Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
3,711
questions
0
votes
0answers
44 views
Is passlib cryptocontext verify method security for timing attacks? [closed]
My question is pretty short: is passlib cryptocontext verify method vulnerable to timing attacks, which would an attacker allow to narrow down the real password?
0
votes
0answers
9 views
Is it possible to create a ZIP file with NUL password? [migrated]
I want to know is it possible to create a ZIP file with NUL password? If it is possible, how?
0
votes
3answers
56 views
What's the basis for recommending resetting my email password when an unknown account password is compromised?
One of the banks that provides identity theft monitoring to accountholders notified me that my email address was included in a recent data breach, along with a password, but without any indication of ...
0
votes
0answers
30 views
How to find out honeypot accounts while using honeywords for password storing [closed]
I am trying to read "Achieving Flatness: Selecting the Honeywords from Existing User Passwords" which suggests a better way for generating honeywords. In the procedure, we initially create a ...
0
votes
1answer
46 views
FIPS compliant passwords protection/encryption?
Do FIPS 140-2 or related documens specify how to protect users' passwords with encryption? Are there any well known schemas for storing passwords in lossless manner and lossy manner?
0
votes
1answer
43 views
why is supporting digest authentication necessary instead of other more secure ways like applying non-reversible transformation to password?
Why is supporting digest authentication necessary instead of other more secure ways like applying non-reversible transformation to password to encrypt them? Is it because the receiving end cannot ...
0
votes
0answers
61 views
Google account hacked, other accounts hacked, other attempted logins. How did they do this and how can I prevent this in the future? [closed]
About two weeks ago on 03/22, there was an attempt to login to my online Chase bank account. I was aware of this when I noticed an email from Chase, which contained a verification code to login on a ...
1
vote
1answer
79 views
Are saved passwords in browsers secure, when stored online?
Where are saved passwords stored if you login to a browser, so they sync whenever you login to that browser on another device. Where and how do Google, Firefox etc. save the passwords? Obviously its ...
0
votes
0answers
5 views
Did I have USB debugging on or off? [migrated]
my phone got stolen a month ago and I Don't know if I had usb debugging on or off(I had enabled developer options in the past and messed around with it a little bit that's why I'm not sure) but I ...
0
votes
1answer
50 views
What is a secure way to send credentials to the server?
I am currently making a file server (Based on HTTP) for my service. I want an upload key, so a key that is needed for uploading. To get this key, the client has to provide his login data.
Let's say my ...
0
votes
2answers
68 views
How to generate all possible combinations of a forgotten password
I have forgotten my password but I know the words used in the password. I remember the password was something like MyPassport@1.82TB.
Is there any software that can produce all combinations like ...
1
vote
2answers
103 views
Does Windows log desktop application passwords?
The other day I logged into Discord on my friend's computer using the desktop application. Does Windows log these events somewhere? Does it store the password hash or some sort of authentication token?...
0
votes
0answers
30 views
What characters should, and should I absolutely not use in generated passwords? [duplicate]
I'm currently setting up a KeePass database after switching over from another password manager, and it has the option to change the character set for generating a password.
This has a lot of options, ...
0
votes
1answer
61 views
Does syncing local data to the cloud count as MFA?
Bitwarden uses TOTP as the multi-factor authenticator method for their password manager. Bitwarden stores and syncs your data so you need the master password + TOTP to get access to your account
...
3
votes
1answer
309 views
How does Linux know if a new password is a “wrapped” version of a old one?
How does Linux know if a new password is a "wrapped" version of an old password?
(or, the process of creating a new password) know "certain" parts of one's password?
Let's say I ...
23
votes
6answers
11k views
Is it safe to publish the hash of my passwords?
How unsafe would be to publish the hash of my passwords?
I have written a Python script for helping me to remember my basic passwords (computer password, encrypted backup password, AppleID password, ...
0
votes
1answer
80 views
Database password encryption compromised
A company has a database with user's passwords encrypted. An attacker compromised the password encryption now it needs to be changed.
