Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
0
votes
1answer
20 views
Attackers seem to have accessed my Chase online login information. How might this have happened?
I recently noticed a series of small deposits made via Chase’s mobile deposit feature. I didn’t deposit this money (there were five deposits, all under $20). My guess is that an attacker wanted to see ...
1
vote
0answers
16 views
Increase password iterations?
Is it possible to strengthen the macOS login password by increasing the number of sha-512 iterations?
-1
votes
0answers
20 views
How to harden user/login password? [migrated]
In High Sierra or Mojave, is it possible to harden our login password so that the hash is more difficult to crack? I'm not a crypto person, but can we increase the iterations, transforms, hashing algo ...
1
vote
1answer
43 views
How do Field Programmable Gate Arrays (FPGAs) compare to Graphics Processing Units (GPUs); for cracking hashes?
As a general rule, GPUs are more effective than CPUs when it comes to performing acutely repetitive tasks, like iterating over lists and generating permutations of a set (i.e. exhausting dictionaries &...
0
votes
0answers
7 views
Windows 10 still allows old password [migrated]
Desktop with Windows 10 (at home).
I changed my Windows password several days ago, restarted several times, and still both old and new passwords work.
How to make Windows forget the old password?
0
votes
0answers
15 views
How does a vpn protect my information? A d other quesions [duplicate]
How does a vpn potect my infomation when i suef the web? Does it work offline from the web? Are tere malicious vpns
3
votes
0answers
59 views
Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on?
Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on?
Using Mimikatz I've seen lots of examples where passwords are stored in memory, either for ...
1
vote
0answers
19 views
Is it possible to open Chrome's databases.db in another MacBook?
According to this post, Chrome passwords are stored in /Users/$USER/Library/Application Support/Google/Chrome/Default/databases/Databases.db. Is it possible for an attacker to copy Chrome passwords ...
5
votes
2answers
1k views
Why is SHA-256 not good for passwords? [duplicate]
I've just started learning about all of this and I can't really find an answer for that anywhere, namely why is SHA-256 not used for passwords? I found that the reason is that because normal SHA-256 ...
0
votes
0answers
10 views
Where/How does Chrome store login credentials in macOS? [migrated]
I swear I've seen this question thoroughly answered somewhere before but I couldn't find the answer I'm looking for...
Chrome secures our saved passwords in the System.keychain, right? But when I ...
0
votes
0answers
27 views
Google login 2FA: security events to cell / always require Cell confirmation (2FA)
For Google account with 2FA enabled :
How to require cellular confirmation to a critical event such as a password change.
How to get notifications to cellular regarding a password-change.
How to ...
0
votes
0answers
70 views
Where/how to store the password for (REST) authentication?
What I have at the moment is as follows:
There are Java clients where I store the passwords locally in files in clean-text format. There is a REST endpoint where I store all the passwords in one file. ...
0
votes
2answers
165 views
What is Byzantine password system?
How safe are password managers like LastPass?
One comment there asks:
Does anyone know of any Byzantine password systems? E.g. 3 or 5 online
systems, where breaking any single system would not ...
1
vote
1answer
72 views
Do hacks of mainstream web applications tend to happen more from random attackers brute forcing or from targeted heuristic attacks?
I'm writing up advice for selecting a master password for a password manager, and I'm wondering if there is available data about the likelihood of different attacks that result in a cracked password. ...
1
vote
4answers
248 views
Dealing with users who reuse bad passwords
What is the best (or good) practise to deal with users, who are determined to reuse their old password, whether it be good or bad? Or simply use a bad password?
Scenario:
A user wants to create an ...
1
vote
2answers
371 views
Details of a good WPA2 pre-shared key (password)?
From the following answer, I understand a strong pre-shared key must be 15 characters at minimum and randomly generated:
https://security.stackexchange.com/a/56646/37051
However, from other reading, ...
0
votes
1answer
60 views
Brute-Forcing DVWA login page with hydra
I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
1
vote
1answer
48 views
Is it safe to keep my KeePassX database on my server or cloud with encryption? [duplicate]
My KeePassX file has a long and strong password.
