Tag Info

Hot answers tagged

40

It depends on what you mean by "readable". If you want to use only hexadecimal characters, you will need 32 of them to reach 128 bits of entropy; this line will work (using only commands from the coreutils package): head -c16 /dev/urandom | md5sum This variant produces passwords with only lowercase letters, from 'a' to 'p' (this is what you will want if ...


34

Burp Suite in proxy mode is able to decrypt HTTPS traffic of any systems which trust it. It does this by generating an own certificate and use this cert to register itself as a certificate authority on the system it is installed on. When it then proxies a request to a HTTPS webserver, it does the HTTPS handshake itself, decrypts the traffic, issues a ...


29

No that is not a security risk. Having stored passwords in a browser is a security risk. Letting an attacker access your computer between when you've typed in the password and before it is submitted is a security risk (and even after you've submitted it, you need to worry about theft of valid session cookies). Being able to jump to blanks/special ...


25

Short answer: The more the better, but for now this is probably enough. There is an important distinction between hacking into your Gmail and cracking an offline password. If you want to hack a Gmail account by guessing the password, you can only do a few tries per second at most. Google will block thousands of login attempts to a single account in too ...


18

Yes, is a security risk, but exploiting it is very unlikely. It can be exploited this way: Someone uses your computer without you around Have enough time to open IE Connects to a website with a saved password Gets the profile of your password and goes away If the intruder have enough time to do all the above, it would be way faster and simpler to ...


18

Some fab suggestions in the other answers. I find that makepasswd is not available everywhere, and using tr is (slightly) tricky, so there's another option using OpenSSL: openssl rand -base64 16 The number is the number of bytes of randomness - so 16 bytes for 128-bits of entropy.


11

I too have tried to come up with a good solution for this. But I found https://onetimesecret.com/ which works great. Basically you create a link containing a password and you send this link to the intended recipient. As soon as the receiver clicks on the link, the link expires and the password is deleted. So the receiver only has one time to copy the ...


10

Depending on the type of characters you may include, an easy command to create a readable password with 128 bits of entropy looks like this: < /dev/urandom tr -dc [:graph:] | head -c20; echo; (Taken from here). [:graph:] are all ascii pritable characters except space. Explanation: 128 bits are equivalent to 3.40e+38 combinations. If you're using the ...


9

The password is not displayed on screen to avoid shoulder-surfing attacks but it is still of course known to the browser. When you use a password store, it gives the actual password to a requesting application and not a hash or encrypted version of it (that'd be very untractable to use). If someone is close enough to you that they can use your keyboard to ...


7

How about you take his challenge? Go make a quick rainbow table of common passwords and run it over his database. You're bound to hit something (especially if he doesn't have a password policy). However, this may not work if he has a small database.


6

The weak point in any security strategy is always human predictability. Any clever password that you can think of, and remember, will be remarkably similar to a lot of other clever passwords people use. We just aren't as unique as we believe ourselves to be. People essentially think and memorise things in well understood and predictable ways. Some basic ...


6

Security risk? You're leaking data, so yes it is definitely a security risk. But risk is the chance of it happening times the impact. The chance is low because it's not every day that you are typing in a password and then leave before logging in. The impact is also low because it's often much easier to just reveal the field's value (especially in browsers) ...


6

Using pwgen Simplest oneliner ever: pwgen It attempts to make passwords that are easy to remember. To disable that and create more secure passwords, use the --secure or -s flag. pwgen -s Are the generated passwords too long? Too short? Just append the desired length: pwgen 9 # Or pwgen -s 9 # Or pwgen 9 -s Similar tools I just happen to know ...


5

Even if he was using a salt, it would still be a terrible plan. SHA-512 is a fast hash, so you don't need rainbow tables in order to find passwords, simply testing inputs along with the salt can be done at the rate of hundreds of millions to billions of candidate passwords tested per second. What your friend should do, is read the answers to How to ...


