Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

learn more… | top users | synonyms

0
votes
0answers
28 views

How to safely pass password reset token from http get request to html page?

I am working on implementing my own custom password reset that sends an email where the user is taking to a page to reset their password. So far I have generated a unique token that gets put in an ...
4
votes
0answers
46 views

What are the recommended scrypt cost factors for 2016?

I've been trying to look for the answer, but the latest one I found was outdated by three years. So what are the recommended scrypt cost factors for 2016?
37
votes
7answers
5k views

I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?

Without even thinking about it, I typed my password into the Google search bar, but I didn't press enter. Since autocomplete is on, does that mean my password has been logged or indexed somewhere? ...
38
votes
10answers
4k views

Could keystroke timing improve security on a password?

When I was young, and had just started out in my software-development career 20 years ago, I wrote a little bit of code on my Amiga that took a password, but also recorded (within some threshold), the ...
4
votes
1answer
72 views

Spoofing an NTP server to allow bruteforce on any smartphone

We all know that smartphones (i'll take iPhone as an example) rely on SNTP/NTP servers to update a device's time and date. So, by creating an SNTP server that mimics Apple's server, we can actually ...
4
votes
1answer
71 views

How secure is my system for a password reset?

I am using my custom Parse Server with Heroku which I am pretty sure (99%) that it is decently secure using things like oAuth2 and 1 way hashed passwords. The problem is I am trying to implement my ...
0
votes
0answers
37 views

Does an account with a !! /etc/shadow entry have to still expire?

Currently where I work, our password policy is set at 84 days. This is set in our login.defs on all of our Linux machines. We have policies that are set around PCI DSS 3.1 and the like, this goes for ...
2
votes
0answers
36 views

Is it possible to remove the password on new generations of Lenovo X1?

I have lost the password for my setup. I set it up a few years ago and now I cannot recall it. The supervisor password is not stored in an EEPROM so the usual tricks do not work. I think it is in a ...
-5
votes
1answer
69 views

What is AES 256 bit encryption? [on hold]

I was looking through some apps to store my passwords in on the App Store when I found one that boasted an "AES 256 bit encryption system". Now that sounds all very good and well, but that doesn't ...
2
votes
1answer
126 views

Enter the password outside the password field

If I press Tab twice after enter my username, I will type my password somewhere outside the password field. Are there any chances for somebody to catch my password when I enter it outside the ...
-1
votes
0answers
55 views

Is it more secure to always download app/update iOS via iTunes in PC/Mac instead of in iPhone directly?

Is it more secure to always download ipa and then sync iPhone/download update by iTunes instead of downloading them in iPhone directly? Because I think it allows me to never enter my apple account ...
0
votes
1answer
79 views

Passwords processed on server side? [duplicate]

So while I was working on my personal project something struk me. When somebody creates an account on any web service/social media they provide their desired username and password,this is then ...
6
votes
4answers
1k views

Does quick denial tell that you passwords are stored in plain text?

Say you are using a website and incorrectly enter your password. The website then "instantly" pops ups with an "incorrect username/password" message. Would it be safe to infer that the website is ...
-1
votes
1answer
74 views

CRC-96(ZIP) decryption

Is there a way to decrypt CRC-96 encrypted string? I am testing a web application which stores the password in the database in CRC-96 encrypted format.
3
votes
1answer
89 views

How to detect mimikatz usage on LAN

My boss is has made it clear that we need better ways of detecting mimikatz usage on the network- and I would agree. In place already for detection is suricata/ET PRO rule set on a couple of taps. ...
1
vote
2answers
80 views

memorable word and answers to security questions when resetting password?

