Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
3,668
questions
0
votes
0answers
18 views
Has anyone used BreachDirectory? [closed]
I've seen a lot of large recent data breaches such as Cit0Day.in, which are collections from various places so just knowing that my email or username was contained in the breach (the info that ...
0
votes
0answers
57 views
Isn't this kind of password ultimately secure and insanely easy to remember? [duplicate]
Pick any dictionary word.
Think of a number over 10 and below 20.
Repeat the word as many times as the number, and end off with the same number (for example, "12").
Example:
...
1
vote
1answer
55 views
Allowing a password reset if an account is locked
Similar to another question about keeping an account locked, is it preferable to allow a user to reset their password while the account is locked out due to the wrong password being used too many ...
0
votes
0answers
59 views
Someone hacked my phone how do i protect it [closed]
I fell asleep at a youth center the other night and someone went through my pockets. I woke up and my phones acting weird. I think they copied my phones information and did something to sim card ...
0
votes
1answer
100 views
Password cracking using Quantum Computers
Suppose that I have a password that is n-digits long. Each digit can take m values. So the number of permutations will be m^n. I wanted to know how much time it would take a quantum computer to crack ...
0
votes
1answer
48 views
How password_hash / password_verify can work with any arguments (PHP)
I already know how to use password_verify and password_hash functions, but I don't really understand how they work.
When I use them I do something like that:
$save_hash = password_hash( $password, ...
3
votes
0answers
53 views
Maximum password length for user accounts on Ubuntu
I have a VPS hosted at a remote location. Obviously the host can login directly (without SSH or any keys) on this box and I want to make brute force password guessing as hard as possible for a bad ...
23
votes
2answers
3k views
Why do password requirements exist while limiting the upper character count? [duplicate]
I do not quite understand why it is common practice to require a difficult to remember password with alphanumeric and special character requirements, while also having an upper limit of 32 characters. ...
0
votes
0answers
49 views
Which config files in a linux install contain passwords or other secrets? [closed]
I'm trying to build a list of configuration files that store secrets in Linux. By secrets I mean files that contains passwords, database string connection, hashes etc. The most notable example is, of ...
1
vote
0answers
19 views
Encrypt an sqlite3 database using python [migrated]
I am trying to create a password manager, I have successfully been able to create the encryption key by using a key derivation function on the master-password using PBKDF2 and SHA256. The passwords ...
0
votes
0answers
26 views
Are my browser's stored passwords safe when my Windows 10 User Account has no password? [closed]
From what I've learnt, most browsers which allow you to save passwords for particular forms and websites (e. g. Google Chrome and Chromium-based web-browsers), encode password based on your Windows ...
0
votes
0answers
22 views
How to assess security of Argon2 parameters [duplicate]
I would like to hash user password with Argon2id, then use this hash as ECDSA private key. I made some tests with Python and passlib.hash and found following parameters:
memory: 32 MB
iterations: 100
...
2
votes
2answers
154 views
Can your internet provider monitor your data (passwords, etc?)
Was typing in my password into an HTTPS website when I started to wonder if my home WiFi (whether a neighbor could have hacked into and monitoring it) is secure.
When I type in
Username123
Password123
...
1
vote
1answer
97 views
Why do administrators create passwords vulnerable to kerberoasting? [closed]
I was researching a kerberoasting attack on the Active Directory domain. To create the stand, I used a Domain Controller on Windows Server 2016 and one client machine on Windows 10. SQL Server was ...
8
votes
4answers
2k views
Alternatives for sending plaintext password while login
Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
0
votes
0answers
38 views
Is there a better method that this for storing a physical password? [duplicate]
This may be a little unnecessary, but taking into consideration:
There are many ways to hack a computer
There are many ways to hack a network
There is always a possibility of an undetected malware on ...
0
votes
3answers
104 views
Problem understanding salting
I'm a beginner in Information Security and am learning about salting. Unfortunately, most of the time I have to learn by myself since the lecturer doesn't provide deep explanation on these. I now have ...
