Linked Questions

7 votes
3 answers

Known Password Lengths and security considerations [duplicate]

Many people wil often brag about the length of their password, like "yeah nobody is ever going to crack my password cause its 22 characters long." I was thinking, if you knew the exact length of their ...
user488244's user avatar
-1 votes
2 answers

Should I worry that passphrase length leaks information? [duplicate]

I have been thinking about how to generate random passphrases from a public dictionary of words (similar to XKCD/Diceware passphrases). One thing in particular I was thinking about is that the ...
Guut Boy's user avatar
0 votes
1 answer

Are short password length requirements a security risk? [duplicate]

I visited a website that requires me to create a password. One of the password rules was "7 to 15 letters". Is this a security risk, since many people would now enter a weak password instead?...
gnasher729's user avatar
  • 2,459
37 votes
8 answers

Should I worry about remote timing attacks on string comparison? [duplicate]

Say we have a Java web application which uses a shared secret to verify the identity of the client. The secret is stored on the server, and the client transmits the secret over SSL where it is checked:...
George Powell's user avatar
21 votes
5 answers

Would allowing shorter passwords sometimes be more secure?

Does the act of requiring certain criteria for passwords make them easier to brute-force? It's always seemed to me that when websites limit the use of "insecure" passwords, it might make it easier ...
MisterEman22's user avatar
30 votes
8 answers

Best way to administer all my passwords

I am trying to figure out what the best solution is to store different types of passwords: Personal passwords (my personal email, my company's email, all the services I use to buy things like ...
Lautaro Rosales's user avatar
21 votes
5 answers

Recommended level of password complexity for Keepass

I want to start using a Keepass master password that I can easily remember. Let's take this sentence: I really hate blue mountains, and let's make it one password: ireallyhatebluemountains. Is this ...
drake035's user avatar
  • 473
23 votes
3 answers

How does SSH defend against keystroke-timing attacks?

This paper: Explains how SSH can be compromised by analyzing the timing of the keystrokes to guess what the user is typing. It's ...
Ram Rachum's user avatar
  • 2,058
-5 votes
5 answers

is my scheme is less secure than the 99% of websites exposed to theses attacks? [closed]

I develop a sort of social network for mobile and desktop browser with a REST API. I can't ask to users to buy a U2F key or any hardware (but I could propose to support it if they have, since Chrome/...
lakano's user avatar
  • 157
4 votes
4 answers

Should I vary the length of my completely-random passwords for the best security?

I use LastPass comprehensively, and for each new site/password I almost always have it generate a random password of the same number of characters, allowing letters, numbers, and symbols (except when ...
ErikE's user avatar
  • 157
3 votes
1 answer

How much does knowing the zxcvbn password strength help an attacker?

On an answer to the question How critical is it to keep your password length secret?, Mike Ounsworth commented that by storing the zxcvbn-calculated entropy of a password you make it easier for an ...
Joshua Dwire's user avatar
2 votes
3 answers

Using timingSafeEqual

I've seen code like this: if(password.length !== allowedPassword.length || !crypto.timingSafeEqual(password, allowedPassword)) So timingSafeEqual is supposed to use the same amount of time to ...
Alex's user avatar
  • 527
4 votes
3 answers

How secure is this JavaScript password generator?

I wonder how secure is this JavaScript password generator: var Password = { _pattern : /[a-zA-Z0-9_\-\+\.\!\@\#\$\%\^\&\*\(\)\_\+\{\}\:\"\<\>\?\|\[\]\;\'\,\.\/\`\~\']/, _getRandomByte ...
user134969's user avatar
  • 1,338
3 votes
1 answer

Save Password length after hash to minimize calculation

Reading this topic How critical is it to keep your password length secret? following scenario comes to my mind: Assume I've a web application (PHP written using password_hash()) using salted password ...
Danny.'s user avatar
  • 1,025
2 votes
1 answer

Is logging number of special characters in password a bad idea?

Recently I started new work, and going through documentation and code to understand what company is doing. While doing that, I noticed there is logged number of special characters in his password. ...
user902383's user avatar