I've read several articles and discussions about how safe it'll be stored such a file on VPS or cloud service such as Dropbox. There was no consensus ...
0
votes
0answers
10 views
Error Installing Certificate - Cisco WLC - Password protected PEM [migrated]
So I will start with saying, I'm not good at all with certificates, I got this .pem file that I'm going to upload to a WLC for Webauth, since the old one is from GeoTrust.
At first the .pem didn't ...
1
vote
1answer
97 views
If someone has a hashed password, how long till they decrypt it?
Earlier my friend suggested that we have a race to see who could decrypt a hashed password first. I want to do it but I don't want it to be an all month thing. I know when passwords are hashed they ...
0
votes
1answer
41 views
How to convert my cert chain to PFX without a password
I am trying to enable an Azure Front Door instance on the front of my website using my EV cert (Extended Validation Certificate).
However, from Azure Front Door Cert Instructions,
Azure Front Door ...
2
votes
2answers
246 views
What to do about email threats containing leaked passwords?
A few days ago I got an email from a hacker supposedly using an email of mine (he was using the same email address TO and FROM) from my own email domain, and had a part of a password I use to purchase ...
1
vote
1answer
51 views
Can a scanning id system like trusona really be secure?
I became aware of Trusona recently (see their demo on this page https://www.trusona.com/ ). They want to 'end passwords'.
I believe in the idea that 'reasonable security' = {something you are + ...
3
votes
3answers
147 views
Bank sends one-time password by e-mail (while sending on SMS) for transaction verification; is this insecure?
Most of the banks uses OTP (One Time Password) to enrich the authentication through dual factor.
But I observed Banks are sending the OTP to mobile as well as email.
I suppose sharing passwords on ...
0
votes
1answer
48 views
Is any plaintext stored as a password hash an effective way to lock out an account?
I'm building a web app with Flask and I have user accounts that store their passwords in a MySQL String column using werkzeug.security's generate_password_hash() method. I wanted to create a Community ...
1
vote
0answers
38 views
How does using an app rather than code card to authenticate improve security?
Our bank used to issue code cards, with 72 passwords printed on them. To login to net bank we used to need to know:
Our bank account number (we have that written down)
A password we've picked. We ...
0
votes
1answer
57 views
Advantages of encrypting IV in AES GCM
I've got a friend who stores some important data locally in a database. Before storing, he however first encrypts it with AES GCM with a certain key. He then encrypts the IV with another key, and then ...
1
vote
1answer
128 views
Are partial passwords a security improvement over full passwords?
With full password authentication, you need to enter the full password every time.
With partial password authentication, you're asked for some subset of the password each time, and which characters ...
0
votes
1answer
45 views
Is using HOTP only authorization considered weak?
Migrated from ServerFault, as advised there.
I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes.
I fully understand 2FA is more secure than Single ...
0
votes
3answers
94 views
Does plain password means security hole?
I registered to a www-site. After that I got a mail where was given info like thanks for registering to our site. Your password is and password in plain text. Does it mean that the site does hold my ...
0
votes
0answers
34 views
Meaning of rtgen (rainbow table generation) parameters
I would like to generate some rainbow tables and try some password lookups as an exercise. I'm familiar with cracking hashes using a few expensive GPUs and hashcat, so I don't want that answer as an ...
61
votes
5answers
12k views
Logged out of Facebook on all devices on a sudden. Should I be worried about being hacked?
A while ago, I was opening Facebook app on Android and then I got the message "Session expired. Please log in again.". I then tried logging in with my current password and was success to log in my ...
-1
votes
1answer
103 views
Is it okay to save passwords as base64 strings with no other hashing or encryption beforehand?
I've just inherited a project where all the passwords on the server side are simply converted to base64 and put in the database. No salt, no hash, nothing. Just a simple db.Add(password.ToBase64) kind ...
