Tag Info

New answers tagged

2

You may want to try: usermod -p '!!' root usermod with the -p parameters takes the raw value to bet set as encrypted password in the /etc/shadow files. The traditional usage of this parameter is to give to usermod an already encrypted password, but it accepts also the '!!' flagging the account as locked. In the end, this command will remove the current ...


1

"Microsoft Account" is probably as close as you'll get for consumer grade out of band 2 factor authentication. How it works is when you login to a site (using MS account) that requires two factor authentication, you launch the app on your phone and then grant access. There is no entering of pins or codes. It is completely out of band. (assuming you are ...


4

This seems good except that it is vulnerable to a phishing attempt / rouge site that can get me to enter the OTP & then use it on the fly to get access. This is what x.509/TLS certificate is supposed to prevent. If: you trust the underlying mathematics of x.509 certificate and TLS, both the server and the client has implemented TLS correctly, the ...


2

Yes, there are Challenge/Response OTP features available on hardware and mobile authentication 'tokens'. I've developed many client and server components to enable that in the last years, on behalf of my employer which is a big player in that market. See the OCRA specs, for details. Just one more thing: not even this protects from MITM attacks or a ...


1

Please do the following steps: Close all your applications that uses an internet connection (safari,google chrome, utorrent .....) Click on the Apple menu icon and go to System Preferences. Go to Network in the View menu. In the Show menu, go to Active Network Ports. Click to deselect the checkbox for the port use to connect to the internet (probably port ...


3

This question is rather broad and hard to answer with so few details. It really depends on your organization's setup, but I'll try to give a general answer: It's always better for a user to type in their own password rather than having an admin create a "temporary password". The main reasons for this (as far as I know) are: 1. The admin could perform ...


14

As @cpast says, the main problem of a single SHA-256 is that it is way too fast. An attacker with an off-the-shelf gaming GPU can try passwords at a rate that is counted in billions per second (American billions, but that's still a lot). Another problem is that there is potential for combining things improperly. SHA-256 is a hash function: it takes one ...


6

sha256 is not designed to hash passwords. To hash passwords, you should prefer to use hash functions created for this usage. You will find all required information below in another question addressing a similar request: Most secure password hash algorithm(s)?. In the above mentioned question, you will learn why general purpose hash functions like sha256 do ...


17

General-purpose hashes have been obsolete for passwords for over a decade. The issue is that they're fast, and passwords have low entropy, meaning brute-force is very easy with any general-purpose hash. You need to use a function which is deliberately slow, like PBKDF2, bcrypt, or scrypt. Crackstation actually explains this if you read the whole page. On the ...


3

You are doing it wrong, and thinking it wrong. The problem with password hashing is not, and never has been, about collisions. The main problems with password hashing are speed (hash functions are too fast) and parallelism (a hash function is always the same as itself). There is a lot of theory on password hashing. As an introduction, read this answer. The ...


0

Banks are normally very large, bureaucratic organizations driven by policies written by people that were well meaning, but can't respond very well to changing threats. Are Phishing attacks worse than compromised machines where the password is stolen? I'm not sure, but it's a valid discussion. Saving the password locally is easy to understand, and for ...


3

While there are aspects of truth in what you say, you have to look at the bigger picture and look at where banks have liabilities and risks. Banks look to minimise the risk down to a certain level (eg there is a fraud appetite that is accepted by banks, as to try and reduce it further costs more and more, rapidly becoming unworkable) and many of these ...


0

He needs only one page, right ? Fine then, you might want to save it somewhere, so he can access only that page. Assuming the data he is trying to get is static, and assuming it's only for data processing purposes he needs that access, wouldn't that be a solution to save it somewhere else to give him access only to that page ? Unless it's the secure ...


0

Your bank may be using a product like RSA's Adaptive Authentication. It uses multiple attributes to assess behavior (e.g. IP address, time of login, device fingerprint, etc.) to ensure the login is ok. It may even be tied back end to a real human being doing analysis of anomolies, or even tied to a 3rd-party like Equifax. My bank allows me to have a dinky ...


2

Banks have real money losses, a significant amount of this comes from unauthorized access to bank accounts so they have financial incentives to make it harder for users to lose their password by storing it in the browser at their local internet cafe/library/etc.


0

Having a double/triple password makes the login process more cumbersome for users and offers no additional security because once the client machine or the server is compromised, the attacker has access to all passwords; it doesn't make any difference if the user has one or two or three passwords to login. What actually increases security is multi-factor ...


