Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [passwords]

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

3
votes
2answers
63 views

Store database access password in PHP class const?

I have PHP project and I need to store MySQL access information. I have a config.php file outside public directory and in the file I have: class Config { const host = "dbserver"; const name =...
0
votes
1answer
49 views

Is it desirable to obtain a brand ssl certificate for a password generator?

I need an advice. I have created a password generator, which creates strong passwords on local PC (its a Progressive Web App). But there is one problem: most site visitors are distrustful to the ...
3
votes
1answer
153 views

How secure is a 100-bit password in 2018 and onwards?

Long story short, I share a server with a few other people and store my backups there. All these backups are archived to a .7z file using AES-256 encryption, using a randomly-generated password of ...
0
votes
0answers
17 views

How to implement change password functionality in a secure manner? [duplicate]

I have a J2EE application running on https where in change password screen, I do a ajax post of the form containing the current password and new password in plain text along with a csrf token to the ...
4
votes
2answers
195 views

How does a zip file detect a correct password?

When extracting files from an encrypted zip archive, the user is asked to give a password in order to read the original file. How does an encrypted ZIP detect when the user has given the correct ...
1
vote
2answers
99 views

How to crack a password given its hash and its possibilities

I am trying to crack a number of passwords that have been hashed using SHA-256. I have the hashes available and I also have the possibilities in which the password can be. Some of these possibilities ...
-4
votes
2answers
120 views

How secure is my hashing algorithm? [duplicate]

This is probably the common question on stack exchange but I need to know is this really safe as it seems to be? //Password hashing stage 1 $a_password = sha1($a_password); $a_password = md5($...
0
votes
1answer
53 views

Mitigating the problem of single point of failure introduced by password managers

I understand the purpose of password managers and the fact that there seem to be a trade-off to accept, but well, I find that trade-off to be unacceptable and I wonder if there's a way to avoid it. A ...
1
vote
3answers
312 views

Any hints for programming my own password manager? [closed]

I mostly want whatever help & suggestions you can give me about what I should avoid & what I should think about when making this. I'm a reasonable programmer & I want to make my own ...
4
votes
2answers
129 views

Do I need a strong password on my home PC if I have a strong router password?

First, let me say that I saw on the "Welcome" window that this site is for professionals, which I am not. But I don't really want an answer from someone who's not a professional, I want a good answer. ...
1
vote
2answers
148 views

How bad is using date to generate a “random” password?

I came across a post about generating random passwords. Apparently the preferred way is date | md5sum I am aware that using the date for this is bad, but how bad is it? How does it fare when ...
2
votes
1answer
51 views

Is Hydra splitting the wordlist file into as many parts as tasks / threads?

I'm playing around with Hydra and an xmpp authentication. I created a basic xmpp server of my own, reproducing an authentication (server side) from a clear text pcap file. I think I got something ...
-1
votes
0answers
46 views

Is PSexec still possible as of Windows 10?

so while I was playing around with Responder on my private network, I managed to find my host machine's NTLMv2 hash and even managed to crack it with the help of some custom rulesets and hashcat. I, ...
1
vote
0answers
30 views

Mutual keys protection/wrapping [migrated]

Is there a known risk in having two keys wrapping each other? Let's say, an adversary has access to both AESkey1(key2) and AESkey2(key1). Does it make it much easier for him to recover the keys?
1
vote
0answers
25 views

ubuntu based app, authorized credentials automatically on installation [closed]

Anki in particular used my google credentials to get synced without me actually typing them. Chromium Version 70.0.3538.77 (Official Build) Built on Ubuntu, running on LinuxMint 19 Shouldn't I be ...
0
votes
1answer
67 views

What's the purpose of the lock and unlock feature in password managers?

I'm afraid this could be a very stupid question, yet I cannot think of an explanation. Password managers (keepass, etc.) often have a button that lets you "lock" the database, so if you need a ...
3
votes
1answer
41 views

Can I securely keep the user logged into my local application AND use the password as a decryption key?

