Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [passwords]

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

1
vote
0answers
18 views

Are there any reliable and updated sources or feeds for password dumps? [on hold]

I am looking for any reliable, up-to-date sources (which may be RSS feeds, websites, or anything else OSINT-based) which contain password dumps and their relative links. I am looking particularly for ...
0
votes
0answers
20 views

John the Ripper: OpenMP mode vs using the “--fork=N” option?

Clang on OSX doesn't support OpenMP by default, so I could not compile JtR with OpenMP support without another Clang installation. However, after looking at the below option, I wonder what the ...
0
votes
0answers
40 views

Web app: using two hashing schemes for CPU-friendly password validation & secure storage [duplicate]

Consider a web application that: uses HTTP Basic Auth over HTTPS, and therefore needs to validate a password (an API Key) on every request and needs to handle a substantial load has very few distinct ...
2
votes
1answer
161 views

Does the use of pepper for passwords violate Kerckhoffs's principle? ​

Kerckhoffs's second principle: "It should not require secrecy, and it should not be a problem if it falls into enemy hands." Does the use of a pepper for passwords violate this principle, since ...
0
votes
1answer
79 views

Login Password not encrypted

So, I was just playing with BurpSuite when I found something I didn't understand. When using BurpSuite on banking websites, I see that after I supply the credentials, the form transmits an encrypted ...
0
votes
0answers
13 views

Set BIOS password in user laptops in an organisation [on hold]

I have a Windows Server 2012 environment with 50 users in an office. I want to set up BIOS password to user laptops (50). How can I set and manage that from a central location?
12
votes
3answers
3k views

Hashing password to increase entropy

Is it secure to hash a password before using it in an application to increase password entropy? Does this practice increase entropy when a PBKDF is used in the application itself or does the PBKDF ...
3
votes
1answer
55 views

PCI DSS minimum password strength equivalent in passphrase

The PCI DSS requirement 8.2.3 says: Passwords/passphrases must meet the following: Require a minimum length of at least seven characters. Contain both numeric and alphabetic characters. ...
-1
votes
1answer
165 views

I entered my password in a possible scam website. What should I do?

A while ago, I found a website that said that it will pay up to 100$ an hour just to watch ads. So, I thought what's the harm, and I created an account using a fake Facebook account (with my real ...
1
vote
2answers
188 views

Best way to know the algorithm used for a password encryption

I have the following password captured using sqlmap- $2a$08$9eaKUtKdFV8fuOAx0sfr4emrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O Now, I don't know how to decrypt this password because I don't know which ...
54
votes
8answers
15k views

How are passwords stolen from companies if they only store hashes?

Everywhere I look it says servers store passwords in hashed form, but then you have those breaking news about hackers stealing passwords from large companies. What am I missing?
2
votes
1answer
56 views

How did my exact name + birthday end up in PwnedPassword lists? [closed]

I find my exact name + birthday in the form of FirstnameMiddlenameSurnameDayMonthYear, e.g. JamesWilliamMiller31052000 in the PwnedPasswords List. But I have a very uncommon Surname (<100 people) ...
0
votes
3answers
103 views

Finding a future-proof password manager

Currently, I am a Windows 10 user who uses Chrome's default password manager and let it autofill in passwords for me. Apparently, if I were to accidentally execute malware or give someone momentary ...
0
votes
1answer
91 views

Can't detect hash type even if I have the password?

I can't found the hash type used in a database hosted in a VM. My hash is c39e02416d974229752c28d7fcefe6e1, and my password is "azerty123456". I noticed that the user table has a column called ...
4
votes
3answers
158 views

What password policy should a typical web app have?

