Questions tagged [passwords]

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

Filter by
Sorted by
Tagged with
0 votes
2 answers
40 views

Is using TOTP from Authenticator app on a mobile device instead of passwords inherently 2FA?

A related discussion can be found, specifically addressing the security implications of using only TOTP for single-factor authentication However, in my view, using a TOTP code from a Google ...
Luka Demetrashvili's user avatar
2 votes
0 answers
95 views

Windows AD - Fake User Account with Multiple Passwords to Detect Password Spray

TL;DR I'm trying to implement a fake user account that has multiple sets of credentials that can be used. Instead of a specific password, any one password from a list of them could be used to ...
CyberKnight's user avatar
1 vote
1 answer
84 views

Does not storing passwords in browser really matter given cookie hijacking exists?

I see lots of articles suggesting not storing passwords in the browser, and it made perfect sense to me, if I can access this data easily, an attacker probably can too. But then I found out about ...
Arthur Moraes Do Lago's user avatar
0 votes
1 answer
91 views

Does 7z or RAR5 offer better resistance to brute force attacks?

Does 7z or RAR5 offer better resistance to brute force attacks?
oqdn's user avatar
  • 1
4 votes
0 answers
159 views

How does Google Chrome's "Warn you if passwords are exposed in a data breach" feature work?

This feature is enabled by default. It says the usernames and passwords would be encrypted before sending to google. But google would know the encryption keys it used and to compare it with leaked ...
eee's user avatar
  • 41
0 votes
1 answer
169 views

Verification of Password without Storing Hash - Security Considerations

Question: I am working on a password-based file encryption and decryption system in Python using the PBKDF2 key derivation function and Fernet encryption. I have a specific requirement: I want to ...
Patrickliu's user avatar
1 vote
1 answer
153 views

Why don't bank verification services use OAuth

I'm going off of this answer, but asking a new question since that's quite old. It seems to be becoming more common for banks or other "legitimate" institutions to want your banking username ...
Silvio Mayolo's user avatar
0 votes
1 answer
67 views

base64 encoding inflight credentials

I did not like how my password and other credentials could be viewed in the browser developer console when passed from a form to my api authentication service. So I'm now base64 encoding using atob() ...
Martlark's user avatar
  • 101
0 votes
0 answers
95 views

Optimal way to securely store password on client with server invalidation but not knowledge

A number of similar questions have been asked about this general topic before (e.g. How to store user credentials in browser securely?), but I wanted to seek some clarification on a specific scenario. ...
InterLinked's user avatar
0 votes
0 answers
88 views

Is ISP sending WiFi password in plain text to phone necessarily a bad sign?

The new router I was given by my internet and phone provider can only be configured via their website. I logged in and went to the page where you can set things like the SSID and password for the WiFi ...
insecure's user avatar
0 votes
0 answers
69 views

Choosing Encryption Strategies for Secure Long-Term Storage of Sensitive Data

When considering external drives for secure long-term storage of sensitive data, what are the pros and cons of using the same password for encrypting all files versus using random passwords for each ...
S. G.'s user avatar
  • 163
0 votes
1 answer
67 views

Best method to store common passwords with multiple users

I've looked around and not seen any solutions to this problem I work for a company as an automation engineer keeping a network behind a DMZ. I have an AD, switches, etc. We have local passwords for ...
user2304953's user avatar
1 vote
1 answer
179 views

Best login flow for username and password authentication

I've been reading countless articles about login flows and what's the best for user auth, but it's all even more confusing now. My scenario: I have a simple app (capacitor spa) that has a simple ...
HRdev's user avatar
  • 13
0 votes
5 answers
464 views

Optimal password minimum length requirement? (In particular, does a 15 character minimum make sense for most university users?)

Is there any professional consensus on what the optimal password minimum length requirement should be? The University of Michigan recently implemented a 15 character minimum for all users. To me (...
user103496's user avatar
-4 votes
1 answer
148 views

How can Linkedin access my account without asking for my password?

A few days ago, I contacted LinkedIn support for an unrelated issue. They didn't provide any help with the issue at hand and instead responded with this : Do we have your permission to log in to your ...
Astariul's user avatar
  • 109
0 votes
0 answers
37 views

Need a way to share credentials for different clientele

I am an independent technology consultant, and I am running into a worrying and recurring issue with my customers regarding sharing account information. Many solution we use I am able to be added as ...
user297809's user avatar
0 votes
2 answers
117 views

Extract Keepass password generator dictionary [closed]

Can I extract a dictionary list from the keepass password generator as my senior forgot his master password?
ligma_ball's user avatar
5 votes
4 answers
603 views

How important is it for WiFi passwords to be secure?

