Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
1
vote
0answers
18 views
Are there any reliable and updated sources or feeds for password dumps? [on hold]
I am looking for any reliable, up-to-date sources (which may be RSS feeds, websites, or anything else OSINT-based) which contain password dumps and their relative links.
I am looking particularly for ...
0
votes
0answers
20 views
John the Ripper: OpenMP mode vs using the “--fork=N” option?
Clang on OSX doesn't support OpenMP by default, so I could not compile JtR with OpenMP support without another Clang installation.
However, after looking at the below option, I wonder what the ...
0
votes
0answers
40 views
Web app: using two hashing schemes for CPU-friendly password validation & secure storage [duplicate]
Consider a web application that:
uses HTTP Basic Auth over HTTPS, and therefore needs to validate a password (an API Key) on every request
and needs to handle a substantial load
has very few distinct ...
2
votes
1answer
161 views
Does the use of pepper for passwords violate Kerckhoffs's principle?
Kerckhoffs's second principle:
"It should not require secrecy, and it should not be a problem if it falls into enemy hands."
Does the use of a pepper for passwords violate this principle, since ...
0
votes
1answer
79 views
Login Password not encrypted
So, I was just playing with BurpSuite when I found something I didn't understand.
When using BurpSuite on banking websites, I see that after I supply the credentials, the form transmits an encrypted ...
0
votes
0answers
13 views
Set BIOS password in user laptops in an organisation [on hold]
I have a Windows Server 2012 environment with 50 users in an office. I want to set up BIOS password to user laptops (50). How can I set and manage that from a central location?
12
votes
3answers
3k views
Hashing password to increase entropy
Is it secure to hash a password before using it in an application to increase password entropy?
Does this practice increase entropy when a PBKDF is used in the application itself or does the PBKDF ...
3
votes
1answer
55 views
PCI DSS minimum password strength equivalent in passphrase
The PCI DSS requirement 8.2.3 says:
Passwords/passphrases must meet the following:
Require a minimum length of at least seven characters.
Contain both numeric and alphabetic characters.
...
-1
votes
1answer
165 views
I entered my password in a possible scam website. What should I do?
A while ago, I found a website that said that it will pay up to 100$ an hour just to watch ads.
So, I thought what's the harm, and I created an account using a fake Facebook account (with my real ...
1
vote
2answers
188 views
Best way to know the algorithm used for a password encryption
I have the following password captured using sqlmap-
$2a$08$9eaKUtKdFV8fuOAx0sfr4emrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O
Now, I don't know how to decrypt this password because I don't know which ...
54
votes
8answers
15k views
How are passwords stolen from companies if they only store hashes?
Everywhere I look it says servers store passwords in hashed form, but then you have those breaking news about hackers stealing passwords from large companies. What am I missing?
2
votes
1answer
56 views
How did my exact name + birthday end up in PwnedPassword lists? [closed]
I find my exact name + birthday in the form of FirstnameMiddlenameSurnameDayMonthYear, e.g. JamesWilliamMiller31052000
in the PwnedPasswords List.
But I have a very uncommon Surname (<100 people) ...
0
votes
3answers
103 views
Finding a future-proof password manager
Currently, I am a Windows 10 user who uses Chrome's default password manager and let it autofill in passwords for me.
Apparently, if I were to accidentally execute malware or give someone momentary ...
0
votes
1answer
91 views
Can't detect hash type even if I have the password?
I can't found the hash type used in a database hosted in a VM.
My hash is c39e02416d974229752c28d7fcefe6e1, and my password is "azerty123456". I noticed that the user table has a column called ...
4
votes
3answers
158 views
What password policy should a typical web app have?
By "typical", I mean in terms of the value of the data and how hard attackers are likely to try to breach it, as opposed to one that's guarding data sensitive enough that it's worth significant ...
0
votes
0answers
46 views
Google passwords security or lack thereof [closed]
I have been wondering about to what degree the info can be stolen if someone hacks into Google. Suppose an attacker got access to all of Google's data. Let's assume my Google password is good enough ...
