Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
3,310
questions
13
votes
2answers
1k views
Why does Windows store Wi-Fi passwords in a reversable format?
Running
netsh wlan export profile key=clear
in PowerShell will dump your current stored Wi-Fi settings, including the password, into xml files inside of whatever directory you are currently in.
Why ...
0
votes
0answers
67 views
how to make a password list like the icloud keychain using crunch
I changed today the admin password of my server. To make the password difficult I used the password generator of my iPhone (icloud keychain), but now I can't log in. Have no idea what happend and I ...
-1
votes
0answers
38 views
Password using same hash value [on hold]
In a application, there is using of same hash value,suppose ssl will implement how its surity that password will using salted hash value after this
13
votes
5answers
7k views
Defense against attacks using dictionaries
Some forms of attacks on passwords use dictionaries. It is safer to use nonsense passwords like YunSUanLin, Artibichoke, etc., which do not seem to pertain to any dictionary?
27
votes
2answers
4k views
How to avoid using System.String with Rfc2898DeriveBytes in C#
I am creating a .NET core webapp in C# that takes in a user password and hashes it to be stored on a server. I'm using Rfc2898DeriveBytes along with a randomly generated salt. I've read, however, that ...
0
votes
1answer
65 views
Disconnected wireless router security
I've changed ISP and am using their router. I wish to donate my old NETGEAR router still with its original Network Key (password). Would someone obtaining this router somehow get access to my ...
3
votes
1answer
242 views
How secure is KeePass KDBX4 by default?
How secure is KeePass KDBX4 by default if someone obtain the .kdbx file and attempt to brute-force it without knowing any hint of the master password?
With assumption :
The password length is equal/...
7
votes
3answers
412 views
How long should zip encryption password be for it take 10 years to crack?
I am using zip 3.0.0 on macOS High Sierra and Debian. Here is my zip version on macOS:
$ zip --version | head
Copyright (c) 1990-2008 Info-ZIP - Type 'zip "-L"' for software license.
This is Zip 3.0 (...
2
votes
7answers
177 views
How can I encrypt a password for storage without having to remember another password?
I've recently started using a password manager (1Password). I have a really good master password (using diceware) but I'm worried that if I forget it then I can't access 1P and all my passwords.
One ...
243
votes
2answers
39k views
Can ads on a page read my password?
Disclaimer: I have minimal web-dev/security knowledge so please answer as if talking to a "layman."
I've heard that web-advertisements need to be able to run their own JavaScript so that they can ...
88
votes
4answers
18k views
Does the length of a password for Wi-Fi affect speed?
I work at a place that gives Wi-Fi to all the customers, with a password that is 19 characters long. A customer came in and claimed that because the password is long, it slows down the internet speed. ...
0
votes
5answers
308 views
How do keyloggers tell it's a password? (And how to fool them.)
This question also applies to clipboard monitoring.
Imagine you are planning to deploy 100,000 copies of a Windows trojan with keylogger functionality. (For the record, I'm not talking about myself ...
2
votes
3answers
149 views
Password reset vs change
My webapp has "password reset" and "password change" functionality.
Password "reset" is typical: user clicks "I forgot my password", enters his email, one-time link emailed there, he visits a form to ...
2
votes
1answer
98 views
Is it safe to use Redis to store username and hashed passwords? [closed]
We are taking a look at using Redis for a Cache Aside pattern, and I am thinking, is it safe to store username and hashed passwords in Redis Cache? If yes, are there security issues with having a key ...
0
votes
1answer
53 views
Passing user ID as parameter without any authentication, what are the security risks?
I've read that passing GUID as URL parameter isn't considered insecure because usually, an app has an authentication mechanism (checking against some session token).
However, how secure would an ...
2
votes
1answer
97 views
Is getpass.io secret-based artwork a threat?
When typing a secret keyword into Getpass, a little jdenticon is showing on the right, based on the secret that was entered. The FAQ on Getpass states the following about it :
Did you notice that ...
1
vote
0answers
66 views
Does kerberos support a grace period in password changes?
The principles are programs instead of human. I want to rotate their password regularly, using random generated password, and then deliver the new password to the programs. I have a mechanism to make ...
