Tag Info

New answers tagged

0

You cannot ever trust a third party to verify password strength. Because what's important isn't the output of your password but your input. You can't assume that a password cracker it taking a purely brute force approach. The dictionary of common words is around 2000. 2000 ^ 3 is 8 billion, which could probably cracked in a negligible amount of time. ...


2

TL;DR: Rather write down strong passwords than remember weak ones. Always use unique passwords! Passwords for offline use should be stronger than for online use. You can use a password made of words if long enough, or take a long sentence and use all first letters as your password. For a password of a given length, a "random" string consisting of ...


0

Usually you have a constant realm and in this case HA1=MD5(username:realm:password) could be stored instead of the password. But, if the password is only used for the SIP account, it actually does not matter if within a attack against the provider username and password get seized or HA1 instead, because the latter is all it needs to authenticate as the user. ...


4

A little test at the site you mentioned suggests they're considering length, alphabet, and brute force attacks only. The password you posted does indeed return an answer of 100 billion years. Changing it to "yummy candy yum" returns 'only' 49 million years. An eight character word, with or without numbers, returns eleven minutes. Adding one symbol ...


0

According to my reading of the source code (docs/file-format.txt), the iteration count is stored in the keyring file, specifically in the 25th through 28th bytes after the end of the keyring name.


0

I am not sure how the website you posted exactly works; but this is my intuition; When you say the password is solely made of english letters; this might not be correct from the 'creator of the website' point of view. You used spaces in between the words; as you can see, these were also treated part of your password, it can be that the algorithm that assures ...


2

As long as you are working with only online needs for the password for integrating with a system while the user is logged in, then you should store the passwords encrypted with both a database key as well as a derived key based on the user's password for your service. When the user submits the password for their login, you can use that to produce a password ...


2

If you need to retrieve the plaintext password at some point, then you indeed need encryption and not hashing (beware that many people call "encryption" what really is hashing). I suppose that your "business need" comes from the need to support some protocol where the server must know the plaintext password (e.g. the APOP authentication method in the POP ...


0

Technically this could happen. Although I couldn't find any recorded cases. Under key disclosure law several countries can obtain your decryption keys, if those keys were incriminating or a confession, there is nothing barring them from using it against you in court. In the US, the 5th amendment protects you from giving up an encryption key until it is ...


38

Getting salt from hash(salt+password) would be just as difficult as getting password from hash(salt+password).


3

Making a hash function "iterative" already exists; it is called PBKDF2. Bcrypt is still preferable because PBKDF2 can be thoroughly optimized on GPU. Designing a good password hashing function is a difficult job; but yes, existing hash function are good building elements, so they are likely to be involved at some point. Indeed, look at scrypt: it starts and ...


1

Your understanding of the reasons why one should use scrypt and bcrypt is correct. Yes, you could, at least in theory, produce a new algorithm that requires time and memory, and it could incorporate an existing cryptographically secure hash function. You can increase time through iteration, and increase memory by requiring large numbers of prior values to ...


12

I'm not really sure why you would want to find the salt, since generally the salt is not considered secret. Basically in your case the salt is essentially the password as you do not know what it is and the password is your salt (let's take semantics aside that dictates as the password will probably not be globally unique) as it's not secret. The PBKDF2 ...


6

Assuming you know the hash function and method used to generate the hash from the password and salt it is possible to discover the salt if you have the original password and the end hash. It would be using brute force - there's no clever or quick way to do it. In your typical scenario your hash is generated by 1) hashing the password then 2) combining it ...


2

The password in SRP is actually a shared secret of (possibly) low entropy. It can be the "password" as the human user understands it, or anything that is deterministically derived from the password. In your case, yes, using a password hashing function such as PBKDF2 is a valid approach. It has the following caveats: PBKDF2, like bcrypt and other good ...


6

If we want to look for rational reasons not to use scrypt right now, we can find mostly these three: It is unclear whether a "memory-hard" function is what is needed, with the parameter configurations supported by scrypt. Scrypt was initially designed to support local encryption, particularly whole-system encryption. This means that the password must be ...


5

No. The "random art" image is created by a random walk through the image area, using the key's fingerprint as the sequence of moves to make. The fingerprint is short enough that the art can never cover more than about 40% of the image. An analysis of the art and some attempts at attacks on it are available in the paper "The Drunken Bishop".


