Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
0
votes
0answers
8 views
Save password on user-side for autologin
If a user wants to login to a system/server, it's recommended to have the hashed&salted password saved in a database, along with its salt.
So the user wants to login, types in the password, ...
0
votes
1answer
52 views
Remember Me vs Remember Email
From what I have noticed, there is very few services that offer the Remember Email over Remember Me or Sign-in Automatically.
These options really do make the life easier for the end-user of ...
1
vote
3answers
65 views
Storing Old Password History and Information
Google, Facebook, Twitter, and several other services still knows the older passwords which we used on our accounts. At times, I can not reuse the same password as I have. Then with Google, if I type ...
1
vote
0answers
21 views
Method to integrate Touch ID in iOS apps
With the recent announcement of Touch ID APIs for third party apps, I am wondering how can we leverage this feature to perform secure transaction ? I am looking for a method to use Touch ID in my ...
0
votes
1answer
22 views
Do dictionary attacks only use specific entries from a dictionary, or combinations of an entry?
If I wanted to crack a password, "cba", but the dictionary I was using only had abc in it, does a dictionary attack try all combinations of abc? abc, acb, bca, bac, cba, cab
Or would cba have to be ...
2
votes
4answers
114 views
password generating algorithm
I read the question about the relevancy of the xkcd password creation algorithm.
Would it be more secure if you used a string of common words with a function that only you knew that would rearrange ...
87
votes
9answers
12k views
Is “the oft-cited XKCD scheme […] no longer good advice”?
I was stumbling around and happened onto this essay by Bruce Schneier claiming that the XKCD password scheme was effectively dead.
Modern password crackers combine different words from their ...
-1
votes
4answers
118 views
What if I develop my own hash algorithm to create strong passwords from easy ones?
I came up with this idea but I cant figure out if it's good or bad, maybe you can help. My goal is: I want to create extremely strong passwords for my main accounts (gmail, skype and so on). I want to ...
42
votes
9answers
4k views
Generic error message for wrong password or username - is this really helpful?
It is really common (and I would say it is some kind of security basic) to not show on the login page if the username or the password was wrong when a user tries to log in.
One should show a generic ...
2
votes
1answer
67 views
How could someone change a root password without modifying `chage -l root` date?
How could someone change the root password without changing chage -l root Last password change date? I know it was changed because it does not match the value in Keepass. I noticed when I tried to use ...
2
votes
2answers
68 views
Password reset system code system vs long hash
I'm building a password reset system at the moment and I've come across a dilema.
Currently we have a system which creates a long md5 has (16 characters) and emails a link to a customer which they ...
1
vote
3answers
61 views
Client-side hashing of password before sending it from login form [duplicate]
I have just realized, that my web application is sending unencrypted passwords from login form. It's just like that -- I've analysed, that string sent by user from login form is hashed with MD5 (which ...
3
votes
3answers
600 views
Is this a secure way of storing passwords? [duplicate]
So a couple years ago when I was learning basic back-end web development, I found a tutorial for creating a basic log in system. I haven't done much modification to the code since, but I have the ...
-1
votes
2answers
71 views
How does salting increase security? [duplicate]
I'm currently going through a course on software security. I've recently been introduced to the idea of password salting, where a random value is concatenated to a password prior to being hashed and ...
1
vote
4answers
120 views
Password protect an excel file for a period of time?
I'm trying to find a way to password protect an Excel file (.xlsm) beyond the built-in password encryption options.
Ideally:
Enter the password
File works for a week(/other period of time)
After a ...
1
vote
2answers
86 views
What happens after setting up HDD password?
I am wondering what happens when I set HDD password in my laptop (Samsung with ssd).
I mean a given case.
I have been having working system without any password. Then one day I decide to set up HDD ...
1
vote
1answer
74 views
how to rememeber passwords securely?
Imagine you have a private RSA-key on your computer encrypted (through PBKDF2, AES-CTR, HMAC256) with a password, now if the user would like to tick "Remember Password", what is the most secure way to ...
8
votes
4answers
1k views
Are efforts being made to bring about password standards?
Rather than adopting a universal standard, many websites develop their own guidelines for how passwords should be constructed.
When you consider the number of passwords the average person today has ...
30
votes
5answers
6k views
Why are brute-force password-cracking attacks not automatically detected and thwarted?
Why doesn't software automatically detect password-cracking attacks, and thwart them?
Long version:
Suppose that someone tries a brute-force password-cracking attack on some program XYZ that ...
1
vote
3answers
60 views
How to limit the need to type a long master passphrase to only once per login session?
I want to set up a password management system on a home machine running Debian, and for this I'm considering only non-proprietary, open source password-managers available through Debian1.
I'd like to ...
2
votes
1answer
55 views
Credential In Windows [closed]
How can I view the Credentials stored in Windows?
Is there any possible way to view the stored password?
I can just export them..
10
votes
4answers
2k views
Authenticating without a database
I've been inspired by a question over on Code Review, which boils down to: What is the proper way to authenticate a user without a database?
Would it be the exact same process if you stored ...
1
vote
0answers
31 views
How to add user entries with password field in LDAP over HTTPS
I am new to this kind of stuff (HTTPS etc.) and pretty much confused on how to go ahead with this.
An LDAP server (ApacheDS) at the back-end stores the user details. To add new users, the user ...
20
votes
5answers
3k views
Password strength and banks 4 pin code?
Why is it that some security advisers recommend using an 8 character password with upper, lower, digits, and symbols while banks only use a 4 digit number pin for debit and 3 digit pin for credit ...
1
vote
2answers
147 views
In what situations can a hacker try to break passwords millions of times? [duplicate]
I keep reading about situations where a hacker could "easily" brute force a password (most recent example) but I'm confused about when some has an opportunity to do this kind of thing. If it is a ...
