Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
-2
votes
0answers
60 views
A case against password managers [on hold]
Disclaimer: I am aware two other similar questions have been asked on this site, but I wanted to add some different information and hopefully start a bigger discussion than the other questions had.
...
0
votes
2answers
72 views
Is a password box with pseudo-random number of stars more secure?
I use a program that confused me while typing the password. It acts like this when I type the password ABC:
I type: A Display: ***
I type: B Display: *****
I type: C Display: **
I can think of the ...
1
vote
3answers
113 views
Schneier is telling me to write my bank security password and keep it in my wallet? Is that right?
Bruce Schneier Writes Down Passwords. So Can You
...
But how should people deal with all of this in the real world, or on line? "Relax," he says emphatically. Surprisingly for a security ...
0
votes
1answer
42 views
Obtaining plain-text passwords from a Domain Controller
Is there anyway to log the plaintext passwords of accounts that authenticate against a domain controller? I know most of the Mimikatz attacks and they all recover credentials from memory, but they're ...
0
votes
1answer
52 views
hashcat specify number of characters
I am trying to figure out a macOS hash 10.8+ and I happen to know that it uses A-Z, a-z, 0-9, is 6-8 characters, and almost certainly random. Currently, it spits out an error regarding hash length ...
1
vote
1answer
75 views
Are Password Strength/Entropy test web sites safe?
Are web sites that do Password Strength/Entropy tests like for example
http://rumkin.com/tools/password/passchk.php
http://www.passwordmeter.com/
https://howsecureismypassword.net/
http://www....
-2
votes
3answers
142 views
Why do services that use 2-factor authentication still ask you to provide a password?
The idea of 2 factor authentication is that if you can prove that you have both a password and a device, you are trusted to be who you say you are. My question is, why does the service still ask you ...
1
vote
2answers
92 views
Why is it unsafe to use a password that exists online?
I recently saw a post asking why something that appeared to be a random string of characters was a bad password. One of the answers was that it already exists on a website so you can Google it by just ...
0
votes
1answer
42 views
An authentication protocol to prevent phishing & solve the problem of password reuse?
When writing about best practices for authentication, I find that today's best practices still leave gaping holes in security, specifically not solving the problem of password reuse by users - ...
39
votes
2answers
7k views
How do universities and schools securely sync passwords between multiple services?
I'm a student and it seems every school or university I have been to has one password that you set for your user account for logging in to university services, which is also then synced to external ...
1
vote
1answer
81 views
Is a Password secure if I change one letter?
If I use a long password (64 characters), which is written on paper and its encrypted content never sees the internet (veracrypt volume), would a secondary volume with the same password, but one ...
1
vote
3answers
102 views
What should a secure passphrase look like?
We all know that passwords should not only be randomly generated, but also look random. The reason is that attackers can use patterns or existing words to be able to bruteforce the passwords faster, ...
0
votes
1answer
92 views
Many websites allow passwords equal to username or e-mail address. Is this not a security risk?
I'm currently testing password policies on websites to get a feeling for what might be an acceptable policy/trade-off that provides good protection for our users without frustrating them.
I was ...
0
votes
0answers
31 views
Are there password managers that support a mobile app that returns a password based on a photographed bar code?
The company I'm working for has to manage the passwords of thousands of OT devices. Technicians out in the field must be able to retrieve the passwords that belong to a given OT device in a simple way....
23
votes
1answer
304 views
Is a password manager better than an encrypted file for storing passwords?
For any passwords other than websites I log into regularly (such as Gmail, Facebook, etc.), I use apg to generate a random 20 character password. I then add that password and a username or email ...
86
votes
6answers
17k views
Is it safe to give my email address to a service like haveibeenpwned in light of the publication of “Collection #1”?
There is a new big case of stolen login/password data in the news. At the same time, I am reading that there are services that let you check if your own login data is affected, e.g.
Have I Been Pwned.
...
1
vote
0answers
29 views
Most used Linux terminal tools that take passwords as a parameter [closed]
I am writing a tools that basically searches scripts and configurations files for hard-coded passwords. My first approach is to identify the most commonly used Linux terminal applications that can be ...
