Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
3,938
questions
0
votes
0
answers
48
views
My script to Encrypt/Decrypt data using PHP [closed]
I made these scripts to Encrypt/Decrypt data, example: Messages or a simple string and be able to transform the encrypted data to plain text again. At the end, I am going to explain why I think these ...
- 9
1
vote
2
answers
84
views
Should I worry? Web hosting mailed me my details and returned my password (unencrypted) and IP logged
Unfortunately, I've tried a hosting service and it returned my password value as it was in my inbox (as connection details).
I went to a control panel in an attempt to delete or deactivate my account. ...
- 13
1
vote
3
answers
115
views
Patterns in passwords
I am posting to ask about two conflicting password recommendations. I know only bits and pieces about cryptography. Let me begin by checking a basic assumption: in a cracking attempt, a string is ...
- 11
0
votes
1
answer
87
views
Best way to connect to user SSH servers
I have a project that calls users' SSH servers to do some tasks.
For now, I am storing users' passwords at my service as hashed (Username, hashed password and salt), but the SSH password (username, ...
- 5
-1
votes
1
answer
30
views
How can you calculate the entropy of arbitrary password rules with known distributions? [duplicate]
Many online entropy calculators make certain assumptions (like assuming a password is as rare as the set of random characters that will generate it), or handwave away the math. I want to know how to ...
- 97
1
vote
3
answers
155
views
Why do I need to provide authentication when accessing a browser's built-in password manager?
Why do I have to provide authentication when I want to read a password stored in my own web browser while I have to do nothing to read the same password on a site's login page?
Is my conclusion ...
- 3,609
2
votes
1
answer
138
views
Why would garbage collection be a problem in password managers?
I was reading an infosec user's take on the LastPass data breach and noted something odd in his commentary on another password manager system (emphasis mine)
I have not done a thorough code review, ...
- 3,808
5
votes
3
answers
1k
views
Why are there multiple "Hardcoded Password" Entries in CWE instead of single one?
When I looked up hardcoded password vulnerability in software world, I saw there are three kinds of vulnerabilities. These are that:
CWE-798: Use of Hard-coded Credentials
The Hardcoded Creds ...
- 519
0
votes
2
answers
77
views
What types of software can have "Hardcoded Password" vulnerability?
When I investigated the Google results, the software vulnerability "Hardcoded Password" (cwe-798 & cwe-259) is a vulnerability for IoT devices' software (see: link1) and thick client ...
- 519
0
votes
0
answers
68
views
How to find out which data breach my password was in?
HIBP and my password manager both claim that a password that I am using has been seen in a data leak.
Neither of them provide information about which data leak exactly my password was seen in.
The ...
- 101
1
vote
1
answer
119
views
Password restrictions limit Diceware word list - (when) can this get bad enough one should choose another strategy?
Besides “your password must contain this” complexity requirements, some places also have “your password must not contain this” rules, sometimes with fairly short substrings of the username, a day of ...
- 225
16
votes
4
answers
8k
views
Can 777-characters long passphrase be considered too short?
Is Rumkin.com's password tool a reliable tool for password strength checking?
I am asking because:
I am getting confusing suggestions:
(the password in this example is 777 characters long)
D. W.'s ...
- 3,609
3
votes
3
answers
457
views
Why removing just one letter form passwords makes it 20x easier to break according to zxcvbn test
Since I am a decent fan of the XKCD no 936 (or actually conclusions and implications it brings), I wanted to test (using try zxcvbn) the complexity and the possiblity of breaking a password like the ...
- 3,609
1
vote
0
answers
70
views
Resetting a well-protected Google account password
Situation: a new client came to me because of a torrent of identity theft issues. One of the issues: several of their Google accounts were having their passwords changed every few days. Each time, ...
-1
votes
1
answer
96
views
Is it a security risk to require passwords to be unique across all users? [duplicate]
More specifically, if Bob Smith uses 123456 as his password, no other user in the system can use 123456. This seems like a security risk to me. Technically, if someone knew something about Bob (he ...
- 1
8
votes
3
answers
4k
views
Can an SSH server in password mode be impersonated if I ignore the fingerprint warning?
Assume that I never check the server fingerprint when logging in to an SSH server. This means that certain configurations of SSH can be impersonated. For example, I can log into a server that only has ...
