Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

3
votes
1answer
138 views

Is BSI’s process good? (Informing email address owners that their address/password (of unknown/different accounts) was stolen)

The German BSI (Federal Office for Information Security) claims to have got a list of 18 million email addresses and passwords – supposed to be the result of identity theft. They allow to check if ...
2
votes
1answer
99 views

Is there more risk in changing administrator password locally vs from a centralized location?

I'm working on a mechanism to better handle group policy passwords in response to MS14-025. We formerly used this mechanism for setting the local admin account passwords on our workstations (primarily ...
1
vote
1answer
74 views

Is there anyway to generate a SAM file?

I was wondering if it is possible to create a windows SAM file. I already tried using chntpw but it seems like it only works under a Redhat based linux, ie I was able to blank/change a Windows 7 ...
1
vote
1answer
49 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
1
vote
1answer
739 views

How to crack SHA512 hexdigest passwords with John the Ripper?

I've been playing with John The Ripper (JtR) to try to crack/audit a salted password that was hashed with SHA-512, with 20 interactions according to the source (for the curious, this is a Rails app, ...
0
votes
1answer
56 views

security in banking app with 4 digit pin code and social security number

The new banking app (for norwegian bank Gjensidige bank) for my android handset allows me to log in using only my social security number, and a 4 digit pin code. The social security number in norway ...
0
votes
1answer
33 views

Do dictionary attacks only use specific entries from a dictionary, or combinations of an entry?

If I wanted to crack a password, "cba", but the dictionary I was using only had abc in it, does a dictionary attack try all combinations of abc? abc, acb, bca, bac, cba, cab Or would cba have to be ...
0
votes
1answer
51 views

Should a Mobile app able to check what password is locally saved via a user facing feature?

I'm working at a company who is currently working to secure their mobile app (iOS native) by adding check points to security sensitive screens on the device (data is stored in the iOS keychain). User ...
0
votes
1answer
105 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
2
votes
0answers
50 views

Method to integrate Touch ID in iOS apps

With the recent announcement of Touch ID APIs for third party apps, I am wondering how can we leverage this feature to perform secure transaction ? I am looking for a method to use Touch ID in my ...
2
votes
0answers
57 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
1
vote
0answers
37 views

How to add user entries with password field in LDAP over HTTPS

I am new to this kind of stuff (HTTPS etc.) and pretty much confused on how to go ahead with this. An LDAP server (ApacheDS) at the back-end stores the user details. To add new users, the user ...
1
vote
0answers
37 views

Security for message queue in ActiveMQ

I am using ActiveMQ and WSO2 for my application. I need to protect my queue to restrict posting of messages by anonymous users(I need to protect my queue with some password). I know, there is a ...
1
vote
0answers
70 views

Trusted Platform Module (TPM) secure password

I'm trying to set secure Trusted Platform Module (TPM) passwords on a network and would like to set it to the maximum length possible. How long can the TPM's password be? Is it limited by bits or by ...
1
vote
0answers
82 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
0answers
58 views

Lock Windows to a specific app

Is it possible, using some program or application, to lock Windows 7 so only a specific app can be used, for example Word, until a password is entered? Thanks!
1
vote
0answers
47 views

Does whosthere.exe of pth toolkit have to run with administrative rights?

To see the users that are connected to the machine and they're pass hashes with Whosthere.exe, do I have to run it as an administrator?
1
vote
0answers
116 views

entropy of FIPS-181 automated password generator

From wikipedia article on password strength: NIST recommends 80-bits for the most secure passwords Is there any estimation of entropy for FIPS-181 automated password generator? Recommended ...
1
vote
0answers
65 views

Rainbow Tables: Why do we need to store the last value of a chain?

Surely we could just make it so a rainbow table says for each beginning of chain do 10k iterations and then we wouldn't have to store both values? Or does by doing it this way it stop collisions? ...
1
vote
0answers
80 views

How should I authenticate my SPA frontend with my API since I´ve got no authentication process in the site?

We are designing a web site for selling financial products online. The following is a high level description of the components: Our frontend will be a SPA built with AngularJs. The frontend will ...
1
vote
0answers
84 views

How secure is a Python Pyro daemon for storing a password?

I am using the Pyro package to create a daemon which will, upon startup, prompt for a password, and then the daemon will store that password as long as it is running. Other scripts will then make a ...
1
vote
0answers
71 views

How to safely use a Key Derivation Function to secure private data - need guidance

I have some secure data created in my client app which I wish to store on the server as backup for the user. The user already has a password to authenticate with the server. The password is never ...
0
votes
0answers
19 views

Is there a repository of credentials used in training materials/samples and SDKs?

Similar to a default password list for network appliances, it's conceivable that application layer passwords are default from training materials given to a developer. In fact, I have discovered ...
0
votes
0answers
26 views

Is there a FIPS 181 like standard for random password generation with alphanumerical seed?

NIST recommends FIPS 181 as a random password generator for "easy to remember" passwords. As far as I understand the standard: it will generate a password that is lowercase, and with some ...
0
votes
0answers
45 views

How does restoring lost password with generated pin and help from service line work?

How does this procedure work: http://www2.schneider-electric.com/resources/sites/SCHNEIDER_ELECTRIC/content/live/FAQS/175000/FA175815/en_US/PLC%20Application%20-%20Forgot%20Password.pdf In short: ...
0
votes
0answers
199 views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...