Tag Info

Hot answers tagged

52

One related question that you missed in your list is this one: How critical is it to keep your password length secret? The accepted answer there (disclaimer: mine) shows that if you have a password scheme which allows all 95 printable ascii characters, then the key space ramps insanely quickly every time you increase the length of the password by 1. You ...


46

I wrote brainflayer and gave a talk about it at DEFCON. Neither Thomas Baekdal's article nor XKCD's comic apply well to modern offline attacks. I read Thomas's article and his FAQ about it, and it may have been marginally reasonable when he wrote it, it no longer is. A key point is that password cracking attacks have gotten much better since then. Q: If ...


35

Number of rounds is often stored with the password and hash. For example, using bcrypt: $2a$10$oEuthjiY8HJp/NaBCJg.bu76Nt4eY4jG/S3sChJhZjqsCvhRXGztm The 10 indicates the work factor, effectively adding 10 bits of entropy in terms of hashing time to brute force. 2^10 = 1024 rounds. It is stored with the hash in case of the need to up the work factor due ...


31

TLDR: Any file encryption does not protect you against Ransom Attack. We can consider two scenarios: You encrypt your files with some tools (e.g. encrypted zip), You have encrypted whole partition (Truecrypt, dm-crypt etc.). In the first case, even if you have encrypted your files they can be encrypted again by ransomware. And then you won't be able ...


15

The attacker can use a form of public key cryptography. For each victim, the attacker creates a public/private key pair. The victim's files are encrypted using the public key, but need the private key to decrypt them again. The private key is only disclosed to the victim once the ransom is paid.


15

The specific attack your talking about had, per the defcon talk, certain specific characteristics that mean that the same attack doesn't really apply to all passwords. First and most importantly, brainwallets effectively put the password hash in a public location. Usually the first defence against cracking of password hashes is to try and secure the hash ...


13

The answer is in your question. Assuming the use of only alphanumeric characters, requiring 8+ characters removes about 3.5 trillion password possibilities (most of them would just be random gibberish). This leaves ~13 quadrillion passwords that are 8-9 characters. Establishing a minimum length, or even an exact length, for passwords forces the user to ...


13

How does a hacker know how many times a password was hashed? The same way you do. The goal of hashing a password is to make it impossible (in practice very difficult) to determine the password, even with full access to all the data. The other requirement for hashing is that the server must be able to determine if an entered password is correct. This means ...


12

A simple non-technical analogy in the form of a four step plan.... You have some money you don't want stolen. You put this money in a safe so that other people can't get at it. Nefarious Evil Doer wants to stop you from getting at that money too. Nefarious Evil Doer locks your safe inside a bigger safe that you don't know the combination to. Now neither ...


9

With eight characters you're extremely limited. My advice - forget the memorisation part. Generate an eight character string using a cryptographically secure pseudo random number generator, using letters (both cases), numbers and symbols. This will give your password 52 bits of entropy, which is the maximum you can achieve using this scheme. The ...


8

Interesting question. @RoryMcCune nicely addressed the question about brainflyer, so I'd like to address your more open-ended question: are passwords such as "this is fun" really as safe as Thomas Baekdal claims? No, no it is not. My first thoughts are 1) that Thomas Baekdal doesn't explain how he's calculating his time estimates, which makes my inner ...


8

The number of iterations and the salt are stored in the same database, usually in the same field as the password hash itself. Because the site needs to know those things just as much as a potential attacker does, and so they have to be easily available. For example, bcrypt hashed passwords contain the (log base 2 of the) number of iterations separated by $ ...


7

The short answer to your question is, please don't try to be creative when it comes to security. Hash your users' passwords with bcrypt or scrypt, then move on to problems actually in need of solving. A password corpus hashed with either of these algorithms are unlikely to have more than a few of their (weakest) entries broken in the foreseeable future. The ...


7

Passwords are hashed for the case that an attacker can read the hashes from the database (e.g. SQL-injection). Afterwards he can brute-force with the full speed of his own environment, often with a GPU, this is called an offline attack. A sleep on the other hand could only protect from online attacks, even then an attacker could make multiple requests and ...


6

This really depends on the site, the level of information being stored, and the TTL (time to live) for the record. Google tends to handle a lot of different accounts for people: gmail, YouTube, blogger, Android accounts, search histories, contacts, calendars, etc; all of the stuff a spearphisher wants. Likewise their app, Google Authenticator, changes keys ...