- 389
0
votes
1
answer
60
views
My Bank Enforces A 6 Character Limit On Passwords. Is This Bad? [duplicate]
A bank I (previously) used in Australia forced users to comply with a 6-character limit on every password. Specifically, the rules were:
6 characters exactly, including at least 1 number and letter
...
- 101
51
votes
5
answers
6k
views
Should a bank be able to shorten your password without your involvement?
The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore.
He called his advisor, who ...
- 611
1
vote
1
answer
49
views
Is there a way to store a verification-hash of a secret on a 'consumer HSM' like Yubikey or another WebAuthn device?
Context: I'm trying to design an SRS solution for your personal secrets - "Anki for passwords." (This is mostly a learning-exercise, to help me develop my intuition for writing secure(-ish?) ...
- 285
1
vote
3
answers
106
views
Why does having default router credentials pose a risk? [duplicate]
When I got to 192.168.0.1/login I am greeted with my router login page and can go change some settings. Now let's say I still have the factory default login something like "admin", "...
3
votes
2
answers
143
views
How do I remember passwords for environments where Password Manager is not available?
I am a big fan of 1Password. And I try to save my passwords in 1Password as much as possible.
However, there are environments where 1Password cannot be used. That is the password to protect 1Password ...
user284652
0
votes
4
answers
230
views
Is it safe for my password hint to be synonymous to my password?
Lets say my password is AppleDogFire642!.
What would be the potential security consequences if my password hint was BananaCatSmoke123@?
- 605
1
vote
3
answers
123
views
Asymmetric encryption of user's data
I got to thinking this morning over my coffee, that it would be nice if I could encrypt data for a Tenant with one key, and decrypt it with another key. In such a way that only a logged in User can ...
- 113
11
votes
4
answers
4k
views
Wi-Fi with guest network
I use an old AirPort Extreme to provide WiFi in my home. It provides a 2.4 and 5.0 GHz network with a good password, only available to me and my wife. It also provides a separate guest network without ...
- 2,051
0
votes
1
answer
15
views
Can an email address be added to "Forward To" list in cPanel without accessing the cPanel?
My company is using cPanel emails, recently while reviewing email forwarders, I noticed an email in the "Forward To" list that our sales email is being forwarded to it and that was unknow to ...
- 1
1
vote
1
answer
87
views
Is it secure to expose a salted bcrypt hash IF it is maximum length random secure password?
Is it secure to expose a salted bcrypt hash (minimum 14 cost) if the used password is 72 characters (maximum) byte long, randomly generated letters, numbers, and special characters using secure ...
- 13
1
vote
0
answers
62
views
Unknown Hash Type [closed]
During a CTF, I came across a certain hash type which can't be identified by various tools (hashID, crackstation, hashes.com, etc.)
The data is as so:
- Plaintext : abc123
- Hash : ...
- 11
1
vote
1
answer
37
views
Web app architecture- set a new password for a on-premises AD setup
I need to implement a web app for a self-service change password use case for on-premise Active Directory users,
which is accessible over the internet.
The service must allow the users to set a new ...
- 111
3
votes
3
answers
125
views
Is a sufficiently long password unsafe just because it only consists of 2-3 letter long mixed-case dictionary words and numbers?
Entropy/Length/Complexity of a password is pretty straight forward and cant really vary much.
For Dictionary Similarity, i would assume that a software just checks how many characters in a password ...
- 319
2
votes
1
answer
666
views
BLAKE-3 vs SHA-256 security
As we can see on this page, BLAKE-3 is about 14 times faster than SHA-256. Is it as safe as SHA-256? I would like to use it for my passwords which are 32 cryptographically random bytes, because my API ...
- 197
10
votes
6
answers
5k
views
What is the best way to calculate true password entropy for human created passwords?
Okay, I know it might seem this has already been beaten to death but, hear me out. I am including a fairly good password strength algorithm for my app for users on sign-up. This one, which I've copied ...
- 251
1
vote
3
answers
93
views
SHA256 for hashing 32 cryptographicaly random bytes
I need to hash 32 cryptographically random bytes, but later the verification the value with hash must be very fast, so I decided to use SHA256. Is it a security issue if my passwords are 32 ...
- 197
16
votes
4
answers
4k
views
Should one reject login attempts when the correct password is newly added to a password deny list?
Best practices say that when users choose a password (at signup or when changing an existing password), the application should reject that password if it appears on a list of passwords known to be ...
- 325
0
votes
0
answers
89
views
Amnesia and death proof master password
I have been thinking about how to store my master passwords (password manager, email and device passwords) for quite a while and I just haven't been able to come up with a satisfying solution yet. I ...
