Tag Info

New answers tagged

1

Note that FIPS 181 is from 1993, which is ancient, in computer security terms, and I doubt that NIST is actively recommending it, especially since as you say it only includes lower-case ASCII letters, making the passwords much easier to crack. At a deeper level, since the goal is for passwords to be unpredictable, it is not generally good to promulgate a ...


1

Tom Van Vleck has written a Javascript pronounceable password generator (as well as ports to Java, C, and iOS). I took his work and created a passphrase generator that combines multiple words into a configurable length phrase.


0

What Travis did not say was what the overall purpose was of using the old passwords in the first place. I mean, audit might require it but nobody is saying WHY it is required. It's probably a bad idea. In general, it isn't going to increase security, and even aside from performance issues it runs the risk of significantly decreasing security if it isn't done ...


1

Clarifications: If I understand you correctly you are interested in including the order a password is typed within the data needed to use it correctly. For example if my password is typed out in order like this: 'p' 'a' 's' 's' 'w' 'o' 'r' 'd' It would not work if someone typed 'w' 'o' 'r' 'd' and then clicked to the beginning and typed 'p' 'a' 's' 's'. ...


2

Forcing unique passwords for both domain admin and Daily account would simply do people so they use like "MyP@ssw0rd1" for their Daily and "MyP@ssw0rd2" for domain admin. That would do the passwords easly guessable anyways, knowing the Daily password would make it easier for an attacker to deduce the domain password out of this. The risk you want to ...


9

There are several reasons why this would be a sub-optimal security scheme. Here are a few: The biggest issue with secure passwords is our memory, or our limited capacity for remembering passwords. We're pushing our memory limits as it is, and always working to devise new tricks to help better remember more secure passwords. This scheme introduces new ...


1

I am assuming we are discussing Windows Active Directory within a domain. As far as I know, I do not believe it is possible to enforce unique passwords between two separate accounts related to the same end-user using standard methods of password implementation. You CAN, however, use a third-party software to manage administrator accounts and change the ...


0

The length of a salt follows the law of diminishing returns. At no point does a salt become less secure by being longer, but it does stop getting meaningfully more secure relatively quickly. You never "crack" a salt - what you are cracking is the hashed password, to which the salt is appended. The salt just addresses the threat of rainbow tables - ...


2

Others have commented on the proper use of salts and passwords but maybe it's useful to add a word on hash functions because your question seem to suggest a somewhat incorrect intuition of the way they work. By design, a good cryptographic hash function should not let you guess how similar the inputs were based on the hashed values themselves. Otherwise, it ...


5

The only property of a salt that is important from a security perspective is that it is globally unique. The length may impact how unique the salt can be, but is irrelevant from any other perspective. Assuming that it has a positive or negative effect on anything is to ask the salt to perform a function that it was never intended to serve. So, a salt should ...


14

A too long salt will not reduce security. A too short salt will reduce security. As the salt gets longer security will improve. At some point you will cross a boundary, where you start getting diminishing returns on increasing salt length. And eventually you will cross another boundary, where a longer salt does not add any security whatsoever. However ...


41

As Mike and Gumbo have mentioned in comments, a salt isn't intended to add protection to bad passwords. It's meant to keep the attackers from breaking the whole database at once. The length of the salt isn't meant to add difficulty to breaking the stored passwords. It's meant to ensure that your salt is reasonably unique compared to others on the Internet, ...


0

Theoretically that is a 'stronger' password against bruteforce methods than just a single catfish. But you also increase other risks: Shoulder surfing - If an attacker spots you typing your password, even 'ca4f1sh!', over and over its pretty east to remember 7ish characters in a logical order and just go home and try accessing your gmail with a few repeated ...


1

Repeating the word "catfish" multiple times would indeed make the password stronger than any single "catfish". Since there is no way to know that you repeated the word or by how many times it has been repeated it stands to reason that the password is indeed strong. As other explanations of the xkcd comic describe, if a random word group were chosen using a ...


0

The problem with picking a password based on any pattern is that, if the attacker knows the pattern, they can then eliminate relatively large numbers of possible passwords they'd otherwise have to test. This is why we advocate for passwords to be randomly-generated as much as possible. The only restrictions you might want to put on the random generation ...



Top 50 recent answers are included