I'm somewhat new to data encryption/safety, but I already read about basic concepts like hashing passwords, encrypting files, etc. If possible, please ELI5 - thanks in advance. Background: my ...
0
votes
1answer
55 views

Choose a sentence, a number, and the name as password [duplicate]

I would like to have your point of view about something I found on internet. The goal here is to help people to use stronger passwords, it's not perfect, but I believe that asking people to use ...
2
votes
3answers
148 views

Password-hash proofing SHA-3

I am in a situation where I need to harden a password hash, but not allowed to bring in any extra dependencies, so I am pretty much forced to do the one thing everyone seems to advise against - roll ...
2
votes
2answers
82 views

How long should a password reset token remain valid?

What is the recommended lifetime of a password reset token? Too short will degrade user experience and too long would compromise security. Microsoft identity default to one day but this very long.
0
votes
1answer
33 views

Password hashing on both client and server : what are the risks concerning hash composition (collisions and reversing)?

There are plenty of question addressing the "client / server : where to hash ?", but i have not found anything about my particular question : considering a server_salted_hash(client_salted_hash(...
2
votes
1answer
47 views

What should I do to develop a secure note taking app in Android 8.0?

One of the factors I considered was, having all the text encrypted and stored in the device memory. But we cannot avoid having raw unencrypted data on the RAM, when the application runs. Won't ...
0
votes
0answers
62 views

What can attackers do to increase the rate of attempts in a brute-force attack as the number of attempts increases?

I am aware of this post (about Moore's Law and brute-force attack). Suppose is the number of brute-force attempts, we have . What I want to ask is the following: suppose an attacker started a brute-...
44
votes
12answers
15k views

Is it better to use an unsuitable hashing algorithm instead of none at all?

I have to store passwords on a system which doesn't offer any of the algorithms recommended for hashing passwords (e.g. bcrypt, scrypt or PBKDF2). Would it be better to use an unsuitable algorithm (e....
3
votes
2answers
137 views

Is using a phrase from a book as a password such a bad idea

I've been told/seen online that choosing a sentence or a phrase from a book and using it as a password is a bad idea. How is this true? Unless the potential attacker knew which book you used I don't ...
0
votes
0answers
65 views

Plaintext password suggestions for Netflix on Firefox

This is a (modified) screenshot of the Netflix login screen on Firefox. When I click on 'show password' and start entering a password, it shows me all of my passwords that begin with that letter (not ...
1
vote
0answers
90 views

Help figuring out this hash function [closed]

I have a tough nut to crack. I'm working on hashing passwords for our network switches (because the alternative is plain-text passwords...). For people who would care about this; it's a huawei switch. ...
3
votes
2answers
200 views

How to choose between password derivation or encryption?

Suppose you use a password manager having all possible features of modern password managers: encryption with a key derived from your master password, auto-filling, cloud or local storage, browser ...
3
votes
3answers
160 views

How is a pepper used with salted passwords?

How is a pepper (a large constant number) used after a password has been salted with a salt by a hashing function such as bcrypt? From Sybex CISSP Official Study Guide, 8th Edition (2018): Adding ...
0
votes
2answers
183 views

What is the standard practice to maintain a password for different websites? [duplicate]

I have come across many users who maintain a re-used password for each and every website, such as P@ssw0rd123 The problem with this approach is if someone breaches the protections of a particular ...
0
votes
1answer
87 views

Why does Google say my password is weak when I only added a division sign after a bunch of random stuff?

I noticed something very interesting after trying to charge my password for a Google account of mines, it seems strange. I went to the Google security control panel and selected to change my password ...
0
votes
2answers
104 views

Top contenders to replace passwords?

Passwords and humans don't mix particularly well. We can't come up with random ones very well, we can't remember random ones very well, we re-use them (I'm talking about all humans here, maybe not ...
26
votes
10answers
10k views

How to secure passwords over HTTP?

Say my password is abc. I want to send it to the server over HTTP. I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
2
votes
2answers
119 views

Why is it still necessary to block brute-force attacks when passwords hash verification requires significant work?

For authentication controls, Owasp gives advice to prevent brute-force attacks by locking out account, and I see this kind of advice in several places (blocking by source IP after failed logins, ...
1
vote
1answer
23 views

restoring logged out gmail session in running instance of chromium browser?