In this situation does the company needs to change the encryption ...
1
vote
0answers
45 views
How much time will Fugaku supercomputer take to generate a wordlist? [closed]
How much time will the Fugaku supercomputer take to generate a wordlist?
Length: 50
Combination: Alphabet(upper/lower) + numbers (0~9)
also, would wordlist generators make a significant time/...
15
votes
4answers
3k views
PBKDF2 usage will slow REST API down?
When implementing password hashing using PBKDF2 for authenticating access to a REST api,when we say that PBKDF2 is slow does it mean that it's going to take a lot of time to hash the password and ...
1
vote
0answers
25 views
Is there record of a pubilc RDS instance with strong password having been hacked?
I am auditing an AWS account and I found a public RDS instance, that is with public DNS, no Security Group IP connection filtering and in a public Subnet
However, the instance has a relatively strong ...
-2
votes
1answer
81 views
Unathorized Access to Google Drive
My Google Account was hacked granting unauthorized access to YouTube and Google Drive. The third party immediately started posting inappropriate content on YT which prompted an email from Google after ...
-1
votes
0answers
43 views
Forced PIN. Microsoft or Malware? [migrated]
After every time I boot into safe mode, at the next normal sign in screen Windows 10 forces me to create a PIN, which I do not want to do. To fix this, I have to either create a PIN and then remove it ...
0
votes
1answer
96 views
Exchange compromise affected company - should we 100% change administrator password?
We host exchange on premise (exchange 2013). We believe following MS's guides and guidelines that we were compromised regarding the exchange zero days hack. We did find some .aspx files that did not ...
1
vote
0answers
50 views
John the ripper output formatting
I'm supposed to crack some passwords from a file. I've done john pwlist.lst > passwords.txt which is outputting the files into my txt file.
I'd like to make it such that when John is cracking the ...
1
vote
3answers
173 views
Are security questions considered as 2FA?
Many sites have a step during registration when you have to create security questions and answers for them. Is this type of security layer considered as 2FA? From what I know, 2FA is used for the ...
8
votes
2answers
322 views
Why is Webauthn not used as primary authentication method?
In theory, authenticating with a public key should be much simpler than with a password. There is nothing to remember for the end-user, and registration can be done just by clicking a button. For all ...
2
votes
0answers
79 views
Should a user's password hash and salt be included when a user requests to download their data under privacy laws? [closed]
I have two related questions:
When trying to design for privacy laws that require giving a user access to their data, should we include their password hash and salt in the data we offer for download?
...
2
votes
0answers
51 views
Authentication in Desktop App
I'm reading the OWASP Authentication Cheat Sheet, but it obviously is focused only on web browser. I'm searching for something similar for a desktop app.
I want users to login to a desktop app. The ...
1
vote
0answers
94 views
Hardware for password cracking
I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
2
votes
1answer
113 views
How are passwords stored in the database of a decentralized peer to peer system?
I want to use username and password instead of public key cryptography for a decentralized peer-to-peer application, but since the passwords are stored on users' computers, there is a possibility of ...
0
votes
4answers
140 views
Why can't you use the same password for every site, if they are hashed on the site?
I've often heard people talking about not using the same password on every website. What's the deal if servers store passwords in a SHA hash instead of plain text? The most they can do is spam you ...
7
votes
3answers
276 views
Why would password managers provide support for OTP codes? [duplicate]
Can anyone explain me what's this trend of providing passwords and OTP codes on the same service? What benefit or value are they trying to bring to the table?
We, as security professionals, have been ...
1
vote
1answer
67 views
In Hashcat, How to generate combinatior attacks consisting of more than two words (in lenght)?
I am trying to make a combinator attack using just one dictionary:
word1
word2
word3
word4
word5
...
And would like to try all 4-words-length permutations separated by commas:
word1,word2,word3,word4
...
3
votes
1answer
329 views
Bitwarden PIN protection mechanism
I couldn't find any deep dive info about PIN management in Bitwarden.
