Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

2
votes
1answer
56 views

Is Google's objective to kill passwords justified?

Google's Trust API has already been tested out in “several very large financial institutions” in June. It apparently uses a combination of multiple weaker indicators such as biometric indicators as ...
-3
votes
1answer
62 views

Does combining two encrypted strings secures password?

For example, a person having password 123456. it's MD5 is e10adc3949ba59abbe56e057f20f883e and SHA1 is 7c4a8d09ca3762af61e59520943dc26494f8941b and after joining both hashes. Which comes to be ...
0
votes
2answers
93 views

Why is it a problem to store strong passwords as unsalted hashes?

My users all have strong (80-bit true entropy) passwords. How do I know that? Because my imaginary website randomly generates the passwords for them (client-side). In that context, could you explain ...
1
vote
2answers
86 views

Can masked passwords on iOS UIs be read?

If someone had physical access to my iPhone, could they see the stored passwords for my WiFi or email that are represented as black circles and not actually the password itself, e.g. under my mail ...
16
votes
6answers
3k views

What extra security does a 2-step website login process with a PIN provide?

I am currently working on a web application with a significant security risk attached to its function. We're using Microsoft Identity Framework to handle user logins, with the system forcing strong ...
-1
votes
0answers
76 views

How does the following brute force password breaker work? [on hold]

def numberToBase(n, b): """ This function will convert the number n into base b and return a list containing the digits of number n in base b """ digits = [] while n > 0: ...
4
votes
1answer
117 views

Why, after a certain character limit, are larger passwords labeled as “weak” on some sites?

On many sites we see an indicator if our password is weak, or strong, to give us a good indication to go with that password, or not. I've been noticing on some sites, that after x amount of ...
0
votes
3answers
63 views

Are there any security advantages to forcing a password-character limit on reset, but allowing unlimited character in password-login?

I was resetting a password a few moments ago, and I was given a character limit of around 10 characters to make a secure password with. After resetting the password, I went to enter my password, and ...
0
votes
1answer
52 views

Do these packages indicate nefarious activities?

Being security paranoid, I could help but notice that in my autoremove list that there were two packages I did not immediately recognise and was immediately suspicious of: The first one was ...
5
votes
3answers
559 views

Is sending a password encrypted or as SHA1 any safer than clear text?

It seems to me that if an attacker can intercept my login request (sent with HTTP POST), then he can replay it later, no matter whether I try obfuscate it or not. What am I missing?
0
votes
0answers
58 views

Why can I login in my Facebook account with an email not the main one? [closed]

My Facebook account was registered with a Hotmail e-mail. My secondary e-mail is an ISP e-mail. Since I remember I never had other secondary e-mail added. However today, in my laptop, I inadvertently ...
0
votes
4answers
58 views

How are salts safe in the database? [duplicate]

I have read many and many of this type of question on the security stack community before I asked this question, but one thing that made me mad about salts and saving it in database is this ... I will ...
0
votes
1answer
51 views

Should all web applications implement a security feature that stores historical passwords? [duplicate]

In addition to Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?. Facebook, and other companies, are storing historical passwords of ...
0
votes
2answers
94 views

Store passwords as integers

I just came up with this idea that I can store passwords as integers which take up 4 or 8 bytes as opposed to a hash that takes like 150 bytes or something. I wrote this function that converts a ...
2
votes
5answers
173 views

How secure is a password protected file?

I have a password-protected excel file that stores other personal passwords. Obviously there have been a number of ways to crack the password. community.spiceworks.com Where do you guys store ...
1
vote
2answers
55 views

Does a hash of a 32-bit integer make a better hash salt than the integer itself?

I have a scenario where I already have a table of resource passwords stored as unsalted 128-bit hashes. I'm unable to force owners to provide new passwords, so I'm trying to mitigate the situation by ...
-4
votes
0answers
47 views

Why would a website have a maximum character limit on passwords? [duplicate]

I was just about to sign up for a website but the maximum password length was 10 but I can't think of a rational reason as to why a site would implement it that way. Can you guys think of anything?
1
vote
2answers
449 views

Received an email about an “Etsy” Password Reset due to the “Linkedin Breach…” is this a phishing attempt?