6
votes
3answers
274 views
Validate Japanese passwords
For English we have some good practice when we want to create an password, like Add numbers, symbols and capital letters. As result we have password like this: P@ssW0rd.
Is there any rule like this ...
27
votes
4answers
10k views
Cracking double encrypted router password?
I noticed in the html of my router this parameter:
form.addParameter('Password', base64encode(SHA256(Password.value)));
So when I type in the password passw I get this via sslstrip:
2018-09-25 21:...
1
vote
1answer
126 views
Does the length of each word of a passphrase matter?
Since they won't brute force a 19-char password,
I was wondering if the attacker's dictionary is simply sorted by frequency? could these passwords have roughly the same strength?
carp ably feud whir
...
1
vote
1answer
46 views
Changing VeraCrypt password during encryption
I understand that password in VeraCrypt is used to protect master key, not the data directly. So is it possible and completely safe to change password during first whole drive encryption? I want to ...
2
votes
1answer
63 views
Is there any defense against this kind of attacks? (key comparison attack, or something)
is there any defense against this kind of attack?
https://youtu.be/7U-RbOKanYs?t=974
I know someone who uses a password encryption hashing that generates the same length of keys as in this video and ...
3
votes
2answers
104 views
Do all Authenticator Apps use the same algorithm?
I've tried some Authenticator Apps (Google,Microsoft,Authy,Lastpass,...) and all of those apps generate same one time passwords at the same time ?
So, these apps are use the same algorithm which is a ...
0
votes
2answers
78 views
Store password securely but being able to check separate characters in that password
I am writing a system where the user must log in with two passwords: a normal password (salted and hashed, stored in database), and a special password where the user needs to type only some letters, e....
3
votes
6answers
180 views
Is it safe to store 2FA tokens together with passwords in 1password?
I'm using 1password and I've seen 1password allows you to store 2FA tokens in the same place where you store the password.
I don't like the idea of having everything in the same place as if someone ...
0
votes
1answer
103 views
Sending shutdown command via ssh using sudo non-interactively
With iOS 12 and the new Siri Shortcuts app, I've been thinking of ways I could leverage the SSH command capability in the app. For those of you who don't know, the app allows you to send a bash file ...
3
votes
1answer
59 views
gnupg keys and pass database - Protecting both from unauthorised access and loss
My target is to use pass to store a lot of passwords and be able to access those passwords from wherever I need them, possibly using just a single pass-thing (password, passphrase, my voice, my ...
2
votes
3answers
173 views
What is probability of a user picking a published password?
Say I have a large list (10 million) of published accounts and associated passwords.
Assume this is a representative sample of population of account passwords.
From this sample I can generate a ...
0
votes
0answers
75 views
Extracting clear text password using Mimikatz and DCSync
I have a AD domain and the passwords are stored using the reversible encryption. I am using the Mimikatz tool with lsadump::dcsync /domain:xxx.com /user:<name> to retrieve the clear text ...
5
votes
1answer
195 views
Can hand/finger movements be determined via changes in WiFi signal strength?
On a password generator website I came across the following claim among a list of security tips:
If there are WIFI routers in your home, then it's possible to know the passwords you typed (in your ...
0
votes
3answers
125 views
Assuming my password is strong enough, how else can I protect my account? [closed]
I'm a very insecure person, so I made my gmail account's password so long, that I started to question whether or not it's possible for someone to hack it with any given method (It's a passphrase with ...
2
votes
2answers
100 views
Wordlist generator for known words in passphrase [closed]
Is there any well-known solution to generate wordlists using (for lack of a better term) wordsets instead of charsets?
I know parts of my old password, but I can't remember the exact order. After ...
1
vote
0answers
46 views
crunch password generation with multiple character sets
I'm trying to use crunch to generate a password list. However, if I add all necessary characters into one character set, as in:
file: charset_huge.lst
complex = [...
7
votes
2answers
1k views
What could an attacker do if they gained access to PBKDF2 hashes?
This is regarding a web application where a user has to login with their personal email as the ID, and a password they have chosen personally.
If an attacker somehow gained access to a credential ...
