Hot answers tagged

22

You can't make that assumption. Hashing occurs extremely fast, even a password that's salted, and uses a secure "slow" algorithm (or even chained set of algorithms) is going to return very fast (for humans). A ballpark estimate for using PBKDF2 with 10,000 iterations for each logon attempt could handle 100,000 attempts in a second (when only looking at ...


6

It is common to have default passwords on devices. After all the camera needs to have some password when it is shipped, and the manufacturer clearly thought that it would be to complicated and expensive to set a different password on every single camera and print it on a piece of paper to include in the package. The intention is that people should change ...


5

Answer: No, a bruteforce attack would most likely fail. http://www.payetteforward.com/my-iphone-is-disabled-connect-to-itunes-fix/ According to this site, and anyone who has ever been a mean big brother, there are only 10 times you can attempt to unlock an iPhone before it is completely locked and needs to be restored. 1-5 failed attempts - The phone will ...


4

While I'm not familiar with CRC-96(ZIP) I'm assuming it is a longer version of CRC-32, but similar in it's function and implementation, so my answer is predicated on that. CRC is essentially a one-way function. Like other hashes this is a lossy operation, resulting in an output of a pre-determined length. You could put in the word 'cat', or the entire ...


3

SANS first ran an article on the basics of what you are looking for -- a way to detect mimikatz on the network -- https://isc.sans.edu/diary/Detecting+Mimikatz+Use+On+Your+Network/19311/ However, remember that mimikatz is capable of Kerberos attacks -- https://dfir-blog.com/2015/12/13/protecting-windows-networks-kerberos-attacks/ -- as well as PtH attacks ...


2

Typically if encryption is used, it's proper encryption and the fault is in the implementation. Or if the implementation of the cryptosystem is perfect, there could still be a thousand other things wrong. I'm not sure you're asking the right question when asking whether AES is secure. If you want to judge whether they know what they are doing, you could ask ...


2

I see two possible problems with this: Browser/Application Autocompletion If you do it in a web browser, and the field you enter the password in can allow data to be stored by the browsers autocompletion - then people with access to the browser can find your password. Either by chance, or intentionally. If you enter passwords in a password field, it should ...


2

Your assumption is wrong. Cryptographic hashes are not generally designed to be slow. Quite the contrary, the most widely used hashes such as MD5 and the SHA series of cryptographic hash function were developed explicitly with speed in mind. They need to be, because they may be used to hash huge files or provide integrity check for internal file system data ...


2

If you do the hashing on the server side, the server (and an attacker with access to it) could read your cleartext password, correct. But hashing the password on the client does not really help if someone managed to get access to the server - because the attacker could easily alter the javascript source to get your password in cleartext or start ...


2

You should send the password reset link (or code) to a predefined email address (or phone number). This is the only protection in this scenario. So called "security questions" are not "less secure" they are totally insecure and if used incorrectly they decrease security as discussed here Do security questions subvert passwords?. The only reason to use them ...


1

Generally, it is ill-advised to implementing your own session handling. If you can, you would be better off by using a well known and well tested implementation. These are the issues I see in your procedure. User requests password reset How will you handle misuse of his function - will you send one email per reset attempt, or will you implement a ...


1

I suppose it depends on the circumstances. If you're running a Windows 95 machine on a dial-up connection to a webservice running on an overloaded Unix box from 1990, then yes I imagine it would take a second or two to return back a result. However, we are in 2016, where CPUs run in the GHz range, and internet speeds run into the MB/s. Hashing to a ...


1

With regards to your first question, you probably should make that an option or at least query the user on which piece(s) of information they've forgotten. If they forgot their password but remember their security question then it doesn't make sense to require a new security question answer. If the user forgot both then they'll need to reset both. You ...



Only top voted, non community-wiki answers of a minimum length are eligible