Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
4
votes
3answers
370 views
Is using the same password for multiple TrueCrypted volumes safe?
I want to use TrueCrypt for encrypting multiple disk volumes.
Assume I use the default cryptographic algoritm (AES) and hash algorithm (RIPEMD-160) and that nobody can get my passwords through ...
4
votes
3answers
1k views
Possible to use both private key and password authentication for ssh login?
It seems that they are mutually exclusive, as disabling one gives me the other, and vice versa. Two-factor auth for my ssh servers sounds really nice, so is there any way to accomplish this?
4
votes
4answers
394 views
Do password complexity requirements reduce security by limiting search space?
I've read that password complexity requirements make passwords easier to guess via brute force attack. The reason for this is that the complexity requirement actually reduce the search space for brute ...
4
votes
5answers
3k views
Is a longer WiFi password more secure?
Today I had to type the same password to connect to a WPA2-secured WiFi network several times, and got really annoyed with the length of the password. Especially since it is just a phrase repeated ...
4
votes
4answers
8k views
Modern high quality password dictionary
Has anyone come across any good password dictionary lately? Some of the lists I found dated back to 90's! Some are simply too big that I doubt their quality. There appears to be some work by someone ...
4
votes
6answers
1k views
Retrieving OSx Keychain passwords
I have a computer forensics style osx login.keychain file that I am trying to find the passwords from.
I have a very weak mac which I used crowbarkc on to try and brute force but the horsepower is ...
4
votes
3answers
360 views
Tracking stolen laptop which has a login password
I have been reading about solutions that track your computer in case of missing. Since I'm using Ubuntu 12.04, the best option would be prey for me, but I'm open to other suggestions.
The question is ...
4
votes
2answers
94 views
HMACSHA512 versus Rfc2898DeriveBytes for password hash
We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key
The salt is 64 char randomly generated string.
We allocated 2048 length on the database for the hashed base64 string ...
4
votes
3answers
239 views
Are there any regulations against financial companies storing passwords in plaintext?
A bank that I use stores my password in cleartext or perhaps using reverisible encryption, which is just as bad.
I know this because when you click "Forgot your password?" (or similar) link, it ...
4
votes
6answers
4k views
Recommend Length for Wi-FI PSK?
I currently have a network set up with WPA2 and AES encryption, the password is 8 characters long but was randomly generated and contains no dictionary words. However I'm concerned about the ...
4
votes
3answers
331 views
Hashed passwords - How many variations of rainbow tables?
First off...I passed the CISSP exam. WOOOO. I had to get that out. GCIH and CEH by Sept. 11'
So, while studying for the technical side of things, I see that there are rainbow tables. They are ...
4
votes
1answer
485 views
Why does Windows 7 require a password hint during setup?
Correct me if I am wrong, but I think Windows 7 is the only operating system out there that requires a hint for the first user created on the system (have not had a chance to check out Windows 8 ...
4
votes
3answers
942 views
Reverse-engineering one-time passwords for two-factor authentication systems
Given a one-time password generator that is time-based (such as Google Authenticator), how many instances of (time, PIN) pairs would one need to significantly weaken the algorithm to a point where one ...
4
votes
4answers
705 views
Brute-force heuristics used in password cracking
Existing questions on this site discuss some of the heuristics used by password cracking tools to avoid doing a completely naive brute-force search (for example, "dictionary word with number ...
4
votes
5answers
211 views
Are password complexity rules counterproductive?
In creating a login for this site I chose a nondictionary password that would be extremely hard to guess, but easy to remember.
I was told that it did not meet complexity rules.
After several ...
4
votes
2answers
185 views
Passphrase using same word several times
I used a trivial 3-letter dictionary word five times in a row (smth similar to pwdpwdpwdpwdpwd), and am surprised to find my self in the list of hacked accounts in a penetration test using a ...
