Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
3,568
questions
0
votes
1answer
27 views
Where and how to store admin account credentials for enterprise systems?
To my understanding, password-protected spreadsheets are not best practice for storing admin creds, whether it's a company of 5 people or a company of 50,000 people. In such a case, what are some best ...
0
votes
0answers
28 views
How to analyse large dataset of strings for secrets? [closed]
I've collected a large dataset of strings (around 10TB) from doing static analysing on android apps and I was searching several days for python libraries to analyse these strings, but I did not find ...
0
votes
2answers
74 views
Replace hashing function with asymmetric cryptography when password authentication
I would like to know if the following ideas are feasible:
Hash function is one-way function.
Generate public key from private key is irreversible(asymmetric cryptography).
User password entry -> ...
0
votes
0answers
44 views
Network Worm Sending HTTPS Passwords in POST Requests
So there are a lot of details to this but let's just say that I'm convinced I'm being actively monitored by advanced hackers. It started when I was posting about time travelers on internet security ...
0
votes
1answer
55 views
Is using Argon2 with a public random on client side a good idea to protect passwords in transit?
Not sure if things belongs in Crypto SE or here but anyway:
I'm building an app and I'm trying to decide whatever is secure to protect user passwords in transit, in addition to TLS we already have.
In ...
1
vote
1answer
90 views
Why are salted hashes better than just hashing?
I have recently read an article about storing passwords safely and I have a few misunderstandings. I found out 4 ways of storing users' passwords:
Just keep them in plain text
Keep passwords in plain ...
0
votes
1answer
33 views
Wordlist generator with a certain pattern
I am trying to generate a wordlist. I am using crunch but I am stuck at defining the pattern I want the words to be generated. For example, I want to define a rule such as this:
Password: Ameri948 ca#
...
0
votes
0answers
24 views
Offline authentication seems really difficult [closed]
I'm building an "offline first" CRM. The main reason it's offline first is because the user will be adding new contacts, updating contacts, adding notes, etc. in an environment where there's ...
3
votes
4answers
182 views
How do I minimize the number of passwords leaked when a PC gets compromized?
For customer support reasons, we need to store passwords to some of our customers' systems (with their explicit, written permission, of course), as well as, obviously, passwords to some of our own ...
0
votes
0answers
46 views
Does hashing client-side increase attack surface (assuming TLS and serverside salt+hash)? [duplicate]
This question asks whether one should hash on the client or the server. I want to know if there is any reason, aside from having to maybe handle one extra hashing library (if it's not already in your ...
-1
votes
2answers
98 views
Passwords via unsecure network [duplicate]
Can the password that one type be compromised if mobile is connected to a compromised router since everything has to go through the router?
4
votes
1answer
176 views
How does a company check the password received from your phone keypad during a call? [duplicate]
I had to call customer service recently regarding my 401(k) and robo call in the beginning asked me to enter my social security number using the keypad followed by a # and then asked for my account ...
95
votes
11answers
12k views
How do very big companies manage their most important passwords / keys?
Third-party password managers such as 1password, etc. are useful for people, businesses, etc. to store passwords. But I bet Facebook, Google, Twitter and other super big tech companies don't use such ...
0
votes
1answer
123 views
Is it safe to generate the longest password possible?
Context
In another question about password generation, I have read an answer suggesting something along the line of:
Let your password manager select characters from all the accepted categories (...
11
votes
3answers
3k views
Diceware as a passphrase for online accounts
I'm reading about Diceware and cryptography in general and I know how secure Diceware can be. I stumble upon this part on The Intercept about Diceware and it says:
"You don’t so much need them ...
0
votes
1answer
86 views
John The Ripper and PBKDF2-HMAC-SHA1
I am trying to hash a list of passwords with PBKDF2-HMAC-SHA1 and then crack them using John. However, John does not recognise the hashes and I get a No Hashes Found error. It works with SHA256, but I ...
1
vote
2answers
102 views
Hardware components based on which to generate password
I want to generate a password for a Keystore in java on Windows platform.
