Tag Info

Hot answers tagged

114

Well, let's start with math: If we assume that your password consists of lowers, uppers, and numbers, that's 62 characters to choose from (just to keep the math easy, real passwords use symbols too). A password of length 1 has 62 possibilities, a password of length 2 has 62^2 possibilities, ..., a password of length n has 62^n possibilities. So that means ...


69

Of course they could, but then they could also just email themselves every time you change your password. Now, depending on the type of system, there are plenty of regulations, audits, reviews, and processes that might be relevant to ensure that the developers don't do this, or many other types of malicious activity. However, you, as a consumer, usually ...


40

Apart from the maths detailed by @Mike, consider also that the password length leaks all over the place: When it is typed, a sneaky bystander can learn it, either by counting the '*' on the screen, or listening to the keystrokes (in the latter case, he can record the sound with his smartphone and play it as his leisure). In a classic "Web browser" ...


33

It is possible that the service not only computed the hash of the full password when it was created, but also hashed the 3rd and 7th character (or possibly every character) individually. That way, they technically wouldn't be storing the characters or the full password in plaintext. However this would be a terrible idea. A hash of a single character is ...


32

For starters, that article misuses terminology. Whatever vulnerability they may be referring to it seems pretty blatant that it is not "brute force" as that would contradict the premise of that very sentence. As another answer suggested it's possible that some form of social engineering was employed, but in this case any rounds of "guessing" left would not ...


19

What's the point of stealing hashed passwords? Let's say I steal a hashed password, I can take a random string, hash it, and see if the hashes match. If they do then I've just cracked your password. For example, assume that under some hash function we get the following hash table: "cat" --> AA "dog" --> AB "elephant" --> AC ... If I steal a ...


17

If you can verify the password by character, it significantly reduces the effective strength of the password. Rather than being exponentially stronger for each character it would only be incrementally stronger. For example, say I have a password four characters long that is "ABCD". If I have to know the entire password to get it right, the possible ...


11

Revealing your password length reveals something about the strength of your password. So you're in essence giving someone a hint about how hard it might be to guess. So if your password is very long (17 characters in your example) it's largely useless information. If the password is short, (6 characters), it tells an attacker that you might be worth ...


8

Any authentication which asks the user for details about the password indicates that the plaintext password is available to the system. This means they are unhashed, but may still be encrypted and protected by other means. There are no techniques to verify the subset of a hashed password against the whole of the hashed password. This is actually one of the ...


8

You cannot know that someone will behave ethically or wisely, so: Never re-use passwords across sites. Decide how much information to share. Withhold information that is not required, and suspect any website that asks for more info than is needed to give you a particular service. I'm afraid that some developers aren't forward-thinking enough to ...


8

The basic reason is because despite all these issues they don't regularly suffer breaches or theft enough for it to be a market differentiator. Weakened passwords still fend off most online attacks against customer accounts when paired with their system lockouts, multi-factor authentication, and other intrusion controls. Most banking customer passwords ...


7

Have you set a master password? If not you don't even need third party software to view the passwords. Just go to options->security->stored passwords and click show passwords and there they are. Try setting a master password in the security settings and see if the software is still able to list your credentials Since I can't yet comment on the other ...


7

The login credentials were found in password dumps from other sites. They were credentials where the username was a .gov email address. The concern is that people tend to reuse passwords and the passwords used on these sites are the password for their government login credentials. Either the passwords were stored in plaintext or the hashed passwords were ...


5

It's not a "security flaw" in the sense that something is broken or that the flickers indicate a bug or an attack. Rather, it's an issue with the underlying graphic stack of Linux and the lack of semantics for privileged desktop clients. Just to get this out of the way, the flicker is most likely caused by a poor interaction between your GPU drivers and ...


5

What you're talking about is known as the pigeonhole principle - if you have n possible passwords and a hash function with m possible outputs, where n > m, there will always be some input values which produce the same output hashes. The question then becomes: does this matter? With a hash output space of 2160 possible values, an accidental collision has a ...


