Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
3,617
questions
8
votes
1answer
417 views
Why do some sites enforce low-security passwords? [duplicate]
I get that what comprises a good password is a bit of a moving target and not everyone agrees - just run a password through a number of checkers to see how it is rated differently depending on the ...
0
votes
0answers
26 views
How can multiple factors in authentication be combined to have a higher level of security? [closed]
Authentication factors can be categorized as
"Something you have"
"Something you know"
"Something you are"
"Somewhere you are
How can these factors be combined to ...
0
votes
0answers
28 views
Confusing Cisco enable password format [migrated]
I'm totally confused by this Cisco password format:
enable password level 15 encrypted 382fda4a4a26e6637edac0eb8b8ba4581087d32d
Overall string is 40 bytes long:
$ echo -n ...
3
votes
2answers
79 views
Password security against Brute Force - local vs online attack?
I always wonder about the generic statements about the security of passwords. Isn't it a huge difference if the password is used for an online account or for local data encryption? For example an ebay ...
1
vote
0answers
63 views
Strange account activity - how to investigate
Today I have observed very strange scenario which appears to be attempts to hack an account. So first, let me tell the pre-story:
I have started to receive 2-factor authentication SMS messages from ...
7
votes
4answers
4k views
Storing Username and salt in separate table
You have a User table:
UserID (auto-incrementing Integer)
Password hash
LastLogin
All related tables are linked by the UserID.
You also have a Username table:
Username
Salt
IncorrectLoginCount
...
1
vote
1answer
119 views
What is the plaintext password of 'hash part 1' in the shadow file?
on immersivelabs lab Password Hashes II
https://dca.immersivelabs.online/labs/password-hashes-ii/
there is a question:
What is the plaintext password of 'hash part 1' in the shadow file?
shadow.txt ...
0
votes
1answer
28 views
Open IMAP connection using hashed password
I make email client over IMAP protocol. To "remember" user's connection details (email, password, host, etc.) I need to store password in plain text, because otherwise I won't be able to ...
14
votes
7answers
2k views
Timing attacks in password hash comparisons
I had a discussion with a friend today about his password hash comparison. I argued that you can't return false on the first hash mismatch you have and I sent him a link to an article about a Java ...
0
votes
2answers
69 views
Worst case scenario for compromised private key in server certificate?
Assume that someone gains access to the password used for my key store containing my server certificate and it’s private key.
I guess without direct access to the server running my application the ...
0
votes
0answers
13 views
How to know the algorithm used to convert the password? [duplicate]
How do i know the algorithm being used while generating this password?
78:C5:F8:ED:AB:3B
to:
90BF8F3AD17
78:C5:F8:ED:AB:3C
to:
DDAD73B1433
Ps. you could probably omit the ':'.
1
vote
1answer
45 views
Does the random presence of a common password sequence within a larger password weaken the password?
I have a somewhat basic understanding of how entropy relates to password strength - generating a password with a truly random selection from some set (whether that's characters, or a set of dictionary ...
0
votes
0answers
34 views
How does the autofilling of private user credentials work? [duplicate]
In the one hand we have a google's password store (or things like LastPass, 1Password, etc.) and it's ability to autofill your credentials when you need it.
In the other hand we have a password ...
0
votes
0answers
14 views
Is password less login secure? [duplicate]
Recently I came across this password less login. For authentication, we need to enter an email address and click on a login button. We will receive a link in your email and when we click on that link ...
1
vote
2answers
168 views
Encrypting a password with its own hash
I just found out that an e-commerce platform (similar to Shopify) I was planning on using allows me to see my password. I know I can't assume anything and I should (probably) just run away from it, ...
1
vote
0answers
40 views
Entered FDE password in GRUB by mistake
For several reasons (I have an external monitor, etc.) when I booted the laptop I typed the FDE (Full Disk Encryption on Linux, LUKS) without looking at the monitor, and I ended up typing the full ...
0
votes
2answers
121 views
Why PIN exists?
Correct me if I'm wrong, but it seems PIN is merely a password but only allowing numbers (and short max length on some services). That sounds very insecure to me, but many services are using it. ...
