Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
22
votes
7answers
5k views
IT will only give password over phone - but is that really more secure than email?
Every year an automated password reset occurs on a VPN account that I use to connect to the institution's servers. The VPN accounts/passwords are managed by the institution's IT department, so I have ...
1
vote
3answers
103 views
How to understand GitHub's password policy?
Today I tried to change my password on GitHub, but the site rejected my new password:
The new password you provided has also been reported as compromised due to re-use of that password on another ...
2
votes
3answers
175 views
Does preventing password recycling increase or damage overall security?
The general opinion on password policies seems to be that complexity rules are counterproductive to security due to the human nature [1].
Does this also apply to password policies prohibiting the re-...
2
votes
2answers
99 views
Could letters alone in a longer password be just as strong as one with digits and specials?
When considering the strength (or secureness) of passwords and passphrases, where some can have a mix of letters of either case, numeric digits, punctuation characters, arithmetic operators, and any ...
1
vote
0answers
47 views
Does PCI-DSS password guidance apply to service accounts?
A service account is a user account created for the sole purpose of running an application. For example, an online banking web site may have a single service account under which the code runs.
...
5
votes
1answer
104 views
Why does the EFFs unique-prefix-wordlist have so long words
A while ago, the EFF published new wordlists to be used with diceware, to create passphrases with “better” words.
One variant is the “short word list (with words that have unique three-character ...
-1
votes
0answers
51 views
Does Microsoft have a password checker? [on hold]
Does Microsoft have a password checker such as http://howsecureismypassword.net/
1
vote
2answers
68 views
Combining a fingerprint scan and password for 2-factor-authentication [closed]
UPDATE:
I found the answer to the "How To?" part of my question on superuser:
Require Fingerprint AND Password/Pin for Windows Logon
Is it possible to require a TOTP on Windows Login using existing ...
0
votes
1answer
80 views
Does using a router connected to an unsecured WiFi network add security?
If I connect a portable router like GL-AR150 to a public, unsecured Wi-Fi network at a hotel and create my own private, password-protected Wi-Fi network, how much more secure is this compared to just ...
0
votes
0answers
30 views
How to pass user/pass from user to api in automated fashion
I was unsure whether to ask this on StackOverflow or here, but decided that it is more appropriate here.
I'm creating a fully-automated local script that will run on a schedule. Once set up, the ...
-3
votes
1answer
74 views
Legal advise concerning copyright infringement (BitTorrent) and Wi-Fi hacking [closed]
Someone has hacked into my Wi-Fi and downloaded a film, TV shows and other content over a 2 year period using BitTorrent, I am now being sued by a copyright infringement company.
The TV programs as ...
14
votes
3answers
3k views
Is this bank website secure enough? No https in login page
Today I opened a bank account to invest my savings. Here's the link to the login page: http://www1.directatrading.com/
I noticed it doesn't use Https protocol (neither is that page nor in the landing ...
1
vote
3answers
175 views
Is it possible to hack into secured wifi and download with bit torrent from my IP address?
Is it possible to hack into secured wifi and download using BitTorrent from my IP address? I live in Denmark- if that makes any difference.
We changed to a new WIFI service provider a few years back (...
0
votes
1answer
58 views
What are some well known websites that do not require multiple character sets in passwords?
NIST guidelines discourage password policies that require multiple character sets.
Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or ...
2
votes
2answers
117 views
Is SSH security necessary on an internal network?
I am running a VM on a spare laptop we have in the office, and have set it up for SSH access from my workstation. Currently I am using user/password authentication, but I would like to remove the ...
87
votes
4answers
10k views
Chrome generated passwords not high entropy?
On Chrome, if you open a sign up page, it will offer to fill and remember the password field. I did this and got the following sequence of passwords offered as generated:
suCipAytAyswed0
...
1
vote
3answers
234 views
Why is it unsafe to send a user their password via SSL encrypted communication rather than always sending a reset link?
I can understand why you wouldn't want to email someone their password, but on an SSL encrypted web page, I dont understand why websites always require you to reset the password when you'd probably ...
1
vote
0answers
40 views
Is creating a derived password safe?