6

Ransomware attacks work by encrypting your files so that you don't have access to them anymore. This works regardless whether your files are encrypted or not, as the ransomware treats your files as opaque blobs. If you are lucky, and your ransomware does file(1)-like checks for the file type, about which file to encrypt (some ransomware only encrypts data ...


6

Once you say the magic words "targeted attack", I'm not sure that theory has much to say on the topic. The whole idea of password entropy only makes sense against a generic dictionary / rainbow table attack. Basically, the online entropy estimators are trying to estimate how far an attacker will have to delve into their rainbow table before they find your ...


6

All ciphers are not made equal regarding this possibility. It greatly depends whether we are dealing with a stream cipher or a block cipher. Stream ciphers (like RC4) take a flow of n plain-text characters as input and produce a flow of n encrypted characters as output. With such ciphers, adding a single character to the password (which acts as the ...


6

Bugs in your script If you think this script runs great, you haven't tested it enough. There is a classic vulnerability in your script: insecure temporary file. You attempted to protect from it, but in an overly complicated way, and you shot yourself in the foot. random=$(tr -dc [:digit:] </dev/urandom | head -c2) random is set to two random ...


5

Any question about password entropy needs to start with a discussion of what "password entropy" really means, and what kind of attack you are trying to protect yourself from. In a nutshell, password entropy is an estimate of how many incorrect guesses an attacker will have to make before they stumble onto your password. These estimates are based on standard ...


5

Are there others I am missing? The one-time password has more entropy than dog's name and is less vulnerable to enumeration/dictionary attacks. On a phishing site, it is fairly easy to display some trivial personal question (e.g. what is your dog's name). The phishing site doesn't need to know the answer. On the other hand it is pretty ...


4

Good question. As far as I know, there's no general way to do it, so I'm curious to see what others post. I know that it is possible to do in some cases if you know how the protocol works. It's well known that encryption does not hide the overall length of the message, so if I know the protocol then I can deduce the length of your password. For example: ...


4

Not uniformly applying a password policy introduces unnecessary security risks and definitely does not improve security. Allowing weak passwords to exist just improves the likelihood that the attacker will crack a hash using a list of common passwords. This problem is made worse as the number of users increases. If 1/100 accounts have a password that ...


3

You should really stray away from rolling your own crypto implementation. Why not use bcrypt for password storage? It's been tested extensively for that and works quite well. Some advantages it has are: Resistance to brute-force Resistance to rainbow tables Salt generation Scalable speeds via setting the rounds of hashing Built upon blowfish algorithm ...


3

The salt is not meant to be secret. It is meant to be unique across users in your database (at least). The reason for this has been mentioned already in that it prevents the attacker from running the brute-force attack on the password hashes against all of the users at the same time. It does not matter what method you use to make the salt unique for it to ...


3

Your randomised salt is a "pepper". Add a regular salt as well. A secret, non-database-stored hash-ingredient is known as a "pepper". (It may be either global or per user. I'd argue, that your pepper is global.) And this is what you are doing. The justification for peppers is that if someone manages to dump your user database, with all the salts and ...


3

This is not a good idea. I would also like to quote the question: I still feel like most people are probably using a password that is the required length or only 1 or 2 characters over the limit. Agree! Well, I don't actually assume people to create passwords of one or two characters if you set the minimum length to 0, but most of your unrestricted ...


3

A developer chooses to write a polyfill because it fulfills his personal need. From this personal aspect may come all problems you may imagine, namely malicious JavaScript code. Can a shim be installed in IE, FF, or Chrome without user knowledge? Surely. Drive-by download attacks which consist in malware delivery without the knownledge/consent of the ...


3

A shim or polyfill does not get installed into a browser but gets delivered as part of a web page to provide functionality for this page. It is just normal active content (JavaScript, Flash...) which only gets named as shim or polyfill because it serves the specific purpose described by these names. It has no special permissions or restrictions compared to ...


3

While the currently accepted answer is correct and the number of iterations is usually stored where the hashes themselves are, even if this was not the case: By Kerckhoff's principle, you should assume the attacker can find out. In practice they could find out for example by creating their own login with a known password or timing a login attempt. Even if ...



Only top voted, non community-wiki answers of a minimum length are eligible