Linked Questions

14 votes
4 answers

Security of a non-random password but that relies on information an attacker cannot possibly know

I am trying to figure out whether a non-random password that relies on information an attacker cannot possibly know can be secure. To give an example, let’s say that I generate my password by putting ...
hb20007's user avatar
  • 559
2 votes
3 answers

Should my password contain part of the service's name?

Let's assume that I have chosen a password X which is both hard to guess and easy to remember. I have the feeling that instead of using X for, say, Gmail, Stackoverflow, Ebay, ... I could use gX, sX, ...
I. Haage's user avatar
  • 453
-1 votes
1 answer

How can you calculate the entropy of arbitrary password rules with known distributions? [duplicate]

Many online entropy calculators make certain assumptions (like assuming a password is as rare as the set of random characters that will generate it), or handwave away the math. I want to know how to ...
Atomic Tripod's user avatar
15 votes
4 answers

Can 777-characters long passphrase be considered too short?

Is's password tool a reliable tool for password strength checking? I am asking because: I am getting confusing suggestions: (the password in this example is 777 characters long) D. W.'s ...
trejder's user avatar
  • 3,639
3 votes
3 answers

Why removing just one letter form passwords makes it 20x easier to break according to zxcvbn test

Since I am a decent fan of the XKCD no 936 (or actually conclusions and implications it brings), I wanted to test (using try zxcvbn) the complexity and the possiblity of breaking a password like the ...
trejder's user avatar
  • 3,639
30 votes
11 answers

Why are passwords generated by a password generator a complicated mix of letters and numbers instead of a long phrase?

E.g. if I were to register for a new website and am prompted for a password, my browser might generate a complicated password that looks like uv^2<YGYy}#Vj}=f which might be impossible to crack but ...
Allure's user avatar
  • 499
22 votes
3 answers

How do big websites (e.g. Google, Twitter, GitHub, ...) have practically infinite session lengths without compromising on security?

I'm currently implementing a login session system for a web application. I've read lots of articles recommending very low session and idle timeouts. For example OWASP says: Both the idle and absolute ...
Lukas Kalbertodt's user avatar
0 votes
3 answers

How good/bad are these transparent Linux consumer FDE setup options? (e.g. for auto-unlocking LUKS)

UPDATED Summary: I'm looking at Linux FDE options that are transparent to the user (my parents) in that the user doesn't need to enter 2 passwords. I found/thought of several options and tried to ...
zpangwin's user avatar
  • 331
20 votes
3 answers

Is LUKS still an effective option for consumer FDE considering Elcomsoft can break it?

I use Fedora Linux and was recently looking into doing Full Disk Encryption on data drives such as /home on some of my / my family's PCs. I understand that LUKS security will be partially dependent on ...
zpangwin's user avatar
  • 331
23 votes
2 answers

Why do password requirements exist while limiting the upper character count? [duplicate]

I do not quite understand why it is common practice to require a difficult to remember password with alphanumeric and special character requirements, while also having an upper limit of 32 characters. ...
George Alfaro's user avatar
5 votes
2 answers

Does brute-force time depend on the length of a password only? [duplicate]

If a password is +30 characters long but contains words from the dictionary, is it less secure than a 10-character password that is !@#$#%$^%$, for example?
Sup Go's user avatar
  • 59
1 vote
2 answers

Can a Keypass file theoretically be cracked offline?

So you create a .kbdx file, protected by a password. AFAIK in asymmetric key schemes and in WPA-AES brute-forcing consists of: Trying a random password on the private key / on the router If it doesn'...
Vorac's user avatar
  • 1,907
2 votes
1 answer

How secure is BitLocker without TPM?

My laptop doesn't have TPM. If I enable BL PIN and someone steals my laptop and remove the drive, will they be able to read it's content on another computer? How am I vulnerable without TPM?
Eduardo M's user avatar
  • 141
0 votes
1 answer

VPN from inside a company

I recently had to bypass my company policy by establishing a VPN connection from a LAN device (raspberry pi) located inside my company, to a WAN server. As devices accessible from outside must be ...
nowox's user avatar
  • 367
0 votes
3 answers

Which brute attacks are more common? Ones that use dictionary words or random symbols? [closed]

If we compare only these two passwords, which one is the safest? Ss1*x_32 or Very-hard-password-it-is-so-hard-to-break-it-1 The question is not about how many bits every password contains but about ...
narra_kk's user avatar

15 30 50 per page
2 3 4 5