Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
3,468
questions
-1
votes
0answers
6 views
0
votes
1answer
59 views
BCrypt vs PBKDF2-SHA256
I read that LastPass uses PBKDF2-SHA256 for storing the Master Password hash, I wonder how this compares to BCrypt and why did they chose this, as SHA256 is a quick hash (probably compensated by PKDF2?...
0
votes
0answers
6 views
Is there a consolidated list of HTML attributes and classes that affect user agent password management? [migrated]
I'm looking for a list of best practices, or just a list of HTML Classes and other identifiers that cause a user agent, or user agent surrogate to invoke custom password handling features.
E.g.
...
0
votes
0answers
28 views
how to create a wordlist contains first 4 letters are alphabets and next 4 letters numbers [closed]
how to create a wordlist contains first 4 are letters alphabets and next 4 letters numbers.
Ex: AAAA0000 - ZZZZ9999
0
votes
1answer
92 views
How does winrar know I typed the right key?
As far as I know WinRar uses the password you type and derives the key from it. But how exactly does it check if the key I typed is correct? What I think is that it compares your guess with the right ...
1
vote
1answer
70 views
How can one mitigate both account-level DOS attacks and online brute force attacks at the same time?
I was recently reading this question, where the accepted answer claims that it is easy for attackers to bypass rate limiting that is based on IP, which makes any sort of IP rate limiting to prevent a ...
1
vote
1answer
93 views
A proposal for effortless two-factor authentication
I have an idea for device-level two-factor authentication that involves no direct input from the user, and I wanted to find out if something like it has been tried before.
Let's say I have an account ...
0
votes
1answer
68 views
Writing a Simple SHA256 Salted Hash Generator
I saw a video detailing how to write a simple salted hash program in C# here. Below is the code they wrote (slightly edited for console applications):
using System;
using System.Text;
using System....
0
votes
0answers
37 views
How does Android know my password contains only numbers? [migrated]
My Android phone's unlock type is set to a password, but it only contains numbers for fast unlocking. (I'm well aware that a PIN is an option, but this way presents more possibilities to an attacker.) ...
1
vote
1answer
200 views
Oversalting Potentially Harmful?
I find it hard to believe, and figure I just missed or forgot something obvious (years since I thought about this stuff), so maybe someone can point it out. But it seems like most of what I know about ...
0
votes
0answers
49 views
Firefox: What would be more secure/private: storing session cookies or saving password in the browser?
I am wondering, assuming the latest version of Firefox, which of the following options would be more preferable security-wise (e.g. assess and/or password to user account will be stolen) and which one ...
1
vote
0answers
46 views
John the Ripper doesn't crack passwords when I use wordlists
Title says it all, I can't tell if John is just crashing or "gives up" on cracking the hash. First I start off by creating an md5 hash out of a word I KNOW is on the rockyou.txt wordlist:
echo -n '...
2
votes
1answer
92 views
Is logging number of special characters in password a bad idea?
Recently I started new work, and going through documentation and code to understand what company is doing. While doing that, I noticed there is logged number of special characters in his password.
...
0
votes
0answers
30 views
Doesn't installing a TOTP client on your primary PC undermine the whole point of 2FA? [duplicate]
Authy is a popular cross-platform TOTP application that supports syncing keys across devices. I have been a little confused by the idea of having a desktop client... This way if someone accesses my ...
-1
votes
2answers
93 views
Recommending diceware upon user registration
The Diceware method of password generation is simple, secure and easy to use
When registering an account on a website
Why do websites not suggest to their users to use the diceware method?
Why do ...
2
votes
1answer
265 views
Security of PIN that spells out words?
Description
PayPal suggests that generating a PIN by spelling words (on a numeric pad, e.g., [ABC] = 2) is a good method for security and memorability, e.g., B-L-U-E-C-O-W = 2583269.
My knowledge ...
0
votes
0answers
16 views
Does hashing client-side increase security when dealing with an untrustworthy server? [duplicate]
Does hashing once on clientside and once on server-side increase security when dealing with an untrustworthy server?
For example when dealing with open source projects where users can self-host their ...