I would like to make a HASH out of some hardware information from my computer and some salt.
My question is: which hardware or ...
10
votes
3answers
5k views
How safe is opening any website on new browser tab?
When I do online shopping where I use my credit card information to purchase, I clear the browser cache, cookies and only open that single site. After I am done, I again clear the cache, cookies and ...
0
votes
0answers
21 views
Should I be concerned about websites emailing me my plaintext password after signing up? [duplicate]
In multiple instances lately, I have received the plaintext passwords I entered(not given to me) emailed to me after signing up. The sites in question have been legitimate small businesses, so I ...
-1
votes
1answer
79 views
Are protected Office 2007+ files secure?
If I can decrypt or "unprotect" a sheet or a workbook in Excel in a matter of 2-3 minutes (faster then it usually takes to read the linked article!), by a means of simple .zip archive ...
44
votes
3answers
7k views
Is bcrypt(strtolower(hex(md5(pass)))) ok for storing passwords? [duplicate]
I have a large database where passwords are stored as strtolower(hex(md5(pass))) (which is a bad way to store passwords, prone to rainbow tables, cheap to dictionary attack, no salt, etc.),
and I'm ...
1
vote
2answers
107 views
How does a shared vault in password managers such as 1Password work?
The password manager 1Password has a feature where multiple accounts in a group ("family") can share login information with each other.
From my understanding, a password manager is never ...
3
votes
4answers
250 views
Is password strength exclusively a function of character set size multiplied by password length-in-characters?
My team is responsible for the creation and management of many passwords (hundreds), which we do almost exclusively programmatically (all generation is random-enough). We leverage a variety of of ...
19
votes
2answers
5k views
Why does Windows not always force me to confirm my password when changing it?
If I can change my password with cmd net user example * without needing to confirm my old password, why, when I change my password in the usual way (via settings or control panel), do I need to ...
7
votes
2answers
2k views
If hashing should occur server-side, how do you protect the plaintext in transit?
I've been working on a full stack project recently for my own amusement and would like to add authentication services to this project, but want to make sure I'm doing it the right way. And before ...
2
votes
1answer
146 views
Does anyone know what this encoding format for passwords is? I think it is a decimal array but I can't seem to convert it
During a penetration test, I ran across a server that was storing passwords in its database in what seems to be a binary array of sorts:
password_table
1,12,12,12,122,21,13,00,00,00,000
11,112,443,12,...
0
votes
1answer
110 views
John The Ripper - find password when you know a part of it
I left my old job a few years back and wanted to check a few of my old pdf payslips but for the life of me I can't remember the password.
I've tried using John The Ripper in incremental mode because I ...
0
votes
2answers
72 views
Can anyone see my files on the same network?
If someone hack my WiFi or they know the password . Can they see or will have access to any of my data stored in my pc connect on the same network. Or can they control my pc or download anything ?
11
votes
3answers
3k views
Safe storage for multiple passwords for multiple accounts
I've had this difficulty for a while, and I hope to get some feedback or referral to the sites where this problem may be discussed.
Nowadays all of us have multiple accounts, both personal and work-...
10
votes
7answers
3k views
Does client side hashing reduce insider risk?
One of the companies I worked for used client-side hashing to minimize risk when logging the password in the server logs. Can this be a good reason to implement client-side hashing?
52
votes
8answers
10k views
How can we eliminate passwords given the problems with biometric authentication?
I've read articles suggesting that passwords will eventually go the way of the dinosaur only to be replaced by biometrics, PINs, and other methods of authentication. This piece claims that Microsoft, ...
3
votes
0answers
90 views
How vulnerable are password managers in the real world?
I'm a senior undergraduate majoring in computer science. I recently took a computer security class where instead of exams we had a final project that could be anything related to computer security.
So ...
1
vote
4answers
228 views
Why can't we protect the password file so that only the system can read it?
Can't we design an OS in such a way that it doesn't allow anyone (not even root) to read the passwords file? Then there will be no need for encrypting the passwords. Why can't we hard-code a computer ...
