Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

11
votes
6answers
619 views

Security of carrying passwords on person

While in college I decided to have a randomly generated 16 character password. I used parts of that password in various sites. However, one of the sites was compromised so I had to change my password. ...
11
votes
1answer
685 views

XKCD #936: under what assumptions is 1000 guesses/second over a network plausible?

In XKCD #936, a rate of 1000 password guesses/second is proposed as a "plausible attack on a weak remote web service". Under what assumptions is this rate plausible? It seems much too high to me. I ...
11
votes
2answers
1k views

Password auditing

Most password policies require the password to be at least 8 characters long and contain symbols from at least 3 classes (lower case letters, upper case letters, numbers, other). Problem is, that a ...
11
votes
3answers
870 views

How much information about the reason for an unsuccessful login should a web application give?

After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application ...
11
votes
3answers
15k views

Is a password protected PDF file safe for bank statement attachments?

My bank emails my monthly statement to me in a password protected PDF attachment. Is this a secure method of transmitting something as sensitive as bank statement?
11
votes
4answers
2k views

How secure is the SRP that Blizzard uses to protect passwords?

Blizzard very recently announced that their network was compromised, but they assure users in their statement that the password information that the attackers had access to was saved in a secure way: ...
11
votes
3answers
322 views

How to test if a browser add-on is safe

I came across this plug-in that started some alarm bells ringing. The add-on would help submit a website to web directories. The first 100 submissions are free, then you need to pay $20 via pay-pal ...
11
votes
7answers
939 views

Aren't password managers still incredibly risky?

I understand the utility in having one application remember a bunch of long, randomized passwords, but all you'd need is one well-placed phishing scam or a keylogger and they get all the keys to the ...
11
votes
4answers
20k views

How secure is WD MyPassport lock

I have a WD My Passport hard drive. There is an option that allows you to lock your hard drive with a password. How secure is this lock? They don't give details about the encryption algorith or the ...
11
votes
1answer
467 views

“Please Enter Nth Character” without HSM

This question has been asked a few times, but always in the format "How does examplewebsite.com implement their 'please enter xth yth and zth characters of your password' function?" And the ...
11
votes
2answers
1k views

Can a Firefox add-on or plug-in access the user's websites' saved passwords in decrypted mode?

Going deeper into the previous question on Firefox plugins and add-ons malware risks: Could a Firefox add-on potentially decode and capture the encrypted websites' passwords saved in the browser?
11
votes
3answers
2k views

Additional security of keyfile on top of a master password for KeePass

I use KeePass + Dropbox to manage and synchronize my passwords across my devices. This system works really great and I trust KeePass' security model. However my biggest remaining concern is the ...
11
votes
4answers
532 views

What is the best way to hand out passwords to a widely spread diverse employee base?

I have a problem I need to solve - specifically, how to hand out passwords to people in a variety of locations, and with a wide variety of access. I've thought of some options, but there are ...
10
votes
4answers
1k views

Does the strength of password matter in bcrypt?

Even if I choose 1 character for my password or 32 characters with numbers, letters, uppercase symbols etc. the bcrypted password will still be 60 characters length password. So does the password ...
10
votes
2answers
5k views

Is it safe to store the password hash in a cookie and use it for “remember-me” login?

I want to store an encrypted string of the password hash in a cookie and use the hash to lookup the user and log them in (if they want to be remembered). Is this safe? The password is one-way hashed ...
10
votes
3answers
790 views

Should I reject obviously poor passwords?

UPDATE: My questions and concerns below boil down to: "Should I reject obviously poor passwords like 'hellomydarling' or 'password'? My guess is yes and I want to know to what extent. I'm using a ...
10
votes
3answers
518 views

has scrypt withstood the test of time?

I've always heard that scrypt was better than bcrpyt... because of memory causing GPU a very difficult time to crack. However, the notion always was that scrypt hadn't been tested, it was kind of a ...
10
votes
3answers
12k views

With ASIC bitcoin miners, should SHA256 be considered insecure for password hashing?

I'm sure everyone here has seen the rise and further rise of bitcoin. The process used for mining bitcoin is basically "let's brute force an SHA256 hash that is less than this amount" That being ...
10
votes
4answers
895 views

Forgetting passwords typed in too frequently

It has happened to me several times that I've become so used to typing in a password I can't consciously remember it and it's purely muscle memory. This is particularly true with complex passwords ...
10
votes
3answers
2k views

Is a password in the clipboard vulnerable to attacks?

I see situations where you may have to input the same password more than once. You may type it in a text editor and copy it to clipboard, to paste it two or more times. In what scenarios this could ...
10
votes
7answers
2k views

Does adding dictionary words to passwords weaken them?

This might sound like a stupid question, but hear me out. If I'm encrypting my financial information and sensitive data via a program like TrueCrypt, the strength of the password is going to matter a ...
10
votes
3answers
311 views

Is there any conceivable reason to prevent a password change in an authentication system?

I connect to the VPN of another company with a company-specific username and password (they aren't giving everyone the same password to every company to access it or anything ridiculous like that.) ...
10
votes
3answers
1k views

Cryptographic Security of Dynamically Generated, Non-Random Salts

So when it comes to security, when I have an idea that seems good, but no one else seems to be doing, I try to assume that I'm overlooking something obvious or otherwise significant. This is one such ...
10
votes
2answers
348 views

How much security is compromised if we accept other characters as login (other than the original password)?

I've just realised that facebook accepts 3 forms of a password: Source: Facebook actually accepts three forms of your password: Your original password. Your original password with the ...
10
votes
2answers
657 views

Password generation - too primitive?

