Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

1
vote
5answers
226 views

Secure login feature with low CPU power

I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
3
votes
2answers
177 views

Is it really “Time to add a word” if there are no tools to crack passphrases of 3 words and up?

It's "time to add a word" says Arnold Reinhold, the creator of Diceware, in his blog (3/2014). He advices to use 6 word sentences (or 5 words with one extra character chosen and placed at random) from ...
1
vote
2answers
59 views

Database compromised and some passwords cracked

I run an MMORPG game and today while moving from one server to another, apache failed and listed some of the data on the server including a back-up of all the source code + database which a few people ...
12
votes
5answers
2k views

Can sites which check your password as you type pose a security risk?

Some sites that I use check my password as I type it into the login (not registration) form. So, for example, to begin with I might have: Username: sapi ✓ Password: passw × and by the time I've ...
1
vote
1answer
17 views

Importance of password strength with secure element?

Greetings SE security community. Background: I have a number of items like certificates, databases, and encrypted file systems that require private keys. In order to avoid having duplicates of these ...
-4
votes
0answers
24 views

How to set a hydra http-post-form attack for this router login site? [on hold]

I'm trying to use hydra to crack it's password but don't know how to set a http-post-form attack! It's a router login websiteit which has 8088 port open.Can't do a ssh, ftp, or http-get,only ...
5
votes
4answers
98 views

Does Windows have a built-in password store?

What passwords are stored in Microsoft Windows? How can I know what password are saved in computer?
124
votes
18answers
12k views

What is a good analogy to explain to a layman why passwords should be hashed?

Note: This is not an actual situation I'm currently in. Assume your boss is one of those old-fashioned computer-illiterate managers and wants to store the passwords in plaintext to simplify ...
0
votes
2answers
73 views

Does cPanel store my login password as plaintext

On attempt to change my cPanel password I was warned that: Your password could not be changed because the new password failed with the following reason : (is too similar to the old one), please try ...
1
vote
1answer
52 views

Running an Open Server (contents are visible)

I'm considering the possibility of running an Open Server, as I would call it, that is, a server where as much of its contents are publicly visible as possible. I would like to give read access to ...
9
votes
6answers
679 views

Are password complexity rules counterproductive?

In creating a login for this site I chose a nondictionary password that would be extremely hard to guess, but easy to remember. I was told that it did not meet complexity rules. After several ...
-1
votes
3answers
63 views

Can I safely use my own statistics to assess password strength on number of times a password is used?

Lets assume I want to give my hypothetic 10mio users userbase a good feedback on their password strength. Besides the classical entropy tests and top500 list of bad passwords, I might want it to be ...
4
votes
4answers
18k views

Modern high quality password dictionary

Has anyone come across any good password dictionary lately? Some of the lists I found dated back to 90's! Some are simply too big that I doubt their quality. There appears to be some work by someone ...
7
votes
4answers
1k views

Should the password of a password protected channel be hashed?

Let's take a chat system, where any user can create a channel with a password protection. Thus, other users may only join using the channel password. This password is therefore known to every person ...
1
vote
1answer
47 views

Would it be possible to add additional files to a password protected zip 2.0 file

So the scenario is this: I don't have the ability to determine/recover the master password for a production system that uses zip 2 archives. However, I need to be able to add new files to existing ...
3
votes
1answer
90 views

PUT vs. POST for password update

I am writing a User Management system that has to include a change of password utility. We don't front end hash passwords (hopefully we will soon). As a result passwords are passed over https in the ...
0
votes
0answers
18 views

Is there a repository of credentials used in training materials/samples and SDKs?

Similar to a default password list for network appliances, it's conceivable that application layer passwords are default from training materials given to a developer. In fact, I have discovered ...
6
votes
10answers
1k views

How to easily remember lots of different passwords?

I know that you shouldn’t use the same password on every site. But, when you log into several dozen sites, keeping track of all the passwords can be pretty hard. What system do you recommend that ...
1
vote
1answer
89 views

Why use an authentication token instead of the username/password per request?

The author of http://stackoverflow.com/a/477578/14731 recommends: DO NOT STORE THE PERSISTENT LOGIN COOKIE (TOKEN) IN YOUR DATABASE, ONLY A HASH OF IT! [...] use strong salted hashing (bcrypt / ...
1
vote
2answers
331 views

How secure is the PwdHash algorithm and system?

I use the PwdHash service (http://crypto.stanford.edu/PwdHash/) and plugins for pretty much all of my passwords. I believe this is safer because: No service gets the same password as another, so if ...
3
votes
1answer
138 views

Is BSI’s process good? (Informing email address owners that their address/password (of unknown/different accounts) was stolen)

The German BSI (Federal Office for Information Security) claims to have got a list of 18 million email addresses and passwords – supposed to be the result of identity theft. They allow to check if ...
4
votes
1answer
39 views

How to help users manage password portfolios based on risks of compromise?

A framework for modeling password management risks and costs, and the beginnings of a good strategy for users to help them manage passwords for their often large portfolios of accounts is outlined in ...
2
votes
3answers
279 views

Time Memory Trade-Off Attacks

Given, we want to crack a password. With Time Memory Trade-Off Attacks one tries to find the right balance between time to compute hashes for all possible passwords. And the used memory to store all ...
1
vote
2answers
52 views

How Empathy - a messaging program, is storing my passwords

I am connected to my chat accounts via Empathy, a messaging program, and it has my password stored in it. I am really curious to know how it is storing the passwords, and if there is any they can ...
3
votes
1answer
75 views

How secure is choosing one out of N generated passwords?

