Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
0
votes
0answers
11 views

I need to read the contents of a crd file as plain text [migrated]

I lost all my passwords due to a dumb mistake I did yesterday. These passwords are really important. My computer has them saved under windows credentials. However, I can't view passwords stored under ...
0
votes
1answer
61 views

Is it possible to reverse a sha256 hashed value if we know part of the input value?

I'm a total noob, so please help me out. Suppose something is hashed in sha256. If we know the value of some part of the hashed text, can we figure out the entire text? Ex: xxxxxx + j4l58jl6j4l6j4 = ...
1
vote
0answers
10 views

Where do hash functions get their preimage resistance? [migrated]

I read through this answer and it seemed to make sense to me, but when I try to make a simpler answer to explain it to myself I lose something in the process. Here is the much simpler hash function I ...
0
votes
0answers
46 views

Does hashing client-side increase attack surface (assuming TLS and serverside salt+hash)? [duplicate]

This question asks whether one should hash on the client or the server. I want to know if there is any reason, aside from having to maybe handle one extra hashing library (if it's not already in your ...
4
votes
1answer
168 views

How does a company check the password received from your phone keypad during a call? [duplicate]

I had to call customer service recently regarding my 401(k) and robo call in the beginning asked me to enter my social security number using the keypad followed by a # and then asked for my account ...
0
votes
1answer
70 views

John The Ripper and PBKDF2-HMAC-SHA1

I am trying to hash a list of passwords with PBKDF2-HMAC-SHA1 and then crack them using John. However, John does not recognise the hashes and I get a No Hashes Found error. It works with SHA256, but I ...
0
votes
0answers
53 views

What's the term for a hash sent early and plain text revealed later?

I think there is a known pattern where you post the hash of a document, e.g. on Twitter, in order to have its time registered. You could then later publish the document and have it accredited for the ...
0
votes
0answers
15 views

Detect what algorithm is used [duplicate]

I wanted to asked how can i identify what algorithm was used. This is my code:...
0
votes
3answers
56 views

Associate API key with user

I am creating a public API that will require API key authentication. When a user wants to register a new API key, they send a request to one of our endpoints with a list of permissions they want. We ...
44
votes
3answers
7k views

Is bcrypt(strtolower(hex(md5(pass)))) ok for storing passwords? [duplicate]

I have a large database where passwords are stored as strtolower(hex(md5(pass))) (which is a bad way to store passwords, prone to rainbow tables, cheap to dictionary attack, no salt, etc.), and I'm ...
7
votes
2answers
2k views

If hashing should occur server-side, how do you protect the plaintext in transit?

I've been working on a full stack project recently for my own amusement and would like to add authentication services to this project, but want to make sure I'm doing it the right way. And before ...
2
votes
1answer
145 views

Does anyone know what this encoding format for passwords is? I think it is a decimal array but I can't seem to convert it

During a penetration test, I ran across a server that was storing passwords in its database in what seems to be a binary array of sorts: password_table 1,12,12,12,122,21,13,00,00,00,000 11,112,443,12,...
0
votes
2answers
142 views

Is it possiable to brute force the original message of SHA-256, given the size of original string?

Given the SHA-256 hash, size and encoding of original string. Is it possible to recover the string with brute force? How many string of a given size will result in the same hash?
10
votes
7answers
3k views

Does client side hashing reduce insider risk?

One of the companies I worked for used client-side hashing to minimize risk when logging the password in the server logs. Can this be a good reason to implement client-side hashing?
0
votes
0answers
42 views

Why developers put the installer/executable and the file checksum on the same server? [duplicate]

On https://exiftool.org/ , there is a link to https://exiftool.org/exiftool-12.01.zip and https://exiftool.org/checksums.txt . Both the ZIP archive and the checksum hash are hosted on the same machine....
0
votes
3answers
88 views

Can we check fingerprint with photos?

Let's assume an insecure communication channel. Alice makes a public key (we assume is PGP, but any asymmetric crypto could be used unless it doesn't have fingerprints for checking) and sends it to ...
0
votes
2answers
103 views

Sign records in a database [closed]

I have a table in my database where I store records to be processed later (basically orders that need to be invoiced or something similar, but this is not the important part). Since this software runs ...
3
votes
2answers
98 views

Is this method of 32 char hash generation secure enough for online-based attacks?