47
votes
6answers
11k views
What are the cons of stateless password generators?
Does anybody have hands-on experience with stateless password generators (managers) like Getpass?
It seems like it does most of the work of cloud password managers, but leans more to the security ...
0
votes
1answer
88 views
Security of adding letter in front of passphrase [duplicate]
I am wondering about the security of adding a letter in front of a long passphrase to help me have different passphrases for each site I use while not requiring me to remember several different N word ...
0
votes
0answers
19 views
60 character hex encrypted value with 32 character hex seed [duplicate]
Attempting to recover lost admin passwords from an old industrial control system database. We believe these have been encrypted rather than hashed (at least we know password version 0 for this system ...
62
votes
6answers
10k views
Is there a reason why I should not use the HaveIBeenPwned API to warn users about exposed passwords?
There's lots of talk about the HaveIBeenPwned password checker which can securely tell users if their password appears in one of their known data dumps of passwords.
This tool has a publically ...
1
vote
0answers
16 views
Security of Passwords vs Biometrics [duplicate]
Would a password with multi factor authentication be more secure than biometrics? I am asking due to the fact that if biometric data gets compromised, there is no way to change it, and in data ...
2
votes
2answers
83 views
How to properly create a password reset token?
I searched for a long time, and never really find any articles or posts that fully explain how a password reset token should be created.
What I know so far:
It should be random.
Its hash should be ...
2
votes
1answer
94 views
Is there a password based challenge response authentication scheme with public key cryptography?
I was thinking about an authentication where
the user only has to know a password
but no salt, everything else the client retrieves from the server
yet a user's password can't be retrieved from the ...
0
votes
3answers
106 views
Is it safe to protect the write permission only with a publicly accessible hashed password?
A user stores a raw information (a comment on a website, a like on a post etc.) in a database. He pairs it with a hashed password and keep the original password safely for him/herself. This password ...
0
votes
1answer
125 views
Is a thousand character password worth the security on my personal accounts? [duplicate]
As for now:
don't care about user experience, meaning that time spent reading, typing, memorizing password.
not thinking about quantum computing attacks.
8 characters good, 24 characters better, ...
1
vote
3answers
199 views
Why do web browsers provide websites with plain text passwords? [duplicate]
Suppose I sign up for website.com with username "John" and password "Secret".
Currently the webbrowser supplies website.com with my real plain text password, and we must trust them to salt and hash ...
13
votes
2answers
2k views
Generating a PIN from cryptographic bytes
One of our applications uses SQL Server for the back end, and that application requires a 4 digit numerical PIN for employees to be created that works with a key (more or less). The system itself ...
1
vote
1answer
144 views
When signing up a new user, is there a way to secure the password using jQuery/PHP?
I'm of the opinion that HTTPS is sufficient for securing passwords from would-be MITM (man-in-the-middle) attacks, but I'm curious to know if there's anything else I should be doing.
During signup, ...
0
votes
0answers
70 views
Is it safe to send an unencrypted password through https? [duplicate]
There's an endpoint that receives an e-mail and password and creates a user account in an external system. To access that endpoint, one must be logged in to our system as it's the only way for that ...
2
votes
3answers
116 views
Is it safe to store my login credentials in a Veracrypt volume?
I have a list of login credentials (usernames and passwords) that I wanna keep safe. I'm planning to keep it in an encrypted Veracrypt virtual drive with AES, SHA-512, and an 8-character password. Is ...
3
votes
3answers
272 views
Should a password generator validate its output against a dictionary?
If I were to design a password generator, is it best to leave it truly random or validate its output to avoid certain passwords?
For example if my password generator was truly random, it's possible ...
-5
votes
1answer
143 views
Has Wi-Fi hacking gotten almost impossible?
I have read about Wi-Fi password cracking for a while and used different tools my self, such as:
Airodump for monitoring
Aicrack for getting key from cap files for WEP/WPA/WPA2
Reaver for WPS
Bully ...
0
votes
1answer
95 views
Lost RAR password, is there any way to access my data? [closed]
I lost my winrar password of my file. I need to access it. Is it possible? If yes, how?