- 1
1
vote
3
answers
68
views
Should password strength validation also be run server-side or only client-side?
Personally, I think that it's not so important to check the strength of the passwords on server-side, since, if the user evades the validation on the client side, it would be their responsibility to ...
- 13
0
votes
0
answers
62
views
KDF vs hash function in loop for hashing password
I'm trying to grasp which benefit can KDF like PBKDF2, scrypt and bcrypt (I know that bcrypt is technically not KDF) may bring over hashing in loop like sha256sum(sha256sum(sha256sum.....(salt + ...
- 345
1
vote
2
answers
192
views
Why PAKE or Zero-knowledge password proof didn't replace sending a password via HTTPS
Technologies like Zero-knowledge password proof and PAKE seems to be pretty mature but almost all modern web-sites still send passwords over HTTPS to check authentication. At first glance, this ...
- 345
1
vote
1
answer
55
views
Does Google share it's international database of search queries with LEA agencies for purposes of breaking encryption?
So, suppose a person accidentally typed their complex encryption password into Google search. They weren't logged in to any Google services so the search was anonymous, and they continued to use this ...
- 11
3
votes
1
answer
145
views
Why banks require such a low password entropy for web/app access?
Many banks I have worked with require between 4-6 characters passwords. Some even force to use only digits.
Such a poor password is protecting your financial information, because MFA is usually not ...
- 10.6k
1
vote
3
answers
131
views
Why don't applications suggest passwords themselves?
Imagine a web app that, on the login page, has a password field which does not allow user input, but just displays a client-only generated password that is reasonably strong, with a button to re-...
- 227
0
votes
1
answer
120
views
Burp Suite: alphanumeric payload decoded to base64 exposes password, but as an encoded string
I'm learning Web Pentesting using Juice Shop and I successfully used Burp Suite to generate an SQL injection payload in the repeater that exposed the plain text email and encoded password of the admin....
- 101
0
votes
1
answer
183
views
Offline One Time Password algorithm
Sometimes when we login in some services we should enter One Time Password or OTP that can be received via SMS, e-mail or a voice call.
Among these options, there are some mobile apps that can ...
- 103
1
vote
2
answers
64
views
Autogenerated PINs
PINs secured by TPM or similar hardware are secure even if short and only numeric because the TPM can throttle and lock after several attempts. I'm concerned about PIN reuse. I suspect most people are ...
- 131
5
votes
2
answers
934
views
Why did WebAuthn beat PAKEs as the preferred password replacement?
Apple and now Google are releasing products that are built on WebAuthn as a replacement for traditional username + passwords. Why did this technology beat out PAKEs?
- 474
1
vote
1
answer
268
views
Is the Web Crypto API secure when the server is trusted?
I've heard a lot of people say that the Web Crypto API is not very safe. For example: https://tonyarcieri.com/whats-wrong-with-webcrypto, Problems with in Browser Crypto. However, I'm looking to use ...
- 63
4
votes
1
answer
165
views
Why would websites ask users to reauthenticate after a password change?
I was discussing with a non-IT friend after he came to me with a question regarding security and password change.
As he puts it: "Why do websites ask me to re-authenticate after a password change?...
- 1,478
0
votes
1
answer
81
views
Using Single Sign-On and the usage of password managers is discouraged. Whay are alternatives for storing tokens for example?
What are the alternatives of storing tokens when password managers are discouraged?
Some of the ideas that come to my mind are storing in a text file and encrypting with GnuPG but that's asks for ...
- 293
0
votes
0
answers
59
views
Why is not there encrypted way of sharing/showing data such as Password to the user (hidden from web app Source code)?
I wonder if there will be (or is) a way to hide data such as passwords from the HTML/DOM structure? As, password fields can hide from external person other than the main user with something like "...
- 1
29
votes
3
answers
6k
views
Why are PIN codes usually of even length (4 or 6)?
A huge problem is PIN guessing from birthdays (dd/mm/yy lends to a 6 digit number that is easily guessed, dd/mm/yyyy for 8 digits). It's very often that a PIN number is taken from someone's birthday ...
- 399
0
votes
0
answers
37
views
On the gains and losses of an additional client side stretching of the user password [duplicate]
Picture a state of the art implementation of a website registration and login system.
I'm interested in analyzing what a defender gains and loses by feeding the user password to a key-stretching KDF ...
- 1,197