Anecdotally, I've noticed that many people's WiFi passwords (based on visiting their homes, etc.) don't seem terribly secure; they're usually fairly short and don't always contains numbers or special ...
Very Tiny Brain's user avatar
0 votes
2 answers
132 views

Should I be concerned that my bank told me that I have a strong password? [duplicate]

I recently ran an account security check through my bank's web site, and my bank "reassured" me that I have a strong password. Should I be concerned that they know that? I had assumed that ...
Very Tiny Brain's user avatar
0 votes
0 answers
46 views

What are password encryption schemes that result in variable length common in MySQL and PHP?

I have stumbled across passwords on a MySQL database behind a PHP webapp. Here are some examples. 753a524d56b48d825328ce27 789e0ad30d15 7ba0868c23e0a2 d327e265ca2abcd7c 48276b3d5618850 ...
knods's user avatar
  • 1
0 votes
0 answers
29 views

Bank employees asked random 2 characters of password during verification! [duplicate]

Let me ask to experts how bank BBVA and Santander en España can check dedicated digits of my password during call to their hot line? They said me that it is verification procedure but I am not sure it ...
Oleksandr Ismailov's user avatar
0 votes
1 answer
69 views

Is Edge (Enterprise) Password feature less secure than open source local password manager? [closed]

For Enterprise, how to know if Edge Password AutoSave is less secure than copy/paste to a desktop password manager which is open source? IMHO Edge should be more secure because: copy/paste has ...
panes-rubrics's user avatar
1 vote
2 answers
416 views

Encrypted 7z file password not working

I'm in an interesting predicament. I have an encrypted 7z file that I made myself. The password for the file is a 60 character generated password that I saved to my password manager. I made sure to ...
CSstudent's user avatar
  • 113
0 votes
0 answers
59 views

Is pass -> [via pbkdf2] -> seed -> ECDSA key pair better than pass(word) hashing?

For a web service, I am considering generating random 25-49 recovery codes as a kind of pass that can be stored in a pass manager (no usernames). Instead of pass(word) hashing on the server, I ...
r j's user avatar
  • 101
0 votes
0 answers
57 views

Passkeys versus passwords for intranet websites

Do passkeys offer more security for intranet websites compared to passwords? I know there are additional methods like 2FA to get more security, but I just want to look at a optional replacement for ...
fitcfitcfatc's user avatar
1 vote
1 answer
320 views

Where are wifi passwords stored? [duplicate]

I'm looking for technical details on how Windows, Linux, and macOS all store the SSIDs and passwords for every wireless network you've ever connected to. I've tried searching for this, but my Google-...
Wes Sayeed's user avatar
0 votes
1 answer
91 views

Is using the computer for MFA safe?

Recently, I discovered that MFA apps just calculate that codes based on a private key and the time clock, so it's easy to use tools like gnu pass to replace those apps with your computer. But what are ...
Vitor Figueredo Marques's user avatar
0 votes
0 answers
90 views

How does user activity affect entropy generation process in GnuPG?

Earlier today, I was using gpg to generate keys for work. While doing so, I noticed: We need to generate a lot of random bytes. It is a good idea to perform some other action (type on the keyboard, ...
Rahul Dixit's user avatar
1 vote
1 answer
72 views

Key Hash With Securely-Optimal Setting : For Encryption vs For Password

Do you have to make a key hash with securely-optimum setting (eg. 100MB memlimit, 3 opslimit) for encryption ? So I'm making a text encryption function with javascript, using XChaCha20-Poly1305 and ...
Agus Setiawan's user avatar
1 vote
0 answers
942 views

John not cracking an NTLM hash

I have been trying to do it with john the ripper as the following: john --FORMAT=NT --wordlist=~/usr/share/wordlists/rockyou.txt hash.txt the hash I am trying to crack is: Computer:1001:...
kimemo 000's user avatar
1 vote
1 answer
206 views

Can I protect against password shucking just by salting the pre-hash?

I'm working on a new web app, and I chose Bcrypt to hash the passwords. To overcome the 72 byte limit on Bcrypt, I'm planning to pre-hash the passwords with SHA-256. However I researched a little and ...
enxg's user avatar
  • 13
0 votes
1 answer
213 views

What's stopping attackers from brute forcing SSH passwords over new sessions?

I know that when you attempt to log in to a device via SSH, upon inputting an incorrect password, you must wait several seconds before you get another attempt. This is obviously a deterrent against ...
Blue Herring's user avatar
0 votes
1 answer
47 views

libxcrypt "failure token" *0

An number of years ago, the libxcrypt project has decided to change the crypt interface such that instead of returning a null pointer on failure, it returns a valid string starting with *, such as *0. ...
Kaz's user avatar
  • 2,295
0 votes
1 answer
112 views

One Time Password Mobile phone authentication

Can the Mobile phone One Time Password authentication be alphanumeric with special characters? If Yes, There will be more pros and less cons with increased security? One Time password Can a One Time ...
Prashant Akerkar's user avatar
3 votes
0 answers
186 views

Can a bad guy ever get access to my gmail account using ONLY the 2fa app or ONLY the recovery phone (plus username)?

