Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
0
votes
0answers
29 views
WPA2 audit tool as of 2013? [closed]
For the purposes of my own research, I have a very modest budget to set up a modest WPA2 brute-forcer supported by GPU(s).
I've done some homework
Brute-Force GPU Password Crackers
How to setup ...
1
vote
3answers
3k views
Windows 7 Password Hash Security
I recently came across a number of sources that suggest that cracking Windows user account passwords is easy by examining their password hashes.
I understand that these hashes are stored in the SAM ...
24
votes
10answers
3k views
Intel How Strong is Your Password page, good advice?
I came across this Intel How Strong is Your Password? page which estimates how strong your password is.
It has some advice on choosing better passwords including that you should use multiple ...
2
votes
1answer
75 views
Brute-Force GPU Password Crackers
Brute-force password cracker programs which claim GPU support include John the Ripper, ighashgpu, oclHashcat, and others. oclHashcat appears one of the more popular, but I am not sure which AMD/ATI ...
10
votes
5answers
915 views
How secure is the SRP that Blizzard uses to protect passwords?
Blizzard very recently announced that their network was compromised, but they assure users in their statement that the password information that the attackers had access to was saved in a secure way:
...
0
votes
2answers
131 views
Bruteforce Passphrase of Dictionary Words
Consider the all lowercase passphrase:
"lazy fox haggles treaty"
Assume all four words are in a dictionary of 2000.
Bruteforcing word combinations, how long does it take to crack this password at ...
-2
votes
2answers
40 views
Looking for safe, simple way to store passwords with PHP 5.2.17 [duplicate]
I've found many posts on StackOverflow and other sites using Google, but since security is always changing, and what was safe a few months ago not me anymore... I felt the need to ask on here.
...
25
votes
8answers
2k views
Are password-protected ZIP files secure?
Following my answer. If I can list contents of password-protected ZIP file, check the file types of each stored file and even replace it with another one, without actually knowing the password, then ...
-4
votes
1answer
66 views
How can I crack ArrayOS password [closed]
I have some Array Load Balance device that the user password hash like:
user "array" "XXXXXXXXXVkjTX9a1kYtNo".
How can I crack the password or find out the algorithm of the hash?
52
votes
7answers
2k views
Touch Screen Password Guessing by Fingerprint Trace
After having some garlic bread at a friend's who is not security-aware, she managed to figure out the PIN code to unlock the screen of my Samsung SIII.
The way she figured this out was by simply ...
-2
votes
1answer
156 views
Unsolicited Password Request from Facebook
Today I have received 3 emails to my three different addresses, one with Google, one with MSN, and one with my company. All emails were sent from password+kjdmiikvhppi at facebookmail.com email ...
7
votes
3answers
172 views
Plain Text Password Reset Vulnerability
If I receive an email with a plain text generated password (in response to a password reset request), is this a vulnerability? The password expires after one use, in other words the user has to change ...
-1
votes
0answers
51 views
Which is the most popular one time password based authentication scheme? [closed]
Which is the most commonly used (popular) one time password based authentication scheme?
15
votes
6answers
829 views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
2
votes
2answers
34 views
Does glibc2 version of the crypt function still use DES for alternative hashing methods?
I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted ...
0
votes
3answers
336 views
What about fuzzy passwords? For “correct” entry within a margin of error?
I'm wondering if a fuzzy password system would be in any way beneficial to users, or worth implementing.
The idea would be that a certain margin of error is acceptable for allowing the user to log ...
0
votes
1answer
71 views
Password storing in Google Chrome content scripts
I am planning to store the login credentials in Google Chrome content scripts. The content scripts will then use these credentials to login to a website when I open it in Chrome.
I wanted to ...
139
votes
18answers
7k views
Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field
Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
20
votes
2answers
1k views
Does versioning an encrypted file make it less secure?
Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices.
The kdb file in itself would be encrypted, but ...
44
votes
11answers
6k views
How reliable is a password strength checker?
I've tested the tool from Microsoft available here which tests password strength and rates them. For a password such as "i am going to have lunch tonight", the tool rates it's strength as "BEST" and ...
3
votes
3answers
380 views
Can password-protected zip files be broken without brute force?
You have a zip file that you created with 7z to password-protect it with AES 128. Can a smart adversary extract the data only through brute force, or is the file vulnerable to other attacks - such as, ...
0
votes
5answers
241 views
Pronounceable Password Generator
I am currently looking for a password generator which produces pronounceable passwords. I have used this random password generator a few years ago to generate a 42 characters long password and found ...
-1
votes
0answers
52 views
If someone know my IP address? [duplicate]
With my IP address. What can they do exactly? Can they spy on every move I make, Like I post here or about my another ID or if i create new e-mail or face book? is it possible to find out all of my ...
8
votes
3answers
1k views
Hacking computers, scifi or reality
I was watching The Girl with the Dragon Tattoo, and this female hacker was really good at hacking. My question is, how is it possible for her to crack passwords besides the brute force approach? I ...
3
votes
2answers
100 views
Protecting Password Hashes with Store Procedures?
I was thinking about the recent (seemingly weekly) security breaches we've seen where millions of password hashes have been leaked and I was wondering how one might secure their site against a ...
