Questions tagged [password-cracking]
for questions relating to the cracking of passwords and the practices to mitigate against passwords being cracked.
791
questions
157
votes
17
answers
22k
views
Is the BBC’s advice on choosing a password sensible?
In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows.
Step 1: Choose an artist (a recording artist I presume)
Lets choose as an example ...
- 7,789
107
votes
13
answers
74k
views
Why is client-side hashing of a password so uncommon?
There are very few websites that hash the users password before submitting it to the server. Javascript doesn't even have support for SHA or other algorithms.
But I can think of quite a few ...
- 1,183
102
votes
3
answers
20k
views
Why is Sojdlg123aljg a common password?
I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
- 753
92
votes
11
answers
16k
views
Is there a threshold for a password so long it doesn't get any more secure or even becomes insecure?
I always hear "A long password is good, a longer password is better". But is there such a thing as a "Password is so long it is becoming unsafe" or "Password is long enough, making it longer won't ...
- 1,138
78
votes
4
answers
21k
views
How long will it take to crack the passwords stolen in the Yahoo hack announced 14 Dec 2016?
Apparently Yahoo was hacked yet again with up to a billion user accounts being compromised. The article says Yahoo uses MD5 for password hashing.
Are the hackers likely to be able to crack the ...
- 895
76
votes
9
answers
17k
views
Can one tell if a password guess was close by the hash result?
I have been reading about password management lately (very interesting stuff!) and was wondering how different the hashes would be for similar strings.
Is it possible to know if a password guess was ...
- 849
65
votes
5
answers
7k
views
Do 2FA sites leak info by confirming a correct password guess?
Here's my relatively layman's view of the issue.
Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly.
...
- 777
63
votes
1
answer
18k
views
I found a password with hashcat, but it doesn't work
My assignment required me to find the password for a PowerPoint file (97 - 2003, v. 8.0 - v. 11.0).
I used office2john.py to retrieve the hash, and I removed the file name.
The hash is:
$...
- 681
61
votes
3
answers
18k
views
Are leet passwords easily crackable?
Making a strong password AND remembering it is like eating while talking. You choke. So the same thing might happen if you have a p455w0(R).|L1K3thys and someone cracks it. I'm just not sure if it's ...
- 717
60
votes
4
answers
105k
views
How secure is 7z encryption?
I have a text file in which I store all my bank details. I compress and encrypt it with 7-Zip using the following parameters:
Compression parameters:
Archive format: 7z
Compression level: Ultra
...
56
votes
9
answers
14k
views
Are randomly-generated passwords starting with "a" less secure?
I generated a password recently for a new account and the first three characters were "aa1".
After exhausting all other attacks, a cracker would start brute forcing. On the assumption they'd start ...
- 715
56
votes
5
answers
405k
views
How to recover a lost zip file password?
I have some files I was given by my teacher at University, I could chase him up, but I may as well try getting blood from a stone, his response rate isn't great and I completed my degree a year ago!
...
- 681
55
votes
3
answers
11k
views
Secret salts; why do they slow down attacker more than they do me?
When studying Dan Boneh's slides for 'Session Management and
User Authentication' (2011) he mentions 'secret salts' on the slide 'Further defences' (slide 48 out of 58).
He suggest to store in the ...
- 603
54
votes
7
answers
10k
views
Is it possible to determine password strength without knowing the password?
I have just got some report of a penetration test and one of the recommendations was to strengthen passwords. I however realized that no passwords were provided for the testers, and I wanted to find ...
- 653
53
votes
7
answers
37k
views
How are GPUs used in brute force attacks?
I have read that GPUs can be used in brute force attacks? But how can this be done and is there a need for any other hardware devices (hard disks for instance)?
Note: I'm more interested in web ...
50
votes
7
answers
15k
views
Is this password scheme legit?
I received an invitation for an IT security fair (https://www.it-sa.de/en).
They additionally delivered a password "Kryptonizer". That is a little card to hang on your keychain with the following (...
- 619
44
votes
7
answers
6k
views
Are partially typed passwords a potential security risk?
I just sat down at my work computer and began to unlock it by typing in my password, I got 6 of the 8 characters in and decided I wanted coffee and walked away to get it. I came back, realized I left ...
