see the current ...
12
votes
1answer
555 views

Is the Litecoin Scrypt hashing technique a threat to hashed passwords?

The Bitcoin alternative, Litecoin uses a different algorithm to protect the block chain, namely Scrypt (not Sha256). Given that GPU accelerators exists, and ASICS are due to be released, does the ...
12
votes
3answers
20k views

Is a password protected PDF file safe for bank statement attachments?

My bank emails my monthly statement to me in a password protected PDF attachment. Is this a secure method of transmitting something as sensitive as bank statement?
12
votes
7answers
1k views

Aren't password managers still incredibly risky?

I understand the utility in having one application remember a bunch of long, randomized passwords, but all you'd need is one well-placed phishing scam or a keylogger and they get all the keys to the ...
12
votes
2answers
722 views

Zip file with two password

I used this command to password protect a zip file on Linux : zip -P 9000 hash.zip hash.py and it creates the zip file just fine, then I wrote a program to test every possible password on it from 1 ...
12
votes
1answer
551 views

Is Rfc2898DeriveBytes using HMAC SHA1 still considered “secure enough” for hashing passwords?

I've been told by a CISSP that the .NET class Rfc2898DeriveBytes would not pass a security audit today because it still uses SHA1. It's reliance on SHA1 - even with the iterations - leaves it too ...
12
votes
3answers
568 views

Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?

On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
11
votes
4answers
3k views

Authenticating without a database

I've been inspired by a question over on Code Review, which boils down to: What is the proper way to authenticate a user without a database? Would it be the exact same process if you stored ...
11
votes
9answers
2k views

Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?

I don't know why do we authenticate by prompting the user to enter both username and password. In my mental model, prompting password only suffices. The reason is as follows: Assume there are x ...
11
votes
4answers
2k views

Why will Google no longer allow me to end or begin passwords with a space? [closed]

Why won't Google allow me to use a password ending in a space anymore? Backstory: I have memorized a cipher that allows me to generate a different and very strong password across many different ...
11
votes
5answers
790 views

Altering passwords before storing

Assume that I'm using bcrypt with a unique salt (or some other best practice) to hash user passwords before storing them in my database. Is there any security advantage to be gained by ...
11
votes
6answers
34k views

Is howsecureismypassword.net safe to use?

Is it safe to enter my real passwords to test them? I mean, are the entered passwords being recorded/transmitted to someone else?
11
votes
2answers
15k views

openssl: recover key and IV by passphrase

A large amount of files were encrypted by openssl enc -aes-256-cbc -pass pass:MYPASSWORD Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
11
votes
5answers
3k views

How can I help catch an email scammer who is contacting me?

My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...