I need to store really sensitive data in a client-hosted database. Since there's no way I can protect this database (because I don't own it), my idea was to encrypt it by using the user's password, so ...
0
votes
2answers
94 views
Is it common to steal plain text passwords and use them to log in to other websites? [duplicate]
Let's say there is a low quality website,myfirstblogwebsite.com, that stores user passwords in plain text. Someone could get hold of those passwords and try them out on websites like Gmail, Facebook, ...
0
votes
0answers
57 views
Phone company keeping password in clear text [duplicate]
I recently found out that the Phone company where I have my contract is storing passwords on their server in clear text and employees can access it given the name or contract number of a person.
...
1
vote
1answer
137 views
Why would Bill Burr of NIST say N3v$r M1^d?
Wall Street Journal wrote that Bill regrets his password recommendations NIST SP 800-63 Appendix A.
Apprendix A is titled "Estimating Password Entropy and Strength". It is about how we might assess ...
0
votes
1answer
73 views
can malware operate on the login screen of windows 10? [duplicate]
Can malware record your keystrokes on the login screen of Windows 10?
Or only after the login screen?
I ask this because sometimes I enter my credential of another distro by mistake.
0
votes
1answer
233 views
Is this possible to brute force 25 billions billions password in less than a month?
i'm using Hashcat for a while & try to solve this challenge: is this possible to crack at least half the possibilities combinations password of 10 character using 94 characters from keyboard with ...
3
votes
2answers
102 views
When running shell scripts, is it safer to pass sensitive information using stdin or as a string option?
I'm building a number of automated scripts that will run within an encrypted environment (full disk encryption).
Many commands in both Windows and *nix have two ways of entering sensitive information ...
2
votes
3answers
92 views
Are mkpasswd SHA512 hashes secure for the public?
I am no crypto expert in any way so please bear with me if my question is kind of stupid.
We use OpenSSH key pairs on a regular basis and due to the asymmetric nature of key pairs, as far as I ...
0
votes
2answers
173 views
Can I throw away a private key and use the public key like a hash function?
Yes yes I know "don't invent your own protocols unless you're an expert". No need to yell at me I just want to know if there's a flaw in this idea and if not has anyone done it before.
The motivation ...
2
votes
3answers
157 views
If I typed username and password, but wrongly clicked another button to go to another page instead of the login button, is there any security risk?
For example, suppose I already typed username and password at this Facebook page:
https://m.facebook.com
But I wrongly clicked 'Create New Account' instead of Log In. My question is, does it ...
0
votes
0answers
30 views
Are 2-page website logins more secure than 1-page logins? [duplicate]
Over the last couple of years, some websites have switched to 2-page logins: on the first page the user enters their username, and on the second page the user enters their password.
Is this actually ...
1
vote
1answer
88 views
Am I likely to see any practical increase in security by combining passphrases and leetspeak?
(We really should just have a button to link this XKCD)
I've just started switching my passwords into passphrases. Now, I didn't roll any dice to come up with them, which I know sacrifices entropy; ...
1
vote
2answers
153 views
How to remove or at least change password from browser memory dump file [duplicate]
I am working with JSP.
So when a user submits a form, all the form fields say username and password gets stored in browser memory dump file in clear text.
I even tried with JSP hidden fields, but ...
0
votes
1answer
134 views
How can an Android device be unlocked, and how long would that take?
The original question was about the minimum password (or PIN) length (or entropy) for the screen lock in Android. Seeing that nobody answered, and following Schroeder's advice, I'm going to edit it ...
4
votes
2answers
247 views
Why not send a plaintext recovery password? [duplicate]
It seems like plaintextoffenders.com sees sending a plaintext recovery password as wrong. Instead, a link to set a password is better. But what's the difference? If a user follows a link and sets a ...
0
votes
0answers
35 views
Does LocalAccountTokenFilterPolicy registry value completely mitigate Windows pass-the-hash (PtH)?
I've been sitting for hours trying to get PsExec and windows/smb/psexec to work without luck, always getting the "Access is denied." error, until I came across the following article on Windows Vista:
...
