Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
1
vote
2answers
88 views
Allowing user to access password protected website without disclosing the password
A friend of mine has the following problem. She is an accountant and her clients frequently give her their login credentials so she could download their accounting data from various financial ...
0
votes
1answer
52 views
After salting my passwords, are they protected against dictionary attacks? [duplicate]
I use sha1() to hash my users passwords, but recently a friend told me that if someone get the hash then they could use dictionary attack and he recommended using salts.
I implemented a random salt ...
6
votes
1answer
369 views
Working out how to decrypt encrypted string when knowing the plain text
I have access to a system which I have been asked to create a data export routine for. However, the address details are encrypted and the original sourcecode/password are lost.
However, I am able to ...
0
votes
1answer
47 views
How can I encrypt my router admin page login session? [closed]
I login to my router using the web connection but the session is not encrypted, is there a third party way to encrypt the web session so no one on my network can sniff the password?
-1
votes
1answer
78 views
Are there low-tech ways to reliably generate passwords? [duplicate]
Between the online services I use, and the number of machines and networks I need login credentials for, and how often some passwords need to be changed, I am faced with the choice of forgetting most ...
6
votes
5answers
2k views
Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security?
0
votes
0answers
42 views
How can I recover the password of a TrueCrypt vlume? [duplicate]
I am trying to recover the password of a trucrypt volume.
It is composed by a combination of 4 words (one invented). I remember 3 of them but not their order.
Do you know any tools that cold help me ...
-1
votes
1answer
82 views
Why do website limit password length? [duplicate]
I just made a new account with some eGov service (Belgian government).
I use LastPass (generate long random strings for each site).
But the system told me that the maximum allow length was 16 ASCII ...
1
vote
2answers
34 views
How to manage company passwords when employing temporary freelancers?
I am from a marketing firm which now has a development team, which i am part of. We have been tasked with finding a few freelancers who can come in and work when either me and the other developer is ...
10
votes
5answers
957 views
How secure is the SRP that Blizzard uses to protect passwords?
Blizzard very recently announced that their network was compromised, but they assure users in their statement that the password information that the attackers had access to was saved in a secure way:
...
-7
votes
1answer
99 views
Is EU based company Wuala secure Dropbox alternative? [closed]
I am not satisfied with Dropbox security and have found this company called Wuala:
http://www.wuala.com/en/about/
I saw this picture illustrating encryption :
The 3rd column is Wuala. Dropbox is ...
376
votes
21answers
59k views
XKCD #936: Short complex password, or long dictionary passphrase?
How accurate is this XKCD comic from August 10, 2011?
XKCD 936: Password Strength
I've always been an advocate of long rather than complex passwords, but most security people (at least the ones ...
2
votes
2answers
63 views
Server checking client's password without ever coming into possession of it
tl;dr: I am wondering what the best way is to check a password when the client does not trust the server.
I know of two common ways servers can check if a user's password is correct:
The server ...
6
votes
3answers
285 views
Can cloud based password managing services be trusted?
I'm a big time user of cloud based password managing services like LastPass.
But in the light of recent revelations like various government backdoors in popular sites, programs like prism, etc. I'm ...
-2
votes
0answers
42 views
How safe is a Random 15 Char Upper-lower-Alpha-numeric unsalted SHA512 password [closed]
Can't seem to find an answer for this or a realistic table that would point me on the right direction. So...
How safe is a Random 15 Char Upper-lower-Alpha-numeric unsalted SHA512 password?
How long ...
41
votes
5answers
5k views
Is sending password to user email secure?
How secure is sending passwords through email to a user, since email isn't secured by HTTPS.
What is the best way to secure it? Should i use encryption?
176
votes
4answers
44k views
Do any security experts recommend bcrypt for password storage?
On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
-1
votes
0answers
27 views
Python Library for Generating Passwords? [closed]
Some time ago I was reading 2600 and they mentioned a password generator which I believe was written in Python; It would take two words as an input, and generate a password. It was useful in that if ...
1
vote
1answer
60 views
What are the security implications of using TOTP for single factor authentication?
(Note: I am not actually planning to do this. This question is strictly theoretical.)
TOTP is commonly used as the second factor in Two Factor Authentication. It is an open standard with available ...
-3
votes
1answer
62 views
Feasibility of brute-force on online password [closed]
I am familiar with how offline brute-force attacks work. But for online accounts, assuming no social engineering, how feasible is it to brute-force attack a password? For example, is this dependent ...
3
votes
3answers
155 views
Recover Server 2008 R2 Domain Admin Password
So I did the ultimate silly thing: I lost my domain admin password for my Server 2008 R2 box.
Sure, I could just re-install but that's going to be a huge pain. I tried rebooting with the Windows ...
8
votes
6answers
12k views
Is howsecureismypassword.net safe to use?
Is it safe to enter my real passwords to test them?
I mean, are the entered passwords being recorded/transmitted to someone else?
4
votes
4answers
186 views
Composition of passwords
Passwords (passphrases) that are taken from known texts (books etc.) are commonly considered to be weak, but what if they are employed in combination with random stuffs, i.e. in forms of AX, XA or ...
35
votes
6answers
2k views
A client wants to tell me his home laptop's password. Must I push him towards a more-complex alternative?
I'm an IT consultant in Canada. One client has known me for a few years. He wants me to do some work on his kids' laptop again. I'll need to log into his kids' Windows user account. (I'm guessing that ...
35
votes
8answers
24k views
Where can I find good dictionaries for dictionary attacks?
Iâm wondering where I can find good collections of dictionaries which can be used for dictionary attacks?