By "typical", I mean in terms of the value of the data and how hard attackers are likely to try to breach it, as opposed to one that's guarding data sensitive enough that it's worth significant ...
0
votes
0answers
46 views

Google passwords security or lack thereof [closed]

I have been wondering about to what degree the info can be stolen if someone hacks into Google. Suppose an attacker got access to all of Google's data. Let's assume my Google password is good enough ...
1
vote
2answers
93 views

Deriving 2 keys from user password - one for login - one for encryption? [duplicate]

Context We have a browser-based client-server application. The client registers with email and password. The password is enforced to some guidelines. Problem The User needs an encrypted vault on ...
0
votes
1answer
30 views

Use john to crack passwords with X alphanums and Y symbols

I'd like to use john to crack passwords that has 3 chars and 1 symbol in it, e.g 123$ If I use mask mode I will have to specify it 3 times, -mask='[a-z0-9]?s[a-z0-9][a-z0-9]' -mask='[a-z0-9][a-z0-9]?...
2
votes
1answer
120 views

What can be done to defend against acoustic keyboard evesdroping?

It is reasonably well established that it is possible to determine what one is typing based on keyboard sounds, and the difference between different keys (source). This provides a significant issue to ...
-3
votes
0answers
21 views

Password secure test. Minimum characters needed? [duplicate]

How can I tell how secure my password is?
-1
votes
1answer
107 views

hashcat - cracking a salted sha256

Given a SHA512 hash, a salt, and username I am trying to crack the hash using hashcat. Every example I've found used a hashfile as input, is there way to provide salt and hash via commandline without ...
0
votes
1answer
36 views

Reset password functionality [closed]

If the password reset form can be accessed only by logged in user, what are the mandatory and good to have fields the form should contain?
1
vote
0answers
51 views

How to correctly store the users credentials [closed]

I am writing an application that requires a username/password for the first time. I was wondering if the concept code below is a valid and secure way to store user passwords in the database. I hope ...
14
votes
3answers
2k views

What are SHA-rounds?

I understand more sha-rounds make it difficult to bruteforce the hashed password in /etc/shadow. Higher rounds also use more CPU processing when executing sudo commands and logging into the Unix ...
0
votes
0answers
51 views

Does the password goes weaker as they get longer since hash has a fixed length? [duplicate]

For example, sha256 has a fixed hash length of 64 characters. So I'm wondering will a password goes weaker as they get longer and longer? Since no matter how long your password goes, the sum will be ...
0
votes
2answers
141 views

Should a mobile banking app force clients to change their password periodically, e.g. every 3 months?

Is there an internet bank that forces users to change their passwords periodically? In Poland, none of the banks forces a change of the password for Internet banking. Of course, banks educate and ...
1
vote
3answers
88 views

Is it ill-advised to use the same password for lock screen and full disk encryption (Windows 10 BitLocker)?

I am wondering which attacks can be prevented by using a different password for the lock screen and full disk encryption. The goal is to prevent people from accessing my data. The details of my setup ...
0
votes
1answer
138 views

Can a Windows 10 Local Account password be retrieved

I have heard that Windows (10) local accounts are not that secure. I am however particularly wondering whether the password can be retrieved using any tools. So I am not talking about resetting it ...
2
votes
1answer
80 views

How to get user and verify password so that the usernames are kept private?

According to the OWASP guidelines: Authentication failure responses should not indicate which part of the authentication data was incorrect. For example, instead of "Invalid username" or "Invalid ...
3
votes
2answers
163 views

Is password dependent iteration count a good practice?

I consider the possibility of improving password security by increasing the hashing iteration count for short passwords. The security benefits I see of this practice are: Short passwords are better ...
0
votes
1answer
93 views

Is this method of hashing passwords good? Node.js [duplicate]

I am currently developing a login for my website, (using node.js and MySQL) and would like some feedback on the password hashing code. const crypto = require('crypto'); function RandomSaltString(...
0
votes
0answers
43 views

How do I find the SSID of a wifi network with multiple separate words? [closed]

I am using the keychain to find logs of wifi passwords entered on networks I have logged into. It works fine for wifi networks where their name is one word such as "Wifi", however it does not work for ...
1
vote
5answers
157 views

Creating a unique password for each device

My team is currently working on an IoT product and we're having some issues thinking about a good way to create a unique password for each device. Each device runs on GNU/Linux and we have an ...
19
votes
6answers
8k views

Which password policy is more secure: one password of length 9 vs. two passwords each of length 8?