4
votes
3answers
208 views
Completely mimimise the possibility of my web hosting account being hacked
I've just moved web hosting providers and I want a fresh, secure start. To a certain extent, I don't mind what I have to do I'm just fed up my account being hacked or infected. I just wondered how to ...
4
votes
2answers
822 views
openssl: recover key and IV by passphrase
A large amount of files were encrypted by
openssl enc -aes-256-cbc -pass pass:MYPASSWORD
Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
4
votes
2answers
165 views
Did I miss anything when checking for passwords?
I was provided with a "challenge" forensics image of 2MB in size (floppy); they provide the disk image and want you to uncover as many passwords as you can find. I downloaded the image and dd'd it to ...
4
votes
1answer
201 views
Should password hashes be encrypted or HMACed?
Assume I am hashing user passwords with PBKDF2, bcrypt, scrypt, or some other secure key derivation function.
Are there:
tangible security benefits,
precedents, and
respected research
for ...
4
votes
2answers
394 views
Storing third-party auth info securely
Suppose there's a multi-user web application that requires access to user's mailbox (on third-party service, like gmail, etc.). This access needs to be persistent. Which means we'd have to store user ...
4
votes
2answers
112 views
How often should passwords change?
I'm asking two very related questions
As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their ...
4
votes
1answer
151 views
Saved passwords (use case)
I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together.
Both the data and the password are encrypted ...
4
votes
2answers
144 views
How secure are passwords that are set via IRC's /nicksrv?
I just registered a nickname on IRC and had to use a password to register it. Given that I've only used IRC, but never understood the P2P mechanics of it, I'd like to know:
Is the password I ...
4
votes
4answers
583 views
Is encrypting a salt value with a password/plaintext a viable alternative to straight up hashing?
The basic problem, as far as I can tell, is that hashing's flaw is that the password is in the hash. Asymmetric encryption's flaw is that the password is encrypted and can be reversed.
The posts ...
4
votes
3answers
149 views
Is using encryption the only viable option to thwart password sniffing?
I'm using HTTPS Everywhere on my browser to chose SSL versions of websites when available, but many sites don't offer a secure version. Is SSL the only viable option to thwart password/clear text ...
4
votes
3answers
3k views
What password-based encryption to use with standard Java 6?
Which password-based encryption method should I use in Java 6? It should be as strong as possible, but work with the default security policy file (not the export restricted one which you have to ...
4
votes
1answer
80 views
Could a password hash that's prone to more collisions provide better overall security?
Website security breaches seem to be a common occurrence, giving the attacker password hashes that he can conduct a brute force attack against, often given him a list of passwords that will work on ...
4
votes
3answers
120 views
Do email clients reduce security?
I have recently taken a security course, and have learned a lot about, among other things, the way passwords are stored, etc.
Afterwards I was thinking about the way that passwords are stored for ...
4
votes
3answers
375 views
Encrypting user data using password and forgot my password
I am planning to do a web application which stores a lot of personal stuff (info, photos...). And to give users a sense of protection, I want to encrypt the data before storing it to the database.
...
4
votes
1answer
192 views
How will security need to be changed if we can crack password hashes in quasi-polynomial time?
If we suppose that we have access to some form of generalized password hacking/cracking that can somehow find an $n$-bit password in time $O(n^{\log n})$, is there need for alarm?
This question ...
4
votes
2answers
172 views
How to prove a password guessing theory from Matt Bishop's book “Introduction to Computer Security”
First, this is not a homework problem. This is a problem from Matt Bishop's book "Introduction to Computer Security" which was used as one of the textbooks for a Computer Security class I took last ...
4
votes
7answers
642 views
What is the best way to securely keep clear passwords?
I'm working on a web project that will connect to a database. For that, I will have to store the login/password of that database user in clear (encrypted in a symmetrical way) in order to be able to ...
4
votes
3answers
2k views
How to crack password hashed using SSHA?
Is it possible to crack a password hashed using SSHA if I know the salt? How can I do it?