I'm looking to generate some new passwords for myself that are easy to remember, but hard to crack. By choosing a generation algorithm and generating one random password with it, I can be relatively ...
1
vote
2answers
65 views

On password change in a web application, should it log users out

When a user is logged into a web-based application in multiple tabs, and changes their password should it automatically log them out of the other tabs? The use case is an account is compromised, the ...
35
votes
10answers
3k views

Why do password strength requirements exist?

Password strength is now everything, and they force you to come up with passwords with digits, special characters, upper-case letters and whatnot. Apart from being a usability nightmare (even I as a ...
0
votes
1answer
95 views

Save password on user-side for autologin

If a user wants to login to a system/server, it's recommended to have the hashed&salted password saved in a database, along with its salt. So the user wants to login, types in the password, ...
1
vote
1answer
62 views

What is the point of hosting database externally?

Following the breach of avast:forum.avast.com they decided to host the database externally@id.avast.com. My question is, what is the point of hosting the database externally since when you get remote ...
3
votes
4answers
140 views

Storing Old Password History and Information

Google, Facebook, Twitter, and several other services still knows the older passwords which we used on our accounts. At times, I can not reuse the same password as I have. Then with Google, if I type ...
2
votes
2answers
157 views

Should I implement my own local password hash?

Having a more-than-elementary knowledge of internet security, I've realized that some web applications and websites I use implement a less-than-ideal password policy. Some examples include: ...
1
vote
2answers
128 views

Remember Me vs Remember Email

From what I have noticed, there is very few services that offer the Remember Email over Remember Me or Sign-in Automatically. These options really do make the life easier for the end-user of ...
119
votes
9answers
21k views

Is “the oft-cited XKCD scheme […] no longer good advice”?

I was stumbling around and happened onto this essay by Bruce Schneier claiming that the XKCD password scheme was effectively dead. Modern password crackers combine different words from their ...
2
votes
0answers
48 views

Method to integrate Touch ID in iOS apps

With the recent announcement of Touch ID APIs for third party apps, I am wondering how can we leverage this feature to perform secure transaction ? I am looking for a method to use Touch ID in my ...
31
votes
11answers
13k views

Are password-protected ZIP files secure?

Following my answer. If I can list contents of password-protected ZIP file, check the file types of each stored file and even replace it with another one, without actually knowing the password, then ...
0
votes
1answer
33 views

Do dictionary attacks only use specific entries from a dictionary, or combinations of an entry?

If I wanted to crack a password, "cba", but the dictionary I was using only had abc in it, does a dictionary attack try all combinations of abc? abc, acb, bca, bac, cba, cab Or would cba have to be ...
2
votes
4answers
134 views

password generating algorithm

I read the question about the relevancy of the xkcd password creation algorithm. Would it be more secure if you used a string of common words with a function that only you knew that would rearrange ...
2
votes
1answer
99 views

Is there more risk in changing administrator password locally vs from a centralized location?

I'm working on a mechanism to better handle group policy passwords in response to MS14-025. We formerly used this mechanism for setting the local admin account passwords on our workstations (primarily ...
1
vote
1answer
80 views

how to rememeber passwords securely?

Imagine you have a private RSA-key on your computer encrypted (through PBKDF2, AES-CTR, HMAC256) with a password, now if the user would like to tick "Remember Password", what is the most secure way to ...
30
votes
9answers
28k views

How safe are password managers like LastPass?

I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long. How safe are password ...
3
votes
1answer
114 views

Windows Scheduled Task passwords

When you create a Scheduled Task in Windows, it gives you the option of running the task as a different user, including saving the password. How secure is the password that is stored?
14
votes
3answers
891 views

Why do some sites block pasting into username or password input fields?

I use a few websites that prevent me from copying & pasting into the username or password fields. It's quite frustrating when using a password manager, and if anything I'd think it discourages ...
1
vote
4answers
127 views

Password protect an excel file for a period of time?

I'm trying to find a way to password protect an Excel file (.xlsm) beyond the built-in password encryption options. Ideally: Enter the password File works for a week(/other period of time) After a ...
-1
votes
4answers
192 views

What if I develop my own hash algorithm to create strong passwords from easy ones?

I came up with this idea but I cant figure out if it's good or bad, maybe you can help. My goal is: I want to create extremely strong passwords for my main accounts (gmail, skype and so on). I want to ...
44
votes
9answers
4k views

Generic error message for wrong password or username - is this really helpful?

It is really common (and I would say it is some kind of security basic) to not show on the login page if the username or the password was wrong when a user tries to log in. One should show a generic ...
2
votes
1answer
68 views

How could someone change a root password without modifying `chage -l root` date?

How could someone change the root password without changing chage -l root Last password change date? I know it was changed because it does not match the value in Keepass. I noticed when I tried to use ...
3
votes
3answers
3k views

Email hacking myth

I never believed that some one can actually hack an email that easy. If someone hacks an email it means he actually hacked the server and he will gain access to many emails not to mine only. Anyway ...
3
votes
1answer
2k views

Password length limits in history of operating systems and popular web sites

I heard that many years ago for example passwords on linux systems were limited to 8 characters. Or rather, you could type in more than 8 characters, but only the first 8 characters mattered. ...
2
votes
2answers
469 views

NTLM/LM Hashes on Domain Controller

I've noticed that when extracting password hashes from a domain controller (using Elcomsoft proactive password auditor) sometimes I'll get LM and NTLM hashes and other times I'll only get NTLM hashes. ...
0
votes
2answers
285 views

Automated software hackers use to try passwords

Because of the eBay hacking, I had to go and look for other accounts that I have used the same password to change the passwords on those site as well. (I know that it's very bad to have same passwords ...