The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [passwords]

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

Filter by
Sorted by
Tagged with
4
votes
3answers
285 views

As a website admin I could see encrypted passwords. Is this ok?

I am building a website that requires the users to login through username and password. I have the passwords encrypted in my database with bcrypt. On the back end, I receive the usernme and password ...
4
votes
2answers
1k views

Putty store cleartext credentials in the Windows Registry; isn't that a very insecure approach?

I have been astonished when I've found that one of the most popular SSH client Putty stores cleartext credentials in Windows Registry: HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\ ...
0
votes
1answer
62 views

How should we apply the salt to the password? [duplicate]

According to Wikipedia: A rainbow table is ineffective against one-way hashes that include large salts. For example, consider a password hash that is generated using the following function (where "|...
0
votes
1answer
41 views

Quantify security strength from entropy and lifetime

Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
0
votes
0answers
54 views

Securely distributing passwords and salts that will be derived by client programs

I am creating a client-server architecture running on top of the KCP protocol in Go. The package for KCP that I'm using is KCP-Go (https://github.com/xtaci/kcp-go). The package supports packet-level ...
3
votes
1answer
112 views

Can having certain restrictions/rules make passcodes less secure?

Say I have a phone whose security is corporately managed, and this management demands that I use a 6 digit passcode to lock the phone. So far, so reasonable. This gives an attacker a possibility of 1,...
1
vote
1answer
84 views

Is it safe to leave MySQL root user without a password if it uses auth_socket?

Since MySQL 5.7, the root user is configured to use the auth_socket authentication plugin instead of a password. Is it safe to leave the root user that way (without a password)?
1
vote
1answer
75 views

How to store user credentials in browser securely?

I need help to authenticate User with user credentials. We are using Angular 5 as a front-end & need to store user's email and password if user checks on remember Me. autofill user credentials ...
1
vote
1answer
57 views

Does digested passwords send over a non encrypted channel offers additional security over plain text passwords?

I am learning about WS-Security and trying to compare different options offered by UsernameToken as described in this document. AFAIK, a digested password is a hash of the plain text password along ...
0
votes
4answers
187 views

What is the best way to store a password on a system/server? [duplicate]

I will have an application server that needs to use credentials to authenticate to another service (email). What's the best way to securely store these credentials locally on the machine? Thanks in ...
0
votes
0answers
21 views

Can an employee be sued for gross negligence by reusing personal passwords at work? [migrated]

An employee is using some easy guessable reused passwords well known to Have I Been Pwned. OUCH. Something bad happens. Can an employee be sued? Option A: An organization does not have password ...
0
votes
1answer
112 views

Security concept for password management

At the moment, I am struggling on a question to which I have not found a good answer so far. I wan't to create a password manager, which will be used by a lot of people. Used languages: PHP / ...
0
votes
0answers
81 views

What authentication systems have been involved in data breaches?

Recently, a Federal Judge ordered Marriott to reveal the forensics report for its data breach. I know the Courts have sided with businesses in the past to keep the forensic details of breaches from ...
0
votes
2answers
68 views

Does a user password protect against network attacks, or only physical?

If I create a user in a Linux system with an empty password, does that expose any remote vulnerabilities, or is it only a problem if someone gains physical access to the machine?
3
votes
2answers
109 views

How strong is a password consisting of words arbitrarily chosen from the dictionary?

Diceware wants us to actually randomly pick n words from a given set of m=65 words. Assume a user does not actually use a dice. Instead they take a physical dictionary of m words and "randomly" picks ...
2
votes
2answers
121 views

Given Diceware, why does the requirement to contain uppercase, numerics & punctuation in passwords still stand?

Example strong diceware password: widow stout harvey crest zomba zloty butyl This password will be rejected by most sites, for example by Outlook.com. (Notable exceptions: Gmail, Stackoverflow, ...
-4
votes
1answer
96 views

How to use hashcat to crack a password made with openssl-passwd? [closed]

I want use hashcat or John the Ripper to crack the hash of a password. I know the password was created using the following command: openssl passwd -crypt -salt tl ******** The asterisks, of course, ...
0
votes
0answers
30 views

How hackers bruteforce web logins when password attempts are limited? [duplicate]

I read about password brute force attacks, but I wonder how hackers try this attack when developers limit password attempts.
0
votes
2answers
71 views

Protect key-streched hashes from rainbow tables?