I've found some through Google, but Iâm interested in hearing about where you get your ...
2
votes
2answers
52 views
What exactly is 'single' mode in John the Ripper doing?
I'm testing out John the Ripper (1.7.9 Jumbo 7) on a file containing MD5 hashes without any usernames. I've been experimenting with different rules and configurations â I am currently using a wordlist ...
0
votes
2answers
88 views
Where is my password stored on Linux? [duplicate]
Is there a specific location where the passwords are stored ?
Is it depending on which version is used ?
Are they salted ?
6
votes
3answers
157 views
Can I spoof IP addresses when attempting to brute force a login?
I am testing my website with hydra brute-force software. But accessing my apache conf remote server file, it seems that an attacker can't log-in more a limited number of times per seconds. Does hydra ...
5
votes
1answer
145 views
Where is my password stored on Windows 7?
Is there a specific location where the passwords are stored ?
Are they salted ?
4
votes
3answers
164 views
Is it safe to store password in HTML5 sessionStorage?
I am trying to improve the user experience on registration by not requiring the user to retype their password if validation on other fields fail. There are a few ways to implement this, example using ...
0
votes
2answers
171 views
Is user password in ubuntu 13.04 in plain text?
Is it stored in plain text or not?
Where can I find the file that contains the username and password for my accounts in Ubuntu 13.04?
-10
votes
0answers
191 views
A freinds father died. Left an password protected iPad. Is there a way to unlock it? [migrated]
A freinds father died a couple of weeks ago. He usally used the same numeric password on all devices. But not on his iPads. I can't even reproduce the password via the fingerprints. The lock time is ...
123
votes
11answers
15k views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the ...
2
votes
1answer
96 views
Can I properly make password-protected 7z archives secure?
After reading the question and answers of this and this, I left with an overall impression from the last one that zips were considered not safe and insecure way of sharing data.
I still think ...
15
votes
3answers
821 views
Router password vs MAC filtering?
I just bought a Galaxy S4, and it didn't connect to the WIFI in my house (I have a 14$ router). After a bit of testing, I've decided to leave my connection open without a password, but added the ...
5
votes
5answers
175 views
Is including a secret GUID in an URL Security Through Obscurity?
I know that this question is a little bit on the side of Opinion/Discussion, but I think there's a provable answer to it.
I think the common view of "Security Through Obscurity" is that the security ...
5
votes
2answers
82 views
Is it common for a One-Time-Password system to become unsynchronized?
One-Time Passwords look like they can play a helpful role in a layered-security system, yet their use, especially paper-based TANs seem like clients could be vulnerable to getting out of sync with the ...
2
votes
1answer
112 views
Similar passwords can't be used again. A sign of unhashed password storage? [duplicate]
In my school everyone must change their password every six months.
The new passwords cannot be the exact same as the old one, this make sense, however many of my peers often complain that they need ...
0
votes
2answers
105 views
Why store the password salt instead of generating it? [duplicate]
So, reading through this article: http://crackstation.net/hashing-security.htm it says that storing the salt is fine in plain text because it renders the lookup/rainbow tables ineffective. I get that, ...
8
votes
7answers
381 views
Why should I hash passwords?
I've read that every good web application should hash passwords. I found many articles about hashing.
So I started implementing hashing on my website and then I asked myself why should I do it? When a ...
-4
votes
2answers
136 views
FileZilla stored paswords get stolen [closed]
My FileZilla passwords has been stolen and used. How is this possible? FileZilla should store the passwords encrypted. I don't get it. I have only 6 months old version of FileZilla installed on my ...
4
votes
3answers
88 views
Is it worth padding passwords?
I'm using phpass (bcrypt) to hash the password and SSL when it's transmitted, and using PDO (with PHP) to stop injections, is it worth padding the password, so that if the user enters "123456" as the ...
7
votes
5answers
301 views
Is there any good reason not to salt/hash passwords you store?
Two organisations I frequently deal with (including my bank) ask me my password to authenticate myself with them... well... they ask for "random" characters from my password.
As I understand it, this ...
4
votes
1answer
133 views
WPA2 audit tool
For the purposes of my own research, I have a very modest budget to set up a modest WPA2 brute-forcer supported by GPU(s).
I've done some homework:
Brute-Force GPU Password Crackers
How to setup ...
-3
votes
0answers
42 views
Securely Accessing Email Account and Storing Login in Web Application
Goal: Registered user will authenticate an email account, allowing the web application to fetch emails every X minutes and display on the webpage. Authentication will be stored for the user (i.e. if ...
19
votes
5answers
1k views
How can I choose a strong password that is easy use on a smartphone?
Typing on a smartphone is tedious. Special characters are the hardest; lowercase letters are generally the easiest. But even a long all-letter passphrase like "correct horse battery staple" is ...
10
votes
3answers
1k views
Why are passwords limited to 16 characters?
What is the reason that most websites limit to 16 characters?
I would have thought the longer the password the more difficult it makes it for someone to crack it?
Is it something to do with hash ...
-2
votes
0answers
44 views
Multi-step logon with KeePass [closed]
Is it possible to configure KeePass to perform multi-step logons? For example, if I wish to access an online banking portal, I first encounter:
mybank.com/logon_step_one
(prompted for:)
Member ...
3
votes
2answers
352 views
How do I block LinkedIn from extracting data from Microsoft Exchange Server?
LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click ...
25
votes
8answers
3k views
Are password-protected ZIP files secure?
Following my answer. If I can list contents of password-protected ZIP file, check the file types of each stored file and even replace it with another one, without actually knowing the password, then ...