What is more secure, having one password of length 9 (salted and hashed) or having two different passwords, each of length 8 (salted and hashed using two different salts)?
-1
votes
1answer
71 views

Best tool for cracking SHA-1s with unique pre and post salts? [closed]

I can't find a tool that supports cracking SHA-1s with different pre and post salts. Any suggestions?
0
votes
0answers
24 views

Does limiting the length of a password help prevent DoS attacks? [duplicate]

I was told that you can DoS a server with unlimited password length because of the time that it would take to hash it. But isn't the password hashed on the client's side before leaving the user's ...
0
votes
0answers
72 views

how good is “Chrome Password Checkup” extension for checking passwords?

From what I read so far Google "Chrome Password Checkup" extension (https://chrome.google.com/webstore/detail/password-checkup/pncabnpcffmalkkjpajodfhijclecjno) checking the password that you use for ...
-2
votes
1answer
87 views

Java Code for Pass Encryption/Decryption [closed]

I want to save an encrypted password (the encryption may be produced manually or using java code, and the encryption technique type does not matter), then the java code will read the encrypted pass ...
0
votes
1answer
57 views

BitLocker To Go password strength

When using BitLocker To Go, given that removable drives are inherently offline and may have to resist such attacks, what are the best practices / recommendations for password strength?
0
votes
1answer
90 views

Is it secure to store my mysql password in a const std::string?

I am implementing a C++ server with a mariadb backend. I have to access my database and I do so using the mariadbpp (its c++ connector). Though I can use mysql_config_editor and store the passwords in ...
2
votes
1answer
90 views

Secure password reset before authentication?

I have recently been considering the password reset flow for a site I'm working on. A request came up that before authentication, a user should have an option to change their password by providing: ...
1
vote
2answers
78 views

Is storing the bcrypt salt in isolated database a good idea?

I read many answers on the stackexchange about Bcrypt, Salt and Where exactly to place the salt. For hashes such as BCrypt it is trivial to extract salt from the hash. So, It doesn't matter really ...
2
votes
2answers
228 views

What to do about company that sent my password information in plaintext?

I make monthly payments to a website/company who insecurely stores my information. These are in the form of loan payments, so I don't know if I can change who I pay to. I asked for login assistance ...
1
vote
0answers
42 views

rar and zip password encoding scheme [closed]

What encoding scheme is used in last versions of ZIP archives(6.3.2+) and RAR archives(3.90+), including RAR5? UTF-8/16, ASCII or something else?
0
votes
1answer
124 views

Is my pseudo “password manager” solution secure?

My solution to store passwords is just using this free program, SafePad, and then writing in a document all my passwords, plain text; for example a line might be Facebook.com - user: johnsmith - ...
2
votes
1answer
104 views

Opera browser: no master password?

I've recently moved from Firefox to Opera (for performance issues). I used to protect my passwords in Firefox with a Master Password. But Opera, so it appears, lacks such feature. I use Debian 9.7 ...
0
votes
0answers
30 views

Does a small max password length indicate there might be a security issue? [duplicate]

Some websites state specific requirements for a password when you create an account. Some are understandable, but in particular the maximum password length doesn't make sense to me. Some websites ...
0
votes
1answer
129 views

Safest & Secure Way To Store People's Login Information?

I am looking to create an application that aggregates data from people's online accounts. The application (Frontend made with HTML/CSS/PHP and Backend made with Python) will log into people's ...
0
votes
0answers
36 views

Protecting/Crypting an external storage

We have an camera with sd card in which it records. AFAIK its software, recording parts etc., cannot be stepped in. We wish a mechanism/methodology that whenever it is plugged into usb socket of a ...
-3
votes
1answer
52 views

Finding encryption type of hash [closed]

Is it possible to find encryption type of a hash with a salt? I have my other password in same encryption type, with the hash from that and the password, if that helps. $2y$10$...