Questions tagged [password-cracking]
for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.
116
questions
107
votes
13
answers
74k
views
Why is client-side hashing of a password so uncommon?
There are very few websites that hash the users password before submitting it to the server. Javascript doesn't even have support for SHA or other algorithms.
But I can think of quite a few ...
- 1,183
157
votes
17
answers
22k
views
Is the BBC’s advice on choosing a password sensible?
In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows.
Step 1: Choose an artist (a recording artist I presume)
Lets choose as an example ...
- 7,789
92
votes
11
answers
16k
views
Is there a threshold for a password so long it doesn't get any more secure or even becomes insecure?
I always hear "A long password is good, a longer password is better". But is there such a thing as a "Password is so long it is becoming unsafe" or "Password is long enough, making it longer won't ...
- 1,138
60
votes
4
answers
105k
views
How secure is 7z encryption?
I have a text file in which I store all my bank details. I compress and encrypt it with 7-Zip using the following parameters:
Compression parameters:
Archive format: 7z
Compression level: Ultra
...
6
votes
6
answers
644
views
How secure is this process for creating passwords?
I've been research into how to be as secure as possible when it comes to password security for online services and websites. Obviously there are some big no no's like using dictionary words, using the ...
- 69
3
votes
1
answer
11k
views
How do we estimate the time taken to crack a hash using brute force techniques
A German hacker famously managed to brute force crack a 160 bit SHA1 hash with passwords between 1 to 6 digits in 49 minutes.
Now keeping everything constant (hardware, cracking technique - here brute-...
- 241
3
votes
3
answers
1k
views
To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?
I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
- 141
24
votes
8
answers
7k
views
Is there a way to make a WEP-secured AP uncrackable?
For some days, I was feeling that my Internet bill was booming. Then, I recently found out that a boy near my house was accessing my router to use the Internet. Then, I read some articles how to crack ...
- 501
11
votes
2
answers
62k
views
If hashing is one way, why can we decrypt MD5 hashes?
I have read some times that hashing is a one way function, that is you can make the hash of a message, but you can't recover the original message from the hash, just check its integrity.
However, if ...
user15194
9
votes
1
answer
20k
views
Bruteforce with hashcat, how to set the mask properly?
Let's say I've an hash of this type:
test::::4e45c7bab093d7011e9b3a5df7d9fa88212beac5ac9c8c47:d6ff3373aa353f3b:123456
I would like to bruteforce it using hashcat, but I'm failing to set the correct ...
- 93
7
votes
2
answers
3k
views
How many known time/result combinations does it take to guess a HOTP/TOTP secret?
I thought about "recovering", "determining", "guessing", "calculating" or "reproducing" the HOTP/TOTP secrets when only the outcome (6-digit code + time) is known.
In case we can view the live ...
- 6,661
5
votes
4
answers
12k
views
Are files encrypted with 7ZIP vulnerable to password crackers?
A client says they can't accept password-protected PDFs to put in their payroll system, so I have to send them without security. I don't want to send unsecured PDFs via e-mail because e-mail is ...
- 1,917
35
votes
2
answers
43k
views
Why are GPUs so good at cracking passwords?
What is it about GPUs that lets them crack passwords so quickly?
It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
- 455
27
votes
3
answers
7k
views
How bad would a partial hash leak be, realistically?
Even though the current recommendation for storing passwords is the usage of a slow key derivation function such as Argon2, scrypt, PBKDF2 or bcrypt1, many websites still use the traditional hash(...
user163495
14
votes
1
answer
103k
views
Forgot password to 7-Zip archive
I think I already know the answer to this question, but I thought I'd ask the experts anyway.
A few months back, I created a password-protected 7-Zip archive which housed the source code of a simple ...
- 343
11
votes
4
answers
968
views
Why do salts for hashing passwords need to be globally unique, not just system/site-unique?
I was reading an answer by Terry Chia to another question about the requirements for a salt, in which he/she (among others) specified that salts need to be globally unique, but don't go into any ...
- 113
10
votes
4
answers
6k
views
Password manager vs password book
I have seen a lot of discussion online surrounding whether using password management software is more secure than writing your passwords down on paper and vice versa. However, a lot of this discussion ...