I have a database table with accounts. I'm using PBKDF2 to create hashes from passwords. The passwords are of the correcthorsebatterystaple type, so we assume they are secure and unique. There are no ...
0
votes
0answers
6 views

Clear text passwords in Unix [migrated]

When did Unix move away from storing clear text passwords in passwd? Also, when was the shadow file introduced?
0
votes
1answer
57 views

Windows Fine-Grained Password Policies (FGPP) - Set Policy Duration

Trying to determine if there's a way to configure an FGPP(the policy itself) to last/be enforced only for a specified period of time or ideally, until a triggering event occurs. E.g., create temp ...
1
vote
0answers
39 views

Is Linux password login inherently insecure or is it just that people use weak passwords? [duplicate]

The normal advice you see everywhere when setting up a Linux server is to setup SSH and disable the password login. Is this because there is some security issue with password logins or because sooner ...
1
vote
2answers
122 views

Securely editing encrypted text files

My method for editing encrypted text files is to decrypt them in a RAM drive, edit them, and then encrypt them. What I'm worried about is information from my text files being transferred to non-...
0
votes
0answers
35 views

Is Argon2 secure to use? [duplicate]

Now that it's been 5 years since Argon2 has been released, is Argon2 secure for public use? (E.g. normal password hashing) Also, what are the secure parameters for Argon2?
0
votes
1answer
193 views

Can I crack a zip file using Hash Suite on Windows?

I'm trying to crack a password I set on a zip file using Hash Suite but it doesn't seem to work for me (not sure if I'm doing everything correctly). Basically, this is what I've done: Created a ...
39
votes
2answers
11k views

How do email clients “send later” without storing a password?

Email clients like Spark for macOS have a feature where a user can send an email later, at any given time, even when the computer is turned off. An SMTP server needs a password based authentication, ...
100
votes
3answers
18k views

Why is Sojdlg123aljg a common password?

I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
0
votes
0answers
85 views

How is a cryptographic key used as a password when using WiFi? [duplicate]

I have recently come from a post and the accepted answer described the password as a cryptographic key. I have an understanding of RSA, AES and uses of it such as digital signatures however I fail to ...
32
votes
3answers
5k views

Which is the best password hashing algorithm in .NET Core?

What are the considerations when picking the best password hashing algorithm in .NET Core? I read that not all hashing algorithms are compliant / unverified, so I am a hesitant on just getting ...
0
votes
1answer
145 views

Do I REALLY need to change my email password when idnotify.com Dark Web Monitoring recommends?

I occasionally get alerts from idnotify.com Dark Web Monitoring, such as this one: 08/31/2019 COMPROMISED EMAIL ADDRESS Email Addresses: Jt***an@gmail.com Date Found: 08/26/2019 Password ********...
3
votes
3answers
158 views

Is a Whirlpool hash with random salt secure enough?

I copied the title from another question, but it wasn't answered there and my case is a bit different. I have inherited an old website to maintain. I noticed that the password hashing is not up to ...
4
votes
3answers
199 views

What is the risk of an attacker inserting new password hashes?

The normal threat model that I see with password hashing is as a kind of defense against if the hash somehow leaks to the wider world. In practice, this appears to usually be via some manner of ...
2
votes
1answer
227 views

How do attacks on password locked accounts work?

A lot of questions here are about the safety of passwords e.g a Login Password to an account on site X. But how can attackers get in the account when they have to guess the passwords? I know there is ...
2
votes
2answers
102 views

Am I using RfcDeriveBytes correctly, when the salt I'm providing it contains the password?

