Questions tagged [password-cracking]

for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.

Filter by
Sorted by
Tagged with
100
votes
12answers
68k views

Why is client-side hashing of a password so uncommon?

There are very few websites that hash the users password before submitting it to the server. Javascript doesn't even have support for SHA or other algorithms. But I can think of quite a few ...
156
votes
17answers
22k views

Is the BBC’s advice on choosing a password sensible?

In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows. Step 1: Choose an artist (a recording artist I presume) Lets choose as an example ...
90
votes
11answers
15k views

Is there a threshold for a password so long it doesn't get any more secure or even becomes insecure?

I always hear "A long password is good, a longer password is better". But is there such a thing as a "Password is so long it is becoming unsafe" or "Password is long enough, making it longer won't ...
51
votes
4answers
89k views

How secure is 7z encryption?

I have a text file in which I store all my bank details. I compress and encrypt it with 7-Zip using the following parameters: Compression parameters: Archive format: 7z Compression level: Ultra ...
6
votes
6answers
598 views

How secure is this process for creating passwords?

I've been research into how to be as secure as possible when it comes to password security for online services and websites. Obviously there are some big no no's like using dictionary words, using the ...
3
votes
1answer
9k views

How do we estimate the time taken to crack a hash using brute force techniques

A German hacker famously managed to brute force crack a 160 bit SHA1 hash with passwords between 1 to 6 digits in 49 minutes. Now keeping everything constant (hardware, cracking technique - here brute-...
9
votes
1answer
17k views

Bruteforce with hashcat, how to set the mask properly?

Let's say I've an hash of this type: test::::4e45c7bab093d7011e9b3a5df7d9fa88212beac5ac9c8c47:d6ff3373aa353f3b:123456 I would like to bruteforce it using hashcat, but I'm failing to set the correct ...
10
votes
2answers
58k views

If hashing is one way, why can we decrypt MD5 hashes?

I have read some times that hashing is a one way function, that is you can make the hash of a message, but you can't recover the original message from the hash, just check its integrity. However, if ...
24
votes
8answers
7k views

Is there a way to make a WEP-secured AP uncrackable?

For some days, I was feeling that my Internet bill was booming. Then, I recently found out that a boy near my house was accessing my router to use the Internet. Then, I read some articles how to crack ...
34
votes
2answers
41k views

Why are GPUs so good at cracking passwords?

What is it about GPUs that lets them crack passwords so quickly? It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
14
votes
1answer
90k views

Forgot password to 7-Zip archive

I think I already know the answer to this question, but I thought I'd ask the experts anyway. A few months back, I created a password-protected 7-Zip archive which housed the source code of a simple ...
27
votes
3answers
7k views

How bad would a partial hash leak be, realistically?

Even though the current recommendation for storing passwords is the usage of a slow key derivation function such as Argon2, scrypt, PBKDF2 or bcrypt1, many websites still use the traditional hash(...
9
votes
4answers
5k views

Password manager vs password book

I have seen a lot of discussion online surrounding whether using password management software is more secure than writing your passwords down on paper and vice versa. However, a lot of this discussion ...
3
votes
2answers
3k views

Pattern based password cracking

I need to select a project for this semester. I'm a second year uni student in Ethical Hacking and Countermeasures. My idea was to see if using some kind of pattern based password cracking can be more ...
7
votes
2answers
42k views

How to crack `salt + SHA256(salt + password)` hashes with JTR?

I have a set of password hashes. Here is an example: 9e74437e97ff201ff38416138a22a7f3adfa3b9c10e947481bd94b16eed7df6b6e2806 From the source code of the application generating this hash I learned that ...
7
votes
3answers
8k views

File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?

I've been using this command to encrypt files for a while now: openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc Then I type in a password. Can someone tell me, roughly speaking, ...
4
votes
4answers
1k views

Should I vary the length of my completely-random passwords for the best security?