1
vote
1answer
53 views
Is using numeric passwords on Macs reasonable for average users?
Is using a numeric password (similar to a PIN code on a phone) on Macs reasonable for regular users, considering they are the norm for passcodes on iOS devices?
Traditionally user accounts on Macs ...
0
votes
2answers
62 views
Why hash on server instead of client? [duplicate]
Please hear me out. I used to scoff at people who asked this question because client-side hashing is "so obviously wrong." I have read similar questions on this site but haven't found a satisfactory ...
1
vote
0answers
63 views
Got a failed log-in attempt message. Is it possible someone tried to enter my PC remotely?
A while ago my PC kind of got frozen. The mouse was moving but I couldn't open other windows and I couldn't open the task manager pressing ctrl-shift-Esc. After a couple of minutes I just pressed the ...
0
votes
0answers
60 views
Why people buy stolen databases with emails and hashed passwords of users? [duplicate]
I see every now and then how hackers stole DB with emails and hashed passwords of millions of users from popular websites and sell it on the black market.
I assume that passwords were hashed with ...
1
vote
1answer
70 views
PDF User Password always give access to the Owner Password, even when encrypted with AES-128
I've been messing around with qpdf, and noticed something that seems huge: that a document's Owner Password is essentially useless, as it can be easily unset, and therefore that only the User Password ...
2
votes
2answers
125 views
How to improve security of a stored password?
Our application needs to store a password in a database. It‘s not possible to store a hash because the password is needed to access other data that are protected by this password.
Currently, the ...
0
votes
0answers
67 views
Should I change my password if I googled it by mistake? [duplicate]
Related to this question, should I change my password if a password manager (keepass) mistakenly entered my user credentials in my search bar? What could happen if Google knows this? What about other ...
29
votes
7answers
7k views
If you mistakenly try to access a website with an unrelated username/password, do they record your logon data? [duplicate]
I use KeePass with auto-type, and once in awhile (when tired, etc.) I'll accidentally launch a similarly-named entry's URL and try to logon with the wrong U/P. This question is unrelated to KeePass ...
0
votes
1answer
56 views
How to determine the type [duplicate]
Today I discover a encryption method
Which
0 = 35
1 = 34
2 = 37
3 = 36
4 = 31
5 = 30
6 = 33
7 = 32
8 = 3d
9 = 3c
It's the encode of number 1 to 0 for the method
Can you please help me to ...
0
votes
1answer
110 views
What happens if your Skype gets hacked? [closed]
Say that, although you did take into account all the security advices, your account ends up being hacked.
Then what happens?
Can they "jump" from Skype to the whole device?
To steal my contacts, ...
0
votes
1answer
121 views
How does the Windows 10 picture password work?
I have been researching on how Windows 10 built their picture password, but there is not much content online.
Can anyone here help explain how the picture authentication system in windows 10 works?
2
votes
1answer
185 views
Typed password in the username text box but didn't hit enter. Should I still change the password?
I know that if I type a password in the username text box and hit enter it is better to change the password just in case. But is it still risky to have written it in the box (with no one watching) ...
0
votes
0answers
25 views
I've been an emailed a password; how can I proceed as securely as possible? [duplicate]
I am going through the on-boarding process for a summer internship with a well-known tech/bank company. I've received mail from HR requesting me to fill out an I-9 form via the external service they ...
0
votes
0answers
45 views
Why would you restrict these characters within a password? [duplicate]
A website restricts these characters from passwords: # * ( ) %
At a casual glance, it looks like they're not sanitizing data input to the database or hashing passwords, but I'm a hobbyist.
Should I ...
0
votes
0answers
62 views
Android Encryption: Can an attacker get the master key due to Android's default password and wear-leveling?
Since Android 5.0:
Upon first boot, the device creates a randomly generated 128-bit master key and then hashes it with a default password and stored salt. The salt and the encrypted master key are ...
0
votes
1answer
100 views
Is it secure to set the encryption password the same as the root password? [duplicate]
When installing Manjaro Linux, it shows the following screen:
What's the logic behind that?