5

If someone were to get a hold of this database and try cracking the passwords, would allowing these additional combinations significantly reduce password strength? I would argue that it would not in this specific situation. I highly doubt that they are storing three forms of the hashed password in the database, but rather hashing three different ...


5

Well, we will probably never be completely sure as we don't have the code. But we can discuss some possibilities. But first, Why the change, actually? What could be a reason for this change anyway? A possibility is that intelligence agencies had something to do with this, like is assumed to have happened with an older version of A5/1, Comp128v2, where the ...


5

They can't. Encryption is encryption. Email services won't spend time and energy trying to brute force your password, nor do I believe they would create backdoors for the sake of email. If they let you send encrypted archives then they simply don't check the contents.


5

A one-liner to create a readable and relatively easy-to-remember password: cat /usr/share/dict/words | shuf -n 4 | tr '\n' ' '| tr -d \' Example output: correct horse battery staple If you want a longer password, change the 4 to a higher number. For a password without spaces, add an escaped space to the end of the line: cat /usr/share/dict/words | ...


4

The whole point of Keybase is that the user doesn’t and shouldn’t have to trust the server with anything. All proofs can be verified without the server. As the Keybase passphrase serves to decrypt the private key used to sign the proofs, the server can’t be allowed to touch it. Also, one has to trust the client to provide a registration passphrase, so even ...


4

Usaually the user's browser stores some cookies with a random string identifying the user on the server. More secure variants of this additionally check other parameters as the browser version, OS of the user and approximate location. Basically, if you visit a webpage like facebook with a cookie, you get authenticated only with the random string in the ...


4

Yes. This could solve your problem: mysyte.com/?token=xxx sets a cookie and redirects to mysite.com/changepwd without returning any markup mysite.com/changepwd recognises the user by the cookie and can safely request for 3rd party resources without leaking the token through referrer headers. To answer your second question: if the resource is over http, ...


4

Disallowing symbols is usually a sign that someone in the development process heard about SQL injection, code injection, or cross-site scripting and decided to take a brute-force approach to preventing it rather than going to the effort of understanding what the real risks and prevention techniques are. Length limits are either a sign that someone didn't ...


3

I think so, but its important to understand true entropy when it comes to how computers brute force. A word in the dictionary in any language can be thought of as a character, similar to a chinese character. And there are common words and uncommon words. Uncommon words can be thought of as having a very large alphabet, common words having a much smaller ...


3

Yes, in particular in the light of "practical purposes" for the non-NSA type of attacker. For online passwords, the rate at which attacks on the password can be done is limited. Also, there usually exist security exploits (customer service being the single biggest security exploit by design) which are often much more vulnerable than your password. Why waste ...


3

Currently windows uses NTLMv2 to store the password, but for backward compatibility some system uses LM hashes. Now it is recommended by the Microsoft to not to use LM method to store the password because of its weakness towards brute force attacks. If you want to see currently which method is used then you have to navigate to ...


3

Shouldn't password stretching and hashing be done on the serverside, as we normally don't trust a client? You got things mixed up here. There is a difference between trusting a client and hashing the user's password client-side. You are right that we never trust the client. But here we are the client and have a need of hashing something. Why should we, ...


3

There is no foolproof way to ensure secrecy, but you can make it quite difficult. One may assume that all electronic communication is constantly monitored so is insecure. However physical mail is certainly not going to be intercepted unless the sender or recipient is under suspicion or is being observed. I suggest you write the password down and mail it in ...


3

There is a package called makepasswd which can do this. $ makepasswd --chars 64


2

That's a bit unfortunate. So long as your code and testing framework are both public, there's nothing that you can do that your unauthorized users can't. You need to lock something down. The best this I can think of is to put the data on the server running your tests. Limit access to the server to only authorized individuals. That way even if people find ...


2

The answer to this question depends on two factors: the attack vector the implementation of allowing different passwords Websites should store passwords not in plain-text or any other form allowing to get the password from the saved value. Therefore usually a irreversible hash-function is used, so that only the hashes of the passwords are compared. Now ...



Only top voted, non community-wiki answers of a minimum length are eligible