Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

Filter by
Sorted by
Tagged with
13
votes
3answers
6k views

How does a 'rainbow table' hacker obtain password hashes in the first place?

I don't understand this part of the Rainbow table attack. In all my Google searches, it says that a hacker uses a rainbow table on password hashes. But how does the hacker obtain the password hashes ...
-1
votes
1answer
43 views

Digital signature from hashing encrypted webpage

I'm studying for the Security+ exam with the help of Total Seminars' Udemy course and in one video they claim that a digital signature is generated by encrypting a message with the sender's private ...
-1
votes
3answers
143 views

Are there any security implications to changing the base of a hash?

File this under "gosh, I'd hope not," but I've been surprised before. I have a hash (HMAC SHA-1 specifically). I need to store the full hash, but due to constraints outside my control, I ...
0
votes
1answer
57 views

How to know what type of encryption type is that? [duplicate]

the hash is a lot of numbers separated by hyphens, something like that 02-35-161-51-43-227-161-06-151-43-22-71-43-46-21.... More than 700 numbers.
2
votes
2answers
102 views

Use delay with a fixed total time to defend against timing attacks

Consider this common example used to demonstrate timing attacks: async def sign_in(username, password): user = await get_user_from_db(username) if user is None: return False # early return :(...
2
votes
1answer
87 views

Explaining a bad approach - not comparing hashes

Today I saw a snippet a code for authentication logic : function checkPass($pass, $login){ $inputedPass = $pass; $req = $bdd->prepare('SELECT password FROM agents WHERE password = ...
0
votes
0answers
141 views

How does JtR crack password protected documents?

I've been trying to figure this out using an encrypted zip file as an example. I am quite familiar with the idea that PBKDF2 creates a key drivered form a password and then that key is used to ...
0
votes
1answer
51 views

How do maintainers calculate x number of accounts compromised by hack? [closed]

I am always curious by reports in the news of big network sites getting hacked and the report confidently stating a statistic such as "only 10,000 users were affected" or "Microsoft confirms 40,000 ...
1
vote
1answer
186 views

Breaking Wifi password knowing its length of 8 [A-Z] alpha (upper-case) characters using Hashcat

I got the WPA handshake, now it's turn to crack the password using Hashcat. First, I wanted to make a wordlist of passwords [A-Z] the length of 8, but Crunch (the tool in Kali Linux) said it will take ...
9
votes
3answers
3k views

Client side password hashing with static salt - did I find a breach?

I downloaded a software that has a login interface. It's a $100 a month subscription software. I disassembled the software and found that passwords are being sent by combining them with a hard coded &...
13
votes
1answer
2k views

What are the risks of not hashing auto-generated passwords?

Summary The main reason for hashing passwords seems to be that users reuse passwords and, thus, leaked passwords would disclose sensitive information about a user (cf. this question.) If the ...
0
votes
1answer
122 views

Is HMAC-SHA256 more secure to hide information than SHA256?

I need to save user email on a public database but I don't want to do it in plaintext, so I need to hash it. If somebody wants to verify if some email exists in the public database, he or she can ...
5
votes
1answer
129 views

How will Apple and Google provide 5-minute data on Covid exposures using 10-minute interval numbers in the hash?

The goal of COVID-19 exposure notification is to notify people that they were exposed to someone who later tested positive for the virus. Protecting privacy in this process requires some cryptography, ...
5
votes
3answers
1k views

Why is a hash sent with data secure?

Hash values are also useful for verifying the integrity of data sent through insecure channels. The hash value of received data can be compared to the hash value of data as it was sent to determine ...
0
votes
0answers
75 views

How does jarsigner -verify work?

Every jar file contains a MANIFEST.MF file containing a hash for every file. With jarsigner -verify you can verify a jar file, but what are the steps taken to verify a signed .class file in a jar? I ...
0
votes
1answer
122 views

John the Ripper / Hashcat rule, reject candidate if char at position X is the same as character at position Y

I'm using John to generate some word lists and I'm trying to figure out the most optimized way to do the next step. What I want to do is add ever possible 3 digit number to a set where the first digit ...
0
votes
0answers
19 views

Zyxel router custom hash algorithm [duplicate]

My router/access-point Zyxel nwa1123-ac pro stores passwords internally with a custom hashing algorithm. This is the resulting hash for the password "admin": $4$fmNgdX1E$...
2
votes
1answer
520 views