I received an email today from Etsy saying they are resetting my password(from the source it looks like a mass reset of all users), due to there being some sort of Linkedin breach, that compromised ...
7
votes
2answers
376 views

Can viruses access passwords that have been saved by a browser?

Say I use Chrome on a new computer to log in to a website, and I select the option to have the browser remember the password. Then I download a straight-up smorgasbord of viruses of every kind. Can ...
2
votes
2answers
178 views

Is it better to choose less-vulnerable random password?

I have created a random password generator function (which can be found here if anyone wants a look), which will churn out passwords with a random mix of letters, numbers, and other characters. This ...
1
vote
1answer
61 views

How secure is the UNIX sha_crypt as a password storage algorithm? [duplicate]

So I have been working on password storage, especially on the algorithms to use (and to not use). Most people are recommending scrypt or PBKDF2 for valuable reasons, but I have not seen any talks ...
1
vote
0answers
55 views

Help - Web-form Bruteforcing with Python [migrated]

So, I have this Python script below. What it does, is it basically bruteforces a web-form (login) using itertools. It does what I want, I've got it to work perfectly etc., however I'd like to ask if ...
106
votes
5answers
14k views

What should I do about Gmail ad asking me for password?

I just got a pop-up after having logged on to Gmail. It said it was from https://googleads.g.doubleclick.net and asked for username and password. What should I do about this? Has anyone else seen ...
3
votes
1answer
64 views

What percent of publicly posted databases implemented password security?

I am trying to get some statistics on databases that were a part of data breaches, namely, I would like to be able to find out what percentages of publicly posted databases (from a data breach) had ...
4
votes
2answers
64 views

Is CHAP authentication still secure?

Assuming the use of the default hashing algorithm MD5, is CHAP authentication still secure? I appreciate that MD5 is considered broken in terms of collision resistance, but I also understand that in ...
4
votes
4answers
112 views

What are possible methods for calculating password entropy?

I noticed there are tons of questions and answers about password entropy on this forum, some even suggesting formulas for calculating it. None did answer my exact question. What are possible or ...
1
vote
2answers
69 views

Periodic password change needed when using 2-step verification?

I know that it's considered good online security hygiene to change one's login passwords every 6 months or so. Is that needed on sites with 2-step verification? Isn't the 2nd step what will keep my ...
-1
votes
2answers
75 views

Website says my new password can't be used because it is the same as an old one [duplicate]

What are the risks of storing (in hashes I guess) all the old passwords? Why would a company chose to not delete old passwords? Why not let users reuse old passwords?
7
votes
2answers
161 views

Is there any recommended approach for “upgrading” MD5 hashes to something secure? [duplicate]

I'm currently dealing with a couple of user accounts containing MD5 hashed passwords. These accounts got migrated from an old system into our current system which uses PBKDF2 for password hashing. I ...
6
votes
1answer
83 views

Is there a way to know if a server is using ssh public key or password?

I am wondering is there a way for an attacker through finger printing to find out whether a server is using public-key versus password authentication method for establishing an SSH connection?
-5
votes
0answers
75 views

How can I decode hashed passwords? [duplicate]

I have access to a Microsoft SQL database where passwords are stored like this: bZB056KMVxCXa/D8zd3q/g== How can I decrypt this hash? I don't know which algorithm is used for this hash.
-2
votes
1answer
243 views

How can someone hack Twitter accounts so fast? [closed]

You may have heard the news about ISIS twitter accounts hacked in light of the Orlando shootings. I am wondering how can it happen so fast (just 2 days after the incident) and what kind of technique ...
0
votes
0answers
39 views

Manually computable passphrases [duplicate]

I need to revamp my password scheme for my various logins on different sites. I had the idea to try and craft a method where I could, using just my brain, algorithmically recall a password so that ...
0
votes
2answers
205 views

Is PIN affective security for credit cards considering it's not always needed?

