Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

7
votes
4answers
385 views

Decentralised password recovery

Are there good/established techniques for password/key recovery in situations without a centralised service? (Anything goes, but I'd prefer solutions that distribute the recovery information across ...
3
votes
3answers
409 views

Method to integrate Touch ID in iOS apps

With the recent announcement of Touch ID APIs for third party apps, I am wondering how can we leverage this feature to perform secure transaction ? I am looking for a method to use Touch ID in my ...
2
votes
3answers
103 views

Acceptably secure solution for users to log in with a short unique code only (no username)

I am creating a website whereby users are given an account by invitation only, and are sent a unique code by post. Users can then log in (at least the first time) by entering the code only. The goal ...
1
vote
3answers
81 views

Storing random initial (one-time) passwords in plain text

I manage a vendor app that issues accounts (with passwords, of course) to end users. From what I can see, final user passwords are stored properly. My concern is the initial account generation and ...
4
votes
2answers
203 views

Best way to store/retrieve sensitive key files?

We have our web servers running in AWS EC2. We have about 30 API Keys/passwords/etc (sensitive data) which is set in the environment for our app to use. Whenever we deploy, we start a new server ...
2
votes
2answers
115 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
1
vote
2answers
69 views

Is it safe to store a passphrase encrypted SSH key in git?

I have a bunch of servers that need to access somewhat sensitive data (passwords for ftps, api keys, etc). Currently I copy a plaintext file back-and-forth between the servers via ssh and encrypt all ...
1
vote
2answers
90 views

How to transform an hash into a usable password?

I was reading about PwdHash and it inspired me to create a little project where you input a master password and an easy to remember alias into a password hash, like bcrypt, and then you get an hash. ...
2
votes
1answer
66 views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a ...
2
votes
1answer
206 views

Storing a user's password in a retrievable manner

I currently store my users passwords as PBKDF2 hashes, for the authentication part of my web application. Each user also has their own private key and public key (also stored in their user profile in ...
2
votes
1answer
888 views

How secure is automatic authentication in Skype?

How secure is checking the automatic authentication option in Skype client? What if I sign in with Microsoft account instead of Skype id? What if both accounts are merged? Is there any documentation ...
1
vote
1answer
145 views

Password entry on OS X and keyloggers

There's several places in my ‘personal security infrastructure’ (is there a better phrase for that?) where I find myself typing very important passwords into text-fields on OS X (for instance, ...
1
vote
1answer
260 views

Is there anyway to generate a SAM file?

I was wondering if it is possible to create a windows SAM file. I already tried using chntpw but it seems like it only works under a Redhat based linux, ie I was able to blank/change a Windows 7 ...
0
votes
1answer
65 views

Secure way to encrypt (not hash) passwords?

I'm building a system that for reasons I'll outline below, can't used hashed passwords, but I'd still like to encrypt them so that it's as hard as possible to crack them, in the (unlikely) event the ...
0
votes
1answer
48 views

Storing server generated passwords

There are some applications that generate passwords for you. Consider a case where you sign in via Facebook, the application (let's call it NEWAPP) verifies your sign in on the server using FB tokens ...
0
votes
1answer
94 views

Passwords propagation, Password Trend and Word Generator in Human Mind

Some passwords like "123456", "admin" are outrageously popular, so are the leet transformations and concatenation of digits. The users seem to pick up the password suggestions or just copy the ...
0
votes
1answer
40 views

Gnome-keyring iteration count location

I know that Gnome-keyring hashes master password between 1000 and 2000 times. It picks random number. I would like to ask where does it save this number, what is the location of that file? As far as I ...
-1
votes
1answer
84 views

Why not use md5 auth mechanisms for IMAP over TLS?

I'm using Dovecot for IMAP connections. I've read a lot of tutorials on how to set up Dovecot, and a lot of them said to only allow: auth_mechanisms = plain login Why should I not allow *-md5 ...
-1
votes
1answer
234 views

Cracking a 6-character alphanumeric password Windows dialog box

To put this problem in context, I have a touch monitor screen whose firmware program is protected by a password. The firmware program is downloaded over RS232 via a Windows utility program provided ...
3
votes
0answers
141 views

Any problems with scrypt yet?

In the question Do any security experts recommend bcrypt for password storage? Thomas Pornin recommends the hashing function scrypt but saying it is "too new to be recommended on a general basis". ...
2
votes
0answers
64 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
1
vote
0answers
62 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
1
vote
0answers
133 views

Database row level encryption scheme

I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
1
vote
0answers
27 views

Is there a repository of credentials used in training materials/samples and SDKs?