0
votes
1answer
50 views
Hydra only executes one try per task then hangs
As in the title, hydra will only execute one try per task before hanging.
$ hydra -l admin -P /usr/share/wordlists/wfuzz/general/common.txt -u 10.10.68.141 http-post-form "/admin:user=^USER^&...
1
vote
2answers
42 views
Why does it take longer for my computer to recognize a wrong password than a correct one when logging in?
When I enter the right password to log in to my computer*, I am in instantly. However, if I mistype it, there is around a 2 second pause. Are there significantly more computations taking place to ...
5
votes
2answers
201 views
Can password managers read my secure data? If no, how does sharing work under the hood?
All the popular password managers on the market advertise that they have AES-256 grade security. In a nutshell, the user has the master key and the password manager has the cipher-text. So the ...
1
vote
0answers
43 views
Good use of libsodium?
I am looking to hash user passwords to store in a database that will likely reside on a user's intranet, so I am expecting the database to be classed as open and insecure.
I am using libsodium 1.0.18 ...
28
votes
4answers
8k views
When passwords of a website leak, are all leaked passwords equally easy to read?
As far as I know, when passwords from a website leak, they leak in an encrypted form. Are all those passwords equally easy to decrypt? My hunch is that a 10-character-long password maybe gets ...
2
votes
2answers
137 views
Recommended length for WPA-2 password in 2020
I'm auditing my network setup and trying to determine an appropriate password length with a random set of digits and numbers. I found a Security Stack exchange answer but it was written in 2012 and ...
19
votes
7answers
6k views
Don't one-time recovery codes for 2FA introduce a backdoor?
Although using multi-factor authentication is clearly a good move, I'm struggling with the 'one-time recovery codes' concept. It seems to me that if you choose to use them, what you're doing is ...
0
votes
2answers
60 views
It is common for an account to be locked after X amount of failed logins, what are the best practice of selecting x?
To my understanding, it is common security practice to lock the account after X failed login attempts in N minute. Usually, the account will be locked for M minutes.
I noticed that most of the time X ...
0
votes
2answers
108 views
What happens if you forget your 1Password password?
When using a service like 1Password, what happens if you forget or lose your master password?
My guess is that you can simply reset your passwords on all the sites 1password remembered for you, but I ...
0
votes
1answer
57 views
Is a QR code with a secret URL that changes every 5th minute secure?
I need to verify that survey respondents are in the same physical room or video chat (to prevent industry espionage). The respondents can join by scanning a QR-code that opens a URL which embeds a ...
0
votes
1answer
78 views
Is there any secure method to have recoverable passwords?
I have a local application that normally authenticates against a remote Active Directory server. If the local host loses network connectivity, a special local account becomes available for login. ...
0
votes
3answers
142 views
Is my login script secure – how to improve it?
I have a login system for my website that works as follows:
In the database I have a table called users with the fields user, password and authentication_token.
user gets set manually by request in ...
2
votes
2answers
126 views
On a single user laptop does it make sense to have a separte password for root and the user?
I have a laptop on which I'm the only user. While installing the laptop I was wondering why I should choose a different password for the root account and user account. My reasoning is:
The change of ...
0
votes
0answers
42 views
Storing account data on device
I am trying to make an app that allows the user to connect to a service through an API I am also developing. All passwords and account data are securely stored on the server.
However, how should I ...
1
vote
1answer
54 views
How do sites detect credential sniffing, and what is the purpose of this attack?
I just got an email from the Unsplash service telling me that someone had logged into my account via credential sniffing:
Five minutes later I get three more emails, each one notifying that a (...
7
votes
5answers
239 views
Owner vs IT employee. Security and passwords
I own a company that has hired an IT employee. He has all passwords to servers, work stations and data. He is refusing to share or supply these passwords (Keys to the Kingdom) on the grounds of ...