And I'm not able to read their code, not qualified enough.
Are there people around here who can explain how PIN protection works ...
2
votes
3answers
98 views
Pros vs Cons of Secure Remote Password
We are setting up an authentication system using Cognito and Amplify. We noticed that Amplify suggests Secure Remote Password as the default.
I can understand the benefits of SRP for protecting ...
2
votes
2answers
86 views
Why should password reset link be single use?
Reading from here: https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html
It mentioned that password reset link should be single use and expire after appropriate period. I don'...
6
votes
2answers
2k views
How are website passwords cracked? [closed]
What approaches are there for cracking user passwords for website/e-mail accounts? can only think of three strategies, but what else?
Algorithmically: Combinatorially attempting different sequences ...
2
votes
1answer
50 views
Buffer overflow outside gdb
I'm trying to exploit a basic C program (below) which I've written:
#include <stdio.h>
#include <string.h>
void main()
{
char ch[10];
scanf("%s", ch);
if(strcmp(&...
2
votes
0answers
49 views
Why does firebase encrypt with password hashes instead of storing the hashes?
I am trying to migrate off of firebase, as in doing so, you can export the hashes of user passwords. Looking at their algorithm, they do not store password hashes, but rather, they use the first 32-...
0
votes
1answer
107 views
How Forgot Password Works?
For my website I need to add "forgot password" functionality. As I searched on the internet there are too much vulnerabilities you may encounter in case of wrong implementing this ...
1
vote
1answer
115 views
Why don't security conscious websites use a combination of private unique identifier and password to secure their logins?
To be clear when I say "private unique identifier" I mean an identifier, which is not stored on the database for the website, it would be hashed in combination with the password and a good ...
-1
votes
1answer
84 views
Does Password Harvesting Happen in Servers?
Maybe someone can explain why my concern is not realistic. If I create a browser-based app with a login (let's say I'm Facebook or Microsoft), why wouldn't I store all the wrong passwords people type?...
1
vote
2answers
66 views
Find encryption key with password and output
One of applications I use has a password manager feature included in it. I can add logins to the password manager and they get stored in a .ini file (for simpler login purpose, I can select an account ...
0
votes
1answer
72 views
VPS host shows plain text “root” account password upon reinstall of unmanaged VM
I recently started using a VPS hosting service, that offers unmanaged VPS. It allows me to reinstall the VM at any point in time, choosing from a number of OS ISO files (doesn't have to be the same OS ...
0
votes
1answer
89 views
Knowing when a hacked password is correct
I was recently a victim of the any van data breach and so I started read up on password encryption and security - it is pretty amazing stuff. One thing that confuses me though is, since GPUs can now ...
0
votes
0answers
46 views
Does an OpenVPN client attemtping to connect a wrong server IP poses a security risk?
I have an OpenVPN server setup at home and the public IP address I get from my Internet Service Provider is dynamic, not fixed. In the configuration file of a VPN client, the IP address of the server ...
1
vote
1answer
63 views
Config file contains password hashes and signature keys
First, I am a beginner in IT security. I hope my question is not too dumb.
I use a program that can show a live feed from a security camera. You can import a project file, that sets up user accounts ...
0
votes
0answers
52 views
Trace Unauthorized login into My Gmail and Facebook Account [duplicate]
I have experienced an unauthorized login into my Gmail and Facebook account, while I was logging into the accounts and doing school assignments. Suddenly, I got an email from Facebook about "...
1
vote
1answer
72 views
Why the need to hardcode passwords? [closed]
Many IOT devices and routers manufacturers hardcode plaintext default passwords in their devices.
Why don't they store the hashed password instead?
For what functionality do they need the plaintext ...
1
vote
2answers
124 views
Why don't companies just tie the password to the user name?
One problem with passwords is that if they can be broken as follows:
pick a random password
hash it
compare that hash to other known hashes
This way, you have broken the password. Then if you can ...
