Linked Questions

7
votes
3answers
3k views

Known Password Lengths and security considerations [duplicate]

Many people wil often brag about the length of their password, like "yeah nobody is ever going to crack my password cause its 22 characters long." I was thinking, if you knew the exact length of their ...
-1
votes
2answers
177 views

Should I worry that passphrase length leaks information? [duplicate]

I have been thinking about how to generate random passphrases from a public dictionary of words (similar to XKCD/Diceware passphrases). One thing in particular I was thinking about is that the ...
37
votes
8answers
6k views

Should I worry about remote timing attacks on string comparison? [duplicate]

Say we have a Java web application which uses a shared secret to verify the identity of the client. The secret is stored on the server, and the client transmits the secret over SSL where it is checked:...
20
votes
5answers
7k views

Would allowing shorter passwords sometimes be more secure?

Does the act of requiring certain criteria for passwords make them easier to brute-force? It's always seemed to me that when websites limit the use of "insecure" passwords, it might make it easier ...
29
votes
8answers
3k views

Best way to administer all my passwords

I am trying to figure out what the best solution is to store different types of passwords: Personal passwords (my personal email, my company's email, all the services I use to buy things like ...
11
votes
5answers
6k views

Recommended level of password complexity for Keepass

I want to start using a Keepass master password that I can easily remember. Let's take this sentence: I really hate blue mountains, and let's make it one password: ireallyhatebluemountains. Is this ...
18
votes
2answers
2k views

How does SSH defend against keystroke-timing attacks?

This paper: https://www.usenix.org/legacy/events/sec01/full_papers/song/song.pdf Explains how SSH can be compromised by analyzing the timing of the keystrokes to guess what the user is typing. It's ...
-4
votes
5answers
390 views

is my scheme is less secure than the 99% of websites exposed to theses attacks? [closed]

I develop a sort of social network for mobile and desktop browser with a REST API. I can't ask to users to buy a U2F key or any hardware (but I could propose to support it if they have, since Chrome/...
3
votes
4answers
813 views

Should I vary the length of my completely-random passwords for the best security?

I use LastPass comprehensively, and for each new site/password I almost always have it generate a random password of the same number of characters, allowing letters, numbers, and symbols (except when ...
2
votes
1answer
775 views

How much does knowing the zxcvbn password strength help an attacker?

On an answer to the question How critical is it to keep your password length secret?, Mike Ounsworth commented that by storing the zxcvbn-calculated entropy of a password you make it easier for an ...
3
votes
3answers
769 views

How secure is this JavaScript password generator?

I wonder how secure is this JavaScript password generator: var Password = { _pattern : /[a-zA-Z0-9_\-\+\.\!\@\#\$\%\^\&\*\(\)\_\+\{\}\:\"\<\>\?\|\[\]\;\'\,\.\/\`\~\']/, _getRandomByte ...
3
votes
1answer
210 views

Save Password length after hash to minimize calculation

Reading this topic How critical is it to keep your password length secret? following scenario comes to my mind: Assume I've a web application (PHP written using password_hash()) using salted password ...