0

I am surprised that people haven't noted that you can and should encrypt the verifier in the db. Typically with large firms the databases are segregated infrastructure. The backup regime of the database servers is also usually deliberately different than the host level backups of the applications servers and web infrastructure. Db backups are usually offsite ...


10

Yes, your steps appear to be correct. The attacker hashes lots of words or sequences of characters until she finds one which matches the target hash. Pseudocode: hashlist = [ "a235b8320c...", "688b4302c57f3...", ... ] wordlist = file.readlines("/path/to/wordlist") for each word in wordlist: h = hash(word) # is the hash of this word in the list of ...


6

It depends what you mean by "enhance security". On the one hand, yes, it's more pieces of information for a thief to steal, but on the other hand, if they can steal one password, chances are they can steal all your passwords. For a great discussion on multi-factor authentication see this answer. by @tylerl. The Cole's Notes is: we like to have multiple ...


1

The main concern with implementing multiple passwords is that users tend to have a hard time remembering one password, and adding more just makes it more likely that they will start writing down each of them, netting you with a loss of security. Besides, even if they don't write it down, there is still a single point of failure and multiple passwords will ...


9

start typing characters., Once the password is valid, the red text goes away, indicating a valid password. This kind of behavior doesn't necessarily violate PCI DSS requirements. If the site works the way you describe, it's not very good from a security point of view because it makes brute force attacks more difficult to detect -- but that doesn't make ...


0

Use a browser plugin such as Cookies Manager Plus on Firefox, then you can simply copy the value to the clipboard. As you say, simply paste the value into the command line for Hydra. See my answer here for the syntax that worked for me. "/dvwa/vulnerabilities/brute/:username=^USER^&password=^PASS^&Login=Login:F=incorrect:H=Cookie: ...


0

Keeping the system fully patched is as important as setting a good password. The strongest that you have suggested is Using a non-privileged account with a password and having an admin account with a different password. The attacker does not require a password to break in. If an attacker gets into the system because of some service that is not patched, he ...


1

If you care about the security of someone's password, you should move away from PBDKF2, and at least to BCrypt. Look at the state of the art in cracking hardware. For BCrypt cracking in hardware, look at High-Speed Implementation of bcrypt Password Search using Special-Purpose Hardware. | Algorithm | hashes/sec | hashes/sec/Watt | ...


1

First things that comes to my mind is are : timing attack: If I would request the token within the 100ms of the original request, (so the credentials are still in memory) will I get a copy of the credentials? Bruteforce: you do not mention any mitigation against brute forcing, so I could possibly mine all your credentials in that way. Record / playback: I ...


1

Do not use Touch ID for anything beyond the Apple lockscreen. In other words, do not use it in apps, or store/read any detail related to Touch ID in the iOS Keychain. Reason #1: http://whaley.org.uk/andrew/blog/2015/03/08/rbs-natwest-touch-id-security Touch ID can be subverted completely by simply attaching a hooker (such as cycript) and telling the ...


1

You are correct @Numeron, the purpose of the \000 is to add a null to the end of the password stream (NULL value or END-OF-FILE value) since the null is an illegal character for a password (or any user input for that matter) it is used here to signify the end of the 'password' string (this is part of normal string behavior). the minor you see is comes ...


2

I continued my own investigation... \ is an escape character in java, but one thing I didn't realise is that it can escape more than one character. In this case, it escapes all three zeroes, thus adding a NUL character onto the string. This turns into an extra byte on the end of the UTF8 array, with value 0. This is presumably used by the algorithm to ...


12

Drilling a bit deeper on the copy and paste issue: Microsoft products, particularly the Office suite, are notorious for attempting to help by adding trailing white space to items copied from, say, Outlook and pasted elsewhere. The purpose of doing this is so that you don't have to be as careful where you place the cursor when copying and pasting to avoid ...


4

It's probably a usability issue. It's very easy to unintentionally accidentally add a space to the beginning or end of a username or password, especially on certain types of devices: mobile with autocomplete, people typing via voice, people using assistive technologies that auto-insert spaces, copying and pasting passwords, etc. The other day I was ...


15

They trim passwords to deal with the (sometimes insecure) process of people copying and pasting them.


9

Because they trim whitespace. The why of that is not known, but is not unusual, and often is related to the inability for humans to discriminate - you and I know that foo bar has a space in the middle, but it's hard for us to say how many spaces are in foobar if any of them are trailing. Judging from productforums posts, this policy is not new.


0

If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security? This is why you should protect your LastPass account with a second factor of authentication. LastPass have several options available such as Google Authenticator, or Yubikey. Good ...