Context We have a situation where we are allowing our users to login using either using Username & password + Memorable word OR Username & Password + answer to Security questions depending on ...
-6
votes
1answer
98 views

How come I can log in on a random webcam with the password “admin”? [closed]

I used http://shodan.io to look for internet-connected webcams. I found one (in Russia), and I managed to succesfully log in to it using admin as the username and admin as the password. How can this ...
4
votes
1answer
71 views

texting password reset link instead of a code

An increasingly common process for assisting with password resets is the application texting a code/token to the user’s verified mobile phone. We have a client which would like to eliminate the need ...
4
votes
4answers
113 views

Sending server-generated password by email

I'm implementing a system where our users need to enter a special (permanent) password to authorise a transaction. The password is separate to their login credentials, and they can only enter this ...
-1
votes
0answers
10 views

Queries on config.php and ArtifactResolutionService.php - SimpleSAMLPHP [migrated]

We are using SimpleSAMLPHP for SSO. In config.php file, datastore type is configured to be phpsession by default. Since this cant be used, next option is memcache. As we dont make use of memcache, ...
-1
votes
0answers
41 views

Best practices for encrypting passwords on a server [duplicate]

I have a web application where users can optionally choose to link their accounts with a third-party service provider to enable some additional features. Unfortunately, the third-party webservice API ...
1
vote
1answer
98 views

How to handle password storage for my project?

We have NFC cards to keep track of presence, students scan their card to a terminal at the beginning of every lesson, we want to extend the cards usage to filter out who can access the Raspberry Pi's ...
2
votes
1answer
85 views

Email code authentication

I'd like to replace passwords with a temporary code that's emailed to the user. The login flow would go like this: User enters their email address. "If that email belongs to a user, a code will be ...
4
votes
1answer
86 views

Safely store passwords in specific scenario

I have a specific network environment. Its a DTN(Delay Tolerant Network) network without continous connectivity, situated on the sea, where nodes are ships. There is also a server that is a part of ...
36
votes
4answers
4k views

Avast AV could read Firefox saved passwords

My friend uses Firefox's built-in password manager feature to save passwords for sites. Later, after installing Avast Free Antivirus there was a feature called Passwords on the Avast UI. When accessed ...
127
votes
7answers
18k views

Internet courtship: Why would a hacker buy me poker chips?

Believe me, I never expected to ever write a title like that on a Stack Exchange site either! Yesterday evening I got a call from my mother. She is quite tech savvy and generally knows her way around ...
1
vote
1answer
46 views

Powershell and cached credentials

In my environment we have powershell remoting off- I get around this using 2 hop scripts, packages(exe -no creds are stored in code- local privs only), and iwmi. I never pass creds to the endpoint, ...
26
votes
5answers
4k views

How does storing hash passwords work? [duplicate]

In usual network applications, that employ password hashing, is the user password hashed on client side before sending it to the server, or is it sent without hashing as encryption of plain text ...
1
vote
0answers
29 views

How to analyze netstat for suspicious connections? [closed]

Somebody accessed my Microsoft account this morning and the IP that did it came from Thailand. A couple of days prior the incident, I noticed that my Command Prompt opened and closed immediately many ...
5
votes
3answers
105 views

Best practice for sharing a (.zip) file password with recipient

When sharing confidential documents, it's common to zip up and encrypt the files with a good password. However, all too often the file is emailed as an attachment with the password in the body of the ...
4
votes
2answers
197 views

How secure are these password schemes?

On One liner to create passwords in linux?, I see advice generally of the form head -c16 /dev/urandom | md5sum. They're all random combinations of text manipulation commands, sha1, base64 and md5sum ...
1
vote
1answer
81 views

What are good password storage policies? [duplicate]

The world has progressed to the point where most of us have faulty memories and dozens of passwords to remember. What are good ways to solve this problem? I am interested in multiple answers and ...
4
votes
2answers
165 views

How do I protect my passwords from WebBrowserPassView?