3
votes
1answer
80 views
How should I share the key of the AES algorithm in each client?
My doubt would be the following:
How should each client know the encryption key? Using the AES algorithm.
(or the best way):
Save it in a file encrypted by password?
Save it in a DB?
Send it over ...
2
votes
2answers
48 views
Private key DES password
If I have a SSL private key that is encrypted with a DES password, and I have to share with another admin a NODES copy of the private key, can the other admin determine what my DES password is?
0
votes
2answers
200 views
What do we do when passwords are not secure anymore? [closed]
During an intense shower thought train. I began to think about a hypothetical world where passwords were no longer a safe way of protecting systems. Edit: W̶h̶e̶t̶h̶e̶r̶ ̶c̶o̶m̶p̶u̶t̶e̶r̶s̶ ...
-2
votes
0answers
16 views
Can anyone please suggest any drupal contrib modules or suggest any custom hooks to implement the below password policies in drupal 8 [closed]
Can anyone please suggest any drupal contrib modules or suggest any custom hooks to implement the below password policies in drupal 8
1.Apply a password dictionary and/or other checks to prevent ...
0
votes
2answers
50 views
How pincodes used as an authentication mechanism?
I'm designing a login system for my mobile app where users only need to provide a pincode to authenticate into the app after they sign-up.
I'm more wondering how the backend would work in such a ...
3
votes
3answers
187 views
How ethical is it to publish an (anonymous) password list from real sources
I'm currently doing security research on the dangers of using default or well known 'secrets' for applications.
To test how big of an issue this actually is, I decided to download local copies of ...
0
votes
3answers
115 views
Is it reasonable to use KeePassXC with YubiKey?
At the moment, I am using KeePassXC with a relatively strong master password. To further improve security, I thought about buying a YubiKey to have 2-Factor-Authentication.
KeePassXC supports the so ...
0
votes
1answer
42 views
What security arrangements do I need to think about when passing a password through my site server
I want to automate some of my home admin.
I'm writing a small-ish website, to do that. Written in C#/.NET, hosted on Azure, backed by an Azure SQL DB, codebase available publicly on GitHub.
One of ...
275
votes
9answers
64k views
Why is Gbt3fC79ZmMEFUFJ a weak password?
On https://passwordsgenerator.net/, it says
Examples of weak passwords: qwert12345, Gbt3fC79ZmMEFUFJ, 1234567890, 987654321, nortonpassword
The first, third, and fourth examples are obviously weak....
25
votes
2answers
4k views
Email from a hacker with my password [duplicate]
I have received an email from a hacker saying he got my email account password.
The password showed in the mail is not my account password but is a password I use sometimes.
I checked haveibeenpwned ...
0
votes
1answer
313 views
An idea for a universal password management standard [closed]
Introduction
For a long time I have struggled with (the idea of) password management. Remembering unique strong passwords is impossible when one has more than a handful, which only leaves the option ...
0
votes
0answers
24 views
How is a password intercepted on a website not using an SSL certificate [duplicate]
I have recently been working on an internal website at my current company. I am using Ajax and PHP to check that the username and password entered in the login fields match what is stored in the ...
0
votes
4answers
161 views
Does improving password complexity improve the security of wireless networks?
Does having a complex preshared key improve the security of WPA2-PSK, or is having even a simple PSK enough to secure the wireless network?
2
votes
1answer
50 views
Does password strength matter when using a YubiKey? [duplicate]
I'm considering buying a YubiKey. I already use a password manager which can generate strong passwords, but I wonder if there's even a point with the YubiKey. I guess it just makes one extra step......
2
votes
1answer
160 views
How to go from wifi password to computer access
In looking at What can hackers do with a wifi password?, it is said:
Simply said, if someone has your Wifi password, they have full access to all connected computers and devices within your network....
6
votes
1answer
196 views
Is this vault-less password manager/generator design safe?
Counter
The counter is appended to the site name and incremented if you need to get a new password for a site or if the generated password is insecure because it randomly matches something like "...