1

One possibility is that her passwords are being synced through the browser. If this is true then even if she changes her password it can be updated on any synced device (convenient for someone who is not in this situation). To remedy this, she will need to change her browser sync settings and password, then change her facebook password (and others) again. I ...


1

This doesn't really give any help with choosing what places to memorize your passwords (as @schroeder notes in his comment), but it will help yo memorize them once you have chosen. one way to help memorize strong passwords is here: http://xkcd.com/936/ another method that is slightly less secure but adds to ease of memorization is to use a standard prefix ...


1

No. The correct/incorrect old password is just data used in a recovery process. Google knows how you changed the password (via forgot password, via the normal change screen) and when, and how old the password is in numbers (eg you changed password 2 times after this old password). So this data is used in a general scoring model to determite if you are a ...


0

There are two approaches I would look into in order to accomplish this. The first is "Cornell Spider", it has the capabilities of looking inside of files for patterns. It's typically used to search for data such as social security numbers, PII, CC data. It is flexible enough that if the sheet you found has any patterns, you can hone in on those patterns and ...


13

Usually, the password isn't stored in the cookie. You login to example.com with your username and password, these are verified to belong to you (typically by hashing your password and checking the hash of your password matches with the hash for a user with that username), and the server issues you a long random number token as a secret identifier for you. ...


4

Hard question to answer exactly. I'm going to refer to Theodore T'so's pwgen (v2.07) implementation exclusively here (pwgen -A0) These pronounceable passwords use "phonemes" as "symbols", rather than single characters, in (the English language biased) pwgen a phoneme can be 1 or 2 characters. There are 40 defined (in pw_phonemes.c), 25 are a single ...


3

The SAM database is stored as a file on the local hard disk drive, and it is the authoritative credential store for local accounts on each Windows computer. This database contains all the credentials that are local to that specific computer, including the built-in local Administrator account and any other local accounts for that computer. The SAM ...


8

Pronounceable words are more-or-less sequences of syllables. What constitutes a syllable depends on the language, including the language variant (British, Scottish, American, Indian... versions of English are not rigorously identical). So we will make some approximations. Let's suppose that we want two-letter syllables, always a consonant followed by a ...


4

Restricting yourself to only passwords that are pronounceable does decrease the entropy, which reduces strength. So in theory, the password will be weaker But password strength is a complicated beast. In particular, if choosing pronounceable passwords means you can remember a longer one than usual, then your entropy goes up and your password becomes ...


0

I run a digital agency and we often have to manage a range of passwords and share them between our team of developers/managers etc. so have been doing research on the best way to manage this. (We previously used KeePass synced over Dropbox, but it was becoming unmanageable.) We've decided on a cloud/hosted solution that can be accessed from our computers ...


1

In my opinion, sudo for server admins is a bit overkill. If people log in, and they have root access (through some mechanism), they usually do maintaining tasks, where they will use sudo for >90% of the time. The purpose of sudo is to give accounts that are logged in some separation between untrusted applications and admin-like tasks, and make users aware ...


1

SSH authentication and security privileges are two different things, hence no point of having it as a default feature. However, it opens one more vector for attack(there is a CVE) and from my point of view makes it easier for users to overuse it, which is bad. On the topic of passwords, one way is to send a short-lived password to the user and require ...


1

On Windows, your Chrome saved passwords are encrypted using DPAPI. This mechanism ultimately derives a key from your Windows account password to keep the data secure, and so once you've logged in, the data can be decrypted by applications that rely on this store. So, Chrome doesn't have access to your Windows account password at all. It relies on the ...


1

When using a reliable two-factor authentication system, using a less secure password is reasonable. It's still best to use a difficult password generated by a password generator using upper and lower case, numbers, and symbols. But folks who will not do deploy such a secure password; in the case of a service that offers two-factor authentication, those ...


1

The answer is both yes and no, depending on what you mean. Each principal in a Kerberos realm shares a secret with the Kerberos authentication servers (Key Distribution Centers, or KDCs). For a software component like a web server, this is a set of randomly generated keys (there is a set rather than just one, to accommodate clients with support for varying ...