A fellow developer and I have been having a discussion about how vulnerable a few different methods of developing a hash are, and I've come here to see if smarter people than I (us?) can shed some ...
13
votes
3answers
5k views

How does a 'rainbow table' hacker obtain password hashes in the first place?

I don't understand this part of the Rainbow table attack. In all my Google searches, it says that a hacker uses a rainbow table on password hashes. But how does the hacker obtain the password hashes ...
-1
votes
1answer
40 views

Digital signature from hashing encrypted webpage

I'm studying for the Security+ exam with the help of Total Seminars' Udemy course and in one video they claim that a digital signature is generated by encrypting a message with the sender's private ...
-1
votes
3answers
122 views

Are there any security implications to changing the base of a hash?

File this under "gosh, I'd hope not," but I've been surprised before. I have a hash (HMAC SHA-1 specifically). I need to store the full hash, but due to constraints outside my control, I ...
0
votes
1answer
53 views

How to know what type of encryption type is that? [duplicate]

the hash is a lot of numbers separated by hyphens, something like that 02-35-161-51-43-227-161-06-151-43-22-71-43-46-21.... More than 700 numbers.
2
votes
1answer
57 views

Use delay with a fixed total time to defend against timing attacks

Consider this common example used to demonstrate timing attacks: async def sign_in(username, password): user = await get_user_from_db(username) if user is None: return False # early return :(...
2
votes
1answer
86 views

Explaining a bad approach - not comparing hashes

Today I saw a snippet a code for authentication logic : function checkPass($pass, $login){ $inputedPass = $pass; $req = $bdd->prepare('SELECT password FROM agents WHERE password = ...
0
votes
0answers
57 views

How does JtR crack password protected documents?

I've been trying to figure this out using an encrypted zip file as an example. I am quite familiar with the idea that PBKDF2 creates a key drivered form a password and then that key is used to ...
0
votes
1answer
48 views

How do maintainers calculate x number of accounts compromised by hack? [closed]

I am always curious by reports in the news of big network sites getting hacked and the report confidently stating a statistic such as "only 10,000 users were affected" or "Microsoft confirms 40,000 ...
1
vote
1answer
88 views

Breaking Wifi password knowing its length of 8 [A-Z] alpha (upper-case) characters using Hashcat

I got the WPA handshake, now it's turn to crack the password using Hashcat. First, I wanted to make a wordlist of passwords [A-Z] the length of 8, but Crunch (the tool in Kali Linux) said it will take ...
9
votes
3answers
3k views

Client side password hashing with static salt - did I find a breach?

I downloaded a software that has a login interface. It's a $100 a month subscription software. I disassembled the software and found that passwords are being sent by combining them with a hard coded &...
13
votes
1answer
2k views

What are the risks of not hashing auto-generated passwords?

Summary The main reason for hashing passwords seems to be that users reuse passwords and, thus, leaked passwords would disclose sensitive information about a user (cf. this question.) If the ...
0
votes
1answer
76 views

Is HMAC-SHA256 more secure to hide information than SHA256?

I need to save user email on a public database but I don't want to do it in plaintext, so I need to hash it. If somebody wants to verify if some email exists in the public database, he or she can ...
5
votes
1answer
117 views

How will Apple and Google provide 5-minute data on Covid exposures using 10-minute interval numbers in the hash?

The goal of COVID-19 exposure notification is to notify people that they were exposed to someone who later tested positive for the virus. Protecting privacy in this process requires some cryptography, ...
5
votes
3answers
1k views

Why is a hash sent with data secure?

Hash values are also useful for verifying the integrity of data sent through insecure channels. The hash value of received data can be compared to the hash value of data as it was sent to determine ...
0
votes
0answers
54 views

How does jarsigner -verify work?