1
vote
2answers
79 views
VPN over HTTPs for a web service only
I have a web service (PHP & MySQL on Ubuntu 12.04) running in a corporate intranet. I have also connected it to internet through a firewall letting incoming connections on HTTPs only (port 443). ...
10
votes
7answers
670 views
Aren't password managers still incredibly risky?
I understand the utility in having one application remember a bunch of long, randomized passwords, but all you'd need is one well-placed phishing scam or a keylogger and they get all the keys to the ...
1
vote
1answer
111 views
Cracking MD5 passwords with the same salt
How long would it take to crack passwords up to 10 letters long if you knew the hashes were MD5 with a salt (that you know)?
0
votes
1answer
130 views
Did somebody connect to my facebook account?
I have a problem. I'm not sure, but I think that somebody (in our home network) found out a password to my Facebook account and sometimes logs in. Is there a way to find out whether it is true?
There ...
2
votes
2answers
104 views
Breach informing
I am a staff member of a large fanfic site, but not the head administrator with control over the site itself.
Recently, we had a security breach and the databases were copied, which included the ...
2
votes
3answers
181 views
How to store passwords securely in my server?
Disclaimer: I know I should use bcrypt to securely store user's passwords. Please, keep reading.
I want to store credentials for several email services for each user. So if I log in with my username ...
4
votes
3answers
118 views
Is it good practice to SHA512 passwords prior to passing them to bcrypt?
I want to allow any-sized passwords to be allowed to be submitted. I currently use bcrypt as a key derivation function for passwords, however I have realized that it has a maximum input length of 72.
...
9
votes
3answers
4k views
How often do two users use the same password
If no two users use the same password, then in theory salting the password hash is not needed. How often, in practice, do two users have the same password?
70
votes
8answers
9k views
Convincing my manager to use salts
My manager says we don't need to salt our passwords because people are not likely to use the same password because they all have different native languages, in addition to the websites they are active ...
0
votes
2answers
203 views
Storing multiple hashes to prevent collisions, security risk?
This is all just for curiosity's sake, so discussion on which hashing algorithm is harder/better/faster/stronger is irrelevant. But my question/thought is this..
With regards to password storage, and ...
1
vote
1answer
113 views
Theoretical home grown password options, or what is it that SCrypt, BCrypt, PBKDF2 does that is so special?
I'm developing a personal web framework, nothing internetty, and probably not even anything that will ever go on my personal LAN. And looking for password advice people seem to only recommend those ...
41
votes
5answers
4k views
Is it safe to tell your users what kind of hashing algorithm you use?
For example, on the user registration page, is it safe to tell people "Your password will be stored as a one-way hash using the (whatever) algorithm."
1
vote
2answers
70 views
In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?
I asked this question first on Stack Overflow but it was suggested that Information Security would be a better place for it (pretty obvious in hindsight).
...
-1
votes
0answers
16 views
Is salted MD5 secure if you force the password to be long? [duplicate]
Let's say the minimum password length is 12, under salted MD5. Is this considered secure?
-1
votes
4answers
66 views
Is salted MD5 or salted SHA considered secure?
Is using something like bcrypt or scrypt necessary? The hashes are so much longer to store in a database. Can one get away with using salted MD5 or SHA and still be secure?
0
votes
2answers
58 views
In addition to using strong hash algorithms, what is a good “password requirement”? [duplicate]
Assuming the use of bcrypt/scrypt:
Would it be a good idea to "require" a password of at least 12 characters, also mentioning the possibility of using long passphrases, instead of your typical ...
2
votes
2answers
260 views
Is upgrading key-stretching algorithms and/or repetitions a thing?
Consider back in the 90s you're ahead of the curve, you hashed and salted your passwords with SHA, and you're a big site, millions of accounts, etc.
Well the web evolves, and over time more advanced ...
3
votes
7answers
126 views
Is providing a website password over the phone any less secure than other identifying information?
I've been dealing with two separate banks for completing a 401k rollover (I do not have any other accounts with either of the two banks), and I've encountered something with both that I've never seen ...
1
vote
4answers
165 views
Should we rethink our entire password strategy? [closed]
Passwords get discussed a lot on this site, and there's quite a lot for both users and sites to do, to stay in line with "best practice".
Web sites need a password strength policy, account lockout ...
4
votes
2answers
55 views
Should password recommendations be different for devices, networks, and internet?
I started using a password manager last year and updated nearly all of my internet accounts to super-strong, unique passwords, and that isn't a problem, cause I only access them from web browsers or ...
1
vote
6answers
201 views
Why not use weak passwords?
In a specific situation: online stores that cannot possibly store payment details because you pay using paypal, but require registration. What reason is there to use good passwords here? Breaking ...
17
votes
4answers
3k views
Is it a security concern that a shop I registered at obviously does not encrypt my password?
I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
21
votes
3answers
4k views
Doesn't plaintextoffenders.com just provide attackers with a good list of sites to attack for passwords?
On the face of it, PTO seems like a good idea in educating people about password security.
On the other hand, if I were an attacker, PTO would be the first place I would start if I wanted to start ...
10
votes
4answers
947 views
Does the strength of password matter in bcrypt?
Even if I choose 1 character for my password or 32 characters with numbers, letters, uppercase symbols etc. the bcrypted password will still be 60 characters length password. So does the password ...
2
votes
1answer
56 views
Identical lanman hashes on AD accounts?
I ran metasploit's smart_hashdump module against my (2008r2) domain controllers, trying to find any accounts that may still have lanman hashes in place. These should have been disabled long ago. I'm ...