Similar to a default password list for network appliances, it's conceivable that application layer passwords are default from training materials given to a developer. In fact, I have discovered ...
1
vote
0answers
85 views

How to add user entries with password field in LDAP over HTTPS

I am new to this kind of stuff (HTTPS etc.) and pretty much confused on how to go ahead with this. An LDAP server (ApacheDS) at the back-end stores the user details. To add new users, the user ...
1
vote
0answers
88 views

Security for message queue in ActiveMQ

I am using ActiveMQ and WSO2 for my application. I need to protect my queue to restrict posting of messages by anonymous users(I need to protect my queue with some password). I know, there is a ...
1
vote
0answers
119 views

Trusted Platform Module (TPM) secure password

I'm trying to set secure Trusted Platform Module (TPM) passwords on a network and would like to set it to the maximum length possible. How long can the TPM's password be? Is it limited by bits or by ...
1
vote
0answers
798 views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
1
vote
0answers
162 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
0answers
92 views

Lock Windows to a specific app

Is it possible, using some program or application, to lock Windows 7 so only a specific app can be used, for example Word, until a password is entered? Thanks!
1
vote
0answers
174 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
1
vote
0answers
55 views

Does whosthere.exe of pth toolkit have to run with administrative rights?

To see the users that are connected to the machine and they're pass hashes with Whosthere.exe, do I have to run it as an administrator?
1
vote
0answers
101 views

Rainbow Tables: Why do we need to store the last value of a chain?

Surely we could just make it so a rainbow table says for each beginning of chain do 10k iterations, and then we wouldn't have to store both values? Or does by doing it this way stop collisions?
1
vote
0answers
107 views

How should I authenticate my SPA frontend with my API since I´ve got no authentication process in the site?

We are designing a web site for selling financial products online. The following is a high level description of the components: Our frontend will be a SPA built with AngularJs. The frontend will ...
1
vote
0answers
134 views

How secure is a Python Pyro daemon for storing a password?

I am using the Pyro package to create a daemon which will, upon startup, prompt for a password, and then the daemon will store that password as long as it is running. Other scripts will then make a ...
0
votes
0answers
45 views

Full key space coverage when generating a rainbow table

Many rainbow tables available online have different tables for various character sets and lengths. Are tables like these usually completely exhaustive for those character sets/lengths? For such a ...
0
votes
0answers
16 views

Best practise Managing Key Material Securely in Memory in android

I am aware of the issue of user entered pass phrases being left in memory if stored in Java Strings (due to String being immutable). Which takes me onto using char arrays. However, I am wondering if ...
0
votes
0answers
64 views

THC-Hydra dictionary attack on JSP login form

I am trying to use Hydra to attack a JSP form but I have some confusion. Normally we use command something like this hydra -L list_user -P list_password HOST-ADDRESS http-post-form ...
0
votes
0answers
52 views

Request for Google Password for Calendar Updates

A website that I trust (Delta Airlines) offers a link to add flight information to Google Calendar; that link opens a window asking for my Google login and password. Based on the advice in a similar ...
0
votes
0answers
54 views

Detection of pass the hash

I have researched about PTH Attacks but yet found any solid way detecting it in a network.is there a way to detect a pass the hash ? analysing the windows message from the dcs or something ?
0
votes
0answers
284 views

Thunderbird password decryption from the signons.sqlite and keys3.db without using any third party tools

I understand from the Mozilla documentations that the passwords are stored in the following two files which are located at ~/.thunderbird/*.default location: ( I use Ubuntu 13.10) signons.sqlite ...
0
votes
0answers
227 views

oclHashcat error messag in Kali Linux

I am in the process of learning oclHashcat syntax. Currently, I am working on breaking a file of md5crypt strings with a dictionary file. The dictionary I am using is rockyou.txt from an installation ...
0
votes
0answers
409 views

Hydra sometimes fails against my own router known password

Hydra sometimes fails against my own router known password. Sometimes confirms it was found, and sometimes returns unusual error code (empty). What does this means? dione@saturno:~/misc$ hydra -l ...
0
votes
0answers
57 views

drupal external authentication - how to handle password?

I need to implement an architecture someone else designed. They have a drupal as user interacting component, and an external authentication module. To authenticate, from drupal, username and ...
0
votes
0answers
25 views

Syncing service passwords during offline installations

Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of ...