5

This sequence: a b a b a b a b H1 E3 B8 W6 Z4 S0 X1 K4 b b b b b b b b S8 E3 O2 W6 G6 S0 C0 K4 a a a a a a a a H1 L3 B8 H5 Z4 D7 X1 Z8 tells that there is a key being used to scramble the input password, much like XOR, except most uses of XOR would output in hex while this output is base36? This sequence A B A B A B A B B0 ...


5

Revealing the length of the password does influence. If your password is weak (short password), an attacker may focus on cracking it. If the password is strong (long password), an attacker might explore other vectors of attack. So the knowledge of the length of password allows a hacker to choose a better strategy while saving time.


5

Great question. In bash, when you use "read" to get a password from standard input, the password is of course stored in plain text in memory. However, this is often the case for passwords in general -- something has to be storing them in plain text to use them. If it was encrypted, a way to decrypt it would have to also exist in memory -- thus the ...


5

This is usually a combination of luck, technology and hand waving. You may see that your database server was hacked (via unusual activity for instance, gigabytes being transferred to Internet, a fact detected by, say, your network provider). You may then have logs which trace activity on the database (ranging from "someone accessed the DB" to actual ...


5

As tylerl noted, entropy isn't really a measure of password strength, but it is the best that we've got: The purpose of password complexity is to stand up against a brute-force attack. The size of the smallest available dictionary that contains your password determines the amount of time required to crack your password. We can guess at what ...


5

Your rejection/acceptance of a truly randomly generated password, and how many times you reject until you accept, will not affect the entropy as the entropy is determined in isolation from generation to generation (just like each toss of a coin doesn't affect the entropy of the next toss). All strings have the same entropy, it's only the context of ...


5

The ZIP format supports several variants of password-protection of a file. The early password protection system in ZIP is known to be seriously flawed. However, later versions of the format provide far better protection, including support for stock encryption algorithms like AES to which no known attacks exist. The author of the video appears to be using ...


4

Above that paragraph it says: It’s possible, too, that my wife’s password was simply “guessed,” though in a different way from what laymen might assume. Guessing less often involves social engineering—trying your birthday or your hometown or your relatives’ names—than “brute-force attacks,” Which is most likely what he was referring to. In ...


4

PBKDF2 is a password hashing function(*); it uses a configurable number of iterations (to make it as slow as is appropriate) and a salt (to deter all kinds of parallelism in attacks). To verify a password, the hash is recomputed, and should yield the same value. To perform this recomputation, you need to use the same number of iterations and the same salt ...


4

As previous answers have already stated, there is no known technique to carry out a partial hash of a password and verify the string. The nature of unidirectional hash functions makes it impossible to verify if a password is similar to another, only that the passwords are identical. Therefore, it would imply that the bank has stored the passwords either ...


4

Yes, it's possible. The WCE product you reference works by scraping passwords directly out of memory. That method also works in Linux; a rootkit which has unfettered access to memory and can hook system calls can extract passwords from there - consider this example, which can steal username and password pairs Both solutions are limited in that they can ...


4

Yes there is a security issue. You stand the risk of inadvertently leaking the length of the passwords using this approach. An attacker could abuse this to determine the length of a password using a form of timing attack. Since calculating the hash is computationally more expensive than comparing the length of the provided password with the stored length ...


3

What matters for a password is not its length or whether it contains "special characters", but its entropy. The entropy is a measure of "how much unknown" the password is to the attacker. Since we assume the attacker to be overwhelmingly smart, this "how much unknown" reduces to "how much random": the attacker cannot be defeated by wit, but by randomness. A ...


3

This is a risky idea. If someone manages to get access to your database and somehow cracks the encryption, they have access to the data of all users. Add to that that users often re-use passwords, and our hypothetical cracker has a treasure trove of valuable information. Resetting passwords may be a bit of work, but it is the safer way of doing things. ...


3

Understand that passwords must be visible to Firefox itself at least so it can use them in web forms. That means if no other precautions are taken passwords can be discovered. Passwords in Firefox are not safe by default and noone ever said they were. If you want to have your password secure, you have to do some securement first - start with setting a Master ...



Only top voted, non community-wiki answers of a minimum length are eligible