New answers tagged

0

This is extremely common practice already, think database connections on servers with most keys stored in plain text on the server, there is little way around it. You just have to prepare your self for automation: Ensure the connection is only 443 (SSL or what ever port the SSL is on for this service) if you access the server physically ensure you only ...


3

Use a password manager like KeePass. Have it auto-generate a different password for every account you own. This ensures that your passwords are far more complex and far more different than a human brain could possibley handle. It also has the advantage that you don't even know you passwords yourself, protecting you from many social engineering attacks. But ...


0

I agree with Aron's answer but will add that having the OTP codes in the password manager defeats the spirit of multi-factor authentication which is to supplement something you know-- a password-- with something you have-- usually your phone. Using 2FA to access the password manager may be sufficient protection, but be clear that when you store the OTP ...


6

The only safe method for a website to transfer a password to the server is using HTTPS/SSL. If the connection itself is not encrypted, an ManInTheMiddle can modify or strip away any JavaScript sent to the client. So you cannot rely on client side hashing. You cannot setup a secure connection between client and server on your own, because there is no already ...


0

What steps must be followed to send password securely from the user registration page (i.e. client side) to the server over a non encrypted channel (http)? Not to be too blunt, but I think you're trying to solve the wrong problem. The best practice here is that the password should be salted and hashed client-side so that the server never even sees the ...


2

The answer here is that it shouldn't be. The password should be hashed (and salted, and any other algorithms to taste) on the client side, and that hash should be passed to the database. The password should not leave the client-side. If you want to prevent that hash from being intercepted, then HTTPS or similar to encrypt the channel is required.


2

There is an additional location where they store cached domain credentials as MSCASH2 hashes: HKEY_LOCAL_MACHINE\Security\Cache So, if you are talking about a domain-joined machine, there are three places that you could find credentials stored. SAM file (need both C:\windows\system32\config\SAM, and C:\windows\system32\config\system) Registry ...


4

C:\windows\system32\config\SAM (Registry: HKLM/SAM) System memory The SAM file is mounted in the registry as HKLM/SAM. Windows locks this file, and will not release the lock unless it's shut down (restart, BSOD, etc). However, if you look at the SAM entry in the aforementioned registry section, you will not find the hash. Therefore, it seems more than ...


0

Pretty much everyone is already doing this I noticed that the new gmail login asks for username first, and then confirms if such username exists, before asking for password input. Google already has this feature. When you try to sign up for a new Google account, it has to check to see if the username already exists or not. Does this not go against ...


0

The point of a "good" password" is to make it difficult to guess. That generally means you need to create a password in a way that there are too many possible passwords that your method could generate, for an attacker to guess yours in a reasonable time. The best way to do this, is to create an actual random password, using dice, or atmospheric noise, or a ...


3

On a Windows machine, inspecting the memory of the IE process is limited to the owner user, and administrators. If an attacker can inspect the memory of your IE process, then that attacker has taken control of your machine and/or your account, and you are already doomed. If the machine is "shared" then there is no really good solution: if an hostile entity ...


1

The first paragraph of RFC7272 appendix B, which is the second paragraph in original [RSA PKCS#12v1.1] (http://www.emclink.net/collateral/white-papers/h11301-pkcs-12v1-1-personal-information-exchange-syntax-wp.pdf), recommends that PBES2/PBKDF2 from PKCS#5v2+ be used, but this is only 'should' (not even RFC2119 upper-case SHOULD) and the scheme of ...


0

If you want to create an encryption key or store a hashed password, you want to use a key derivation function, not a simple hashing function like SHA-256. A KDF is like a hash that gets applied many times, but is typically designed to be computationally expensive in order to make brute-force searches harder. While you might be able to use SHA-256 as a KDF ...


1

Can this scheme be extended to work with hashed passwords somehow? Not this scheme. Because of how it works it needs to have the password or some specific equivalent (see http://stackoverflow.com/questions/1000281/storing-password-in-tables-and-digest-authentication for details) to do some necessary computations. Of course with a naive approach you ...


1

Thankfully the world has evolved away from the old break-the-glass style of storing things on a USB key, and that evolution is (free and open source!) Vault. It has clear and obvious mechanisms for key rotation, uses ephemeral secrets when possible, and has full audit logging, and ultimately the very magical possibility of instantly revoking any credential a ...


3

Am I right to say that this won't work if the password is not stored in plain text on the server? I fail to see how the server could verify the hash if the password is already hashed (with salt and pepper) on the server. This scheme does require the password to be stored in clear-text. Very bad. Can this scheme be extended to work with hashed ...