0
votes
0answers
33 views
How did this “hacker” make it look like I sent the email to myself? [duplicate]
So I went through my junk today as I wasn't receiving a sign up email from a service I signed up to. Looking through and another email caught my eye. The email looks like it has come from my own ...
22
votes
3answers
4k views
Do servers store my previous passwords?
When I change my password on some web servers like email, cloud, and social networks and try to use my previous password, the server denies it with message "Don't use your previous passwords".
Does ...
3
votes
1answer
71 views
How much less secure is a password with a repetitive pattern of characters?
I want to make sure my password is very difficult to bruteforce but also easy to remember and convenient.
So my idea is to just use a short password and repeat it a few times like this:
...
4
votes
0answers
61 views
Kerberos Attacks Questions
It's amazing how many "Attacks on Kerberos" articles exist out there and almost none really explains the small details.
My guess is that usually they assume it's basic knowledge and sometimes, they ...
1
vote
3answers
323 views
Broken into my office, HDD/SSD stolen. How secure is Chrome password saving feature?
I'm working as a developer in a shared office space, and today when I came to work, my PC no longer booted into windows, only UEFI with error -> couldn't find the primary SSD. I opened up the case on ...
1
vote
1answer
101 views
How to crack a list of hashed passwords given their possibilities
I am trying to crack a number of passwords that have been hashed using SHA-256 using some java code.
I have the hashes available and I also have the possibilities in which the password can be. Some ...
0
votes
1answer
70 views
What is a collision attack in simple terms? [closed]
I'm not a security expert but I've got interested in Cryptography and I'm reading about it.
I was trying to find out which is the best between SHA256, Bcrypt and MD5 when it comes to hashing ...
0
votes
1answer
164 views
Why Skype doesn't ask for password every time?
Every time I launch Skype on my desktop it doesn't ask for my password. It asks for the password only when I run it for the very first time. Is it secure? For me it's better to type the password every ...
0
votes
1answer
65 views
Question about brute force performance
I just make an SHA512 brute force programs that can do 5MH/s on my i5 3.5Ghz (4 cores) which manage to use all CPU resources. If I run the program on a 2PFLOPS hpc , How many hash can it generate per ...
3
votes
2answers
85 views
Store database access password in PHP class const?
I have PHP project and I need to store MySQL access information.
I have a config.php file outside public directory and in the file I have:
class Config
{
const host = "dbserver";
const name =...
0
votes
1answer
75 views
Is it desirable to obtain a brand ssl certificate for a password generator?
I need an advice. I have created a password generator, which creates strong passwords on local PC (its a Progressive Web App).
But there is one problem: most site visitors are distrustful to the ...
3
votes
1answer
198 views
How secure is a 100-bit password in 2018 and onwards?
Long story short, I share a server with a few other people and store my backups there. All these backups are archived to a .7z file using AES-256 encryption, using a randomly-generated password of ...
4
votes
2answers
297 views
How does a zip file detect a correct password?
When extracting files from an encrypted zip archive, the user is asked to give a password in order to read the original file.
How does an encrypted ZIP detect when the user has given the correct ...
1
vote
2answers
109 views
How to crack a password given its hash and its possibilities
I am trying to crack a number of passwords that have been hashed using SHA-256.
I have the hashes available and I also have the possibilities in which the password can be. Some of these possibilities ...
-4
votes
2answers
135 views
How secure is my hashing algorithm? [duplicate]
This is probably the common question on stack exchange but I need to know is this really safe as it seems to be?
//Password hashing stage 1
$a_password = sha1($a_password);
$a_password = md5($...
1
vote
4answers
191 views
Mitigating the problem of single point of failure introduced by password managers
I understand the purpose of password managers and the fact that there seem to be a trade-off to accept, but well, I find that trade-off to be unacceptable and I wonder if there's a way to avoid it. A ...
1
vote
3answers
393 views
Any hints for programming my own password manager? [closed]
I mostly want whatever help & suggestions you can give me about what I should avoid & what I should think about when making this.
I'm a reasonable programmer & I want to make my own ...