0
votes
0answers
21 views
Are 2FA options available when booting into your laptop? [duplicate]
Are there any 2FA methods that can be used when accessing the BIOS or booting into your Hard Drive?
If not now then what about the future?
0
votes
0answers
43 views
Review of the design of Credentials Manager app
I want to make a mobile app that will act as a Credentials Manager and store all my access information for websites, credit cards, secure notes, and so on on the server encrypted with REST API.
The ...
0
votes
0answers
33 views
Building a dictionary [duplicate]
I want to create a list of passwords to perform dictionary attack. Please show me how to build a password dictionary file. First, I gather information from users like hobbies, date of birth, favorite ...
0
votes
0answers
27 views
Received email with password in the subject - To what extent have I been hacked? [duplicate]
I was cleaning out my spam folder, when I saw one with a subject line which had a little-used password of mine. 16 hours ago. I'm fairly sure odds of guessing this password are small, so I looked.
The ...
19
votes
6answers
5k views
Why use entropy at all in considering password strength?
I don’t understand the password vs. passphrase analyses that I read. Let me explain.
Here is a pass phrase. It has 5 words using only lower case (I’m ignoring randomness for this purpose): friend ...
1
vote
0answers
65 views
SECURITY VIOLATION: Root login attempted - Which password is affected?
Logwatch shows that proftpd was tried to be logged into using root
0.0.0.0 (111.254.68.221[111.254.68.221]) - SECURITY VIOLATION: Root login attempted
I found:
Normally, proftpd does not allow root ...
0
votes
1answer
52 views
Is it safe to type a password in a VNC client connected to a server to access another server? [closed]
I am using VNC GUI client from my Desktop to connect to a remote (ubuntu) server, say S1. From the remote server (S1), I will be logging into another server (say S2) via SSH. Via VNC client, I will be ...
0
votes
2answers
72 views
E2E encryption for web app - two passwords vs encrypting data with login pass and sending only hash to server
Hello I am looking for some compromise with integrating E2E encryption for web app (basic FE and BE).
Basically I read about two concepts which are trully E2E encryption and not that much complicated.
...
2
votes
2answers
103 views
Does storing all the passwords a user has ever used create a vulnerability in the broader password environment?
By saving all the passwords for all users forever, are companies accidentally creating a less secure environment?
Related to this question:
Why do some sites prevent users from reusing their old ...
0
votes
0answers
40 views
Is storing passwords in encrypted container still bad practice? [duplicate]
Suppose I need to store a bunch of passwords: storing them in a txt or odt file inside an encrypted container, such as the ones produced by VeraCrypt, is bad practice? Would I put myself at risk?
If ...
-1
votes
1answer
50 views
Is it bad practice to publish details of password complexity requirements? [duplicate]
I've noticed that some sites publish very detailed password requirement statements to users.
Here's an example screenshot (not singling out this site - just a random image that came up when googling '...
8
votes
2answers
2k views
Should http basic auth passwords be stored hashed serverside?
HTTP basic auth sends credentials un-hashed and unencrypted over the wire, relying on TLS for confidentiality in transit. However, should the password be stored hashed using a standard KDF in the ...
0
votes
2answers
79 views
Is adding encryption before hashing more secure?
One way to secure a password in the database is to hash it with salt i.e. appending a random string to the password and then hash it and store the value.
Does encrypting the password || salt then ...
1
vote
1answer
165 views
Why limit password length?
This question is inspired by Is there any security risk in not setting a maximum password length?.
Specifically the accepted answer https://security.stackexchange.com/a/238033/9640 says limits are ...
26
votes
2answers
7k views
Is there any security risk in not setting a maximum password length?
I'm a listener of the podcast "Security Now" where they often claim that there are no reasons to limit the number of characters a user can use in their passwords when they create an account ...
0
votes
0answers
27 views
Handling parallel login and Max invalid attempts using OTP with same phone number
I am designing a login system that performs login operation using OTP and Email ID of the registered user.
The current approach is as below
User enters the Registered Email Id
If the Email ID is ...