1
vote
0answers
45 views
Strange cyrus/imaps Logins without valid password
I found apparently successful logins from a foreign ip-address to our cyrus-imap server:
Nov 24 08:16:20 server-1 cyrus/imaps[12101]: starttls: TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits ...
0
votes
2answers
97 views
Is it possible to find a zip password if it is being generated locally?
I have a program that generates a zip file with a password. Is it possible to determine the password if you analyse the program as it is being run? Would calls to function libraries show the password ...
24
votes
7answers
5k views
Are algorithmically-generated personal passwords a security risk?
We all know why password reuse is bad: eventually some site at which you have an account that did not properly hash+salt user passwords will get hacked, and your password will be published in a big ...
0
votes
1answer
50 views
Is client-side hashing secure during password creation when verification is still done server-side?
Trying to do this to distribute the work of creating a lot of users in which their passwords are hashed. This will cause the server to do a very large amount of work. The idea is this:
(Assume ...
1
vote
1answer
68 views
What is the minimum secure length for gpg -c file.txt?
I want to use gpg -c with a user-generated password that I can easily remember. Are 16 characters enough? for example would a password similar to "I own 32 houses." be bruteforcable?
0
votes
1answer
44 views
Difference between access control systems that can/can't be compromised without valid credentials?
Take the following examples:
When I run sshd, it can in theory grant access to anything that the process itself has access to, regardless of provided credentials. For example, I could in theory ...
1
vote
1answer
75 views
Concatenating secure and reused passwords
Would concatenating (i.e. joining together into one string of text) a secure (i.e. Diceware) password and other, much less random, passwords be a good idea? This new password would be used as master ...
21
votes
3answers
4k views
Does complexity of salt in password hashing matter?
I have no cyber security knowledge whatsoever, and am trying to safely store passwords in a database. I understood I need to use salt, to avoid rainbow table attacks and to make sure two users with ...
0
votes
0answers
19 views
Found out that a paid VPN service emails plaintext passwords [duplicate]
I recently found out that a VPN service does not hash their customer passwords and I need professional insight on how to deal with this.
Here's how I found out:
Bought a subscription on the wrong ...
1
vote
0answers
39 views
Is it reasonable to type a bank password in a phone call to the bank? [duplicate]
Recently my friend called their bank (via a normal phone call) to perform an operation with her account and she had to type her password during the call. Everything worked fine, the operation was done ...
1
vote
1answer
115 views
Using Google Docs to share passwords
Background
Often developers and clients need to exchange passwords to be able to access some services. Of course the best option would be to never use someone else's credentials to log in, and instead ...
0
votes
0answers
67 views
How is Firefox importing credentials from other browsers without the need for the admin password?
Im currently looking into the security of different browser password storing mechanisms. My main focus lies on the new Chromium based Microsoft Edge browser.
As far as I can see, Chromium based ...
0
votes
1answer
112 views
Can I consider files compressed with password safe at all?
A follow up to my 7,5 years old question. Back 10-15 years ago, when I wanted to send an executable file over Gmail from my PC, all I had to do was to change file's extension to some meaningless one ...
0
votes
0answers
34 views
Password leak to malicious AP with the same SSID [duplicate]
I was just surprised to find out that devices when connecting to WiFi networks compare the SSID to known ones and try the saved password.
In other terms: I have replaced my home router, and my device ...
1
vote
1answer
84 views
Can I use the same password for my Computer, Mobile and Password Manager?
I am considering using the same password for my Computer, Mobile and Password Manager.
The premise of the "password reusing is bad" rule is that if one website leak the password then all of ...
0
votes
1answer
74 views
Is typing the PPP password in the PPP username a risk?
I went to my router admin page where first you need to type in the router's admin and password. I am not talking about that. I am talking about PPP account and password (separate from router's ...
1
vote
0answers
26 views
Making custom wordlists for languages besides English
I'm testing a site whose audience doesn't usually have English as their main language. When it comes to non-English, I consider there to be 3 groups
The target language's alphabet is a subset of the ...