- 1,796
42
votes
1
answer
19k
views
How does the attacker know what algorithm and salt to use in a dictionary attack?
I am curious about password cracking methods like dictionary and brute force attacks. Nowadays passwords are stored as hashes and not plaintext on the server. Then how can the plaintext passwords in ...
- 598
41
votes
7
answers
111k
views
Somebody hacked my router and changed my wifi SSID
One of my neighbours hacked the password of my router and he uses my limited internet package. I change the wifi SSID almost daily, but he can hack it easily.
Today, he changed the SSID to a hate ...
- 539
41
votes
14
answers
19k
views
How can I make a strong password that's easy to remember? Is the 4 Word method safe? [duplicate]
I have heard of the method of using 4 random dictionary words, it gives you lots of characters and is easy to remember.
But that seems to be open to dictionary attacks, especially if the attacker has ...
- 569
37
votes
12
answers
11k
views
Is it acceptable practice to only increment a number when changing a password?
Note: I'm not asking about this password scheme is the best or not (of course it isn't); I'm asking about its theoretical or practical secureness relative to the optimal password scheme based on the ...
- 623
37
votes
5
answers
11k
views
How can I prove this site has a huge security weakness?
Disclaimer: I'm a computer programmer, not a security analyst or anything to do with security. I have zero experience in the world of cryptography, so bear with me please.
Situation: I was given the ...
- 489
35
votes
2
answers
43k
views
Why are GPUs so good at cracking passwords?
What is it about GPUs that lets them crack passwords so quickly?
It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
- 455
34
votes
5
answers
7k
views
Does it matter if a brute force search for a password returns a collision and not the password?
Assume the following very basic hashing algorithm.
h(k) = k mod 17
Let's say we create a password 12345 for a website that uses this very basic hashing algorithm. That would yield the hash of 3.
...
- 2,331
30
votes
6
answers
6k
views
The most secure way to handle someone forgetting to verify their account?
Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account.
Suppose they forget to verify it, and later try to login.
Should the error ...
- 581
30
votes
9
answers
7k
views
What considerations do I need to keep in mind when enforcing passphrases?
According to XKCD: Password Strength, if the password consists of “four random common words”, it will be secure and memorable.
I want to make a web application and make users create their passwords ...
30
votes
5
answers
2k
views
Would turning a Diceware phrase into a sentence decrease its security?
Diceware passphrase lengths are on the rise - up to six or seven words now. The old adage that passphrases are easier to remember may be true for shorter phrases, but six truly random words can be ...
- 443
29
votes
4
answers
12k
views
Is randomly generating passwords from an assortment of dictionary words cryptographically secure? [duplicate]
We should all know the XKCD comic on password strength, suggesting (appropriately) that a password based on multiple common words is more secure and memorable than a password such as Aw3s0m3s4u(3 or ...
- 490
28
votes
12
answers
17k
views
Reusing passwords that can possibly never be cracked
Reusing passwords pose as a terrible risk for users because in the event of a data breach, with the passwords not being stored securely enough, this means that, by default, all other services that ...
user173331
28
votes
4
answers
9k
views
When passwords of a website leak, are all leaked passwords equally easy to read?
As far as I know, when passwords from a website leak, they leak in an encrypted form. Are all those passwords equally easy to decrypt? My hunch is that a 10-character-long password maybe gets ...
- 399
28
votes
2
answers
4k
views
Is it possible for my password to have more than one password combination?
Can my password have more than one password combination?
I read up on physical combination locks (the lock you open with numbers) and I learned that a combination lock can have more than one ...
- 2,127
27
votes
4
answers
7k
views
Does putting salt first make it easier for attacker to bruteforce the hash?
Many recommendations for storing passwords recommend hash(salt + password) rather than hash(password + salt).
Doesn't putting the salt first make it much faster for the attacker to bruteforce the ...
user123540
27
votes
3
answers
7k
views
How bad would a partial hash leak be, realistically?
Even though the current recommendation for storing passwords is the usage of a slow key derivation function such as Argon2, scrypt, PBKDF2 or bcrypt1, many websites still use the traditional hash(...
user163495
26
votes
4
answers
12k
views
Cracking double encrypted router password?