1

If you're using a secure channel namely TLS, you don't need to do these sort of tricks. About your first question, yes you're right, this scheme requires the server to have access to password in clear text to be able to reproduce H(nonce+cnonce+password). About your second question, I can't think of a way that won't open you up for replay attacks.(but I'm ...


1

This is essentially identical to simply generating a password that isn't hashed, in security terms. Whether you use your first name for a password or the checksum of the current time doesn't matter; if the thing you send over the Internet is compared with a string directly stored in a list on the server side, then the password isn't usefully hashed. The ...


-2

@SethWhite - believe you have given the most accurate answer. Many users don't understand the avenues and methods used to break a password. Also there are additional security measures such as port blocking for unknown http/ftp callers. Someone better versed should explain. Seth shows that there are at lease four different avenues to breaking a password the ...


2

I guess it depends on what the server does, but it doesn't add much protection either way (or is even worse). (Also, does the average user know how to compute a hash on mobile? Sounds quite a hassle to me.) 1. Server stores hashed password This means client sends H = hash(password) to the server, server looks up clients hashed password H' in the DB and ...


1

Would this increase security? No. Any modern application already stores it's passwords hashed in the database. Whenever an authentication attempt is made, the user input is hashed and compared with whatever's in the database. Mostly this happens with a 1-way encryption (the hash cannot be decrypted back to it's raw value). When you would create a hash on a ...


1

Just don't confuse password cracking techniques with brute force. Brute force literally means starting with 1 character trying all possible alphabetically, then moving to 2 characters, 3, 4, etc... Once an algorithm or a heuristic logic is applied it not called brute force anymore. So why are people still talking about brute force? Reason is that for ...


4

PBKDF2-HMAC-SHA-256 number of iterations desired = 1024 length of the salt in bytes = 16 length of the derived key in bytes = 4096 Ok - PBKDF2-HMAC-SHA-256 is a solid choice, though if you're running on any modern 64-bit CPU, I would strongly recommend PBKDF2-HMAC-SHA-512 instead, because SHA-512 requires 64-bit operations that reduce ...


3

Link to zxcvbn password entropy demo. According to zxcvbn, your initial password's stats: Normal: PwdThing Guesses: 100 / hour: 5 months (throttled online attack) 10 / second: 58 minutes (unthrottled online attack) 10k / second: 35 seconds (offline attack, slow hash, many cores) 10B / second: less than a second (offline ...


0

I very strongly recommend you evaluate SecretServer. It is on-prem web-based, has excellent logging and auditing, supports devs, ops, security, et cetera. You can script against its API to check out "secrets" for operations that need them, as they need them, then when the "secrets" are checked back in, the password for each is reset automatically.


3

What's the best way to store passwords? This is a very broad subject that encompasses many different areas of IT. It also has the tendency to be opinion-based. However, there are some very important things we can know, and then use to make an informed decision. Also, there are many different ways to handle passwords. What size company? Small? Medium? ...


94

Let's try skipping theory and going straight to practice. Will typing the same word twice (or N times) substantially help? John the Ripper Jumbo has a variety of "simple rules" about this d duplicate: "Fred" -> "FredFred" f reflect: "Fred" -> "FredderF" oclHashcat rules based attack has simple rules just for this, too d Duplicate entire word d ...


1

I've been using keepass for years and I'm very happy with it. I have my password database synchronised between my devices using dropbox, and the database is encrypted with a password + keyfile (which I manually copy to each required device). This means that even if someone was able to compromise my dropbox, and gain access to the database, it would be ...


2

I'll go for the secure password manager application. However, my Approach may also apply the split knowledge for the master vault password (Should be stakeholders or senior management to hold this). Which means one party couldn't be able to delete anything without tracking. The permission level will be shown below master <== can do eveything ...


13

My password cracker already tries letter doubling, word doubling, word reversing and doubling, word-case-flipping and doubling... ...and many more. Yep. Doubling adds some to the difficulty: about four bits worth, tops. It'd take me sixteen times longer to crack, than a raw dictionary attack with letter replacements. But I'd eventually get ...


5

Humans are surprisingly predictable creatures. The way we think is not nearly as unique as we would like to believe. Chances are, any clever thing you can think of to make your password more secure, has already been thought of by lots of other people, and hackers are well aware of all of these clever tricks. The only way to make a password properly secure, ...


