Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
4,040
questions
0
votes
0
answers
16
views
Is the Windows PIN sign-in option good protection in case of device theft? [duplicate]
I've been hearing stories about people suffering apartment break-ins. This made me think about what might be stolen from my apartment if something similar happened, and the desktop computer certainly ...
1
vote
1
answer
96
views
Is there a private, secure and easy login system?
I am trying to figure out the implications of authentication technologies. Answers to a previous question indicate my real question is more "meta than that.
The primary requirements for an ...
- 323
1
vote
2
answers
135
views
Why shouldn't I use the OAuth password grant if I have to implement a custom username+password login anyway?
I'm building a web REST API. Users must be able to authenticate themselves to this API.
I don't know ahead of time which clients will want to use the API. I want to allow for the possibility of anyone ...
- 11
22
votes
4
answers
9k
views
Whats the safest way to store a password in database?
I read that a password and a salt needs to be combined and then hashed. You save the result and the salt in plaintext. Is it a good practice to use the username as a salt? Why and why not?
I also read ...
- 349
15
votes
4
answers
5k
views
What prevents a browser from saving and tracking passwords entered to a site?
Since we are accessing Gmail from the Edge browser, Microsoft could have access to the Gmail password. Theoretically, Microsoft can track this password along with sending it to Gmail servers. What ...
- 453
1
vote
1
answer
38
views
Using a mask for Aircrack [duplicate]
I have been using aircrack with an old router of mine I have given it a password from one of my old networks. It has a simple convention; two numbers, a keyword with a capital at the start then two ...
1
vote
1
answer
74
views
After Flashing BIOS -> Password protection still enabled?
can someone confirm whether it is normal for the BIOS password protection to remain active and unchanged after performing a complete BIOS firmware upgrade? My assumption was that the entire flash ROM ...
- 43
1
vote
1
answer
151
views
Storing multiple hashes of the same password
My application requires users to connect via different protocol that each have different auth flows and hash requirements, in particular Argon2 and SHA-256 (for SCRAM-SHA-256).
To allow both types of ...
- 113
0
votes
1
answer
116
views
Strange way of handling forgotten password
I was about to signup for ebanking solution, but then noticed their instructions for forgotten password are: Create a new account.
So there's no option to reset your password, just a suggestion to ...
- 103
0
votes
1
answer
83
views
Passing password through terminal when using pass + gpg
I'm planning to use the pass to store passwords for a web service. My service will need to store passwords for many database servers. So my idea is store these passwords with the Linux pass command. I ...
- 3
0
votes
2
answers
132
views
Multiple Layers of Hashing when storing passwords [duplicate]
A common principle in InfoSec is Defence-In-Depth.
When encrypting sensitive data, it might make sense to have the data encrypted a few times.
Veracrypt does this for example with the AES-Twofish-...
- 713
0
votes
3
answers
223
views
How dangerous is it to Google my password? [duplicate]
I have heard numerous, numerous times that Googling your password to anything (like is Pass124 a good password), is a very bad idea- and surprisingly there is no question (that I could find) on this ...
- 1,496
1
vote
1
answer
114
views
Is there any reliable information on how many places make the mistake of storing passwords in plaintext?
I think the risk of passwords being stored in plain text (or easily reversible encryption) is well known. I'm curious though how frequently does it actually happen? Has there been any study or ...
- 115
1
vote
1
answer
126
views
How effective is re-entering your password to enable high-risk functions on your account when autofill is always available?
Websites ask for passwords to ensure you are the account owner before you make changes to high-risk settings, but autofill works all the time, even when the browser is in Incognito mode.
If someone ...
- 121
19
votes
2
answers
4k
views
Could a Google Chrome extension read my password?
I am concerned about the security of my passwords while using Google Chrome extensions. Specifically, I'd like to know if it's possible for a Chrome extension to read passwords that I enter on ...
- 301
2
votes
1
answer
124
views
Can I add salt to my salt for password hash? [duplicate]
Following this tutorial, I got a bunch of questions with this code :
const crypto = require("crypto")
async function hash(password) {
return new Promise((resolve, reject) => {
...
0
votes
1
answer
81
views
Is there a good case of passwords to be hidden on the screen to the extent it is? [closed]
In the olden days most computer displays involved a coaxial lead attached to a cathode ray tube. This functioned as a radio transmitter of what was displayed on the screen. I understood the response ...