I noticed in the html of my router this parameter:
form.addParameter('Password', base64encode(SHA256(Password.value)));
So when I type in the password passw I get this via sslstrip:
2018-09-25 21:...
user187425
25
votes
4
answers
6k
views
Does a password policy with a restriction of repeated characters increase security?
A security value called Restriction of Repeated Characters for Passwords (QPWDLMTREP) can be configured in IBM i. If QPWDLMTREP has a value of 1, then "the same character cannot be used more than ...
- 369
25
votes
7
answers
7k
views
Source code as password
Passwords with a mixture of letters, numbers, and special characters are sometimes hard to remember. Is it secure to instead use a small amount of memorable source code as a 'passphrase'?
As an ...
- 745
25
votes
2
answers
18k
views
How does WiFi password cracking work?
Let's say I have a wireless network that is password protected.
What procedures can an intruder take to gain access to my wireless network, or at least be able to decipher the packets I am sending ...
- 1,134
24
votes
8
answers
7k
views
Is there a way to make a WEP-secured AP uncrackable?
For some days, I was feeling that my Internet bill was booming. Then, I recently found out that a boy near my house was accessing my router to use the Internet. Then, I read some articles how to crack ...
- 501
23
votes
1
answer
56k
views
John the ripper does not crack password
I'd like to attack a self-created sha256 hash with john --wordlist=
So far I've done the following:
$ echo 'testpassword' | sha256sum > mypassword
removed the tail of the output with vim
$ cat ...
- 333
22
votes
4
answers
9k
views
Does password length / complexity make any difference if hashes are leaked?
Password length/complexity only mitigates a brute force attack, correct? In the event of a hash leak, since any algorithm is a fixed length, there could potentially be a pre-image* with a very short / ...
- 323
21
votes
5
answers
8k
views
Would allowing shorter passwords sometimes be more secure?
Does the act of requiring certain criteria for passwords make them easier to brute-force?
It's always seemed to me that when websites limit the use of "insecure" passwords, it might make it easier ...
- 313
21
votes
2
answers
4k
views
Store Credit Card Information in Password Manager?
For convenience purposes I manage my passwords with the password manager Bitwarden on my personal computer and smartphone with autofill function (but with asking for the master password or fingerprint ...
- 385
20
votes
5
answers
29k
views
How to crack a password given its hash and its salt using a more efficient method than brute force?
I have been able to crack passwords, given their salts and their hashes, by using brute force.
In the first place, the length of passwords was 3 and the salt length 2:
e.g., hash: rrVo/xC.s5/hQ, ...
- 309
20
votes
2
answers
6k
views
Shouldn’t patterns be just as secure as PINs?
I’ve seen multiple sources online that say that unlock patterns are less safe than ‘random’ PINs.
I was thinking; how come?
From what I see, they would both be just as secure; you chose different ...
- 303
20
votes
6
answers
3k
views
Correct terminology when describing password security to layman
I am writing a page for our website which describes the measures we take to keep our customer's information secure. On this page one section describes how we keep their passwords secure.
We are ...
- 311
19
votes
5
answers
8k
views
Someone is trying to access my mail account, what safe actions can I take?
Intro
I have a free mail account on this (german) website. If I type my password wrong I get, once successfully logged in, a message telling me about my failed log-in attempt.
Problem
Recently I ...
- 301
18
votes
3
answers
5k
views
Does revealing part of your hash give an attacker advantage when attacking your password? [duplicate]
This question was prompted by a recent visit to a certain site that provides (apparently for GDPR reasons) a table with all of your data, including part of your hashed password. I understand this ...
- 191
17
votes
10
answers
15k
views
Crack hashed passwords using a known password
I'm a dev trying to deploy a new dashboard I've written at work, the old one is a mess of hacked together libraries and only about half of the codebase is still even in use (dead code everywhere that ...
- 341
17
votes
1
answer
8k
views
John the ripper password cracked or not?
I have the shadow file from an embedded device running linux. Trying to use John to crack it. There is only the 'root' hash in the shadow file.
12 seconds in, John finds the password for 'root', but ...
- 171
16
votes
4
answers
8k
views
Can 777-characters long passphrase be considered too short?
Is Rumkin.com's password tool a reliable tool for password strength checking?
I am asking because:
I am getting confusing suggestions:
(the password in this example is 777 characters long)
D. W.'s ...
- 3,619