4
votes
2answers
821 views
openssl_digest vs hash vs hash_hmac? Difference between SALT & HMAC?
openssl_digest vs hash vs hash_hmac
I want to use SHA512 for storing password.
Which of the above methods are best to use? Why?
What is the difference between SALT & HMAC?
I just read ...
4
votes
2answers
1k views
Reference implementation of C# password hashing and verification
Does anyone have a reference implementation (ideally 3rd party certified, or government approved) way one-way hash a password for C# and or Java?
Ideally,I'd like to see something that includes a ...
4
votes
1answer
144 views
Reducing password length with hash function
Suppose I would like to use a very long string as a password. As an example we can just say this string is 100 characters in length.
However, suppose the application for which I would like to use ...
4
votes
1answer
112 views
Need to ephemerally store third-party password
One particular web service that I am writing interfaces with an API. Each API call requires the user's username and password to be sent, no state is maintained.
Ideally, when using my web service the ...
4
votes
2answers
101 views
Does the password you use to sign into a VPN determine the strength?
I subscribed to a VPN service and need to change the password. Does the password I use to log in determine the strength? For example should it be 64 characters long or can it be 10? I'm thinking of ...
4
votes
3answers
272 views
password complexity policy for non “English” passwords
In an internationalized application, what is the best practice for a policy on complexity of passwords? I am not having luck searching for the answer. Wikipedia lists these items for password ...
4
votes
1answer
550 views
Is a public known password protected Wifi more secure than one without a password?
When connecting to a public Wifi from a café for example, some don't use a password and some do. If they do use a password it is often publicly known to everybody around.
Does having a password on ...
4
votes
3answers
179 views
Decoy User Account on Windows
Is there a way to have two passwords for a Windows account? One password unlocks the decoy version of the account and the other unlocks the "real" version of the account. I would use Truecrypt's ...
4
votes
1answer
330 views
Can a Bitlocker To Go user pin be brute forced?
I have a external hard disk and protected a partition on it with Bitlocker To Go. I printed the recovery code but I lost it. I can't remember the user PIN either. If I could only know the first ...
4
votes
1answer
416 views
Why does Microsoft limit password length? [duplicate]
Possible Duplicate:
Should I have a maximum password length?
According to a recent TNW article:
Microsoft doesn’t like long passwords. In fact, the software giant not
only won’t let ...
4
votes
3answers
645 views
How can I report PCI-DSS violations?
A large supermarket chain in the UK, are storing their passwords in plaintext. Apparently, Mastercard's security department are already involved. I'd like to report them for violating PCI-DSS, since ...
4
votes
3answers
301 views
How should I choose a difficulty factor for my password hashing function?
Assuming that I'm doing password hashing properly and using bcrypt, scrypt or PBKDF2, how should I go about choosing an appropriate difficulty factor? i.e rounds for bcrypt, iterations for PBKDF2 and ...
4
votes
1answer
161 views
Thoughts on creating unscalable conditions to brute force even small passwords?
I stumbled upon something called "scrypt" which claims to add fixed time/space complexity requirements into password-based key derivation.
Quoting from their page:
A simple password-based encryption ...
4
votes
2answers
5k views
Where/How is an ODBC password stored when 'saved' in Access?
I have been working on a program that uses MS Access and ODBC to connect to an SQL server. One of the requirements is that the user need not know the password for the connection to the SQL server, so ...
4
votes
2answers
889 views
Cisco IOS question - password management, service password encryption types
I'm university student studying for my certification exam, and I was doing some reviewing today when I found a question that I can't find an answer to.
Basically, in the CCNA3 2.4.1 Cisco Netacademy ...
4
votes
1answer
1k views
Rainbow tables, generation and lookup, preferably using GPU
1a) What software can I use to generate my own rainbow tables, preferably software that can utilize CUDA or ATI Stream?
One of the reasons I want to make my own, is that I want to use a specific ...