- 323
-2
votes
1
answer
234
views
Why are passwords in the Linux terminal unmasked? [closed]
When entering a password into the password field in a Linux terminal- the password is just in the clear!
This is a commonly known fact.
But what if I'm in public, like in an office, and need to enter ...
- 1,496
2
votes
0
answers
59
views
Is it possible to create a random alphanumeric password with built in error detection? [closed]
A friend told me about a giant alphanumeric password that he had to enter somewhere. Although he was initially worried that he would need multiple attempts due to typos. He was pleasantly surprised ...
- 121
22
votes
3
answers
5k
views
Is there a problem with having a combined login/register screen?
I am designing a new login/register process for a system and want to combine the 2 initial pages for register and login.
This would be one page where the user would enter their email and press '...
- 221
4
votes
3
answers
2k
views
How to track PBKDF2 progress?
Background:
We have an application with password authentication. We now need to raise the number of PBKDF2-iterations and this means that the login takes quite a bit longer than before. Therefore, ...
- 533
2
votes
8
answers
496
views
Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password?
Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password? If so, can you give me a password cracker specifically designed to crack non-keyboard characters? If yes, do you think it will crack this one?
- 21
2
votes
0
answers
391
views
I linked an account with Plaid. If I change my username and password, will that mostly protect me in the event of a breach?
This is very similar to this question from 5 years ago, but I didn't see a clear answer: Is Plaid safe if I change the password after deposit?
I've linked an account with Plaid. That account is 2FA ...
1
vote
1
answer
200
views
Recommended way to store password that needs to be used as plaintext?
I'm making an application that logs multiple accounts into a game server. I'm able to do this by passing in the username and password as argument parameters to the game executable.
Unfortunately, I ...
15
votes
4
answers
6k
views
Security of a non-random password but that relies on information an attacker cannot possibly know
I am trying to figure out whether a non-random password that relies on information an attacker cannot possibly know can be secure.
To give an example, let’s say that I generate my password by putting ...
- 569
4
votes
1
answer
751
views
Find password decryption used in MSSQL
I have the 2 encrypted passwords in my MSSQL database and I'm trying to decrypt it. Here's one of the encrypted password:
E4-68-3F-BE-91-CC-BE-B9-27-4B-18-B1-5F-1B-39-66
The password to the above ...
- 143
2
votes
2
answers
191
views
"Strong password” leaked message
The Safari browser can suggest and remember strong passwords: 18 random digits and uppercase/lowercase letters separated by hyphens.
The browser also tells you if you use a password that is known to ...
- 2,583
1
vote
0
answers
72
views
Hashcat when account name is "Not a real account" [closed]
Couldn't hashcat be applied to godbolt.org given this file data?
/etc/passwd
ce:x:10240:10240:Not a real account:/app:/bin/bash
/etc/shadow
ce:$1$rockyou$hty8SH9lK4mcCQXKENxaa1:18723:0:99999:7:::
...
- 111
0
votes
0
answers
78
views
Is Windows 10 'Backup and Restore' sending my password in plaintext on unencryped link?
[Note: I have a Windows 10 system in an air-gapped network as the only computer on the network where it is the acting "server", as part of an RMF-compliant, DAAPM (link to PDF on dcsa.mil) ...
0
votes
2
answers
120
views
Alternatives for password where at least one secret is not know by the server, with similar transparency
Some service like Bitwarden use the password to encrypt part of your personal data, so that nobody except you can access it, and they archive this because the server only gets your password's hash ...
- 103
0
votes
0
answers
22
views
How to recover my password from my file.key [duplicate]
I don't remember my passphrase for my PGP key that was created several years ago.
How can I decrypt my file.key to recover it?
Or what should I do to recover it from my file.key?
0
votes
4
answers
3k
views
Can somebody explain simply why crypt of a password with a salt (the hash result) is equal to crypt of the password with the hash result itself?
Can somebody explain simply why crypt of a password with a salt (the hash result) is equal to crypt of the password with the hash result itself ?
Surely there is a simple mathematical explanation. I ...
- 41
-1
votes
1
answer
348
views
bruteforce local software's password
There is a lot of online tools to bruteforce online server like hydra and offline with hashes like hashcat. Yet it seems very weird that there is not a single offline bruteforcing app for software. ...
