Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

8
votes
4answers
640 views

Doesn't imposing a minimum password length make the password weaker by reducing the number of possible combinations?

I thought the strength of a password depended on the total number of possible combinations. Therefore, allowing longer passwords should be safer because you then have more possibilities. But why do ...
8
votes
6answers
998 views

Is it useful to protect hashed password with encryption?

Imagine that I am hashing the users' passwords with a random, long enough, salt, using key stretching, and a secure hash. Would it be more secure to finally encrypt the hash with a symmetric key?
8
votes
5answers
3k views

How to catch a gmail hacker/money-scammer? (in conversation with one right now!)

My friend's GMail account was recently hacked and the perpetrator sent out one of those classic "help I was mugged, I need money" style e-mails. (Edit: I know it's legit; my friend called me to tell ...
8
votes
3answers
821 views

Generating random passwords by clicking randomly on the keyboard?

How secure is it to generate random strings/passwords manually for different purposes by just clicking randomly on the keyboard ? I usually need random strings for salts and for passwords, and I ...
8
votes
4answers
807 views

Is storing answers to security questions in plain text bad form?

If the input for the security question is completely digital, should the answer to a security question be hashed (or at least encrypted) on the authentication server?
8
votes
7answers
804 views

How can I prevent users from using bad passwords in my web application?

There is a long discussion on whether it's the responsibility of the user or the system administrator to deal with the strength of the password. Obviously, the password is a very private thing, but ...
8
votes
4answers
2k views

Passwords - any statistics on user behavior?

I'm looking for analyses of how users choose and use passwords. I'm sure there are many resources out there that analyze user passwords. For instance, I've seen many people analyze dumps of password ...
8
votes
4answers
1k views

Why using random salts?

I read this blogpost on how to store passwords in a database, the secure way. Elbert tells us to do this: Generate a random salt and include something random and the username in it. Hash this. Hash ...
8
votes
4answers
1k views

How to protect ftp account information in the source code of a program

I wrote a game which stores high score information on an ftp server. In the the source code I need to write out the ftp link with the account name and password in it. For example: url = new ...
8
votes
4answers
1k views

Are efforts being made to bring about password standards?

Rather than adopting a universal standard, many websites develop their own guidelines for how passwords should be constructed. When you consider the number of passwords the average person today has ...
8
votes
11answers
2k views

How to easily remember lots of different passwords?

I know that you shouldn’t use the same password on every site. But, when you log into several dozen sites, keeping track of all the passwords can be pretty hard. What system do you recommend that ...
8
votes
3answers
2k views

time to crack file-encryption password - more than just iteration

I have often seen that takes x amount of time to crack a certain length password. But this just seems to be the amount of time it takes to iterate through all the possibilities. What about the time it ...
8
votes
4answers
604 views

Why does password strength matter?

I understand from a cryptographic standpoint that you want a password to be as random as possible to resist brute force or dictionary attacks. That is fine- but in what circumstances can those ...
8
votes
4answers
2k views

Hacking computers, scifi or reality

I was watching The Girl with the Dragon Tattoo, and this female hacker was really good at hacking. My question is, how is it possible for her to crack passwords besides the brute force approach? I ...
8
votes
3answers
7k views

Can password-protected zip files be broken without brute force?

You have a zip file that you created with 7z to password-protect it with AES 128. Can a smart adversary extract the data only through brute force, or is the file vulnerable to other attacks - such as, ...
8
votes
4answers
1k views

Reasonable way to store encrypted passwords in a webapp's database, Linux

This question is generally similar to past questions asked here, but I haven't seen one the relates to Linux. Case at hand: a PHP web app has a MySQL backend. As part of its functionality it accesses ...
8
votes
4answers
585 views

How to evaluate the strength of a hashing algorithm?

At work the hashing algorithm we use for passwords appears to be bespoke. Obviously that's a pretty bad idea, but the management don't seem bothered. The algorithm always produces 20 character long ...
8
votes
6answers
1k views

Cracking long Windows XP passwords

Completing an assignment for my Ethical Hacking unit at University at the moment and the first task I have is to crack some passwords. Decided to use backtrack to crack some passwords from a Windows ...
8
votes
4answers
698 views

Is using a flash drive as a base for security a safe thing to do?

I'm developing some software for schools. I've found severe flaws with the current popular school LAN protection that I feel needs fixing so I plan on releasing my own software. One the those ...
8
votes
4answers
7k views

Regulations that specify password length?

I have read: PCI DSS 1.2 SOX 404 AR 25-2 ISO 27001 But only PCI DSS specifies a minimum password length. Are there any other regulations that dictate password lengths for any industry? NIST ...
8
votes
4answers
2k views

Is forcing users to change passwords useful?

In many places, there's a policy that force the user changing it's password once a few months. The logic here is, that even if the password have leaked somehow, it'll be abused only for a relatively ...
8
votes
3answers
386 views

Increase the security of an already stored password hash

Right now we're using 1024 byte PBKDF2 with 256 byte user-specific salt and variable iterations. However, I would much prefer to be able to, perhaps once every year or two, to be able to flat out ...
8
votes
3answers
9k views

Choosing a session ID algorithm for a client-server relationship

I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
8
votes
2answers
746 views

Should user be allowed to save password in browser?

