Tag Info

New answers tagged

1

Rate limiting is probably the only practical way to mitigate these attacks for most public-facing applications. And you're correct in that it's a security/UX tradeoff. Given the login form example alone, "your username or password is invalid" is a more secure (exposes less information) way to present info, but most public services have other endpoints to ...


0

First, I'm not entirely sure what the question is, so I'm going to make some guesses. Is there a trade off between security and UX? Yes. Just like the trade off between security and performance, and the trade off between performance and UX, and the trade off between any set of requirements for a system. That is the nature of requirements. If they were ...


0

Most of your assumptions are correct. The general idea (as far as the user interface is concerned) is: give the attacker as little information as possible slow down the attacker If people need to register you cannot avoid the error message 'This user already exists'. If registered users need to login the generally recommended precautions are indeed: ...


0

You can easily inject characters as if typed either via USB tools or code. Depending on the latency of trying a code and assuming no lock-outs it may not take too long to iterate through every possibility. A better option may be to attach a debugger, enter any code and step through until you see the check of the input string. Change the logic of the result ...


1

Biometrics are fairly inexpensive now and work at least 80% of the time. I find it great on TabletPCs and have been wanting to deploy biometric keyboards because it is faster ( at least for that 80% of the time). I bet this was not nearly as much of a problem with Win2000, WinXP, Win2003, and WinVista because by default, the username field was already ...


3

When only the server sends a certificate, but not the client, the SSL connection is fine and dandy, but the server has no clue about who it is talking too. What SSL provides in that case is that the server can be sure that it talks to the same client all along, with no possible eavesdropper in the middle. If the server must still know who the client may be, ...


6

Explanations for weak password rules Well, those are obviously bad rules. But here are some possible explanations (or "explanations") for it: Must not start with a number The site owner might actually think that this is a good rule. To prevent for example 1234546 or just prepending a common phrase with '1' (e.g. 1password) Must not have a special ...


3

One reason for enforcing weaker passwords is that a weaker password is easier to remember for the user. When the user forgets their password, an automatic password retrieval procedure must be used. Such a procedure usually entails that a plaintext password is sent to an email account. This offers a lot of attack surface which is outside of the control of the ...


12

If you use the same password for several distinct sites, then you are doing something wrong. Each password shall be site-specific. Therefore, there shall be no reason why the "weaker standards" would have any impact on "all your passwords". (Similarly, there is no rational reason for changing all your passwords on a regular basis. There is a widespread ...


0

http://thepiratebay.se/torrent/10650419/w0w_Dictionary_Password_Pack Massive Password/Dictionary pack = 52.9 GB extracted.


13

The answers given already answer the question, but if you wanted a password of the same length with those equals replaced by more random characters (more characters that are random, not more randomness), you can just round the number of bytes read up to the nearest multiple of 3: head -c 18 /dev/urandom | base64 This is because base64 encoding operates on ...


-2

It sounds like you already know the answer. Keeping them reduces the password space to search. Consistency between passwords is only harmful if you can reduce the password space down to an exhaustible size based on your password generation. Which in this case I don't believe is possible. I personally like to include more symbols in my password ...


19

Base64-encoding processes input bytes by groups of 3; each group yields 4 characters. The '=' signs are padding so that the string length is always a multiple of 4; since the '=' signs are not part of the core Base64 alphabet (letters, digits, '+' and '/'), the decoder knows that these signs are padding and don't encode actual bytes. That way, input ...


0

You need to look into the Chinese IME (Input Method Editor) that is provided with Windows, and also popular 3rd party ones. They all operate mostly the same though. Basically you enter a word by typing Latin characters that sound it out, then the computer presents a list of possibilities and you select one from a menu. When writing passwords most Chinese ...


1

From what you describe, the process may be the following: During device registration, the application on the device (be it a phone or a laptop) generates some secret value and sends it to the bank; it also stores it. This "secret" may be a secret key, or a private/public key pair: it does not matter much here. The point is that the device can now be ...


1

Entropy matters more than starting letter. A competent brute force attack should sort guesses by frequency of use rather than alphabetically. If they are foolish and go alphabetically, then there would be an advantage, but if your passwords is zebra and my password is a#4difk*, your password is going to be guessed FAR sooner as a frequency based word list ...


0

Brute force is an approach not a specific program. Brute force has as its goal to cover all possible passwords, but how the algorithm is implemented is specific to a programmers approach. One may start at a, others may start with the most commonly used letter. Tomorrow someone may come up with a new approach.There are precomputed lists of hashes already ...