I just got shocked with what can be achieved with WebBrowserPassView. It basically shows every password I've saved in my browser (Chrome). I guess other users on my PC could get my passwords that ...
1
vote
1answer
29 views

Passing a hash of a secret to a server instead of the plain text

Instead of passing an authentication token or api key in an http header to a server in the plain text, what if I calculated its hash and passed the hash? This way even if a adversary intercepts the ...
-1
votes
0answers
12 views

Would the fact an attacker knows you are using common words affect difficulty? [duplicate]

So I think we've probably all seen the famous "correct horse battery staple" XKCD comic: https://xkcd.com/936/ Now let's say that this becomes common practice for a lot of users, so an attacker has a ...
7
votes
1answer
330 views

I stored a copy of my KeePass database on a portable hard drive and I lost the drive. Should I worry about that?

I've been using KeePass for years, and I have a lot of accounts. I need to access them anywhere I work, so I store one copy of my database on a portable hard drive. The drive isn't encrypted. The ...
1
vote
2answers
81 views

Registration Email Hijacking

(Please read the update at the end) I am trying to find out how to send user registration emails securely. I read answers on this question: I don't intend to send passwords in emails, but I was ...
5
votes
2answers
150 views

Migrating password db off MD5 by chaining MD5 and Bcrypt?

I have a legacy system currently storing unsalted MD5 passwords. Unfortunately, some other controls are not in place (like the ability to expire passwords) and I'm trying to upgrade my algorithm to ...
2
votes
2answers
86 views

Are there any examples of huge damages done by password leaks, or bad password management policies? [closed]

Everybody knows that a strong password is very important. However, I can't find any citable public example of any kind where a user or users suffered a heavy loss from using bad passwords, or their ...
3
votes
2answers
85 views

What scenario are 'extra' strong passwords and hashing algorithms actually protecting against?

Note: I completely understand the need for strong passwords & I understand that there is an issue of speed with hashing. I am just interested in better understanding the actual negative impact of ...
3
votes
5answers
588 views

Why can passwords be used to encrypt data, but are less strong for authentication?

Encryption software is often password based. Even if the adversary gets your computer they can't get the data without knowing the password, and bruteforcing is infeasible. Websites use passwords to ...
1
vote
1answer
39 views

How many possible randomly generated salts could be generated using PHP's password_hash() function?

I have two questions here: 1) How many possible randomly generated salts could be generated using PHP's password_hash() function? 2) According to php.net it states that the return value is a ...
2
votes
1answer
94 views

Recover password from .pfx file

I have an old Windows SmartClient application that is published with a signed certificate (a .pfx file). We want to extend the expiration date to more than one year. I've used a program called ...
1
vote
1answer
70 views

Password sent over TLS: threats other than TLS compromise?

One of my findings during a security audit was a password, sent as is over the network. As bad as it sounds, this happens only over HTTPS connection. Some authors suggested here that additional ...
1
vote
3answers
97 views

Why shouldn't I use an old password? [duplicate]

Some services like Google or Facebook forbid me to use a password that has already been use for the same account in the past. My question is, if this old password was never compromised (i.e it was ...
-1
votes
0answers
89 views

Enter the 1st 3rd and 12th character of your password [duplicate]

Some businesses such as banks and insurance companies ask for specific letters of your password. For example a bank asks for the 1st, third, and 12th character of your password. Would this be less ...
7
votes
1answer
85 views

What's the most secure way to circumvent encryption to enable password recovery?

I have a web app (which I've talked about here before). Users can use it to save people's contact details. These contact details are encrypted to ensure that they are difficult to get at if they're ...
6
votes
3answers
184 views

Authenticating a user via SMS

I'm involved in a project that's building a chat-bot that users can communicate with via SMS from their mobile phones. We'd like the users to be able to use the bot to do some basic account-management ...
3
votes
1answer
73 views

Creating accounts on sites with no security?

I'm sort of confused about security on some sites. Here on stackexchange.com, for example, seem to have no security normaly, but as you log in or create an account, it uses keyexchange and an ...
9
votes
1answer
129 views

Handling “forgot password” functionality with encrypted data without security questions

As a sort of follow-up to this question on handling password-reset functionality when dealing with encrypted user data, is there any good method for resetting a user's password in an encrypted web ...