Let's say X is a malicious person. Let's say I have a gmail account with a recovery phone and with 2fa enabled. Let's say X knows the username but not the password. X doesn't have any other ...
capet's user avatar
  • 131
0 votes
1 answer
61 views

How does increasing minimum password length affect the size of password space?

I understand that when there are a possible characters and passwords must be of length n there are an possible passwords. But usually passwords can vary in length between some minimum and maximum ...
jtw's user avatar
  • 1
1 vote
1 answer
80 views

Would asking for user input email again in password reset increase security?

I have a workflow like this right now: User inputs the account email and clicks the "forget password" button User receives an email containing a link with token for password reset User ...
John Winston's user avatar
1 vote
1 answer
174 views

What are the risks of reusing the same passphrase for FDE, user account, and password manager?

Consider a home user who runs Linux on a laptop with full-disk encryption and uses a cloud-based password manager. Assume the laptop is firewall-protected with no SSH access. It seems reasonable to ...
jth's user avatar
  • 123
0 votes
1 answer
86 views

2FA implementation security

I am looking to implement 2FA. I know of duo and eg. Eset secure authentication. But both solutions seem to be implemented in a strange way, that is they require some form of communication with either ...
atapaka's user avatar
  • 461
1 vote
1 answer
145 views

Two different salted hashes of the same password for the same user

I am creating an authentication system that is able to login to the same account with different sets of credentials. I also want to allow users to login with either username or email with the same ...
the Radek's user avatar
0 votes
2 answers
140 views

Is there any good way of calculating a brain-generated password's entropy?

After reading this post, I understand that a password's entropy depends on the assumptions made when it is to be attacked (e.g. if it is generated randomly from a list of 2048 words, etc.). Let's ...
Dan's user avatar
  • 165
1 vote
2 answers
155 views

Why do entropies of passwords significantly differ from site to site?

I read the infamous xkcd cartoon comparing two passwords and their strength. Curious whether their calculation was accurate, I searched many entropy calculators and plugged in the two examples from ...
xk58945's user avatar
  • 11
0 votes
0 answers
106 views

What is the most resistant way to unlock a device

The standard way to unlock a device is with a password. TPMs have improved this to the point that we can create devices that can be unlocked with very short passwords such as PINs and we can create ...
Zaz's user avatar
  • 101
25 votes
4 answers
6k views

Does a password policy with a restriction of repeated characters increase security?

A security value called Restriction of Repeated Characters for Passwords (QPWDLMTREP) can be configured in IBM i. If QPWDLMTREP has a value of 1, then "the same character cannot be used more than ...
John Haire's user avatar
2 votes
1 answer
115 views

Distinguish origin of password prompts

I am wondering how to distinguish (password) prompts that the OS issued from prompts that are delivered application-side. This question first occurred to me when considering Firefox master passwords, ...
kaiyazeera's user avatar
0 votes
3 answers
316 views

Password managing apps seem to have access to my passwords

Keeper used to be free so I had stored most of passwords on that app a few years ago from a past device. When I tried to access the passwords after five years, the app had turned into a subscription ...
Jason Song's user avatar
14 votes
2 answers
4k views

Reasoning behind banning '#' from the start of passwords? [duplicate]

Today, on an official government website, I came across the following password rules: "Your password has to be at least 8 characters long. It can't have any blank spaces. It has to use characters ...
Hazsi's user avatar
  • 141
5 votes
3 answers
390 views

Using Proof of Work to slow down login attempts

For a while I've been pondering a user authentication protocol that aims to ensure that a client does some computational work before the server will attempt to authenticate the password. The reason ...
Cruncher's user avatar
  • 153
0 votes
1 answer
108 views

Security of using Yubikey to derive Diceware password?

I bought a new Yubikey, and am currently setting it up to use on my desktop PC. Previously the PC was secured with password only, and I'd like to use the Yubikey as an alternative: instead of using ...
Danya02's user avatar
  • 163
1 vote
0 answers
463 views

Tool to Decrypt Chrome, Firefox and Edge login information [closed]

Im new to python but Ive created a couple of programs that can collect the user credentials for Google Chrome, Mozilla Firefox and Microsoft Edge and decrypt them then save the decrypted output to ....
Luke Jordan's user avatar

1
2 3 4 5
81