Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
3,380
questions
1
vote
0answers
34 views
Can the cost factor be changed of Windows' credential cache?
I'm having a hard time finding relevant documentation from Microsoft (or any third party, for that matter) about any registry key that may change the cost factor of cached credentials.
One can ...
34
votes
8answers
7k views
Is it a mistake to use a password that has previously been used (by anyone ever)?
A few months ago, kutschkem answered a question about HIBP with this:
Let's say every person on earth has used ~1000 passwords so far. That makes approximately 10 trillion passwords, which is ~243 ...
2
votes
0answers
22 views
Credential Storage for Partner/Vendor Accounts
We work with many other companies to do data exchange. As an example, we might work with COMPANY A to send them sensitive data over SFTP. This would be done by them giving us an SFTP Host/Account/...
2
votes
0answers
36 views
How do biometric password managers work?
Many password managers for mobile offer the option to unlock the password vault with a fingerprint instead of a password. If you never type in your master password, how is it possible to decrypt the ...
3
votes
1answer
73 views
Password seal by paper or by password manager?
At my current company, the IT Risk team decided to ensure root passwords of about 90 systems by the following conventional method:
The length of each password must be 16 characters, where they input ...
3
votes
1answer
60 views
Password strength when used with 2FA
We have two factor authentication, with passwords and one time code received on SMS.
Now normally I know you could restrict users to create passwords with min 8 character length, lower and caps ...
10
votes
4answers
4k views
How can I check password strength client-side?
I have a website and my users will be using their selected password to encrypt their RSA private key using JavaScript client-side. How should I be making sure they are using a strong password without ...
0
votes
0answers
46 views
Password management with an always password hidden [closed]
Is there any password management application which hide permanently password for non adminstrator user, even with at autocompletion on web browser ?
The idea is to keep password secure from users, ...
0
votes
3answers
122 views
Providing password review results to auditors
The IT Security department is getting audited and the auditor had approached our IT Security team and requests to see results of the password review process, which compares existing database of ...
0
votes
1answer
62 views
What are the steps of hashing and steps of verifying password using salt and key? [duplicate]
What are the steps of hashing password during registration and login to an application using salt and key?
Are the following steps considered correct if applied to an application?:
1- During ...
1
vote
0answers
61 views
Hosting password compromised [closed]
Last Monday I received two emails from my hoster:
10h42: Connection notification
10h42: Confirm your notification
I didn't login that day, so I knew something was wrong. I immediately logged in, ...
-1
votes
1answer
85 views
during login to a system is it better to compare the registered encrypted password with the inserted password after encrypting it or the opposite?
During login to a system, is it better to compare the registered encrypted password with the inserted password after encrypting it
or
compare the inserted password with the registered password after ...
0
votes
0answers
8 views
Access to a machine mistakenly deleted from AD [migrated]
I mistakenly deleted a machine (WINDOWS 10) from my company's AD domain, the PC is in the office in Istanbul and I am in Italy, we use a local administrative password generator with expiration so the ...
3
votes
1answer
126 views
Which user authentication measures are used nowadays?
I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, ...
2
votes
1answer
79 views
How to configure .NET's PBKDF2 implementation (Rfc2898DeriveBytes) in 2019?
I want to use .NET's Rfc2898DeriveBytes functionality in order to store my passwords in a database. In order to use it, I still need to make several decisions which will influence the level of ...
2
votes
1answer
154 views
How to store a user's password in a database in 2019? [duplicate]
This question, but focused on .NET's given PBKDF2 implementation, has been asked here now.
Situation
I am currently updating a password storage mechanism for a website.
My plan for storing a ...
0
votes
0answers
88 views
John the Ripper Custom Dynamic Hash Function Usage
I have created a custom dynamic hash function comprised of a series of different existing hash functions chained together. I'll spare you the exact details because it's for a class assignment.
I've ...
-1
votes
0answers
38 views
What should be minimum password length for security today? [duplicate]
What should be mimimum user password lenght for security today if we use uppercase, lowercase, number and special character?
1
vote
1answer
80 views
Can 2FA / MFA be secure & functional in a purely offline state (PWA)?
I'm building a Progressive Web App intended to be used primarily in an offline state. The user can "login" while disconnected, which verifies the password against a locally-stored hash and some other ...
0
votes
4answers
122 views
Attacks on password-based encryption
Frequent attacks on password-based encryption are dictionary attacks with special hardware. I suspect that this is the only promising attack on the ciphertext. Is that correct?
Another attack ...
1
vote
1answer
86 views
Password hashing with salt. Where do you leave the salt? [duplicate]
I want to hash a set of sensitive data using a hash+salt. I've done a little research and now I know that:
The salt should be random.
The salt should not be reused.
Using hashing without salt makes ...
3
votes
2answers
125 views
Is it true that argon2i is “preferred for password hashing and key derivation”?
I was looking at the wiki for the node-argon2 package in npm, when I came around this justification for using argon2i as the default mode:
The variant of the hash function. Argon2 has several ...
2
votes
0answers
35 views
Link for username & password dataset [closed]
I want to know links to download "username and password" dataset for my research.
I want to create a big dataset of 100-200MB for my research.
1
vote
0answers
43 views
Security of the native Password Autofill function in iOS 12
I have read Apple documents on the iOS 12 password autofill function for iPhones. But I could not find much information pertaining to where the passwords are stored and what vulnerabilities might ...
1
vote
2answers
89 views
PCI DSS compliance on storing email body in database which contains plain text password
I work in a PCI DSS certified environment, which (as many secure environments) require 'Strong Cryptography' when storing user passwords, as per requirement 8.2.1. We simply hash them using BCrpyt.
...
2
votes
4answers
151 views
Can you set up 2FA with a USB drive?
