Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
3,729
questions
0
votes
0answers
44 views
Securely Sharing passwords with Users external to Organization
What is the most secure way to share passwords by a user in one organization (say alice@alice.com) with another user in another Organization ( say bob@bob.com )
A trivial solution is alice@alice.com ...
-1
votes
0answers
40 views
How can we use salts to increase the efficiency of hashing? [closed]
The goal when creating or changing your password is to make it as unique as possible so that it cannot be easily guessed and hence compromised. The main goal of salts is to achieve this. They increase ...
-5
votes
0answers
57 views
Why is the back-end “show password” ability considered a non-issue? [duplicate]
Organization X stores your passwords as you save them. One would expect these saved passwords are stored away, unreadable. However, some major organizations now... let you read them?(See next ...
42
votes
2answers
6k views
Why don't car keys use algorithms like RFC 4226?
I've been reading a bit into car security and all of the ways cars can be stolen through various alterations of replay attacks. Upon researching whether any of the more modern cars are using anything ...
0
votes
1answer
40 views
How to monitor your user accounts for breached logins?
On a few rare instances, I've received an email from a website notifying me that my email and password were found in batch of harvested logins, and they then force me to change my password.
This has ...
10
votes
4answers
2k views
Password management of emailed cleartext passwords
If a website emails a password in cleartext when you use the "forgot password" function, is there any possibility that the password is hashed? It does generate a different password if you ...
3
votes
2answers
231 views
Does HTTPS leak password length?
On a website with user accounts, all HTTP requests coming from the submission of a login form kind of contain the same info, there are only a few things that are different in the HTTP requests, such ...
0
votes
2answers
88 views
Password Strength Determination
Recently, I've checked the some articles including R. E. Smith, The Strong Password Dilemma. ch. 6., Password Strength: An Empirical Analysis, Distance between two passwords and Password strength ...
1
vote
2answers
131 views
How is a password kept secure before hashing?
I know that once a password is on a server it is hashed and salted. But when it was transferred over the internet it was stored in plain text, right? And also when it is in the memory of the server ...
0
votes
1answer
76 views
Is there data on the most common password strength requirements?
Many websites have different requirements for a strong password (beyond simple length I mean). Anecdotally, I think these requirements are common:
Password must contain a mix of upper and lower case ...
1
vote
0answers
114 views
Using John the Ripper for Blockchain.info second password
Is there a way to use JtR for Blockchain.info's (v2) secondary password?
I already tried the blockchain2john.py file, and it does not ask for primary password (which I know already) so it is going to ...
0
votes
2answers
111 views
How would I safely store a password locally?
I have a program which allows another authorized user (with a password) to access someone else's computer without them having to be there. However, I don't know how to safely store the password ...
0
votes
1answer
72 views
What is the equivalent of “forgot password” in password-less login applications using FIDO2 / Webauthn or later?
I'm assuming instead of saying "forgot password?" the text would say "lost your key?" or "don't have your device?". But what would the process of secondary access look ...
0
votes
1answer
63 views
Password hashing for local servers
I'm running a local web server on my Raspberry Pi and want to have a login screen. My plan is to hash the password and store the result in a text file ( This is where I'm storing settings for the ...
0
votes
2answers
119 views
Is it possible to reverse a hashed password? [duplicate]
Is it possible to reverse a password hashed with bcrypt?
1
vote
1answer
117 views
Do I need strong user password for an encrypted VM?
I've just imported Whonix VirtualBox VM, and have encrypted its drive via VirtualBox settings. Now when I booted it, the default credentials are "user/changeme", and setup suggests I change ...
3
votes
0answers
113 views
Should I build my own login functionality? [closed]
I've looked at various ways of logging in users and I'm wondering if I should write my own.
There are a lot of third party solutions that make it easy and cheap to get started, like Amazon Cognito and ...
2
votes
1answer
71 views
How can I use a unique salt for each user
I know there are various questions that seem similar, for instance, this one. However, it does not answer my question.
I'm creating a signup/login system (with node.js to be particular), and I'm ...
0
votes
0answers
35 views
What is an SLT1000 password encryption? [duplicate]
The sample password-encryption below.
{SLT1000}8kmbGwpGQRS0b8GOdAH4/Wrt8z4=
Could anyone identify what type of encryption is this?
3
votes
1answer
246 views
How can salted passwords work if you don't “keep the salts in the system”?
In this report on the recent ParkMobile breach, the article has this comment from the company:
“You are correct that bcrypt hashed and salted passwords were obtained,” Perkins said when asked about ...
1
vote
0answers
80 views
JTR finishing very quickly with rockyou.txt and not cracking the hash
I've been fumbling through the world of Information Security by going through the HTB challenges, and I've come across an issue I just can't seem to find an answer for. During one of the challenges I'...
5
votes
1answer
491 views
How did Firefox get my passwords?
I just installed Firefox browser, while I have previously used Google Chrome as my main browser. I am using Windows 10.
During the installation and setup process for Firefox, I was given the option to ...
2
votes
0answers
33 views
Entering password on third party websites to enable integrations
I've got a third party service that I want to integrate with various other websites/applications, the third party service says they support this however rather than using an API key or OAuth to ...
1
vote
2answers
90 views
Passwords verification against a set of breached passwords
NIST and OWASP ASVS recommends checking passwords against those obtained from previous data breaches. The list of such passwords can be downloaded from "Have I Been Pwned" (https://...
2
votes
1answer
138 views
Passwords stored as obfuscated text, not encrypted
An application I admin (but did not develop or implement) claims to be storing passwords in a database using “reversible encryption.”
I have access to the database table, and was able to work out that ...
1
vote
1answer
62 views
Is combining salt from two places secure enough and what length
I need to implement some hashing scheme for an open-source project. This is what I currently have and I'd like to hear whether this is secure enough -
The password is hashed using PBKDF2-SHA256 (which ...