2
votes
2answers
66 views
is there an upper limit on time to brute-force a password, based on acceptable login delay and hardware speed ratios?
Suppose a user uses a password to log in to their PC. When the user logs in, the PC applies a cryptographic function to the password and compares the ciphertext to the stored ciphertext of the known ...
3
votes
5answers
201 views
What is the most secure way to store the password on a physical medium (paper, etc)? [duplicate]
Let's assume that I have to store the password on a material medium (paper, etc). What is the most secure way to do that? I mean a way of storing the password that does not needs any electronic tools ...
0
votes
1answer
24 views
Linking mail server with application database
I have a web application running on node.js, backed by a MongoDB database which stores user data etc... I'd like to offer my users an email account, so I've set up a mail server using Postfix, dovecot,...
1
vote
3answers
125 views
What are the benefits of logging the username of a failed authentication attempt?
From time to time, some users can accidently type their password in the username field, either because they missed the tab key or because they thought their account was simply locked, not logged out (...
2
votes
0answers
59 views
User has been authenticated. Now what?
I'm trying to create a user authentication system for an application. I can't use a built in library for that such as ASP.NET Identity, but I can use any simple methods in .net.
Not wanting to ...
1
vote
2answers
120 views
Bcrypt data type and length?
I'm using the following library for hashing my password.
string password = BCrypt.Net.BCrypt.HashPassword("stackoverflow");
The length is apparently 60 each time. My question is, I'm planning to ...
0
votes
1answer
75 views
How to securely handle a login system [duplicate]
I'm making a desktop application in C# and I want to know If I'm handling this (from security perspective) as should be or not.
My Users table have both hashed_password and salt, both are binary(32).
...
-1
votes
1answer
100 views
How to securely generate and store the salting for password hash? [duplicate]
Assume a client authenticates using the password, which includes hashing and salting. The hash values are stored in a remote database server.
Questions:
For the hash values stored in the database ...
1
vote
1answer
224 views
How to crack forgotton KeePass password when knowing most of the password
A few days ago I changed my KeePass password and forgot it unfortunately. It isn't that much different from the previous one, but I kept trying and trying and it says it's incorrect
I found https://...
107
votes
2answers
15k views
Is a redirect showing the password in plain text a security vulnerability?
A couple of days ago, I attempted to log into the website of a well-known SaaS provider. I used a password manager on my browser (so user/pass were correct) and the NoScript plugin which had limited ...
44
votes
6answers
9k views
User Account with no password
I'm currently job searching, and sometimes I come across sites that are just huge databases full job postings, and before you apply you have to create an account. I came across a site, but I'm ...
0
votes
1answer
199 views
How can I decrypt traffic on a WPA encrypted network?
I am connected to a WPA/WPA2 Access Point and I want to sniff all wireless traffic inside that network. How can I decrypt the traffic even though I don't have the pre-shared key?
2
votes
2answers
165 views
Given a secure channel, are there any benefits in using SCRAM over a username and password?
Given that a communication over HTTP
uses SSL encryption
uses public key pinning to prevent MiTM attacks
is security in any way elevated by using Salted Challenge Response Authentication Mechanism (...
35
votes
7answers
11k views
What are the security risks of logging the hash of rejected passwords?
According to Is it common practice to log rejected passwords?, I know logging rejected plain text password is a bad idea, but how about if I store the hashed form of rejected passwords? I want to have ...
0
votes
1answer
149 views
Calculating Entropy using md5sum, sha256sum etc
We can calculate the Entropy S of a string simply like this:
S = L * log_2(N)
Where L stands for used characters in the string
And N for every possible character
Example: We want to calculate the ...
0
votes
0answers
218 views
What are security advantages of pass in comparison to KeepassXC (GUI App)?
At the moment I use KeepassXC on macOS. Before I used KeepassX, which discontinued their development.
I am considering switching to command line client pass - the standard unix password manager, ...
27
votes
10answers
5k views
How to strike a balance between security policies and practical implementation challenges? [duplicate]
At our organization, we came across some frequent incidents such as:
Reported successful password guessing attacks
Frequent password reset complaints
We started an investigation to identify the ...