My situation is: +I have created a special purpose gmail account +I used a complicated password to protect the account. On purpose, I did not use any 2FA options are a "reset" email address or phone ...
1
vote
1answer
86 views

What to do when a conference uses HTTP and stores passwords in plaintext?

So, a site that I was using to sign up for an academic conference transmits information unencrypted (HTTP), including passwords. Then I see, using the 'forgot password' function gets me an email with ...
145
votes
6answers
22k views

Is password entry being recorded on camera a realistic concern?

I live in a city where CCTV camera coverage is comprehensive and increasing. Cameras are getting cheaper and higher resolution. Everyone has a video camera in their pocket already, and we are starting ...
54
votes
5answers
13k views

Is it bad practice to prefix my hash with the algorithm used?

Let's say I have a database with a bunch of users in it. This user database would typically have a hashed password per user. Would it be bad practice to prefix this hash with the hashing algorithm ...
0
votes
2answers
77 views

Reseting passwords using IP address

I sent a password reset request, to reset an account of mines and after having some talk with a rep I told him I forgot the email to the account which he told me to just provide the IP address that I ...
10
votes
1answer
1k views

Why don't Twitter and Facebook enforce password complexity during sign up? [closed]

If you try creating an account using your smartphone, these platforms don't seem to have strong password requirements. They both enforce a minimum 6 character limit and nothing else (I did however ...
2
votes
4answers
140 views

Is an authenticated server seeing the plaintext password a serious problem?

Typically a server ends up observing the plaintext password sent by a user at some points (correct me if it is not). Assuming that there is a secure channel established and the data are confidential, ...
2
votes
2answers
55 views

Domain offline - are unmaintained email clients a security risk?

I have just unregistered a domain. Now my mail client (Thunderbird) popped up a message saying that it cannot connect to the mail server. That's fine - for the moment. However, I wonder what would ...
1
vote
2answers
159 views

Is it possible to bruteforce a file encrypted with a keyfile?

If someone used a keyfile (4092 bit of entropy) to encrypt a file, and bruteforced it with Hashcat... would Hashcat have to guess the blob data in the keyfile to crack the encrypted file? $ dd if=/...
0
votes
0answers
20 views

How can I much can I consider an email secure? [duplicate]

People always forgot passwords, so some people prefer to simply send a token over email https://hacks.mozilla.org/2014/10/passwordless-authentication-secure-simple-and-fast-to-deploy/ (which is the ...
0
votes
1answer
33 views

OpenSSL: what's the difference between -kfile and -pass?

It seems both -kfile and -pass can be used to encrypt files with a 2048 bit keyfile? I don't understand the difference between the two methods: $ openssl enc -salt -aes-256-cbc -in inputfile.txt -...
1
vote
1answer
44 views

What are the disadvantages of using Shamir's Secret Sharing to implement a Partial Password scheme?

Suppose I want to implement a partial password scheme, where the user authenticates by using two passwords: one a normal password, the other is partial, where he only needs to type the selected three ...
2
votes
0answers
49 views

GPG: how to encrypt using a keyfile? (symmetric)

In Ubuntu this produces a "filename.txt.gpg" file and works: $ gpg --symmetric --passphrase-file keyfile.key filename.txt In debian, I get a popup requesting I enter a password... How do I encrypt ...
2
votes
2answers
135 views

How to harvest plaintext passwords from emails

Do you have any links to stories from a reputable source about any malware that harvests plaintext passwords from emails? I do tech support and every once in a while one of my clients will send me ...
0
votes
3answers
116 views

Would it be more secure to enforce “at least one upper case” or to enforce “at least one letter (any case)”

I am devising a set of password requirements. I am requiring users to use the following: Minimum 8 characters Minimum 1 number Minimum 1 special character Minimum 1 letter (any case) I would like ...
4
votes
5answers
270 views

Should admin users confirm their password before changing a user password?

In a hypothetical website, there are two types of users, admin users and normal users. Normal users can change their own password, and in keeping with best practices are required to provide their ...