Crack windows excel password

I have many password protected microsoft excel worksheet and I need to be able to edit it. I have forgotten the password, and I know that I can edit the file and take out the password check, but I ...
2
votes
2answers
128 views

How to store MFA secret

I have an online application that I'm adding MFA to, using the Google / Microsoft Authenticator apps for mobile phones. I've tried to adopt a security focussed approach to storing the MFA secret and ...
0
votes
1answer
83 views

File authentifications via PGP versus via unique file hashes

Many files that are available for download (eg in github) come along with "asc" signature files attached, or with a sha256 file hash. Can someone please explain difference of PGP signatures vs file ...
0
votes
1answer
245 views

Directly signing a file with gpg or instead its checksum file?

It is my understanding that when file is signed with gpg the signature will provide 2 guarantees, a proof of ownership of the signature and the integrity of the signed data. lets say I have a doc.txt ...
2
votes
0answers
78 views

Can I skip any password hashing for localhost authentication?

Setup I have several services (Postfix, Apache (PHP)) that access a PostgreSQL database on a Debian Linux 10 system. everyone is on the same host they use the loopback interface (127.0.0.1) to ...
0
votes
2answers
331 views

Save private key in a database to share between multiple accounts

I don't know if my concept would be secure so I ask here. The main purpose is to log in with password x and also use that password to encrypt an RSA private key with AES to store that in the main ...
0
votes
2answers
143 views

Encrypting an object and storing the hash of its decryption key in the same database

To meet one of my application's needs, I must store an encrypted object in the database. Sometimes, I need to verify whether the user holds the right decryption key without the need to retrieve (...
0
votes
1answer
119 views

What vulnerabilities would this type of “password manager” have?

When I was searching for a password manager to use I stumbled upon the concept of Master Password which instead of encrypting and saving your passwords, generates them by using your master password ...
28
votes
4answers
6k views

How secure is this hash-based personal password scheme? [duplicate]

I use a password scheme where I keep a small number of easy to remember personal passwords. Instead of using the passwords directly for each service, I run them through a hashing algorithm first, as a ...
0
votes
2answers
98 views

Is chain hashing algorithms the ultimate solution for hashing passwords?

Let's say I my password is a simple password, 123456 Then if the database was exposed, if the password was: -- stored in plain text -> cracked -- stored it hashed with no salt -> prone to rainbow ...
2
votes
2answers
229 views

Can you help me with some misconceptions about bcrypt and salting?

I researched password hashing and cracking and I have some misconceptions: First rule of thumb to create a strong password is to use 10+ combination of digits/upper/lower/symbols to prevent brute ...
0
votes
0answers
144 views

John the Ripper Obtain Password from Hash

John the Ripper 1. Ran ./pdf2john.pl /home/desktop/1.pdf > /home/desktop/1.txt (Hash inside 1.txt) 2. Ran ./john /home/desktop/1.txt Output: Loaded 1 password hash (PDF [MD5 SHA2 RC4/AES 32/64]) No ...
0
votes
1answer
64 views

What advantage does HMAC provide in generating short hashes comparing to regular hash function?

This question is specific to the Apple/Google Contact Tracing framework. See https://www.blog.google/documents/56/Contact_Tracing_-_Cryptography_Specification.pdf for the cryptography spec. In this ...
2
votes
3answers
81 views

Password checking process for common websites

This will seem like a very basic question, but I wanted to make sure I don't miss something. When you enter your password in a login page and you press enter, what exactly happens right after until ...
5
votes
2answers
227 views

Can name and date of birth be hashed somehow to generate a secure identifier?

I'm working on a project which we intend to launch for developing countries, and, as a result, want to limit the amount of information needed for login and identification, while still maintaining ...
3
votes
1answer
350 views

Why does pwdump7 retrieve LM hashes even though they're disabled?

I'm currently undergoing a penetration testing certification, where I'm asked to : Set up a fully-patched Windows 10 Pro VM (done) Retrieve local password hashes from the SAM database using pwdump7 ...
0
votes
1answer
93 views

How to share information between devices, while keeping it anonymous

I'm developing an app for alert people if they encounter covid-19 positive person. I'm very much concern about user's privacy. So I need to make a user completely anonymous. What is want is as ...
0
votes
0answers
180 views

Safest alternative for hashing credit card numbers to use the hash as fingerprint?