Every jar file contains a MANIFEST.MF file containing a hash for every file. With jarsigner -verify you can verify a jar file, but what are the steps taken to verify a signed .class file in a jar? I ...
0
votes
1answer
54 views

John the Ripper / Hashcat rule, reject candidate if char at position X is the same as character at position Y

I'm using John to generate some word lists and I'm trying to figure out the most optimized way to do the next step. What I want to do is add ever possible 3 digit number to a set where the first digit ...
0
votes
0answers
19 views

Zyxel router custom hash algorithm [duplicate]

My router/access-point Zyxel nwa1123-ac pro stores passwords internally with a custom hashing algorithm. This is the resulting hash for the password "admin": $4$fmNgdX1E$...
2
votes
1answer
97 views

Crack windows excel password

I have many password protected microsoft excel worksheet and I need to be able to edit it. I have forgotten the password, and I know that I can edit the file and take out the password check, but I ...
2
votes
2answers
69 views

How to store MFA secret

I have an online application that I'm adding MFA to, using the Google / Microsoft Authenticator apps for mobile phones. I've tried to adopt a security focussed approach to storing the MFA secret and ...
0
votes
1answer
52 views

File authentifications via PGP versus via unique file hashes

Many files that are available for download (eg in github) come along with "asc" signature files attached, or with a sha256 file hash. Can someone please explain difference of PGP signatures vs file ...
0
votes
1answer
55 views

Directly signing a file with gpg or instead its checksum file?

It is my understanding that when file is signed with gpg the signature will provide 2 guarantees, a proof of ownership of the signature and the integrity of the signed data. lets say I have a doc.txt ...
2
votes
0answers
73 views

Can I skip any password hashing for localhost authentication?

Setup I have several services (Postfix, Apache (PHP)) that access a PostgreSQL database on a Debian Linux 10 system. everyone is on the same host they use the loopback interface (127.0.0.1) to ...
0
votes
2answers
78 views

Save private key in a database to share between multiple accounts

I don't know if my concept would be secure so I ask here. The main purpose is to log in with password x and also use that password to encrypt an RSA private key with AES to store that in the main ...
0
votes
2answers
64 views

Encrypting an object and storing the hash of its decryption key in the same database

To meet one of my application's needs, I must store an encrypted object in the database. Sometimes, I need to verify whether the user holds the right decryption key without the need to retrieve (...
0
votes
1answer
76 views

What vulnerabilities would this type of “password manager” have?

When I was searching for a password manager to use I stumbled upon the concept of Master Password which instead of encrypting and saving your passwords, generates them by using your master password ...
28
votes
4answers
6k views

How secure is this hash-based personal password scheme? [duplicate]

I use a password scheme where I keep a small number of easy to remember personal passwords. Instead of using the passwords directly for each service, I run them through a hashing algorithm first, as a ...
0
votes
2answers
76 views

Is chain hashing algorithms the ultimate solution for hashing passwords?

Let's say I my password is a simple password, 123456 Then if the database was exposed, if the password was: -- stored in plain text -> cracked -- stored it hashed with no salt -> prone to rainbow ...
2
votes
2answers
115 views

Can you help me with some misconceptions about bcrypt and salting?

I researched password hashing and cracking and I have some misconceptions: First rule of thumb to create a strong password is to use 10+ combination of digits/upper/lower/symbols to prevent brute ...
0
votes
0answers
81 views

John the Ripper Obtain Password from Hash

John the Ripper 1. Ran ./pdf2john.pl /home/desktop/1.pdf > /home/desktop/1.txt (Hash inside 1.txt) 2. Ran ./john /home/desktop/1.txt Output: Loaded 1 password hash (PDF [MD5 SHA2 RC4/AES 32/64]) No ...
0
votes
1answer
61 views

What advantage does HMAC provide in generating short hashes comparing to regular hash function?

This question is specific to the Apple/Google Contact Tracing framework. See https://www.blog.google/documents/56/Contact_Tracing_-_Cryptography_Specification.pdf for the cryptography spec. In this ...
2
votes
3answers
78 views

Password checking process for common websites

This will seem like a very basic question, but I wanted to make sure I don't miss something. When you enter your password in a login page and you press enter, what exactly happens right after until ...
5
votes
2answers
167 views

Can name and date of birth be hashed somehow to generate a secure identifier?

I'm working on a project which we intend to launch for developing countries, and, as a result, want to limit the amount of information needed for login and identification, while still maintaining ...

1
2 3 4 5
40