Linked Questions
10 questions linked to/from What's the practical limit for rainbow-table based bruteforce?
548
votes
11
answers
94k
views
Is my developer's home-brew password security right or wrong, and why?
A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below.
His team spent months adopting an industry standard protocol using Bcrypt. ...
- 4,749
43
votes
9
answers
19k
views
Is salting a hash really as secure as common knowledge implies?
I'm implementing a salt function for user passwords on my web page, and I'm wondering about some things.
A salt is an extension added to a password and then hashed, meaning the password is stored in ...
54
votes
4
answers
23k
views
Why is using salt more secure?
Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
- 1,415
47
votes
2
answers
9k
views
Are there more modern password hashing methods than bcrypt and scrypt?
This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt.
What I'm wondering is if there are any "...
- 2,908
31
votes
3
answers
13k
views
Google Account: implications of using application-specific passwords
In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google ...
- 1,319
10
votes
2
answers
10k
views
How expensive is it to guess a 15 character password, and should I be worried?
I'm currently using AES encryption (at home) on GNU/Linux (one of LUKS AES-256 variants with xts) and on Windows 7 (Truecrypt) with a 15 characters password (alphanumeric lowercase only plus _).
...
- 201
14
votes
3
answers
2k
views
An alternative to traditional passwords: is there some merit to this idea?
If you've got a website aimed at people that are not necessarily technically proficient, letting new users choose their own password isn't very secure because of the simple fact that a lot of people ...
- 587
6
votes
1
answer
7k
views
Why does openssl enc -aes-256-cbc -a -salt increase the file size?
I'm using openssl enc -aes-256-cbc -a -salt for automated differential backups to Amazon Glacier. But I noticed that using this command increases the file size almost perfectly by 35%.
In my ...
- 163
8
votes
4
answers
1k
views
multiple dice ware lists to make memorable passphrases?
I understand the basics of why diceware produces good security and why seven word passphrases are a good idea these days.
The EFF has helpfully produced updated diceware lists that eliminate lots of ...
- 83
3
votes
0
answers
533
views
How strong are google's Application-specific passwords? [duplicate]
Possible Duplicate:
Google Account: implications of using application-specific passwords
In 2-step verification of google accounts, we need to use the Application-specific passwords generated by ...
- 149