1
vote
2answers
93 views
Deriving 2 keys from user password - one for login - one for encryption? [duplicate]
Context
We have a browser-based client-server application. The client registers with email and password. The password is enforced to some guidelines.
Problem
The User needs an encrypted vault on ...
0
votes
1answer
30 views
Use john to crack passwords with X alphanums and Y symbols
I'd like to use john to crack passwords that has 3 chars and 1 symbol in it, e.g 123$
If I use mask mode I will have to specify it 3 times,
-mask='[a-z0-9]?s[a-z0-9][a-z0-9]'
-mask='[a-z0-9][a-z0-9]?...
2
votes
1answer
120 views
What can be done to defend against acoustic keyboard evesdroping?
It is reasonably well established that it is possible to determine what one is typing based on keyboard sounds, and the difference between different keys (source). This provides a significant issue to ...
-3
votes
0answers
21 views
Password secure test. Minimum characters needed? [duplicate]
How can I tell how secure my password is?
-1
votes
1answer
107 views
hashcat - cracking a salted sha256
Given a SHA512 hash, a salt, and username I am trying to crack the hash using hashcat. Every example I've found used a hashfile as input, is there way to provide salt and hash via commandline without ...
0
votes
1answer
36 views
Reset password functionality [closed]
If the password reset form can be accessed only by logged in user, what are the mandatory and good to have fields the form should contain?
1
vote
0answers
51 views
How to correctly store the users credentials [closed]
I am writing an application that requires a username/password for the first time.
I was wondering if the concept code below is a valid and secure way to store user passwords in the database. I hope ...
14
votes
3answers
2k views
What are SHA-rounds?
I understand more sha-rounds make it difficult to bruteforce the hashed password in /etc/shadow. Higher rounds also use more CPU processing when executing sudo commands and logging into the Unix ...
0
votes
0answers
51 views
Does the password goes weaker as they get longer since hash has a fixed length? [duplicate]
For example, sha256 has a fixed hash length of 64 characters. So I'm wondering will a password goes weaker as they get longer and longer? Since no matter how long your password goes, the sum will be ...
0
votes
2answers
141 views
Should a mobile banking app force clients to change their password periodically, e.g. every 3 months?
Is there an internet bank that forces users to change their passwords periodically?
In Poland, none of the banks forces a change of the password for Internet banking. Of course, banks educate and ...
1
vote
3answers
88 views
Is it ill-advised to use the same password for lock screen and full disk encryption (Windows 10 BitLocker)?
I am wondering which attacks can be prevented by using a different password for the lock screen and full disk encryption. The goal is to prevent people from accessing my data. The details of my setup ...
0
votes
1answer
138 views
Can a Windows 10 Local Account password be retrieved
I have heard that Windows (10) local accounts are not that secure. I am however particularly wondering whether the password can be retrieved using any tools.
So I am not talking about resetting it ...
2
votes
1answer
80 views
How to get user and verify password so that the usernames are kept private?
According to the OWASP guidelines:
Authentication failure responses should not indicate which part of the authentication data was incorrect. For example, instead of "Invalid username" or "Invalid ...
3
votes
2answers
163 views
Is password dependent iteration count a good practice?
I consider the possibility of improving password security by increasing the hashing iteration count for short passwords.
The security benefits I see of this practice are:
Short passwords are better ...
0
votes
1answer
93 views
Is this method of hashing passwords good? Node.js [duplicate]
I am currently developing a login for my website, (using node.js and MySQL) and would like some feedback on the password hashing code.
const crypto = require('crypto');
function RandomSaltString(...
0
votes
0answers
43 views
How do I find the SSID of a wifi network with multiple separate words? [closed]
I am using the keychain to find logs of wifi passwords entered on networks I have logged into. It works fine for wifi networks where their name is one word such as "Wifi", however it does not work for ...
1
vote
5answers
157 views
Creating a unique password for each device
My team is currently working on an IoT product and we're having some issues thinking about a good way to create a unique password for each device.
Each device runs on GNU/Linux and we have an ...