4

I would say yes. Not in any meaningful way (do not base you passwords on this), but still. Letter Frequency First of all, if you follow this rule, your password contains a 'z' instead of an 'a'. The letter 'a' occurs a lot more frequently in English text than the letter 'z' (this is also true for the beginning of a word), and as such it will be part of ...


0

No a password starting with z is not more secure. Brute force attacks often use dictionaries to iterate through a possible list of passwords. It will eventually arrive at the entries starting with z. Note that some dictionaries do not list the passwords alphabetically but according to the frequency a password can occur (based on previous experience); like ...


2

I don't speak Chinese but I believe the operational word to use for your Google-searches is "pinyin". This is the official method of encoding Chinese text into Latin characters (that's not the only one, though). So you want "Mandarin word lists in pinyin". With such terms, I find this downloadable dictionary which looks promising. In the .u8 file, one will ...


5

Some Zip archives use the old PKZIP encryption, which uses a weak homemade stream cipher. The attack is described here (implementing it is a nice exercise for crypto students, by the way). Tools which apply that attack exist (use Google to find some). Windows XP inherent abilities at "Zip password protection" use this weak algorithm; see this answer for some ...


0

Alternatively you could setup a proxy that would allow incoming clients to connect to the proxy via HTTPS, and then the proxy can do the encryption/decryption, and get the actual data from the Pi - this allows the Pi to focus on the non-security related aspects of it and offload the HTTPS if that is indeed the issue - note that this requires a "secure" ...


1

Assuming you have a password reset function (I'd be surprised if you didn't), I'd just blank/replace the hashes with something empty/useless. This way, nobody can log in, and the proper user can reset their password to regain access. You should consider using a better hashing technique than SHA-1. For simple passwords, there are Rainbow Tables and other ...


1

Generating random passwords and sending them to users is fine. But the most important thing to do, if not already done, is to warn ALL users that their passwords have been compromised and if they are using the same on whatever other website/app they absolutely have to change it.


2

The usual computations on password entropy take place in the context of a dictionary attack, especially an offline dictionary attack, where the attacker can try passwords at will without locking anything. When there is an auto-locking tamper-resistant hardware, the context changes. Conceptual view: there are N possible passwords (to simplify the exposition, ...


5

Maybe a silly question but are you certain you're not getting a ✓ meaning that the password you have entered has met the minimum requirements for the sites password policy? Such that the client side code is saying "yes, this is a valid password and I will accept it, although I have not yet validated the correctness." When you enter the password as ...


5

If nothing else, it's an API for checking passwords without any time delay. It has to be: if they had a time delay after every incorrect guess, it would defeat the point of live-checking the password. If you password is "password", then the server has to check seven incorrect passwords before reaching the correct one, and you can't afford to have a delay ...


0

I don't see any reason for the incomplete password to ever be sent to the server - the client knows the rules of the password (i.e. 8 chars, must contain number, etc.) and can validate it and display the status to the user prior to sending any request


0

I can see a sever problem here: You can attempt brute force cracking while the server does the heavy lifting. In the case of a sufficiently powerful server, the attacker has a good chance of success at little or no (client side) computing cost. If the server is too weak, it opens up a nice channel for a denial of service attack. Last time I checked, it was ...


1

Windows Credentials Yes, they are stored hashed within files in the c:\Windows\System32\Config\ directory. You will need the SAM and system files. However, a backup of these files may be stored in the Windows repair folder at c:\Windows\Repair\. If Windows is running and you need access to the locked files in the Config folder (for example you know the ...


20

Modern cryptosystems are generally not susceptible to known-plaintext attacks. In terms of encryption algorithms, there are basically 3 algorithms commonly in use in TLS: AES RC4 DES (in 3DES) All 3 of these are believed to be resistant to known-plaintext attacks, and have been well studied for such attacks. The one thing I would wonder about are ...


0

Analogy: As a locksmith, I may (with the customers' permission) keep records of what I've done for them, including the details of their keys. But that puts me at risk of having my own shop broken into and the list stolen (or an Evil Employee doing so) -- in which case the crook could make keys for many houses, and I'd be liable for not having protected this ...


4

Yes, Widnows saves users' passwords in 3 files: Windows\System32\Config\SAM file (without extension). Windows\System32\Config\SAM.sav: it is a copy of the first one Windows\System32\Config\SAM.log A transaction log of changes. To access these files, run Start/CMD and type %SystemRoot%then choose the subfolder system32\config. These files can not be ...


