Tag Info

Hot answers tagged

29

"Linux" (as some aggregate of all the installations) typically has quite a bit more than just a password denying external access. First, there's a uniform set of discretionary access controls: read/write/execute permissions, for user/group/everybody else. Traditionally, these permissions are actually used, rather than ignored and/or worked around. ...


25

You are basically right; this is poor practice, for several reasons: As you note, it requires server-side storage of the password as plaintext or in some reversible format. Typing a password repeatedly works on "muscle memory", which allows the user to "remember" his password as a sequence of gestures on the keyboard; asking for specific letters exercises ...


21

Modern cryptosystems are generally not susceptible to known-plaintext attacks. In terms of encryption algorithms, there are basically 3 algorithms commonly in use in TLS: AES RC4 DES (in 3DES) All 3 of these are believed to be resistant to known-plaintext attacks, and have been well studied for such attacks. The one thing I would wonder about are ...


21

Base64-encoding processes input bytes by groups of 3; each group yields 4 characters. The '=' signs are padding so that the string length is always a multiple of 4; since the '=' signs are not part of the core Base64 alphabet (letters, digits, '+' and '/'), the decoder knows that these signs are padding and don't encode actual bytes. That way, input ...


15

The answers given already answer the question, but if you wanted a password of the same length with those equals replaced by more random characters (more characters that are random, not more randomness), you can just round the number of bytes read up to the nearest multiple of 3: head -c 18 /dev/urandom | base64 This is because base64 encoding operates on ...


13

While I was searching online for information about Linux security, the most typical explanation was: Linux is secure, because the root password is required to access the kernel and install new applications - therefore external malicious software can't do any harm as long as the administrator is the only person to know the password. You're right in that ...


12

If you use the same password for several distinct sites, then you are doing something wrong. Each password shall be site-specific. Therefore, there shall be no reason why the "weaker standards" would have any impact on "all your passwords". (Similarly, there is no rational reason for changing all your passwords on a regular basis. There is a widespread ...


7

Explanations for weak password rules Well, those are obviously bad rules. But here are some possible explanations (or "explanations") for it: Must not start with a number The site owner might actually think that this is a good rule. To prevent for example 1234546 or just prepending a common phrase with '1' (e.g. 1password) Must not have a special ...


6

There is no secure system. There are only systems which might be sufficiently secure against specific kind of attacks, and attack scenarios might change fast. Linux as a desktop system profits from low adoption, which means that you are not an attractive target for mass attacks. Also it provides better segmentation between security boundaries, that is, it ...


5

Some Zip archives use the old PKZIP encryption, which uses a weak homemade stream cipher. The attack is described here (implementing it is a nice exercise for crypto students, by the way). Tools which apply that attack exist (use Google to find some). Windows XP inherent abilities at "Zip password protection" use this weak algorithm; see this answer for some ...


5

Maybe a silly question but are you certain you're not getting a ✓ meaning that the password you have entered has met the minimum requirements for the sites password policy? Such that the client side code is saying "yes, this is a valid password and I will accept it, although I have not yet validated the correctness." When you enter the password as ...


5

If nothing else, it's an API for checking passwords without any time delay. It has to be: if they had a time delay after every incorrect guess, it would defeat the point of live-checking the password. If you password is "password", then the server has to check seven incorrect passwords before reaching the correct one, and you can't afford to have a delay ...


5

Assuming your server doesn't use any credentials besides system-level accounts and the MySQL password, there's one thing you need to protect: the swap file. Programs are supposed to take steps to prevent credentials from winding up in swap, but they don't always do so. There are some sensitive things in /dev and /proc (such as /dev/mem and /proc/kcore). ...


5

SHA-256 is a hash function. That means it cannot be decrypted. If the original data that was hashed is relatively small (and not salted), you could try rainbowtables. Also see "Difference between hashing a password and encrypting it"


4

The PUT HTTP verb is supposed to be idempotent, a smart word meaning that sending twice the request should not have any further effect. The idea is that a "PUT" command is the opposite of "GET": the data contents sent with a "PUT" are supposed to be stored at the specified URL, and may conceptually be obtained back from that same URL with a "GET". In that ...