0

The length of the password is always a key factor in password security but try to improve the content also, doubling the password may help against the pratice with HYDRA/Dictionary attacks


3

There are a lot of factors but it ultimately breaks down to what type of password cracking are you trying to protect against. Against a brute force hack increasing the length of the password will make it harder to crack. Assuming their hashing isn't horrible a decent 8 or 9 character password should already be very hard to impossible to brute force crack. ...


1

adding length to a password does substantially increase the security of a password so I think typing your password twice or doubling every character is better than not doing it and using a shorter password of 8 or 9 characters. Refer to this link to read more about how increasing password length significantly improves its security: ...


20

In general, no, doubling the password does not substantially increase (or decrease) your security. What it doubles is your typing effort. Doubling your password may decrease your security if it incites you to choose a shorter/easier base password so that your typing effort is not too cumbersome. In broad terms, password security comes from its randomness, ...


62

Security.StackExchange is full of questions proposing "home-brew" password strategies. The short answer is always the same: doing something to differentiate your password from the standard dictionary attacks is good - as long as Very few other people on the planet are also using your strategy. If your "home-brew" strategy turns out to be common - like ...


0

But limited characters is pretty common for both password and username. In secure computing you have something called attack surface, vulnerability, and exploit. Separate is reliability. Yes more character is more random but you also have a larger attack surface. You can create sufficiently random passwords with a limited character set. ...


1

I avoid symbols in passwords because they may be difficult to type, especially on keyboard layouts or devices I'm not familiar with. Also, more importantly, I don't often trust all software developers. Once I used passwords containing spaces. Some services later changed their authentication methods so that they stripped blank spaces from passwords. This ...


0

As @dr jimbob said you are using the non printable character £ in your password !@£$%^&*(). If you remove the non printable character £ from your password it will be accepted what ever be the service. This is because the password encryption was developed in c or in Java in core level to maintain the high level of security. It is difficult make the non ...


0

First, simply look for offline password attacks against whatever software you're using that generated those unreadable passwords - at this stage, you haven't given any evidence that they're hashed vs. encrypted vs. scrambled some other way. Second, if it's open source, look up the source. In general, see if oclHashcat or John the Ripper (JtR) has a module ...


2

You seem to be confusing authentication with authorisation. OAuth is chiefly about authorisation and has various flows to support different scenarios and use cases, one in particular which overlaps with your question supports user / resource owner password based authentication for authorising the requesting application access to some set of resources. As ...


2

The hash that you posted has 32 hexadecimal characters. Each hexadecimal character is 4 bits, so this is a 128 bit hash (32*4=128). Some of the more common hash functions that produce 128 bit hashes are MD5 and RIPEMD-128. See here for others. However, as some of the other commenters have pointed out, hashes are designed to be difficult (if not ...


0

If you have the plain text password, you can probably find out which hashing algorithm was used. However, even if you do know which hashing algorithm was used, you will not be able to reverse a hash back into the password. This is exactly the point of password hashing: it is a one way algorithm. Think of the hashing algorithm as a mathematical meat ...


1

Tokens and passwords are really very different things. But you haven't specified in your question what you are really asking. You mention OAuth in the subject line of your question but then don't mention it again in the body of the question. OAuth has different kinds of tokens in its spec, depending on what sub-spec you're talking about and what kind of ...


0

In any instance of a vulnerability, adversarial thinking helps. In what scenario would I find this vulnerability helpful, if I maliciously wanted access to someone's account? Well, as a sysadmin, I have access to everyone's password hash, along with any salt and pepper. But, because they are hashes, I still cannot crack a password which is well chosen. I am ...


0

You were right at the beginning. This is a password for a Wifi network. It has some different properties than something for, say, your bank or your company. For one thing, you'll be entering it on a zillion different devices—many of which have terrible user interfaces. (TVs, PS4, printers, mobile phones, etc.) So if you do the usual advice and put in all ...


0

For one of the business I work with, they need to allow employee access to their network, as well as various devices that report data back to a central server. With a key rotation requirement in place, entering a wifi key into every device was pretty time consuming. One of the requirements I imposed was the key had approx 64-bits of entropy, which for a ...


7

As noted in the comments, some version of Windows have an "eye" symbol that can be clicked to show what you've typed into the password box. If you leave six of your characters in the lock screen password box, it takes only one click on the eye to expose the plaintext. This does not mean the attacker would know how long your password is, but does mean it ...


0

This particular sequence is just holding down SHIFT and typing 1234567890. So I am assuming that they are disallowing this particular sequence because it is simple for a hacker and a lot of people do this. For example, I have seen people use QWERASDFZXCV for a password which is insecure because you are just holding shift and moving down the left side of the ...



Top 50 recent answers are included