Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

-1
votes
2answers
4k views

Hydra https-form-post

I have never experimented much with online password crackers. I attempted to use Hydra today on this website www.athena2.harker.org and I keep getting false positives. This is what I have done so ...
1
vote
1answer
45 views

Password-less authentication in web apps - How safe it is?

I read a long time ago this article about how could work a Password-less Authentication System, which sounded to me like a great idea. I even built it in a small fun little application for fun. To ...
2
votes
1answer
61 views

Plain text password emailed back during registration [duplicate]

I would like to ask if the passwords in the database are not encrypted if during registration I am receiving plain text password with username.
11
votes
3answers
2k views

Why do some bank websites use passwords that are not case sensitive?

It was recently brought to my attention that a certain big bank website allows users to log in with passwords that are not case sensitive. After confirming this, I checked other websites I bank with ...
3
votes
4answers
202 views

How do clients enroll using SRP?

From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
4
votes
0answers
22 views

Re-display password in registration form good or bad?

When a user tries to register and the data he submits are not right such as bad email, or weak password, we would display the registration page again to him with the data he just submitted along with ...
2
votes
1answer
949 views

How secure is automatic authentication in Skype?

How secure is checking the automatic authentication option in Skype client? What if I sign in with Microsoft account instead of Skype id? What if both accounts are merged? Is there any documentation ...
1
vote
0answers
70 views

Decode Obfuscated Malicious PHP Code [on hold]

I found 3 php files in a htaccess-password-protected upload folder on my server: 1. default_folders.php 2. factory.php 3. HMAC.php Each of them contains a variable string, eg: <?php ...
1
vote
1answer
44 views

Has anyone used this ICLOAK USB device? [on hold]

Does anyone know about this ICLOAK USB device? Opinions or how well they work? I'm looking for a security solution when I'm using PCs where I work. Occasionally we have to log into to web sites, ...
1
vote
1answer
79 views

Storing server generated passwords

There are some applications that generate passwords for you. Consider a case where you sign in via Facebook, the application (let's call it NEWAPP) verifies your sign in on the server using FB tokens ...
4
votes
2answers
284 views

Password entry on OS X and keyloggers

There's several places in my ‘personal security infrastructure’ (is there a better phrase for that?) where I find myself typing very important passwords into text-fields on OS X (for instance, ...
44
votes
10answers
11k views

Why does the user pick the password?

Almost every web service I can imagine has the user pick the password. Why is this? Couldn't the system choose a better password? It doesn't have to be some complicated mess; see ...
0
votes
0answers
11 views

What are alternate options for PBEWithMD5AndTripleDES with SecretKeyFactory.getInstance( ) for encrypting Image files? [on hold]

Are there any alternate options other than PBEWithMD5AndTripleDES. As we are aware MD5 is not considered secure enough a hashing method. My requirement is to implement Password Based Encryption (PBE) ...
22
votes
6answers
4k views

Source code as password

Passwords with a mixture of letters, numbers, and special characters are sometimes hard to remember. Is it secure to instead use a small amount of memorable source code as a 'passphrase'? As an ...
1
vote
1answer
128 views

Passwords propagation, Password Trend and Word Generator in Human Mind

Some passwords like "123456", "admin" are outrageously popular, so are the leet transformations and concatenation of digits. The users seem to pick up the password suggestions or just copy the ...
7
votes
2answers
311 views

An analysis of storing hints for passwords?

What are the security implications of asking users to provide password hints? What are best practices for storing user hints? What research has been done on using user-supplied password hints to ...
2
votes
3answers
134 views

Storing random initial (one-time) passwords in plain text

I manage a vendor app that issues accounts (with passwords, of course) to end users. From what I can see, final user passwords are stored properly. My concern is the initial account generation and ...
2
votes
2answers
83 views

Single-use password as the default authentication method?

The crazy password requirements (joke1, joke2) lead me to a situation where there is no way for me to memorize the passwords to the several sites that make those requirements. The result is that ...
4
votes
2answers
171 views

Is it safe to store a passphrase encrypted SSH key in git?

I have a bunch of servers that need to access somewhat sensitive data (passwords for ftps, api keys, etc). Currently I copy a plaintext file back-and-forth between the servers via ssh and encrypt all ...
2
votes
1answer
57 views

Securely storing passwords using PHP5

Starting note: After going through some articles and answers posted on SO related to storing secured passwords I'm still not sure whether my way of thinking is applicable to todays reality. I'm ...
2
votes
1answer
153 views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as last pass store passwords in plain text (or hash values that can then be decrypted with the master password) in memory after a user logs into the ...
0
votes
0answers
6 views

How to reset my password on Windows tablet [on hold]

Turned on my Samsung T700 after several months of not use (got iPad) and found myself totally locked out because I totally forgot my pin. I found some references online how to create a USB boot driver ...
4
votes
3answers
474 views

Method to integrate Touch ID in iOS apps

With the recent announcement of Touch ID APIs for third party apps, I am wondering how can we leverage this feature to perform secure transaction ? I am looking for a method to use Touch ID in my ...
4
votes
1answer
48 views

Countermeasures for a family-member attack on a password reset procedure

Given an account reset procedures, there are usually some recovery questions, and in better implementations a link will be sent to confirm the password change via email or SMS. Therefore, the attacker ...
0
votes
0answers
7 views

Value of S and r in Fiat-Shamir Protocol [migrated]

In the book Cryptography and Network Security by Forouzan,in chapter 14, Fiat-Shamir protocol, its mentioned that two large prime numbers p and q are chosen and kept secret. However n=p*q is made ...
30
votes
5answers
6k views

If a web site shows me what my password was changed to, is it stored as plain text?