The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
8
votes
4answers
4k views

HMACSHA512 versus Rfc2898DeriveBytes for password hash

We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key The salt is 64 char randomly generated string. We allocated 2048 length on the database for the hashed base64 string ...
8
votes
4answers
5k views

HTTP Basic auth password storage more secure than Digest auth

If you are using SSL already, it appears Basic auth is the way to go since you can perform bcrypt with the password when you store it in the database, where as Digest auth only allows md5. As we know, ...
8
votes
4answers
4k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
8
votes
6answers
933 views

Does repeating one word to form a password result in a similar pattern in its encrypted format?

If i use a single word to form a password by repeating it like the examples below: securesecuresecuresecuresecuresecure SeCuReSeCuReSeCuReSeCuReSeCuReSeCuReSeCuRe ...
8
votes
5answers
526 views

Utility company does not hash passwords in the database

I had to use my utility company's online account information application and forgot the password. Going through the steps of resetting the password I was emailed the password in the open. I found this ...
8
votes
6answers
7k views

One Time Passwords. Using OTP at Windows, Ubuntu and internet sites

my question is this: Is there a way (software,hardware/token or web-ware) to use One Time Passwords in the following scenarios: Logon to my pc/laptop (windows or ubuntu) Logon to sites with OTP ...
8
votes
3answers
1k views

Is this code snippet good enough for password hash and salt

After a few days reading up about salting and hashing passwords, I found an actual bit of code that tells how to do it. This is what I found: $blowfish_salt = ...
8
votes
2answers
632 views

Plain Text Password Reset Vulnerability

If I receive an email with a plain text generated password (in response to a password reset request), is this a vulnerability? The password expires after one use, in other words the user has to change ...
8
votes
2answers
506 views

Banning specific passwords?

There have been a couple of questions about enforcing good passwords, so I thought I'd add my own: In addition to enforcing a minimum Shannon entropy, would it generally be a good practice to ...
8
votes
3answers
803 views

Calculating how secure my password is

I generally use gnuPG for encrypting my files. And as far as I know it's strength ultimately depends on the passphrase I use. So, I would like to know: how can I mathematically calculate how secure my ...
8
votes
3answers
4k views

Is LastPass' locally stored One-Time-Password recovery a security problem?

If you forget your LastPass master password then LastPass provides the possibility to recover access to your vault using a One-Time-Password (OTP) which is stored locally but is initially disabled. ...
8
votes
2answers
693 views

Is there more to password hashing?

You have a plain text password and salt. The plain text password is assumed to be securely random and only known by the user and the salt is no secret and not necessarily unique but stored alongside ...
8
votes
4answers
394 views

Will passphrases always be secure?

In a world where most people used passphrases instead of passwords, wouldn't an attack that generates a random string of words (alternating between word delimiters) be similarly effective to a brute ...
8
votes
3answers
18k views

How secure is WD MyPassport lock

I have a WD My Passport hard drive. There is an option that allows you to lock your hard drive with a password. How secure is this lock? They don't give details about the encryption algorith or the ...
8
votes
1answer
2k views

How will security need to be changed if P=NP?

If we suppose that it is found that P=NP, how will security measures need to be changed? I'd like to know the major security measures that are affected, and how they would need to be changed. We can ...
8
votes
2answers
515 views

Security risks of typing wrong password

I accidentally typed my root account password on my google account login, I know google keeps their website quite safe but this question came in mind: Is there a risk if you accidentally type in ...
8
votes
3answers
1k views

Is it safe to generate passwords online?

I usually generate strong passwords using various online tools. Some time ago I mentioned it to friend of mine and he looked at me as if my life was one big fail. Is it really so unsafe to generate ...
8
votes
4answers
705 views

Hash(master + hostname) password scheme for a server pool

I manage about 20+ Linux servers and I am considering using an md5 scheme similar to following to generate the admin passwords: echo 'masterpassword' 'serverhostname' | md5sum Which returns ...
8
votes
3answers
606 views

Which authentication at the end of the Secure Remote Password protocol?

For the the client and server to prove to each other that they have the same premaster shared key, the original author suggests this: M = H(A | B | K) --> <-- H(A | M | K) ...
8
votes
5answers
181 views

Citations for inadvisability of globally unique password

I am looking for an authoritative source to back up my position in a disagreement over password policy. I am having a disagreement with a client about the user identification/authentication process ...
8
votes
4answers
697 views

Do honeywords add any real security?

This paper proposes the concept of honeywords for detecting if a password database has been compromised. As far as I understand it works like this: You save n password hashes for each user, one that ...
8
votes
2answers
1k views

Are the SS64.com password generators a good approach?

There are two password generators on ss64.com: The standard one The strong one How they work I made standalone versions of them, plus copy of the original HTML/Javascript versions, if you want to ...
8
votes
1answer
876 views

Reversible password storage obfuscation method for third-party login credentials

I have an internal business application, that as part of its functionality connects to a third-party app using login credentials specific to the user of my own app. These passwords are stored in a ...
8
votes
4answers
657 views

How can we factor Moore's law into password cracking estimates?

How would we go about factoring Moore's law into exceedingly long password cracking estimates? Let's say we've got a 12 character password containing mixed-case alpha characters and numbers, i.e. ...
8
votes
1answer
421 views

Protecting emails in your database

It's common to encrypt passwords in the database, but I'm wondering what solutions are out there to protect emails in your database. Not just from hacking, but from disgruntled employees or engineers ...
8
votes
3answers
2k views

Encrypting user data using password and forgot my password

I am planning to do a web application which stores a lot of personal stuff (info, photos...). And to give users a sense of protection, I want to encrypt the data before storing it to the database. ...