I'm using Rfc2898DeriveBytes in my application to encrypt a password with a randomly generated salt, and with a set iterator count for slowness. Before, I just grabbed the generated salt and put it ...
-9
votes
1answer
184 views

Does word store my passwords in plaintext? [closed]

I have a document which I wrote my passwords in and saved it to my disk, and I have been hearing a lot about programs storing passwords in plaintext Did word store my password I saved in plaintext??? ...
51
votes
7answers
15k views

Is this password scheme legit?

I received an invitation for an IT security fair (https://www.it-sa.de/en). They additionally delivered a password "Kryptonizer". That is a little card to hang on your keychain with the following (...
1
vote
0answers
111 views

I need to store passwords with two-way encryption. What is the best way to do this?

I am creating a service that will access a database with passwords to different network devices like routers etc. Service takes users credentials and validates if he or she is allowed to access a ...
0
votes
2answers
161 views

Linux and Windows Password Security Settings

I'm asking a client why some password parameters are not defined in the Linux OS level and he's saying that, internally, Linux and Windows complexity and timeout settings are different. If they set ...
63
votes
3answers
14k views

Why does Windows store Wi-Fi passwords in a reversible format?

Running netsh wlan export profile key=clear in PowerShell will dump your current stored Wi-Fi settings, including the password, into xml files inside of whatever directory you are currently in. Why ...
13
votes
5answers
8k views

Defense against attacks using dictionaries

Some forms of attacks on passwords use dictionaries. It is safer to use nonsense passwords like YunSUanLin, Artibichoke, etc., which do not seem to pertain to any dictionary?
27
votes
2answers
4k views

How to avoid using System.String with Rfc2898DeriveBytes in C#

I am creating a .NET core webapp in C# that takes in a user password and hashes it to be stored on a server. I'm using Rfc2898DeriveBytes along with a randomly generated salt. I've read, however, that ...
0
votes
2answers
96 views

Disconnected wireless router security

I've changed ISP and am using their router. I wish to donate my old NETGEAR router still with its original Network Key (password). Would someone obtaining this router somehow get access to my ...
3
votes
1answer
300 views

How secure is KeePass KDBX4 by default?

How secure is KeePass KDBX4 by default if someone obtain the .kdbx file and attempt to brute-force it without knowing any hint of the master password? With assumption : The password length is equal/...
7
votes
3answers
497 views

How long should zip encryption password be for it take 10 years to crack?

I am using zip 3.0.0 on macOS High Sierra and Debian. Here is my zip version on macOS: $ zip --version | head Copyright (c) 1990-2008 Info-ZIP - Type 'zip "-L"' for software license. This is Zip 3.0 (...
2
votes
7answers
188 views

How can I encrypt a password for storage without having to remember another password?

I've recently started using a password manager (1Password). I have a really good master password (using diceware) but I'm worried that if I forget it then I can't access 1P and all my passwords. One ...
247
votes
2answers
40k views

Can ads on a page read my password?

Disclaimer: I have minimal web-dev/security knowledge so please answer as if talking to a "layman." I've heard that web-advertisements need to be able to run their own JavaScript so that they can ...
88
votes
4answers
18k views

Does the length of a password for Wi-Fi affect speed?

I work at a place that gives Wi-Fi to all the customers, with a password that is 19 characters long. A customer came in and claimed that because the password is long, it slows down the internet speed. ...
0
votes
5answers
347 views

How do keyloggers tell it's a password? (And how to fool them.)

This question also applies to clipboard monitoring. Imagine you are planning to deploy 100,000 copies of a Windows trojan with keylogger functionality. (For the record, I'm not talking about myself ...
2
votes
3answers
164 views

Password reset vs change

My webapp has "password reset" and "password change" functionality. Password "reset" is typical: user clicks "I forgot my password", enters his email, one-time link emailed there, he visits a form to ...
2
votes
1answer
149 views

Is it safe to use Redis to store username and hashed passwords? [closed]

We are taking a look at using Redis for a Cache Aside pattern, and I am thinking, is it safe to store username and hashed passwords in Redis Cache? If yes, are there security issues with having a key ...