- 223
10
votes
6
answers
5k
views
What is the best way to calculate true password entropy for human created passwords?
Okay, I know it might seem this has already been beaten to death but, hear me out. I am including a fairly good password strength algorithm for my app for users on sign-up. This one, which I've copied ...
- 261
8
votes
3
answers
8k
views
File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?
I've been using this command to encrypt files for a while now:
openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc
Then I type in a password.
Can someone tell me, roughly speaking, ...
- 273
8
votes
2
answers
54k
views
How to crack `salt + SHA256(salt + password)` hashes with JTR?
I have a set of password hashes.
Here is an example:
9e74437e97ff201ff38416138a22a7f3adfa3b9c10e947481bd94b16eed7df6b6e2806
From the source code of the application generating this hash I learned that ...
- 973
7
votes
7
answers
12k
views
Is it possible to detect password length from hash? Does doubling your password add more security?
Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
- 1,151
5
votes
2
answers
26k
views
Generate John the Ripper rule
This question asks for pointers about generating JtR rulesets, but the OP states
I understand how to use it to make various permutations from a given wordlist
Could someone please explain that? ...
- 471
4
votes
4
answers
1k
views
Should I vary the length of my completely-random passwords for the best security?
I use LastPass comprehensively, and for each new site/password I almost always have it generate a random password of the same number of characters, allowing letters, numbers, and symbols (except when ...
- 157
4
votes
2
answers
3k
views
Pattern based password cracking
I need to select a project for this semester. I'm a second year uni student in Ethical Hacking and Countermeasures. My idea was to see if using some kind of pattern based password cracking can be more ...
- 1,447
2
votes
2
answers
3k
views
Is it a good idea to combine words from different languages to increase a password's strength? [duplicate]
I was thinking of a way to generate a password that is easy to remember, but hard to crack, like the famous "correct horse battery staple" suggested by XKCD, also discussed here, and I've realized I'...
1
vote
3
answers
10k
views
Cracking passwords after a pattern with John
So I am trying to find out how easy it is to crack a password using some great Linux tools.
We all know about John as a password cracker and how great it is. But how about specifying a pattern.
Let'...
- 195
65
votes
5
answers
7k
views
Do 2FA sites leak info by confirming a correct password guess?
Here's my relatively layman's view of the issue.
Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly.
...
- 777
56
votes
5
answers
405k
views
How to recover a lost zip file password?
I have some files I was given by my teacher at University, I could chase him up, but I may as well try getting blood from a stone, his response rate isn't great and I completed my degree a year ago!
...
- 681
42
votes
1
answer
19k
views
How does the attacker know what algorithm and salt to use in a dictionary attack?
I am curious about password cracking methods like dictionary and brute force attacks. Nowadays passwords are stored as hashes and not plaintext on the server. Then how can the plaintext passwords in ...
- 598
29
votes
4
answers
12k
views
Is randomly generating passwords from an assortment of dictionary words cryptographically secure? [duplicate]
We should all know the XKCD comic on password strength, suggesting (appropriately) that a password based on multiple common words is more secure and memorable than a password such as Aw3s0m3s4u(3 or ...
- 490
27
votes
4
answers
7k
views
Does putting salt first make it easier for attacker to bruteforce the hash?
Many recommendations for storing passwords recommend hash(salt + password) rather than hash(password + salt).
Doesn't putting the salt first make it much faster for the attacker to bruteforce the ...
user123540
16
votes
5
answers
5k
views
Is it a good idea to use non-Latin Unicode characters in a password?
I've heard many suggestions as to what makes a good password (hard to guess, not a dictionary word or permutation thereof, at least a certain length, etc.) so that it cannot be cracked in a realistic ...
- 261
15
votes
1
answer
6k
views
Understanding brute-forcing algorithms [duplicate]
I've been reading up on brute-forcing techniques and possible methods of prevention, but there is one issue that I haven't been able to find a clear answer to.
The way I understand it, a 'simple' ...
- 261
11
votes
1
answer
85k
views
show previously hacked passwords with John The Ripper
I tried to crack my windows passwords on the SAM file with john the ripper, it worked just fine, and it shows me the password. But when i try to hack the same file again, john just tells me :
Loaded ...