1

To access the windows passwords, you'll need both the SAM and SYSTEM file from C:/WINDOWS/SYSTEM32/config On a Linux Distro, like Kali-linux, you can then use the command "bkhive SYSTEM bootkey" to get the bootkey from the system file. Then, use the command "samdump2 SAM bootkey > samdump.txt" to get the hash dump from the SAM file. If you open the file, ...


0

All local user account passwords are stored inside windows. They are located inside C:\windows\system32\config\SAM If the computer is used to log into a domain then that username/password are also stored so it's possible to log into the computer when not connected to the domain. As for seeing which passwords are currently stored on a computer you can use a ...


2

@Travis Pessetto most likely has the correct answer to your question. I just wanted to point out that some places will do this without knowing your old plaintext password. This can be done by generating permutations of your new password and comparing each hash to your old password hash. Old Hash (Plaintext Unknown): ...


4

I just logged into cPanel and when I click to change my password it asks me for three things: My old password A new password Confirmation of the new password Screen Shot: It also says that the old password cannot be empty. This may not be exactly how cPanel does it but, it is a possibility: Since you have sent it your old password to cPanel it can ...


3

There is nothing complicated about building a tool to crack Diceware passphrases assuming you have an oracle, such as a hash of the passphrase, that will tell you when you have the correct answer. The cracking tool would simply loop through all possible combinations of up to n words from the Diceware list. It is also straightforward to estimate how long such ...


5

Assuming your server doesn't use any credentials besides system-level accounts and the MySQL password, there's one thing you need to protect: the swap file. Programs are supposed to take steps to prevent credentials from winding up in swap, but they don't always do so. There are some sensitive things in /dev and /proc (such as /dev/mem and /proc/kcore). ...


0

For hashing functions, no ready analogy finds itself in the sphere of football or automobiles. The best we can do is to spill the actual facts. Dear Boss, In a perfect world, users would be security conscious, and never use the same (or even a similar) password for two or more different sites or services. In that perfect world, a password would have little ...


1

It is stupidly simple to get around most sets of independently-evaluatable password complexity rules; minimum length, case requirements, non-alpha character requirements. "Password1", unless your name happens to be Joe Password, will get past most rule systems because it's at least 8 characters long, with a capital and a number. It's also the first thing any ...


0

You should NOT be able to determine if any user have the same passwords given the information in your database. It's just a security risk by design. If you really want to do something like that, at the very least please never tell the user the actual reason, just say something like "Your password is not complex enough" coupled with the generic ...


2

As @aviv pointed out, revealing to a user that some other user also has the same password is a problem. If you really intend to maintain such statistics, then you have another inherent problem: the "statistics engine" can only help any attacker, since it outputs a list of passwords that are in use. Even a reduced form which merely says "this password is ...


2

I dont think you want to do that at all... you will be giving hints about other user's passwords. If I get the message that 1 other user is using my password - now I have valuable information. I might even know or guess who that user is if I have some prior knowledge on him


2

A shared password is a poor design for managing access to a private communication channel. For example, you can't kick a user out without closing the channel: you can't cause them to forget the password. You can't prevent a user from sharing the password with other users (voluntarily or involuntarily) — if a user's password is exposed, you can invalidate it, ...


0

Analogy time: Storing plaintext passwords is like leaving your house unlocked. Encrypting the password database is like storing the key under the doormat. Hashing passwords is like using a 3-digit number lock shared by all users. Salting the password hashes gives each user their own number lock. PBKDF gives those number locks more digits. No one should ...


-2

The technical importance of hashing is vastly overstated. The practical reason you need to hash is because everyone else does it; it is considered "best practice". If you have a breach, it is much easier to defend a position where you are doing the same as your peers. Doing something different, even if it's the right thing, is much harder to defend. So I ...


0

Your logic isn't sound. "The password doesn't need to be hashed because many people will need the password." The second part of your statement is true and you've decided that that dictates that the first statement should be true. They're actually unrelated. Should the people that need the password get it from your server? Feels like they should get it ...


1

Generally speaking, you are right: given the keys 0, 1 and 2, it is possible to produce the encrypted form of any other file for the same password, even if the said password is not known. If you follow this road, you will probably be interested in Info-ZIP, a clean opensource reimplementation of the PKZIP format. Alternatively, you may want to recover the ...


4

The PUT HTTP verb is supposed to be idempotent, a smart word meaning that sending twice the request should not have any further effect. The idea is that a "PUT" command is the opposite of "GET": the data contents sent with a "PUT" are supposed to be stored at the specified URL, and may conceptually be obtained back from that same URL with a "GET". In that ...



Top 50 recent answers are included