A while ago (12 years old), I recognized my passwords weren't safe at all. Because I used the very same password everywhere, some grumpy admin could easily take over all my accounts (he got mail and ...
10
votes
3answers
473 views

If multi factor authentication is enabled, how should that affect self-service password reset?

Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required) ...
10
votes
3answers
885 views

Should an admin user be able to edit passwords?

For your typical web app, should an admin superuser have the right to edit a user's password, or should only that user have the right? (Even with edit ability, the admin would never see the current ...
10
votes
1answer
310 views

Is this cross-site password model secure?

I'm looking for a way of securely having passwords for different pages. Say I generate this password: ild23rfsfdfg%*#fArg34t34657%537@asd7oak2094^*q2k2k@Kk3j4tn453Q5# Then, for each site, I change ...
10
votes
3answers
614 views

How can I promote good password practices in an organization that doesn't currently care about that?

I work with an organization that uses some very poor practices such as using default user accounts, default passwords (or passwords the same as user accounts), sharing password information between ...
10
votes
3answers
1k views

HMAC Based Request Signing - Storing the Salt

I'm working on a (non high security) project that currently isn't live but might go live at some point. We have a REST API (implemented using Restlet and Neo4j) running on a server and an Android ...
10
votes
2answers
670 views

How insecure is PowerShell Web Access?

Windows Server 2012 comes with a new feature that allows you to administrate the server via a PowerShell command line in any modern browser including Smartphones. This sounds cool and scary at the ...
10
votes
2answers
3k views

Estimating the size of a rainbow table

What are rainbow tables and how are they used? Gives a very precise answer about what rainbow tables are and how they are used. I had always confused hash-tables and rainbow tables. My question is ...
10
votes
3answers
778 views

If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?

In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the ...
9
votes
5answers
3k views

Using Google Search results to determine password strength

Google is a repository of Internet data, as it indexes tremendous amount of data. It uses a prediction service to determine the rest of the search query. With such a huge repository in place, can we ...
9
votes
4answers
1k views

Is 2FA really necessary with long, high entropy passwords?

I was wondering if two factor authentication is really necessary if you are using high entropy, long, unique passwords for each site. From my experience 2fa just beefs up security a little more, by ...
9
votes
6answers
1k views

Is it useful to protect hashed password with encryption?

Imagine that I am hashing the users' passwords with a random, long enough, salt, using key stretching, and a secure hash. Would it be more secure to finally encrypt the hash with a symmetric key?
9
votes
6answers
2k views

Should I hash a password if it is randomly generated

The best practice is we should hash a user password using algorithms such as bcrpyt to protect the user, however, given the following conditions, is hashing in the backend still matters? the ...
9
votes
6answers
1k views

Is putting every username and password for our organization in a giant Google spreadsheet a spectacularly bad idea?

Our startup has something like 100 usernames and passwords to keep track of, and we can't keep track of all of them. Would putting all of them in a Google spreadsheet shared amongst ourselves be a ...
9
votes
6answers
398 views

How can I ensure that default passwords are no longer in use?

There are two situations in which 'default' passwords get used on a network: A new user is registered. In her registration pack, along with her new username, e-mail address and so on is her initial ...
9
votes
2answers
667 views

Does it make sense to choose a longer password than the output of a hash?

Let's take MD5 for example: It outputs a 128-bit hash. Does it make sense (in theory) to choose an input (password) which is itself longer than 128-bit? Does it increase the probability of a ...
9
votes
4answers
1k views

Are efforts being made to bring about password standards?

Rather than adopting a universal standard, many websites develop their own guidelines for how passwords should be constructed. When you consider the number of passwords the average person today has ...
9
votes
5answers
702 views

Using a weak password on a truecrypt volume

I have put together a portable apps USB stick for when I need to use random site computers, I also threw truecrypt on with an encrypted volume for some word documents. The password I am using is ...
9
votes
3answers
1k views

Logging “password with counter” use

When prompted to update their passwords after they've become stale (whether that's after 30, 60, 90 days — whatever is implemented by policy), many users simply increment the number that they may have ...
9
votes
3answers
8k views

Can password-protected zip files be broken without brute force?

You have a zip file that you created with 7z to password-protect it with AES 128. Can a smart adversary extract the data only through brute force, or is the file vulnerable to other attacks - such as, ...
9
votes
5answers
2k views

Gold Standard for password hashing

I've developing a web application that will be dealing with highly sensitive information and I want to ensure the hashing of passwords is gold standard. Ideally I'd go for per-user salted SHA512 ...
9
votes
4answers
8k views

Regulations that specify password length?

I have read: PCI DSS 1.2 SOX 404 AR 25-2 ISO 27001 But only PCI DSS specifies a minimum password length. Are there any other regulations that dictate password lengths for any industry? NIST ...
9
votes
4answers
1k views

Reasonable way to store encrypted passwords in a webapp's database, Linux

This question is generally similar to past questions asked here, but I haven't seen one the relates to Linux. Case at hand: a PHP web app has a MySQL backend. As part of its functionality it accesses ...
9
votes
4answers
643 views

How to evaluate the strength of a hashing algorithm?

At work the hashing algorithm we use for passwords appears to be bespoke. Obviously that's a pretty bad idea, but the management don't seem bothered. The algorithm always produces 20 character long ...
9
votes
2answers
877 views

My bank makes me enter my password using the mouse. What's up with that?

Internet banking login process for Westpac requires user to enter the password using the mouse. It's annoying, what's up with that? Is it just to try and stop keyloggers on public computers or is ...
9
votes
6answers
1k views

Cracking long Windows XP passwords

Completing an assignment for my Ethical Hacking unit at University at the moment and the first task I have is to crack some passwords. Decided to use backtrack to crack some passwords from a Windows ...