I just changed the password on a school-related web site. After completing the change successfully, the next page showed what the password was changed to. Can I conclude from this that the password ...
-1
votes
1answer
32 views

I want to know about all the specifications of a cell phone when it enters into particular area [closed]

I want to produce a signal such that when a cell phone enters that area, I must get all the specifications of that device. Can I do it? Which signal is good?
4
votes
2answers
185 views

Password strength metrics

In the question Source code as password I suggested using a combination of entropy and as @Lawtonfogle put it 'meatspace difficulty'. As suggested in the xkcd comic correct staple horse battery is a ...
1
vote
2answers
46 views

Do I need to set maximum characters length for password using bcrypt?

I using bcrypt to create a password hash and in the php documentation it says Caution: Using the PASSWORD_BCRYPT for the algo parameter, will result in the password parameter being truncated to ...
22
votes
10answers
4k views

Password Management within an Organisation

Within an organisation there are many passwords such as those for root accounts on servers, hosting accounts, router logins and other such things, that need to be kept track of. I know in some ...
15
votes
6answers
3k views

Managing website passwords for small team

I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
3
votes
0answers
80 views

What is the most efficient password scheme in terms of entropy per convenience [closed]

Although the main points are right, but now six words are needed, which is both inconvenient to remember, and inconvenient to type. My question is, has then been any case studies on the most ...
0
votes
2answers
42 views

Full Disk Encryption, Single User System: User/Root Passwords required?

Are there any security issues of having no (or weak) passwords for user and root account on a single user system with full disk encryption (except boot partition)? Assuming no SSH server is running, ...
2
votes
1answer
50 views

Why use a password manager to protect browser logons when e-mail client is neglected?

Friends use password managers like lastpass or dashlane which have plugins for the browser, but not for the email clients (thunderbird or livemail). But surely the email password is the Achilles heel ...
4
votes
3answers
254 views

Best way to store/retrieve sensitive key files?

We have our web servers running in AWS EC2. We have about 30 API Keys/passwords/etc (sensitive data) which is set in the environment for our app to use. Whenever we deploy, we start a new server ...
1
vote
1answer
47 views

All UTF-8 characters for generated passwords

Why do a lot of password generators don't generate strong passwords including chinese, arabian...-characters? All generators I saw, also the included one in my password manager keepass, just output ...
4
votes
2answers
251 views

Should email verification be followed by password-based login? Why?

[This is a duplicate, considered off-topic at http://stackoverflow.com/questions/26564992/should-email-verification-be-followed-by-password-based-login-why] A typical account creation process seems ...
7
votes
2answers
1k views

When taking ownership of a TPM in Windows 7, how is the SRK derived from the password?

When you take ownership of a TPM in Windows 7 you encounter a screen like this: Based on this document, it is my understanding that completing this dialog box somehow results in the generation of ...
0
votes
2answers
94 views

Can I save passwords in my app securely and retrieve them without asking for a master password? [closed]

I need to save some passwords used on my app, so the user doesn't have to input them so often. I'm trying to understand how this is done. I imagine to keep them safe they should be encrypted however ...
2
votes
3answers
110 views

Is it a good idea to use non-Latin Unicode characters in a password?

I've heard many suggestions as to what makes a good password (hard to guess, not a dictionary word or permutation thereof, at least a certain length, etc.) so that it cannot be cracked in a realistic ...
26
votes
4answers
3k views

Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?

I am developing an application in PHP and it uses bcrypt encryption to store passwords. I want to keep the history of hashes whenever the user changes the password. By doing this I want to stop the ...
-1
votes
2answers
83 views

SHA256 to text or MD5

I want to decrypt a sha256 to text. Is there a way other than bruteforcing to decrypt sha256? Like if I convert that SHA256 to MD5 and then try decrypting?I know its hard and the possible way for ...
-2
votes
0answers
18 views

Hydra giving false negative passwords [duplicate]

i used the hydra gui on myself and put my password in the wordlist to see if it worked and it came back no passwords found I did this 2 more times same thing I figured I did something wrong so I ...
2
votes
1answer
62 views

How to implement application-specific passwords using strong hashes?

I am implementing a service where application-specific passwords seem a good choice to improve security. A question on why and when they might make sense has already been discussed here Google ...
2
votes
0answers
51 views

Disallowing Similar Passwords [duplicate]

Upfront, I want to clarify that I am not a professional cryptographer, I am more curious about playing with the math and science behind it, and also want to improve my habits with my own personal and ...
2
votes
1answer
118 views

Secure database password stored in an env variable

I need to somewhere store my DB password on my production environment to access the DB. At the moment the prod system is deployed in the cloud, so is the DB. The password, the username and some other ...
1
vote
5answers
586 views

Authenticate user without knowing their password

I'm working on a project where each each user will have a public/private RSA key-pair. Users will be able to send encrypted messages to each other using the each target user's public key so that only ...
1
vote
0answers
34 views

Hashcat Turkish character problem [closed]

I'm using cudahashcat, it haven't special chars like "öçşĞÜ" in standart charsets. I defined charsets with windows-1254 and other encoding types(and -1 öÖçÇğĞşŞüÜıİ?a parameter), i tried but they ...
1
vote
2answers
177 views

Is SpiderOak truly “zero-knowledge”?

I've recently changed SpiderOak password on computer A. Because I have SpiderOak installed on computer B as well, I thought I will have to update the password on it so the application can connect to ...
2
votes
1answer
68 views

Do I have an SSH password?

I have an Ubuntu server hosted on DigitalOcean, I have been using SSH keys since the very beginning. (You can chose for it to be setup before the server instance has even been created). So I have ...