22
votes
7answers
3k views
Is salting a hash really as secure as common knowledge implies?
(I did search on this topic, but I found no complete question/answer that addressed it, or even good portions of questions that might be relevant.)
I'm implementing a salt function for user passwords ...
10
votes
5answers
297 views
What is the best way to hand out passwords to a widely spread diverse employee base?
I have a problem I need to solve - specifically, how to hand out passwords to people in a variety of locations, and with a wide variety of access.
I've thought of some options, but there are ...
-3
votes
0answers
74 views
My Evaluation on the Recent Honeywords Paper [closed]
I just read the paper "Honeywords: Making Password-Cracking Detectable" and have some thoughts about the reality and viability - as well as weaknesses of this approach.
My initial take is that this ...
-3
votes
1answer
55 views
Good Password Length [duplicate]
If you are looking to be careful and your passwords include all the types of characters, what is the ideal password length?
5
votes
2answers
91 views
Password list generation
I've found during a lot of recent pen-tests that companies will use passwords like
c0mp4ny@b(
for a company called "company abc"
Is there any quick and easy way to generate a list of passwords ...
2
votes
4answers
170 views
When salting and hashing passwords, any advantage to including password length?
In this answer, Gilles says (emphasis mine):
There's no need to hide the salt from the attacker: it needs to be unique (and not derived from the password) but it doesn't need to be more secret ...
0
votes
1answer
100 views
Using JTR to crack Skype Passwords
The scenario: coworker's Skype somehow lost his auto-fill password. He doesn't remember it anymore, and the account is hooked up to an email address that no longer exists. He's never purchased any ...
5
votes
4answers
247 views
Do honeywords add any real security?
This paper proposes the concept of honeywords for detecting if a password database has been compromised.
As far as I understand it works like this:
You save n password hashes for each user, one that ...
1
vote
1answer
60 views
Simple and secure remote installation method that accepts input via a web page?
When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner?
...
6
votes
6answers
312 views
Cleartext password in HTML
Is there any problem with outputing a user's password to the HTML in an hidden field (see use case below before flaming xD)?
The use case is a registration form with two steps. The user fills in the ...
31
votes
41answers
3k views
What is your way to create good passwords that can actually be remembered?
What are the methodologies which can be used to generate "human" good quality password?
They have to ensure a good strength and also easy to remember for a human being.
-8
votes
0answers
73 views
New work phone that belonged to someone else [closed]
I got a phone at work that belonged to someone else. I still get calls intended to for him, but is it possible that I am seeing his WhatsApp messages (I get messages and I don't recognize the sender) ...
24
votes
1answer
968 views
What's the risk if I accidently type my password into a username field (Windows logon)?
I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
13
votes
7answers
3k views
Why do people still use/recommend MD5 if it is cracked since 1996?
It's still commonly recommended way of hashing passwords, even if it's insecurity had been proven in 1996
Therefore we suggest that in the future MD5 should no longer be implemented in ...
4
votes
2answers
94 views
HMACSHA512 versus Rfc2898DeriveBytes for password hash
We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key
The salt is 64 char randomly generated string.
We allocated 2048 length on the database for the hashed base64 string ...
4
votes
1answer
80 views
Could a password hash that's prone to more collisions provide better overall security?
Website security breaches seem to be a common occurrence, giving the attacker password hashes that he can conduct a brute force attack against, often given him a list of passwords that will work on ...
4
votes
3answers
120 views
Do email clients reduce security?
I have recently taken a security course, and have learned a lot about, among other things, the way passwords are stored, etc.
Afterwards I was thinking about the way that passwords are stored for ...
0
votes
3answers
104 views
Why one time passwords using nested hash chain are not used?
I am wondering, why web sites do not use one-time passwords generated by hash chain. By that I mean that a client chooses a secret and after being salted, he applies some secure hash function F() on ...
3
votes
2answers
129 views
Masking password when typing vs hiding input when typing
There is a command-line application that interactively prompts you for your password to a third-party service. Whereas e.g. sudo completely hides your input as you type your password, this ...
1
vote
2answers
139 views
Avoiding Brute Force Attacks in a Web Based Login Form
My login form uses Ajax so it doesn't need to reload if the password is wrong. A PHP script process the request and creates the session if the credentials are right. My idea is to have the PHP script ...
9
votes
3answers
464 views
Do users of non-latin character languages suffer from spyware and trojans?
Do Chinese, Japanese, other languages that can't be represented in ASCII get their passwords stolen? I figure there can't be some sort of bruteforce attack software for them, right? Their characters ...
0
votes
2answers
76 views
Does hash solve passwords in parts?
From an answer this earlier question: Does adding dictionary words to passwords weaken them?
"...you have no way to recognize it as a password before testing it
(against a hash or an online ...
114
votes
11answers
14k views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the ...
10
votes
7answers
417 views
Does adding dictionary words to passwords weaken them?
This might sound like a stupid question, but hear me out. If I'm encrypting my financial information and sensitive data via a program like TrueCrypt, the strength of the password is going to matter a ...
4
votes
2answers
112 views
How often should passwords change?
I'm asking two very related questions
As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their ...