4
votes
1answer
133 views
BIOS Password vs. BitLocker Pre-boot PIN
I'm attempting to ensure maximum security for my PC. I'm running Windows 10 Pro on a business-class HP notebook.
Unless I'm mistaken, I understand that both a BIOS password and the BitLocker pre-boot ...
1
vote
2answers
84 views
Password policies and keyspace question
After reading several answers to Are randomly-generated passwords starting with "a" less secure?
and the link to JtR keyspace topic, I had a thought/question.
Even though most PW policies ...
1
vote
1answer
95 views
Is it safe to use 2 password derivation functions to one password?
The example I'm working on is this:
i store the user password using Argon2 in my database
and then use PBKDF2 to derive an AES key from the user password , and store only the salt used in PBKDF2, i ...
1
vote
0answers
70 views
Implementing an anonymous, password-less login model
I would like to implement a password-less login for a mobile application (discussion board/social media).
The data contains non-critical social media content (usernames, posts, replies, photos).
The ...
1
vote
1answer
78 views
Is password generation adherent to a primitive pattern insecure?
A certain website I use has a section the password to which is e-mailed to you. I'm not involved with administrating it, but I've been able to discern the algorithm used for password creation. It uses ...
55
votes
9answers
13k views
Are randomly-generated passwords starting with “a” less secure?
I generated a password recently for a new account and the first three characters were "aa1".
After exhausting all other attacks, a cracker would start brute forcing. On the assumption they'd start ...
0
votes
1answer
68 views
Does it increase security to hash a SHA1 hash with a common salt with SHA256 with individual salt [duplicate]
I tried to find a similar question but I did not find a question describing my exact scenario and I am still puzzled if the following actually makes an application more secure.
I have legacy ...
0
votes
0answers
124 views
How strong do linux user account passwords have to be when using Full Disk Encryption (FDE) too?
Suppose a non-root user was compromised over remote by malware that is now using su (tty or similar) trying to login as root, trying every possible password by bruteforcing.
assume: full disk ...
1
vote
1answer
90 views
Diagram of personal information security vulnerability?
Is there a standard diagram format or language for illustrating a security model and what information is needed to access specific accounts? Something like UML for passwords and 2FA?
I was recently ...
1
vote
1answer
103 views
Do non-administrator Windows accounts need strong passwords?
I have always used long passphrases for my own Windows user accounts. But I know some people who use moderately common passwords (we'll say they're in the top 1,000 most used passwords, but not in the ...
2
votes
0answers
67 views
Add additional rounds on existing SHA-512 salted hashes without knowing clear text password?
Assuming you have a salted SHA-512 password hash with 5000 rounds. For example:
{CRYPT}$6$rounds=5000$6835c5dcf0bb7310$hVod/jy7uONMSa.FVpLHb/2OrWpAj3lB/....
1
vote
1answer
65 views
Banking app logon - multiple fingerprints on a device vs 2 passwords known by 1 person
Yesterday I logged on to my banking app via my iPhone. The normal procedure was to enter information that consisted of:
The answer to a security question. This had to be entered in full and was the ...
0
votes
0answers
41 views
Gmail's MFA for team?
We have mailboxes on G-Suite from Goole.
Currently, we are enabling MFA for all boxes in our team, but what boxes which are used by different people?
For now, I found a few solutions, each with its ...
4
votes
1answer
245 views
How were nuclear launch codes authenticated?
What is the history of authenticating nuclear launch codes? Were hashes used for verification? How would a nuclear launch base be able to verify that the code is correct, and how were new codes ...
37
votes
8answers
15k views
Isn't “Dave's protocol” good if only the database, and not the code, is leaked?
I've read "Is my developer's home-brew password security right or wrong, and why?", but there's still a question in my mind:
Even if someone uses a bad, home-brewed security algorithm just like Dave, ...
1
vote
1answer
181 views
What's the risk if I accidently type my password into a username field in a website? [duplicate]
On websites that separate the screens where username and password are entered, such as GMail, it is possible that the users type the password in the username field because the username is sometimes ...