0
votes
2answers
42 views
How do I make a word list for cracking password? [duplicate]
I already know the password format: 1 Upper Case Letters + 5 digits + bf (bf is the known letters, they must included in the password and at the end)
For example: A12345bf, C12301bf, D10282bf.
I want ...
0
votes
2answers
110 views
How do I brute-force a password when I know the format? [closed]
The format is 1 letter + 5 numbers (e.g. A12345).
Any method and software?
0
votes
1answer
81 views
What happens if I reuse passwords
I want to understand the risk in reusing complex password.
Unique complex passwords for each and every email account, say 3.
All other accounts, bank, medical, social, share a complex password, 1
...
1
vote
3answers
74 views
Admin change user details / account information in admin interface
I'm creating this admin dashboard, and I have a question wich I have been stuck on for a while now.
And I'm starting to question what kind of data the admin should be able edit/view on the other ...
1
vote
1answer
65 views
Securely storing a master key client-side
My company is currently evaluating a product which comes with a browser-extension-based password manager. The password manager is peripheral to their core product, but is the only way to use it. We're ...
1
vote
2answers
121 views
Is my email, pc or something else hacked?
Recently I registered iCloud account with my gmail account. Now I received fake email from "iCloud" on mail.com email address which I use frequently for registering accounts on various sites....
0
votes
2answers
49 views
What can you do to make a hashed token database retrievable at a later date?
I have a table for single use tokens, and one of the columns is a token_digest which contains a bcrypt hash of the access token. Since the token_digest is a salted and hashed version of the plaintext ...
1
vote
2answers
163 views
What's the difference between these MD5 hashes?
What's the difference between this format:
Hash found: admin:$1$$oLN1UCc1Y3T30QkMcKMSx0
and the following:
5f4dcc3b5aa765d61d8327deb882cf99
And also,
How to turn the first hash format into the ...
0
votes
0answers
61 views
How is asking for a previous password a good practice?
Since data leaks are being more and more common, why companies like Microsoft and Google (but I'm not asking just about them) ask for a previous password if a user try to recover it?
Google's password ...
0
votes
2answers
73 views
hide_my_wp wordpress plugin is activated with php eval function that might trying to read /etc/passwd? Is it true?
When I install this plugin and activate in wordpress, hide_my_wp put some eval codes in wp_options and I see the following code being injected in a new row with the ID called 76624:
upload-dir=./../../...
0
votes
0answers
77 views
(Re)Hacked Instagram accout even if Two Factor authentication was enabled
A friend of mine, let's call her Alice, had an Instagram account that was hacked. She uses an iPhone. The scenario looks like this:
Alice gets a link from a Business Account via WhatsApp, and clicks ...
2
votes
0answers
136 views
Recovered a 7z password with hashcat, but it's not the right one
I am trying to recover a 7z file, but have forgotten the password. It's completely AES-256 encrypted (i.e. not even the filenames are available).
Steps:
Generated hash file with 7z2hashcat.pl
Ran a ...
24
votes
6answers
7k views
Password entry: are “paste from password manager” and “eyeball to view passwords” mutually-exclusive features?
Context
NIST SP 800-63b gives the following guidance for password forms (aka login pages):
Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This ...
0
votes
2answers
87 views
Is it unsafe to have some users with passwords and some without?
I'm working on an app where some accounts use passwordless authentication by email (using magic links) and some require a password to login. Is it okay to represent this rule in the account table by ...
0
votes
0answers
55 views
Can a secure key-exchange algorithm replace hashing for password authentication?
Over the weekend I was thinking about the problem of scaling various web services. One common practice to scale authorization is to use cryptographically signed tokens. This way when a request comes ...
1
vote
1answer
102 views
How to apply custom filters for John The Ripper when cracking RAR3 archive password?
My problem is that I'm trying to crack RAR file with is encrypted with RAR3 encryption.
Decided to try with John The Ripper.
Here are clues I have from my friend.
Max password length is 8
Only ...
5
votes
2answers
1k views
Does brute-force time depend on the length of a password only? [duplicate]
If a password is +30 characters long but contains words from the dictionary, is it less secure than a 10-character password that is !@#$#%$^%$, for example?
