Hot answers tagged

91

Let's try skipping theory and going straight to practice. Will typing the same word twice (or N times) substantially help? John the Ripper Jumbo has a variety of "simple rules" about this d duplicate: "Fred" -> "FredFred" f reflect: "Fred" -> "FredderF" oclHashcat rules based attack has simple rules just for this, too d Duplicate entire word d ...


62

Security.StackExchange is full of questions proposing "home-brew" password strategies. The short answer is always the same: doing something to differentiate your password from the standard dictionary attacks is good - as long as Very few other people on the planet are also using your strategy. If your "home-brew" strategy turns out to be common - like ...


20

In general, no, doubling the password does not substantially increase (or decrease) your security. What it doubles is your typing effort. Doubling your password may decrease your security if it incites you to choose a shorter/easier base password so that your typing effort is not too cumbersome. In broad terms, password security comes from its randomness, ...


13

My password cracker already tries letter doubling, word doubling, word reversing and doubling, word-case-flipping and doubling... ...and many more. Yep. Doubling adds some to the difficulty: about four bits worth, tops. It'd take me sixteen times longer to crack, than a raw dictionary attack with letter replacements. But I'd eventually get ...


5

Humans are surprisingly predictable creatures. The way we think is not nearly as unique as we would like to believe. Chances are, any clever thing you can think of to make your password more secure, has already been thought of by lots of other people, and hackers are well aware of all of these clever tricks. The only way to make a password properly secure, ...


4

PBKDF2-HMAC-SHA-256 number of iterations desired = 1024 length of the salt in bytes = 16 length of the derived key in bytes = 4096 Ok - PBKDF2-HMAC-SHA-256 is a solid choice, though if you're running on any modern 64-bit CPU, I would strongly recommend PBKDF2-HMAC-SHA-512 instead, because SHA-512 requires 64-bit operations that reduce ...


3

Link to zxcvbn password entropy demo. According to zxcvbn, your initial password's stats: Normal: PwdThing Guesses: 100 / hour: 5 months (throttled online attack) 10 / second: 58 minutes (unthrottled online attack) 10k / second: 35 seconds (offline attack, slow hash, many cores) 10B / second: less than a second (offline ...


3

What's the best way to store passwords? This is a very broad subject that encompasses many different areas of IT. It also has the tendency to be opinion-based. However, there are some very important things we can know, and then use to make an informed decision. Also, there are many different ways to handle passwords. What size company? Small? Medium? ...


3

On a Windows machine, inspecting the memory of the IE process is limited to the owner user, and administrators. If an attacker can inspect the memory of your IE process, then that attacker has taken control of your machine and/or your account, and you are already doomed. If the machine is "shared" then there is no really good solution: if an hostile entity ...


3

There are a lot of factors but it ultimately breaks down to what type of password cracking are you trying to protect against. Against a brute force hack increasing the length of the password will make it harder to crack. Assuming their hashing isn't horrible a decent 8 or 9 character password should already be very hard to impossible to brute force crack. ...


2

I'll go for the secure password manager application. However, my Approach may also apply the split knowledge for the master vault password (Should be stakeholders or senior management to hold this). Which means one party couldn't be able to delete anything without tracking. The permission level will be shown below master <== can do eveything ...


2

I guess it depends on what the server does, but it doesn't add much protection either way (or is even worse). (Also, does the average user know how to compute a hash on mobile? Sounds quite a hassle to me.) 1. Server stores hashed password This means client sends H = hash(password) to the server, server looks up clients hashed password H' in the DB and ...


1

Would this increase security? No. Any modern application already stores it's passwords hashed in the database. Whenever an authentication attempt is made, the user input is hashed and compared with whatever's in the database. Mostly this happens with a 1-way encryption (the hash cannot be decrypted back to it's raw value). When you would create a hash on a ...


1

Just don't confuse password cracking techniques with brute force. Brute force literally means starting with 1 character trying all possible alphabetically, then moving to 2 characters, 3, 4, etc... Once an algorithm or a heuristic logic is applied it not called brute force anymore. So why are people still talking about brute force? Reason is that for ...


1

The first paragraph of RFC7272 appendix B, which is the second paragraph in original [RSA PKCS#12v1.1] (http://www.emclink.net/collateral/white-papers/h11301-pkcs-12v1-1-personal-information-exchange-syntax-wp.pdf), recommends that PBES2/PBKDF2 from PKCS#5v2+ be used, but this is only 'should' (not even RFC2119 upper-case SHOULD) and the scheme of ...


1

Thankfully the world has evolved away from the old break-the-glass style of storing things on a USB key, and that evolution is (free and open source!) Vault. It has clear and obvious mechanisms for key rotation, uses ephemeral secrets when possible, and has full audit logging, and ultimately the very magical possibility of instantly revoking any credential a ...


1

Am I right to say that this won't work if the password is not stored in plain text on the server? I fail to see how the server could verify the hash if the password is already hashed (with salt and pepper) on the server. This scheme does require the password to be stored in clear-text. Very bad. Can this scheme be extended to work with hashed ...


1

If you're using a secure channel namely TLS, you don't need to do these sort of tricks. About your first question, yes you're right, this scheme requires the server to have access to password in clear text to be able to reproduce H(nonce+cnonce+password). About your second question, I can't think of a way that won't open you up for replay attacks.(but I'm ...


1

This is essentially identical to simply generating a password that isn't hashed, in security terms. Whether you use your first name for a password or the checksum of the current time doesn't matter; if the thing you send over the Internet is compared with a string directly stored in a list on the server side, then the password isn't usefully hashed. The ...


1

I've been using keepass for years and I'm very happy with it. I have my password database synchronised between my devices using dropbox, and the database is encrypted with a password + keyfile (which I manually copy to each required device). This means that even if someone was able to compromise my dropbox, and gain access to the database, it would be ...


1

Two things make a password more secure: Length and randomness. So, the answer to your question is definitively Yes, you are increasing security of your password. But in general, your initial password is not super secure because it uses words that can be found in a dictionary. And, the doubling is just a repetitive pattern that an cracking algorithm can ...


1

adding length to a password does substantially increase the security of a password so I think typing your password twice or doubling every character is better than not doing it and using a shorter password of 8 or 9 characters. Refer to this link to read more about how increasing password length significantly improves its security: ...


1

I avoid symbols in passwords because they may be difficult to type, especially on keyboard layouts or devices I'm not familiar with. Also, more importantly, I don't often trust all software developers. Once I used passwords containing spaces. Some services later changed their authentication methods so that they stripped blank spaces from passwords. This ...



Only top voted, non community-wiki answers of a minimum length are eligible