I want to set up two factor authentication for some of my online accounts. I don't want to install an app, and I don't like using my phone as the physical medium anyway, because it's more likely to ...
68
votes
3answers
12k views
Got an email saying my password is weak, reason for concern?
I recently received an email from a well-known company stating that the password I use is weak and can be easily guessed.
The email seems legit with no attempt to steal information, they only say "...
2
votes
2answers
120 views
User passwords printed on paperwork at a dental office?
My dental office just printed my user-defined password (not a first or one-time password) to their portal on some checkout paperwork.
I asked on Law.stackexchange and it doesn't sound like this is a ...
0
votes
0answers
18 views
What are the vulnerabilities of the autofill feature in iOS 11 and later?
iOS 11, 12, and later offer an autofill function from the iOS keyboard for specific apps enabled for the function. I have read Apple's documentation and it appears that the passwords are stored in the ...
0
votes
3answers
127 views
Will it be safer to use self sign CA and client certification in the company for a private website?
Our company have 10+ private websites and 20+ person and need to open a different one automatic when the developers are testing some functional. We do not want anyone outside the company to view the ...
0
votes
2answers
68 views
Windows Account Password Resetting process for large network
I am working on large windows based network environment (Active Directory) and I have a requirement of implementing clear and secure password reset process for windows user. Especially management ...
2
votes
1answer
25 views
Do Xfinity hotspots require passwords?
There's a Xfinity hotspot(xfinitywifi)that I see on my phone that I occasionally use for reasons but lately it has been acting up so I contacted Xfinity customer support. They asked for some stuff ...
1
vote
3answers
249 views
If no one knows a password, is there a reason to change it?
Scenario: A high level access account on a single machine, where the account is created by the system/application with a secure password, without exposing the password to a human or to any other ...
0
votes
0answers
34 views
How long shall a password be to resist a botnet brute force? [duplicate]
Imagine that I'm an evil genius, and I had the brilliant idea of creating a botnet for brute forcing passwords. Or I'm just the owner of the Echelon, and I have a farm of distributed servers around ...
1
vote
2answers
56 views
How can SubtleCrypto help in the process of sending a password via HTTPS?
I heard from someone that SubtleCrypto should be used in client-server communications to login and register, then he told me it would be useful even if someone took control in the middle of the HTTPS ...
1
vote
1answer
88 views
Will using CTR mode with unique IVs, but only one password for encrypting multiple files, leak data or keys?
I'm working on a project to encrypt many files with a single password.
The steps I will employ to encrypt the files are:
user will execute a command similar to tool --encrypt --recurse directories/...
4
votes
3answers
383 views
As a website admin I could see encrypted passwords. Is this ok?
I am building a website that requires the users to login through username and password. I have the passwords encrypted in my database with bcrypt. On the back end, I receive the usernme and password ...
5
votes
2answers
1k views
Putty store cleartext credentials in the Windows Registry; isn't that a very insecure approach?
I have been astonished when I've found that one of the most popular SSH client Putty stores cleartext credentials in Windows Registry:
HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\
...
0
votes
1answer
71 views
How should we apply the salt to the password? [duplicate]
According to Wikipedia:
A rainbow table is ineffective against one-way hashes that include large salts. For example, consider a password hash that is generated using the following function (where "|...
0
votes
1answer
48 views
Quantify security strength from entropy and lifetime
Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
0
votes
0answers
54 views
Securely distributing passwords and salts that will be derived by client programs
I am creating a client-server architecture running on top of the KCP protocol in Go. The package for KCP that I'm using is KCP-Go (https://github.com/xtaci/kcp-go). The package supports packet-level ...
3
votes
1answer
119 views
Can having certain restrictions/rules make passcodes less secure?
Say I have a phone whose security is corporately managed, and this management demands that I use a 6 digit passcode to lock the phone. So far, so reasonable. This gives an attacker a possibility of 1,...
1
vote
1answer
94 views
Is it safe to leave MySQL root user without a password if it uses auth_socket?
Since MySQL 5.7, the root user is configured to use the auth_socket authentication plugin instead of a password.
Is it safe to leave the root user that way (without a password)?
1
vote
1answer
118 views
How to store user credentials in browser securely?
I need help to authenticate User with user credentials.
We are using Angular 5 as a front-end & need to store user's email and password if user checks on remember Me. autofill user credentials ...
1
vote
1answer
59 views
Does digested passwords send over a non encrypted channel offers additional security over plain text passwords?
I am learning about WS-Security and trying to compare different options offered by UsernameToken as described in this document.
AFAIK, a digested password is a hash of the plain text password along ...
0
votes
4answers
191 views
What is the best way to store a password on a system/server? [duplicate]
I will have an application server that needs to use credentials to authenticate to another service (email). What's the best way to securely store these credentials locally on the machine?
Thanks in ...
0
votes
1answer
117 views
Security concept for password management
At the moment, I am struggling on a question to which I have not found a good answer so far.
I wan't to create a password manager, which will be used by a lot of people.
Used languages: PHP / ...
0
votes
0answers
82 views
What authentication systems have been involved in data breaches?
Recently, a Federal Judge ordered Marriott to reveal the forensics report for its data breach. I know the Courts have sided with businesses in the past to keep the forensic details of breaches from ...
0
votes
2answers
69 views
Does a user password protect against network attacks, or only physical?
If I create a user in a Linux system with an empty password, does that expose any remote vulnerabilities, or is it only a problem if someone gains physical access to the machine?
3
votes
2answers
121 views
How strong is a password consisting of words arbitrarily chosen from the dictionary?
Diceware wants us to actually randomly pick n words from a given set of m=65 words.
Assume a user does not actually use a dice. Instead they take a physical dictionary of m words and "randomly" picks ...