19
votes
6answers
8k views
Which password policy is more secure: one password of length 9 vs. two passwords each of length 8?
What is more secure, having one password of length 9 (salted and hashed) or having two different passwords, each of length 8 (salted and hashed using two different salts)?
-1
votes
1answer
71 views
Best tool for cracking SHA-1s with unique pre and post salts? [closed]
I can't find a tool that supports cracking SHA-1s with different pre and post salts. Any suggestions?
0
votes
0answers
24 views
Does limiting the length of a password help prevent DoS attacks? [duplicate]
I was told that you can DoS a server with unlimited password length because of the time that it would take to hash it. But isn't the password hashed on the client's side before leaving the user's ...
0
votes
0answers
72 views
how good is “Chrome Password Checkup” extension for checking passwords?
From what I read so far Google "Chrome Password Checkup" extension (https://chrome.google.com/webstore/detail/password-checkup/pncabnpcffmalkkjpajodfhijclecjno) checking the password that you use for ...
-2
votes
1answer
87 views
Java Code for Pass Encryption/Decryption [closed]
I want to save an encrypted password (the encryption may be produced manually or using java code, and the encryption technique type does not matter), then the java code will read the encrypted pass ...
0
votes
1answer
57 views
BitLocker To Go password strength
When using BitLocker To Go, given that removable drives are inherently offline and may have to resist such attacks, what are the best practices / recommendations for password strength?
0
votes
1answer
90 views
Is it secure to store my mysql password in a const std::string?
I am implementing a C++ server with a mariadb backend. I have to access my database and I do so using the mariadbpp (its c++ connector). Though I can use mysql_config_editor and store the passwords in ...
2
votes
1answer
90 views
Secure password reset before authentication?
I have recently been considering the password reset flow for a site I'm working on. A request came up that before authentication, a user should have an option to change their password by providing:
...
1
vote
2answers
78 views
Is storing the bcrypt salt in isolated database a good idea?
I read many answers on the stackexchange about Bcrypt, Salt and Where exactly to place the salt. For hashes such as BCrypt it is trivial to extract salt from the hash. So, It doesn't matter really ...
2
votes
2answers
228 views
What to do about company that sent my password information in plaintext?
I make monthly payments to a website/company who insecurely stores my information. These are in the form of loan payments, so I don't know if I can change who I pay to.
I asked for login assistance ...
1
vote
0answers
42 views
rar and zip password encoding scheme [closed]
What encoding scheme is used in last versions of ZIP archives(6.3.2+) and RAR archives(3.90+), including RAR5? UTF-8/16, ASCII or something else?
0
votes
1answer
124 views
Is my pseudo “password manager” solution secure?
My solution to store passwords is just using this free program, SafePad, and then writing in a document all my passwords, plain text; for example a line might be
Facebook.com - user: johnsmith - ...
2
votes
1answer
104 views
Opera browser: no master password?
I've recently moved from Firefox to Opera (for performance issues).
I used to protect my passwords in Firefox with a Master Password. But Opera, so it appears, lacks such feature.
I use Debian 9.7 ...
0
votes
0answers
30 views
Does a small max password length indicate there might be a security issue? [duplicate]
Some websites state specific requirements for a password when you create an account. Some are understandable, but in particular the maximum password length doesn't make sense to me.
Some websites ...
0
votes
1answer
129 views
Safest & Secure Way To Store People's Login Information?
I am looking to create an application that aggregates data from people's online accounts.
The application (Frontend made with HTML/CSS/PHP and Backend made with Python) will log into people's ...
0
votes
0answers
36 views
Protecting/Crypting an external storage
We have an camera with sd card in which it records. AFAIK its software, recording parts etc., cannot be stepped in. We wish a mechanism/methodology that whenever it is plugged into usb socket of a ...
-3
votes
1answer
52 views
Finding encryption type of hash [closed]
Is it possible to find encryption type of a hash with a salt?
I have my other password in same encryption type, with the hash from that and the password, if that helps.
$2y$10$...