0
votes
1answer
30 views
Does a password-derived public key authentication improve security over pure password-based authentication?
Despite best efforts it is pretty clear that most users reuse their credentials, especially for what they consider non-critical sites such as forums. While TFA does mitigate the potential damage of ...
2
votes
1answer
111 views
What's wrong with storing a username and password as a cookie?
I'm working on a legacy application that issues JWTs with a short expiry time.
They do not have refresh token functionality implemented.
So obviously while using refresh tokens would be the right ...
0
votes
2answers
82 views
Android phone's lockscreen PIN disappeared?
I own a ZTE Axon 7 (model 2017G) that I purchased secondhand from a reputable vendor in Germany ca. 3 years ago. The phone has been working well, and I updated the OS to Android 8.0. manually earlier ...
1
vote
1answer
79 views
Password protected wall
I'm currently building a website where you have an account and can do "dangerous" things with it. I want to password-protect these things, so the user has to type their password, if they ...
2
votes
1answer
79 views
How can a pdf file have two passwords?
I receive emails from my bank with password protected PDF files, and they provide two passwords - either xxxx or yyyy. How is this possible?
0
votes
1answer
80 views
Could a Chromecast be compromised from its default open network?
I left my apartment for few days, so I disconnected my wireless router but I forgot to disconnect my Chromecast as well. I remember that when a Chromecast can't find the network it was connected to ...
0
votes
2answers
71 views
Is necessary to use salt if I use a complex password? [closed]
I read that it is important to use a salt together with the password to avoid rainbow table attack. I agree with that, but is there any difference, in terms of security, if
I use password + salt or
I ...
1
vote
1answer
114 views
Is it OK to store the user's plain-text password in a claim?
For customer reasons, my web app authenticates the user against a proprietary user database using a simple API like bool authenticate(string username, string password)
In case the user changes his ...
25
votes
2answers
9k views
What's the point of Microsoft Account 2FA if it still lets me log in using password instead?
I have a Microsoft Account linked to a Microsoft Authenticator app for 2FA purposes. Every time I log in, it first sends me the Authenticator request, but I can always click "Other ways to sign ...
13
votes
3answers
5k views
How does a 'rainbow table' hacker obtain password hashes in the first place?
I don't understand this part of the Rainbow table attack.
In all my Google searches, it says that a hacker uses a rainbow table on password hashes.
But how does the hacker obtain the password hashes ...
0
votes
0answers
62 views
Decrypting a file knowing only the password
I have encrypted a file using a program with a password and would like to decrypt it on another device just with the password. Is there any software that takes the password, runs it through all key ...
3
votes
2answers
163 views
how would a 12-digit password be a safe guard in this situation?
So guys, I messed up with the configs in a computer and let the SSH server open to the wild with ROOT login enabled. I'm trying to assess the potential damages, which I may never know for sure.
...
0
votes
1answer
60 views
MacOS able to access data without password
On a Mac, one can go into recovery mode by turning off the Mac and clicking Command R while turning it on. Then, by typing resetpassword into Terminal, one is able to reset the password without ...
0
votes
0answers
14 views
Is it possible to have and use a dynamic dictionary for brute-forcing? [duplicate]
For some reason - totally useless for the question - I have this PDF file with a password I forgot and I have no way to remember. I know for a fact (the person who created and gave me this PDF told me ...
1
vote
1answer
62 views
How to avoid password TCP message sniffing and subsequent hijacking
I'm developing a TCP Streaming API for "IoT" devices in LabView.
The TCP Server will be listening to a certain port, and our devices will try to connect to it. In order to know that the connecting ...
0
votes
3answers
97 views
What is the best practice for resetting multi-factor when a user requests to recover their password?
I am in the process of developing a web-application which requires MFA on every login. (On the first login, before you can do anything, you are forced to setup MFA. Due to monetary restrictions and ...
2
votes
1answer
57 views
Use delay with a fixed total time to defend against timing attacks
Consider this common example used to demonstrate timing attacks:
async def sign_in(username, password):
user = await get_user_from_db(username)
if user is None:
return False # early return :(...