0
votes
0
answers
74
views
Assessing the Implications of Using msoffcrypto for Open Sourcing a Medical Data Processing Pipeline
I am in the process of creating a Python pipeline intended for reading and processing sensitive medical personal data from password-protected Excel files. The pipeline utilizes the msoffcrypto library,...
- 1
0
votes
1
answer
194
views
Online password generator vs. offline counterparts? Are there widely adopted guidelines/recommendations?
Are there any widely adopted guidelines/recommendations in regard to online password generators? Are they recommended over offline generators, for example? If so with what justification?
References ...
- 1,672
2
votes
1
answer
403
views
Why would website block password manager auto-fill?
I use a password manager and have a browser plugin installed for it to simplify entering passwords into websites. I recently encountered a website (enterprise SaaS solution I use at work), which ...
- 271
0
votes
1
answer
168
views
FFUF command returns status code 400, regardless of mode option: clusterbomb, pitchfork, sniper
I'm working on a lab on PortSwigger.com titled Username enumeration via different responses. While using ffuf to solve the lab, the output keeps returning a 400 status code.
So far this is what I've ...
- 103
2
votes
3
answers
229
views
Should my password contain part of the service's name?
Let's assume that I have chosen a password X which is both hard to guess and easy to remember.
I have the feeling that instead of using X for, say, Gmail, Stackoverflow, Ebay, ... I could use gX, sX, ...
- 463
0
votes
2
answers
358
views
XKCD #936 Why not both?
This "correct horse battery staple" XKCD comic #936 was a topic discussed here already. However, I saw no one suggesting combining the second method of using dictionary words with an "...
- 1
0
votes
1
answer
122
views
Are Apple TOTP verification codes the HOTP secret?
Apple provided the capability of using TOTP within iOS itself and I noticed there was a section for Use a verification code on a website or in an app which bypasses the QR Code.
My question is whether ...
-2
votes
1
answer
196
views
Biometrics the only real security
Since 2FA exploits are increasing, and most end-users are hellbent on using the least secure passwords available, are biometrics the only real security left?
- 11
0
votes
2
answers
814
views
If someone knows your wifi password AND is out of wifi range, does it present any particular risks?
This is a close matchup for If someone knows your wifi password can they hack your router?
I gave someone my general (not the guest-specific) wifi password, but they flew home to another continent. ...
0
votes
3
answers
208
views
Is using TOTP from Authenticator app on a mobile device instead of passwords inherently 2FA?
A related discussion can be found, specifically addressing the security implications of using only TOTP for single-factor authentication However, in my view, using a TOTP code from a Google ...
2
votes
0
answers
270
views
Windows AD - Fake User Account with Multiple Passwords to Detect Password Spray
TL;DR
I'm trying to implement a fake user account that has multiple sets of credentials that can be used. Instead of a specific password, any one password from a list of them could be used to ...
- 21
2
votes
1
answer
193
views
Does not storing passwords in browser really matter given cookie hijacking exists?
I see lots of articles suggesting not storing passwords in the browser, and it made perfect sense to me, if I can access this data easily, an attacker probably can too.
But then I found out about ...
0
votes
1
answer
208
views
Does 7z or RAR5 offer better resistance to brute force attacks?
Does 7z or RAR5 offer better resistance to brute force attacks?
- 1
4
votes
0
answers
300
views
How does Google Chrome's "Warn you if passwords are exposed in a data breach" feature work?
This feature is enabled by default. It says the usernames and passwords would be encrypted before sending to google. But google would know the encryption keys it used and to compare it with leaked ...
- 41
0
votes
1
answer
359
views
Verification of Password without Storing Hash - Security Considerations
Question:
I am working on a password-based file encryption and decryption system in Python using the PBKDF2 key derivation function and Fernet encryption. I have a specific requirement: I want to ...
2
votes
1
answer
420
views
Why don't bank verification services use OAuth
I'm going off of this answer, but asking a new question since that's quite old.
It seems to be becoming more common for banks or other "legitimate" institutions to want your banking username ...
- 121
0
votes
1
answer
125
views
base64 encoding inflight credentials
I did not like how my password and other credentials could be viewed in the browser developer console when passed from a form to my api authentication service. So I'm now base64 encoding using atob() ...
- 101