0

The specific-conditional entropy can be greater than the entropy. This is the key mathematical fact. You are arguing about the number of combinations but you should be arguing about entropy. These kinds of password policies only make sense if the user picks the password and is not uniformly generated. In these cases, by restricting the possible pool of ...


1

As far as things like rainbow table cracks or brute force or things like that, I don't think this is an issue. You can expect that LastPass will be using proper security practices (at least as much as you can expect it from other companies who store highly-sensitive info (PayPal, Google, etc)) and therefore can probably safely assume that there are no ...


1

Since one factor is the awkwardness of entering passwords, especially on a tablet. there is a good argument to stick with alphanumerics and forget about symbols. It's also a more general problem, website passwords and such, that most symbols are rejected. But since you only need the enter the password once per device. there's not a huge obstacle there. ...


-1

Simply storing password using sha1/md5 or any hashing function is not a good practice. Many sites are providing dictionary to crack these password. Solution is to use a powerful salt to add in password, then convert it to sha1 hash. You are using very basic or a kind of simple padding. You can use rand, time stamp, double hashing as salt. Performance wise ...


1

There are two things that affect any security generally: What do you have to do. What do attackers have to do to overcome your security. The second is the most obvious; the easier it is for attackers to "break" the security, the less secure you are. The first though is also important; if your security prevents you doing what you have the system for, then ...


6

There are two things wrong with what you are doing with what you are doing: your algorithm in it's simple form is fast and thus not suited for password hashing. (the properties you want in a password hashing algorithm is it being fast enough to run once, but slow if you need to run it several times as well as being unfriendly when being run on FPGA/ASICs ...


15

No a salt should not be derrived from other known parameters, a salt should be globally unique. So the best you can do is to generate a really random salt for each password. Todays operating systems have a "random source", on a deterministic computer it is the best you can do to read form this random source (DEV_URANDOM). Beside this, the SHA-* hash family ...


4

A drawback of SHA1 is that it is fast, so it is easier to create rainbow tables and brute-force it. Adding a salt helps, but if the password is weak, then "number + weak password" may well be in the rainbow tables along with the password. PHP provides built-in password mechanisms. When you use these, the crypt function automatically generates a salt for you ...


2

There are a few different things to consider here. 1. Managing passwords for web applications and authentication purposes You mention that people are saying that "storing passwords via encryption is like storing passwords in plain text". I think that what they mean (although I have no idea who 'they' are) is that storing passwords in a database for website ...


13

Context is everything. storing passwords via encryption is like storing passwords in plain text. This advice is about client programs implementing a faux password manager that stores password to access online service in encrypted format so you don't have to type the password to access that service at all. This kind of encryption is moot because to ...


-1

If we don't try to delete it but override it with meaningless value, it is easier. Even string.value can be override by useless char set.


0

Well most people posting here are security concerned and mostly use strong passwords for this reason. But the bank has another concern: Users who use "123456" as password and feel safe. For example my own bank forced me to use a character password. Why? Because they want to encourage users to choose strong passwords with high-entropy as they are an option ...


5

There's a more important reason for prompting for username first and then prompting for password: it allows Google to offer a different UI for accounts that are using passwordless authentication or other experimental login mechanisms without revealing beforehand which accounts are using it. It's similar to how Google's 2Factor auth UI isn't displayed until ...


1

It's only tangentially related, but David Aspinall (University of Edinburgh) and Mike Just (Glasgow Caledonian University) published a paper on partial passwords in 2013: "Give Me Letters 2, 3 and 6!": Partial Password Implementations & Attacks. Their paper looks at online attacks for which the backend storage mechanism is irrelevant, but it makes a ...


4

Email addresses are not the same as usernames. A username is semi-private information (potentially), but an email address is publicly disclosable and publicly routeable. Think about postal mail, the mailing address if often well known, but the current list of valid recipients is not necessarily design to be public, although there are often ways to look that ...


26

For Gmail, you can determine whether an account exists simply by sending an email to an @gmail.com address. If it bounces, that account does not exist. This is true of many email providers. Here, usernames are not considered secret. If a user has the email address foo@example.com everybody knows that foo has an account at example.com with username ...


0

I've used a software called Windows Gate to disable password validation in Windows systems. I haven't used it on Windows 8 personally, but it has worked on every other Windows system, servers and otherwise. It is part of the Hiren's Boot CD package, which you can download and burn to a CD. I used the following steps: Boot from CD Boot into miniXP ...



Top 50 recent answers are included