4

I just logged into cPanel and when I click to change my password it asks me for three things: My old password A new password Confirmation of the new password Screen Shot: It also says that the old password cannot be empty. This may not be exactly how cPanel does it but, it is a possibility: Since you have sent it your old password to cPanel it can ...


4

I would say yes. Not in any meaningful way (do not base you passwords on this), but still. Letter Frequency First of all, if you follow this rule, your password contains a 'z' instead of an 'a'. The letter 'a' occurs a lot more frequently in English text than the letter 'z' (this is also true for the beginning of a word), and as such it will be part of ...


3

One reason for enforcing weaker passwords is that a weaker password is easier to remember for the user. When the user forgets their password, an automatic password retrieval procedure must be used. Such a procedure usually entails that a plaintext password is sent to an email account. This offers a lot of attack surface which is outside of the control of the ...


3

There is nothing complicated about building a tool to crack Diceware passphrases assuming you have an oracle, such as a hash of the passphrase, that will tell you when you have the correct answer. The cracking tool would simply loop through all possible combinations of up to n words from the Diceware list. It is also straightforward to estimate how long such ...


3

When only the server sends a certificate, but not the client, the SSL connection is fine and dandy, but the server has no clue about who it is talking too. What SSL provides in that case is that the server can be sure that it talks to the same client all along, with no possible eavesdropper in the middle. If the server must still know who the client may be, ...


3

I think your effort is broken by design. You want to install a program at someone's machine that connects to an FTP server via password, but you don't want the user to know the password. No matter what you do to protect it, the user can easily intercept the network traffic comming from the program. For example, the user could set up a proxy and just dumping ...


2

Windows Credentials Yes, they are stored hashed within files in the c:\Windows\System32\Config\ directory. You will need the SAM and system files. However, a backup of these files may be stored in the Windows repair folder at c:\Windows\Repair\. If Windows is running and you need access to the locked files in the Config folder (for example you know the ...


2

To access the windows passwords, you'll need both the SAM and SYSTEM file from C:/WINDOWS/SYSTEM32/config On a Linux Distro, like Kali-linux, you can then use the command "bkhive SYSTEM bootkey" to get the bootkey from the system file. Then, use the command "samdump2 SAM bootkey > samdump.txt" to get the hash dump from the SAM file. If you open the file, ...


2

@Travis Pessetto most likely has the correct answer to your question. I just wanted to point out that some places will do this without knowing your old plaintext password. This can be done by generating permutations of your new password and comparing each hash to your old password hash. Old Hash (Plaintext Unknown): ...


2

As @aviv pointed out, revealing to a user that some other user also has the same password is a problem. If you really intend to maintain such statistics, then you have another inherent problem: the "statistics engine" can only help any attacker, since it outputs a list of passwords that are in use. Even a reduced form which merely says "this password is ...


2

I dont think you want to do that at all... you will be giving hints about other user's passwords. If I get the message that 1 other user is using my password - now I have valuable information. I might even know or guess who that user is if I have some prior knowledge on him


2

A shared password is a poor design for managing access to a private communication channel. For example, you can't kick a user out without closing the channel: you can't cause them to forget the password. You can't prevent a user from sharing the password with other users (voluntarily or involuntarily) — if a user's password is exposed, you can invalidate it, ...


2

Generating random passwords and sending them to users is fine. But the most important thing to do, if not already done, is to warn ALL users that their passwords have been compromised and if they are using the same on whatever other website/app they absolutely have to change it.


2

The usual computations on password entropy take place in the context of a dictionary attack, especially an offline dictionary attack, where the attacker can try passwords at will without locking anything. When there is an auto-locking tamper-resistant hardware, the context changes. Conceptual view: there are N possible passwords (to simplify the exposition, ...



Only top voted, non community-wiki answers of a minimum length are eligible