- 679
9
votes
3
answers
9k
views
Which is faster - brute-forcing, or using a dictionary attack that contains all possible permutations?
Assuming a 6-character password uses the mixalphanumeric charset, giving each character a character set of 62 and the entire password a keyspace of 62^6 = 46.6 billion (if my calculations are correct)....
- 989
8
votes
5
answers
7k
views
A password manager a single point of failure. Then why is it so often recommended nowadays? [duplicate]
The conclusion of this article is that to protect passwords in 2017, you need length and randomness. It recommends giving up all little hacks and techniques like turning "o" into 0 in favor of picking ...
- 81
8
votes
2
answers
19k
views
Estimate the time to crack passwords using bcrypt
I am reading on the Ashley Madison password exposure case. Dean Pierce was able to output about 4000 cracked passwords within 5 days given his system. I'm assuming that he generated a table of hashes ...
- 81
7
votes
2
answers
21k
views
Cracking a password Protected pdf file using John the ripper
What exactly happens after I provide the hash from the pdf file to John for cracking the password?
Does John extract just the password hash from the file and work on it, or is there something else?
- 119
7
votes
4
answers
889
views
Password Policy: Issue random generated passwords / Let the user choose a password
I'm currently thinking about a new password policy. Originally I wanted the users to choose a password that is X digits long, contains numbers, special chars, lower and upper case,... but then I did ...
- 4,313
7
votes
1
answer
5k
views
What is "NAND mirroring", the alleged technique that the FBI will use to crack the San Bernardino shooter's iPhone?
According to Ars Technica,
Jonathan Zdziarski, a leading independent Apple iOS security researcher and forensics expert, has a theory about the FBI's newly discovered potential route into the ...
- 181
6
votes
1
answer
27k
views
Decrypting SAM hive after Windows 10 anniversary update?
After a lot of frustration, I've finally cracked my local Windows 10 password using mimikatz to extract the proper NTLM hash.
In particular, samdump2 decrypted the SAM hive into a list of users with &...
- 1,207
5
votes
4
answers
1k
views
What are possible methods for calculating password entropy?
I noticed there are tons of questions and answers about password entropy on this forum, some even suggesting formulas for calculating it. None did answer my exact question.
What are possible or ...
- 6,661
5
votes
1
answer
21k
views
John the ripper passwd file format with salt not working
I'm trying test password strength in one of our e-commerce sites. I'm using john the ripper to brute-force a password file. The algorithm used by PHP is:
$hash = md5($salt . $pass)
No other ...
- 61
5
votes
2
answers
2k
views
Can a weak password generate the same hash as a strong password?
Conventional password advice encourages the use of long passwords with the rationale being hashing the entire password space (rainbow table or brute force) takes longer with each character added.
...
- 221
4
votes
2
answers
3k
views
How does a zip file detect a correct password?
When extracting files from an encrypted zip archive, the user is asked to give a password in order to read the original file.
How does an encrypted ZIP detect when the user has given the correct ...
- 579
3
votes
2
answers
573
views
How to choose between password derivation or encryption?
Suppose you use a password manager having all possible features of modern password managers: encryption with a key derived from your master password, auto-filling, cloud or local storage, browser ...
- 183
2
votes
1
answer
5k
views
Is there any smarter way to crack wpa-2 handshake?
I was testing on my own router that how secure is my password. First I set a random 9 digit number as a password but the aircrack-ng was unable to crack it even in 45 minutes and tried other tools ...
- 177
1
vote
2
answers
8k
views
Brute-Forcing DVWA login page with hydra
I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
- 11
1
vote
1
answer
1k
views
Breaking Wifi password knowing its length of 8 [A-Z] alpha (upper-case) characters using Hashcat
I got the WPA handshake, now it's turn to crack the password using Hashcat. First, I wanted to make a wordlist of passwords [A-Z] the length of 8, but Crunch (the tool in Kali Linux) said it will take ...
- 13
1
vote
1
answer
2k
views
WPA/PSK Dictionaries
I have been reading some articles on WPA/PSK encryption and one said that the hash is calculated like this:
Key = PBKDF2(passphrase, ssid, 4096, 256)
Where PBKDF2 is a standardized method to derive ...
- 113