1

You forgot the local physical attack! A long complex password makes shoulder spotting much less likely to succeed. Even if someone stares at my keyboard, he won't get my passwords unless he's Rainman. (cannot comment)


-2

I found a way to have a password for my Keepass vault that is easy to remember but at the same time virtually impossible to break which I named algorithmic passwords. To construct my password, I'm using a python shell. The basis for my password is a power tower which is a form of function that grows incredibly fast with few operations and numbers. For ...


3

While it is safer to make complicated passwords, I always recommend making them easy at the same time, and also have a uniqueness per website. The only way this would be a vulnerability is if you fall for a phishing scam, which is why it is important to have multiple ways to recover your email address, because your email is your way to recover other ...


4

Using a complex password for a single secure site is like using a special lock on your apartment door, which makes opening the door take longer and protects you better from 1% of all burglars Most answers deal with all kinds of attack scenarios, which could compromise your password, but to decide if a smaller password (6 Characters) is sufficient if you use ...


1

Besides the data typically useful for identity theft and social engineering scams note that the bills will often contain data on how much of which you used which helps analyze your lifestyle. Just one example. Suppose you have electricity company billing differently for different times of the day and it's obvious from the bills that you spend very little ...


3

They would get access to any information contained on your account there, including: home address e-mail address bank or credit card information (hopefully not the entire thing, right?) statements (which would probably allow them to impersonate you on the phone with said company) in addition to the information, they may be able to over-pay and trigger a ...


5

To expand further on these answers, only you can say if it's "worth it." The heart of this question has to do with risk analysis. Best practice would typically state that for any account like this you should have a randomly generated password stored in a password manager. Typically most find the amount of work necessary to do this is much smaller in relation ...


23

The most significant potential risk that I see is that profile information on these sorts of sites could potentially be quite useful for pivoting into identity theft. If there is stored financial information visible (like the last four digits of your credit card number, for instance) this has been shown to be useful in helping attackers own additional ...


17

"assume that this isn't a malicious hacker" right... If you are okay with your name, account number, home address and account details being sold or used as part of a social engineering attack on you then there is no more need to protect it than your Facebook account. However most people think this is enough of a reason to not set their password to ...


-1

As other comments says, the main problem is the too close structure between different password. A better solution would be to apply a hashing method to this "password + change" so that the result cant give back your main password. That's the basic principle of http://passwordmaker.org/ : You have a master password you only use to generate password (you ...


-3

As I disagree with the conclusion of most answers here I am going to break this problem down in a slightly different way. Let's consider a couple of breaches and examine what the effect of such a password scheme would be, however I am going to make one little change to your scheme (as your current scheme is simply too simple): Eg if I remember ...


2

My suggestion is, "don't." The scheme you've suggested is vulnerable to brute force attacks. Instead, use a password database application that is ported to the devices you use, and can both generate complex passwords and auto-fill them for you.


-5

Here is a framework I use (YMMV) that is based on the typical CISSP approach to passwords (something you know, something you are, something you have). I break my password structure down into these three topics with character substitution. Currently I never re-use password, my typical password is about 20 characters, and I can always recall them: ...


5

This provides almost no additional security over using the same password everywhere. The entire point of using multiple passwords is to prevent a leak of one from compromising multiple accounts. If I get your password to twitter, the first thing I'm going to do trying to hack you on Google is going to be to try permutations of your twitter password. It ...


17

You use distinct passwords on distinct systems because you know that some of these passwords may leak. If your passwords are high enough in entropy then they won't leak through brute force, but they may still leak through some other ways, e.g. server compromise (grabs the passwords as they come by), key loggers (grabs the password as it is typed),... Using ...


9

In a perfect world, sure that would be a wonderful method for a human to remember their passwords. However, the world is far from perfect. The main issue with your method is that if just one of your passwords is ever discovered (through leakages, guesses, breaches, etc) then your entire security apparatus could unravel -because patterns are trivial to ...


4

There are issues with a couple of your assumptions. 309 million is a laughably small number if there is an offline attack. And on an offline attack, even with a good salt, the attacker will go after the low hanging fruit first. Ie. find the passwords that are in the dictionary, then the short passwords, then other simple passwords. How much of a problem ...


3

My answer is simply yes. You can't assume sites are using salted hashing methods. For example, MD5 is still being used in the wild and people think its perfectly acceptable. But with a strongly salted hashing mechanism, there's just no way someone can gain access to the actual password, even if it be a low char pass. Especially speaking if your server is ...



Top 50 recent answers are included