1
vote
1answer
110 views
Fully-secured screen lock in Ubuntu with encryption
I have Ubuntu 19.10 with full disk encryption. The encryption is effective as long as the system is turned off or restarted. Otherwise the data is unencrypted behind a locked screen which may not be ...
0
votes
2answers
60 views
Will extra rules to my diceware list generation scheme decrease security?
I finished reading the Code Book by Simon Singh, I'm interested in playing with some of the ideas in the book to help increase my own understanding. I don't intend to implement the following in any ...
-1
votes
1answer
59 views
Using a Pepper as the index to insert a salt
In this question on this board the author of the selected answer states the following.
If you, as an attacker, manage to extract hashes and salts from a database, you probably either find a way to ...
0
votes
2answers
94 views
2FA: Do app passwords render the second factor invalid?
I am currently in the process of employing a 2FA authentication on as many services as I can. If it is relevant for the question: I use a time-based OTP authenticator app.
When setting up, I noticed ...
0
votes
1answer
120 views
How to recover lost zip file password?
I have a folder with very important files on my computer and I zipped it with a password for security reasons. Unfortunately, I'm not able to recover the password. Usually, I always use the same kind ...
27
votes
8answers
9k views
Are there joint password accounts? (Like bank accounts)
Online joint accounts that are similar to bank accounts that are joint accounts?
Say you want to have two partners for a certain account, let's say a PayPal account, and you want to make it so that ...
3
votes
2answers
255 views
Creating a Password Policy for a Bank Corporation, what must one take into consideration?
When creating a Security Policy such as Password Policy, what are some of the typical assets that need to be protected?
And how does this affect, employees, contractors, vendors, suppliers, and ...
-3
votes
1answer
135 views
Bruteforcing a Wi-FI password [closed]
Is it possible to brute-force a WiFi password, since technically there are no limits with login attempts?
If there is any, the MAC address of the attacker device can be changed.
51
votes
12answers
16k views
Is it bad to use special characters in passwords? [duplicate]
I'm trying to find the best degree of entropy for a password template, and after carrying out several tests, the best result came from this: à.
This symbol alone adds 160 characters to the set (...
6
votes
1answer
212 views
Functional Google 2FA code (via SMS) received from a random (but in use) mobile phone number
tl;dr for those who are misunderstanding my post: imagine your friend who uses GMail suddenly tells you they have 2FA enabled, and logged in to their account, and that the 2FA code (SMS) they received ...
-1
votes
1answer
91 views
How to run .exe on windows startup without having admin access? [closed]
I want to know how to bypass the requirement of an admin user in order to have a program run upon windows startup.
1
vote
1answer
60 views
Secure Windows 10 Home admin's data behind a password, even when user apps are running
Windows 10 Home's default account lock system for the admin account is not completely secure because there are multiple free password recovery tools & ways available that can be used by a non-...
0
votes
2answers
106 views
Preventing Users from Using QR Code Password and Scanner for Authentication [duplicate]
A user was discovered using a QR code to log into a PC. Apparently, the password was put into a QR code generator and printed. The user:
Provides their username
Scans the QR code with a handheld ...
0
votes
2answers
122 views
What's the safest password type? [closed]
I've used Dashline (password manager) with random generated passwords, but I forgot the master password and there is no way to get it back. I read that password managers and random generated passwords ...
5
votes
6answers
247 views
Why use any other password generation method when Diceware/EFF dictionary exists?
Recently I discovered method of generating passwords with Diceware/EFF dictionary.
Look at my example, passphrase vs randomly generated password:
rockstar reword gamma banker unwarlike (64,6 bits ...
2
votes
0answers
60 views
If the given key of a Vigenère Cipher has repeated letters, does it make it any easier to break?
I am studying the Vigenère Cipher that given a passphrase uses rotating Caeser Ciphers to encode the plaintext. The ‘classical’ attacks on Vigenère first deduce the length of the passphrase by ...
1
vote
1answer
250 views
Do I need fail2ban if I have a strong password?
Is there any advantage to me installing fail2ban on my VPS web server? As far as I understood, fail2ban's only purpose is to stop bruteforce and dictionary attacks by preventing consecutive password ...