This question asked about how having a PIN is safer than signing the receipt when doing a credit card transaction (personally the question makes no sense to me as it's just a scientific fact that a ...
27
votes
3answers
4k views

Can I share what password hash function I used in a public report?

I have developed a web site during an internship, using a database with accounts. I used the crypt() method from PHP, with a secured algorithm plus salt (found on the web with a lot of feedback). ...
1
vote
2answers
65 views

Password storage in 1password and other similar password storing applications

My understanding of memory in a computer is that it is stored in blocks that are over written only when the computer finds it convenient. so if a program asks to write in a certain block rather than ...
2
votes
1answer
78 views

What encryption is used by 1password?

I use a password storage application on my Mac called 1password. I was wondering if it encrypts the data it stores on my computer and decrypts it using a key made from my "one password" or if it has ...
3
votes
1answer
74 views

Web Based penetration test that uses MD5 for password

I'm trying to penetrate test a web based form (which is MikroTik's login form) with different tools for security measurement. I've tried THC-Hydra but problem is the password computed as MD5 first ...
5
votes
2answers
894 views

Why is whatsapp using 6 digit codes for verification?

My question is kind a simple. Why does whatsapp use 6 digit codes to verify the device? They could also use 5 or 7+ digits and or alphanumeric characters. Are there any reasons they chose exactly 6?
-2
votes
0answers
18 views

How to make a excel file that will lock after one year from the date of enterinf password [duplicate]

I want to make a excel file that will lock automatically after one year.and there will beca password which can open it for next one year. Is it possible to make such type of file??
-5
votes
1answer
131 views

Where do webstites store the hashes? [closed]

I understand that lots of websites store passwords in hashes but where do they actually store the hashes? How can a website compare your hashed version of a password with theirs? Is it stored ...
0
votes
0answers
15 views

Password Managers — Generating Passwords On The Fly a Safe Approach? [duplicate]

Most password managers store user credentials for individual services encrypted on their own back-end databases, so that your passwords are available on multiple devices. So, a DB compromise on these ...
1
vote
2answers
130 views

What are the recommended steps involved in creating an encrypted file format? [closed]

I'm developing a pretty standard program which lets users save their work in a custom file format and reopen it later. Now I'd like to add the capability to encrypt the file using a user-defined ...
6
votes
3answers
124 views

Why are low-entropy passwords considered OK in many cases?

When talking symmetric encryption, a 56 bit key is known to be so weak. If you use it for your encryption, you are considered a goner as you wont survive brute-force. When talking passwords however, ...
1
vote
3answers
115 views

Is it secure to send a password recovery link for company application to an employee's personal email address?

I would like to automate the recovery of the password for the employees of a company. However, the problem is that not every employee has a corporate email account and some employees can't access ...
62
votes
5answers
5k views

Do 2FA sites leak info by confirming a correct password guess?

Here's my relatively layman's view of the issue. Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly. ...
0
votes
2answers
104 views

Secure password generation for different websites [duplicate]

I came up with the idea to generate passwords for internet sites by the following shema: $masterpassword $hostname $TLD hashfunction($TDL.$masterpassword.$hostname) So the actual password is a ...
24
votes
8answers
4k views

Patterned password, based on site name [duplicate]

I'm considering implementing a pattern for my passwords, using the following ideas: Master password that I store nowhere An algorithm to mangle it based on the site I am accessing So for example I ...
0
votes
2answers
97 views

Password security in a Snapchat photo

This is going to be an extremely stupid question, so forgive my ignorance. Let's say I took a Snapchat photo of one of my passwords written in plaintext (let's ignore for a moment the security ...
3
votes
2answers
130 views

Are password generators secure?

Here's a scenario that I often encounter: Some user needs access to something on my network, but they don't have an existing account in AD. I create an AD account for them which I then use to allow ...