Same question asked here in 2014 but since a lot has changed since then, I would like to get feedback from experts on the latest best practices. The problem We need to hash credit card numbers to ...
1
vote
1answer
496 views

Argon2id Configuration

I read an article about how to use Argon2id in C# here. Below is the code they wrote (slightly edited): using System; using System.Diagnostics; using System.Linq; using System.Security.Cryptography; ...
0
votes
1answer
95 views

Writing a Simple SHA256 Salted Hash Generator

I saw a video detailing how to write a simple salted hash program in C# here. Below is the code they wrote (slightly edited for console applications): using System; using System.Text; using System....
2
votes
1answer
233 views

Oversalting Potentially Harmful?

I find it hard to believe, and figure I just missed or forgot something obvious (years since I thought about this stuff), so maybe someone can point it out. But it seems like most of what I know about ...
0
votes
1answer
207 views

John the ripper - ecryptfs - sample not cracked: 0 password hashes cracked

I tried to use john the ripper on the sample : ecryptfs_sample_metadata.tar (password is 'openwall') Which I downloaded from here: https://openwall.info/wiki/john/sample-non-hashes If i try sudo ...
0
votes
1answer
124 views

Does TLS (Transport Layer Security) protect against deliberate tampering or accidental corruption?

If someone tampers with data being transmitted over HTTPS using TLS, would that result in a corrupted decrypted message or would it result in the error being detected such as through a cryptographic ...
0
votes
1answer
303 views

Using DD to get the hash of a non-system partition encrypted by VeraCrypt

I am trying to use DD for Windows to obtain the hash of a non-system partition that was encrypted via Veracrypt, but have run into a bit of a problem. The command I used to get the hash of the ...
1
vote
0answers
960 views

John the Ripper doesn't crack passwords when I use wordlists

Title says it all, I can't tell if John is just crashing or "gives up" on cracking the hash. First I start off by creating an md5 hash out of a word I KNOW is on the rockyou.txt wordlist: echo -n '...
0
votes
1answer
406 views

OAuth2 - Sending a hash of your client_secret when using the client credentials grant instead of the secret

I'm working on an API that I'd like to be accessible internally by other servers as well as devices that I consider both as confidential private clients. Devices are considered private clients because ...
0
votes
0answers
42 views

Are there any security implications of signing a hex digest over the binary digest?

Hash functions usually used for signing output a fixed amount of bytes. However, some tools output the data as an ASCII hex string, and other tools use the binary bytes. It is clear that from a ...
0
votes
0answers
96 views

Bruteforce different encodings

I have a hash $office$*2013*100000*256*16*664f9e0787392c2b1632d3947aaadee4*27dc7d029f76244a407acf9b5afa3740*ebbc055ae08124f6a6be81ef812da4fece16b2ad86eede3916d9cda15f71833f password: лl My wordlist:...
2
votes
1answer
126 views

What hashing strategy is recommended for desensitizing reporting data?

I need to desensitize data for reporting. There may be some PII but nothing like SSN, mostly Name or Phone. They won't be concatenated together anywhere. Also this is in the US with no European (or ...
0
votes
0answers
19 views

Does hashing client-side increase security when dealing with an untrustworthy server? [duplicate]

Does hashing once on clientside and once on server-side increase security when dealing with an untrustworthy server? For example when dealing with open source projects where users can self-host their ...
5
votes
1answer
411 views

Why is the BCrypt text “OrpheanBeholderScryDoubt”

I'm looking for a reference about the weird initial BCrypt text "OrpheanBeholderScryDoubt" Why was this string used? Would using 192 zeros or ones not have worked well in practice for some reason? ...
0
votes
1answer
774 views

Hash that outputs a 8 characters [duplicate]

I'm investigating a login system that exposes (probably) hashed passwords. Password: HTSr0MF8Ou4liOCUayXHDg== The password is stored in base64 format. When I decode it, I get random 8 chars ...
0
votes
2answers
206 views

Why hash on server instead of client? [duplicate]

Please hear me out. I used to scoff at people who asked this question because client-side hashing is "so obviously wrong." I have read similar questions on this site but haven't found a satisfactory ...

1 2
3
4 5
42