0
votes
1answer
65 views
How to create a secure password for a Java keystore?
What would be the recommended approach (industry standard) for generating a password for a Java keystore that contains TLS certificates? In the event that the keystore is obtained, an attacker would ...
0
votes
1answer
66 views
Is passlib cryptocontext verify method security for timing attacks?
My question is pretty short: is passlib cryptocontext verify method vulnerable to timing attacks, which would an attacker allow to narrow down the real password?
0
votes
3answers
71 views
What's the basis for recommending resetting my email password when an unknown account password is compromised?
One of the banks that provides identity theft monitoring to accountholders notified me that my email address was included in a recent data breach, along with a password, but without any indication of ...
0
votes
1answer
59 views
FIPS compliant passwords protection/encryption?
Do FIPS 140-2 or related documens specify how to protect users' passwords with encryption? Are there any well known schemas for storing passwords in lossless manner and lossy manner?
0
votes
1answer
48 views
why is supporting digest authentication necessary instead of other more secure ways like applying non-reversible transformation to password?
Why is supporting digest authentication necessary instead of other more secure ways like applying non-reversible transformation to password to encrypt them? Is it because the receiving end cannot ...
1
vote
1answer
87 views
Are saved passwords in browsers secure, when stored online?
Where are saved passwords stored if you login to a browser, so they sync whenever you login to that browser on another device. Where and how do Google, Firefox etc. save the passwords? Obviously its ...
0
votes
1answer
62 views
What is a secure way to send credentials to the server?
I am currently making a file server (Based on HTTP) for my service. I want an upload key, so a key that is needed for uploading. To get this key, the client has to provide his login data.
Let's say my ...
1
vote
2answers
104 views
How to generate all possible combinations of a forgotten password
I have forgotten my password but I know the words used in the password. I remember the password was something like MyPassport@1.82TB.
Is there any software that can produce all combinations like ...
1
vote
2answers
115 views
Does Windows log desktop application passwords?
The other day I logged into Discord on my friend's computer using the desktop application. Does Windows log these events somewhere? Does it store the password hash or some sort of authentication token?...
0
votes
0answers
31 views
What characters should, and should I absolutely not use in generated passwords? [duplicate]
I'm currently setting up a KeePass database after switching over from another password manager, and it has the option to change the character set for generating a password.
This has a lot of options, ...
0
votes
1answer
69 views
Does syncing local data to the cloud count as MFA?
Bitwarden uses TOTP as the multi-factor authenticator method for their password manager. Bitwarden stores and syncs your data so you need the master password + TOTP to get access to your account
...
3
votes
1answer
379 views
How does Linux know if a new password is a “wrapped” version of a old one?
How does Linux know if a new password is a "wrapped" version of an old password?
(or, the process of creating a new password) know "certain" parts of one's password?
Let's say I ...
23
votes
6answers
11k views
Is it safe to publish the hash of my passwords?
How unsafe would be to publish the hash of my passwords?
I have written a Python script for helping me to remember my basic passwords (computer password, encrypted backup password, AppleID password, ...
0
votes
1answer
82 views
Database password encryption compromised
A company has a database with user's passwords encrypted. An attacker compromised the password encryption now it needs to be changed.
In this situation does the company needs to change the encryption ...
1
vote
0answers
49 views
How much time will Fugaku supercomputer take to generate a wordlist? [closed]
How much time will the Fugaku supercomputer take to generate a wordlist?
Length: 50
Combination: Alphabet(upper/lower) + numbers (0~9)
also, would wordlist generators make a significant time/...
15
votes
4answers
3k views
PBKDF2 usage will slow REST API down?
When implementing password hashing using PBKDF2 for authenticating access to a REST api,when we say that PBKDF2 is slow does it mean that it's going to take a lot of time to hash the password and ...
1
vote
0answers
26 views
Is there record of a pubilc RDS instance with strong password having been hacked?
I am auditing an AWS account and I found a public RDS instance, that is with public DNS, no Security Group IP connection filtering and in a public Subnet
However, the instance has a relatively strong ...
-2
votes
1answer
88 views
Unathorized Access to Google Drive
My Google Account was hacked granting unauthorized access to YouTube and Google Drive. The third party immediately started posting inappropriate content on YT which prompted an email from Google after ...
0
votes
1answer
99 views
Exchange compromise affected company - should we 100% change administrator password?
We host exchange on premise (exchange 2013). We believe following MS's guides and guidelines that we were compromised regarding the exchange zero days hack. We did find some .aspx files that did not ...
1
vote
0answers
118 views
John the ripper output formatting
I'm supposed to crack some passwords from a file. I've done john pwlist.lst > passwords.txt which is outputting the files into my txt file.
I'd like to make it such that when John is cracking the ...
1
vote
3answers
238 views
Are security questions considered as 2FA?
Many sites have a step during registration when you have to create security questions and answers for them. Is this type of security layer considered as 2FA? From what I know, 2FA is used for the ...
8
votes
2answers
355 views
Why is Webauthn not used as primary authentication method?
In theory, authenticating with a public key should be much simpler than with a password. There is nothing to remember for the end-user, and registration can be done just by clicking a button. For all ...
2
votes
0answers
80 views
Should a user's password hash and salt be included when a user requests to download their data under privacy laws? [closed]
I have two related questions:
When trying to design for privacy laws that require giving a user access to their data, should we include their password hash and salt in the data we offer for download?
...
2
votes
0answers
56 views
Authentication in Desktop App
I'm reading the OWASP Authentication Cheat Sheet, but it obviously is focused only on web browser. I'm searching for something similar for a desktop app.
I want users to login to a desktop app. The ...