I use LastPass comprehensively, and for each new site/password I almost always have it generate a random password of the same number of characters, allowing letters, numbers, and symbols (except when ...
4
votes
4answers
5k views

Are files encrypted with 7ZIP vulnerable to password crackers?

A client says they can't accept password-protected PDFs to put in their payroll system, so I have to send them without security. I don't want to send unsecured PDFs via e-mail because e-mail is ...
7
votes
7answers
10k views

Is it possible to detect password length from hash? Does doubling your password add more security?

Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
3
votes
2answers
21k views

Generate John the Ripper rule

This question asks for pointers about generating JtR rulesets, but the OP states I understand how to use it to make various permutations from a given wordlist Could someone please explain that? ...
2
votes
2answers
2k views

Is it a good idea to combine words from different languages to increase a password's strength? [duplicate]

I was thinking of a way to generate a password that is easy to remember, but hard to crack, like the famous "correct horse battery staple" suggested by XKCD, also discussed here, and I've realized I'...
1
vote
3answers
7k views

Cracking passwords after a pattern with John

So I am trying to find out how easy it is to crack a password using some great Linux tools. We all know about John as a password cracker and how great it is. But how about specifying a pattern. Let'...
54
votes
5answers
390k views

How to recover a lost zip file password?

I have some files I was given by my teacher at University, I could chase him up, but I may as well try getting blood from a stone, his response rate isn't great and I completed my degree a year ago! ...
65
votes
5answers
7k views

Do 2FA sites leak info by confirming a correct password guess?

Here's my relatively layman's view of the issue. Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly. ...
37
votes
1answer
16k views

How does the attacker know what algorithm and salt to use in a dictionary attack?

I am curious about password cracking methods like dictionary and brute force attacks. Nowadays passwords are stored as hashes and not plaintext on the server. Then how can the plaintext passwords in ...
29
votes
4answers
11k views

Is randomly generating passwords from an assortment of dictionary words cryptographically secure? [duplicate]

We should all know the XKCD comic on password strength, suggesting (appropriately) that a password based on multiple common words is more secure and memorable than a password such as Aw3s0m3s4u(3 or ...
27
votes
4answers
6k views

Does putting salt first make it easier for attacker to bruteforce the hash?

Many recommendations for storing passwords recommend hash(salt + password) rather than hash(password + salt). Doesn't putting the salt first make it much faster for the attacker to bruteforce the ...
13
votes
5answers
4k views

Is it a good idea to use non-Latin Unicode characters in a password?

I've heard many suggestions as to what makes a good password (hard to guess, not a dictionary word or permutation thereof, at least a certain length, etc.) so that it cannot be cracked in a realistic ...
15
votes
1answer
5k views

Understanding brute-forcing algorithms [duplicate]

I've been reading up on brute-forcing techniques and possible methods of prevention, but there is one issue that I haven't been able to find a clear answer to. The way I understand it, a 'simple' ...
9
votes
3answers
8k views

Which is faster - brute-forcing, or using a dictionary attack that contains all possible permutations?

Assuming a 6-character password uses the mixalphanumeric charset, giving each character a character set of 62 and the entire password a keyspace of 62^6 = 46.6 billion (if my calculations are correct)....
8
votes
5answers
5k views

A password manager a single point of failure. Then why is it so often recommended nowadays? [duplicate]

The conclusion of this article is that to protect passwords in 2017, you need length and randomness. It recommends giving up all little hacks and techniques like turning "o" into 0 in favor of picking ...
7
votes
1answer
5k views

What is "NAND mirroring", the alleged technique that the FBI will use to crack the San Bernardino shooter's iPhone?

According to Ars Technica, Jonathan Zdziarski, a leading independent Apple iOS security researcher and forensics expert, has a theory about the FBI's newly discovered potential route into the ...
5
votes
2answers
2k views

Can a weak password generate the same hash as a strong password?

Conventional password advice encourages the use of long passwords with the rationale being hashing the entire password space (rainbow table or brute force) takes longer with each character added. ...
5
votes
2answers
19k views

Cracking a password Protected pdf file using John the ripper

What exactly happens after I provide the hash from the pdf file to John for cracking the password? Does John extract just the password hash from the file and work on it, or is there something else?
7
votes
2answers
52k views

show previously hacked passwords with John The Ripper

I tried to crack my windows passwords on the SAM file with john the ripper, it worked just fine, and it shows me the password. But when i try to hack the same file again, john just tells me : Loaded ...
7
votes
4answers
791 views

Password Policy: Issue random generated passwords / Let the user choose a password

I'm currently thinking about a new password policy. Originally I wanted the users to choose a password that is X digits long, contains numbers, special chars, lower and upper case,... but then I did ...
6
votes
2answers
14k views

Estimate the time to crack passwords using bcrypt

I am reading on the Ashley Madison password exposure case. Dean Pierce was able to output about 4000 cracked passwords within 5 days given his system. I'm assuming that he generated a table of hashes ...
3
votes
2answers
440 views

How to choose between password derivation or encryption?

Suppose you use a password manager having all possible features of modern password managers: encryption with a key derived from your master password, auto-filling, cloud or local storage, browser ...
1
vote
1answer
2k views

How long to crack an 8 character WPA2 hash if first char is known

I know the first char is A and it's all upper alphanumeric. Is there a way to estimate how long a mid level single GPU using hashcat would take to crack it?
6
votes
2answers
2k views

How many known time/result combinations does it take to guess a HOTP/TOTP secret?

I thought about "recovering", "determining", "guessing", "calculating" or "reproducing" the HOTP/TOTP secrets when only the outcome (6-digit code + time) is known. In case we can view the live ...
5
votes
1answer
18k views

John the ripper passwd file format with salt not working

I'm trying test password strength in one of our e-commerce sites. I'm using john the ripper to brute-force a password file. The algorithm used by PHP is: $hash = md5($salt . $pass) No other ...
4
votes
2answers
2k views

How does a zip file detect a correct password?

When extracting files from an encrypted zip archive, the user is asked to give a password in order to read the original file. How does an encrypted ZIP detect when the user has given the correct ...
2
votes
3answers
280 views

To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?

I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
2
votes
1answer
4k views

Is there any smarter way to crack wpa-2 handshake?

I was testing on my own router that how secure is my password. First I set a random 9 digit number as a password but the aircrack-ng was unable to crack it even in 45 minutes and tried other tools ...
1
vote
1answer
489 views

Breaking Wifi password knowing its length of 8 [A-Z] alpha (upper-case) characters using Hashcat

I got the WPA handshake, now it's turn to crack the password using Hashcat. First, I wanted to make a wordlist of passwords [A-Z] the length of 8, but Crunch (the tool in Kali Linux) said it will take ...
1
vote
1answer
1k views

WPA/PSK Dictionaries

I have been reading some articles on WPA/PSK encryption and one said that the hash is calculated like this: Key = PBKDF2(passphrase, ssid, 4096, 256) Where PBKDF2 is a standardized method to derive ...
61
votes
3answers
17k views

Are leet passwords easily crackable?

Making a strong password AND remembering it is like eating while talking. You choke. So the same thing might happen if you have a p455w0(R).|L1K3thys and someone cracks it. I'm just not sure if it's ...
77
votes
4answers
21k views

How long will it take to crack the passwords stolen in the Yahoo hack announced 14 Dec 2016?

Apparently Yahoo was hacked yet again with up to a billion user accounts being compromised. The article says Yahoo uses MD5 for password hashing. Are the hackers likely to be able to crack the ...
29
votes
12answers
17k views

Reusing passwords that can possibly never be cracked

Reusing passwords pose as a terrible risk for users because in the event of a data breach, with the passwords not being stored securely enough, this means that, by default, all other services that ...
75
votes
9answers
16k views

Can one tell if a password guess was close by the hash result?

I have been reading about password management lately (very interesting stuff!) and was wondering how different the hashes would be for similar strings. Is it possible to know if a password guess was ...