Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
3,778
questions
0
votes
2answers
77 views
WinSCP :: Percent-encoding in SFTP password, why?
I recently discovered the problem with Percent-encoding.
It makes perfectly sense when we are dealing with such problem in a browser scenario. But I don't get why a software like WinSCP can be ...
1
vote
1answer
57 views
Not the same password for AWS (root user) and Amazon.com shopping, because that is not secure in my eyes
I use the same email address for the AWS root user and my Amazon shopping account.
Unfortunately the password for both parts of Amazon is also the same, when I change the AWS password I automatically ...
0
votes
0answers
57 views
What is the maximum practical limit for secret storage in the human brain? [closed]
I understand this question is more for a psychologist or a linguist to answer, but I'd imagine having a thread on the security section of stackexchange for known password entropies practically used ...
17
votes
1answer
4k views
Crack 7Z password if I also have the original file
Some of my files have been encrypted by ransomware. I can find some backup of files (unfortunately not all of them). Can I find the password of the 7Z zipped+encrypted files if I also have some of the ...
2
votes
3answers
115 views
Is using random salt to pbkdf2 for every request to Rest API good/bad?
Here are my conditions:
My Rest API must accept username and plain password. But, that's very bad. That's why the client must encrypt the password first and my rest API will decrypt it to get the ...
0
votes
1answer
65 views
VeraCrypt: Is it possible to change the master key?
The password in VeraCrypt is used to en-/decrypt a header, that contains a master key, that is used to en-/decrypt the data.
I know, that I can change the password, which will not change the master ...
0
votes
0answers
44 views
Reset linux user password with ssh key based access [migrated]
I'm not sure if what I'm trying to do is possible, so I wanted to see opinions of security people.
I have a remote nvidia device left with default credentials and someone brute-forced the device and ...
0
votes
0answers
35 views
How to use scrypt or Argon for Openldap version < 2.4.5 [migrated]
I know that support for Argon2 was released with OpenLdap 2.4.5 according to this link https://bugs.openldap.org/show_bug.cgi?id=8575, but what if I want to use it with a previous version like 2.4.4 ...
0
votes
1answer
37 views
ncrack ssl option
There is the following option in ncrack (from the man page):
Misc options:
ssl: enable SSL over this service
ssl (Enable/Disable SSL over service)
By enabling SSL, Ncrack will try to open a TCP ...
0
votes
1answer
238 views
John the ripper not able to crack the password
I generated two hashes from this site:
Plaintext 1 (p1): world
Salt 1 (s1): hello
Hash 1 (h1): 936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af
Plaintext 2 (p2): world2
Salt 2 (s2)...
0
votes
1answer
70 views
Is pbkdf2 with hmac using md5 still secure?
I have an old system that can do PBKDF2 with HMAC using MD5, but not SHA-2. Now I know that MD5 is insecure and shouldn't be used for new applications, but https://crypto.stackexchange.com/a/9340/...
0
votes
1answer
79 views
Submitting password over untrusted VPN
Hi，I do not work in IT security and hence am asking some general questions here.
I read https://security.stackexchange.com/a/172821/266785 and have questions that would appreciate answers.
Is my ...
0
votes
1answer
90 views
Store a password as an identifier (as safely as possible)... since there is no other choice
I have to deal with a place that has some terrible security practices. For example, this place gives people passwords (eg. domain logon on Windows, but paired with their name as the username) that is ...
1
vote
1answer
49 views
Is username + password functionally equivalent to a single login string of the same length?
My intuition is failing me with this. Would it make it easier or harder for an attacker trying to gain access to any of the accounts in a database?
I can see that in the case of a single login string, ...
0
votes
1answer
115 views
strength of 64 character long password with containing only Hexadecimal digits (xdigit)
I wrote a small shell function to generate random passwords. Such a password may look like the below.
D2fdAbE5e9bcAFDBE5bEeED3b795ecf44B35e99B6D28591429fEE6B7C0BcCed1
I started to wonder if this is ...
2
votes
3answers
160 views
Is it sensible to accept a password + any other random characters for successful authentication?
Supposing a user of my system has set their password to Password123
At the login screen, what would be the security implications of me accepting:
Password123 or
Password1234 or
Password123ABC
Based on ...
1
vote
1answer
88 views
Is 2FA based on Google Authenticator Real?
I was reading this response on SE about 2FA:
Well, I hate to break this to you, but Google Authenticator plus
password isn't really two-factor authentication. Proper 2FA is two
separate items out of ...
1
vote
3answers
162 views
To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?
I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
1
vote
0answers
69 views
Can SMB/CIFS credentials be extracted from Linux?
On a penetration test, I have completely compromised a Linux machine and I am now trying to move around the network. The Linux machine has a mounted CIFS share, and I want to get the password used to ...
0
votes
4answers
173 views
Forget Me Not? Abandoning the Forgot Password Functionality
They say a chain is only as secure as its weakest link. When it comes to account security it seems to me that the Forgot My Password functionality is the weakest link in the security chain because it ...
30
votes
6answers
7k views
Is it insecure to display the number of characters when users enter a new passphrase?
When users are entering a new passphrase somewhere, it's helpful to provide feedback on the number of characters received by the system.
In a user experience (UX) test I just ran, my user created a ...
0
votes
0answers
39 views
Specification of AES-based PKCS#5 Password-Based Encryption (PBE)
recently I had a look at the capabilities of the Java keytool to create PKCS#12 containers with a protected private key. According to the standard a private key is protected using a PKCS#8 shrouded ...
0
votes
0answers
106 views
What are security risks of a domain user accounts with denied interactive logon?
When I create domain user account with denied interactive logon, what are real security risks when hacker gets the password?
http://paulasitblog.blogspot.com/2017/01/deny-interactive-logon-for-service....
0
votes
1answer
81 views
Company sent me a registration email with a clear text password [duplicate]
I recently signed up for a company's product, and promptly received an email confirming my registration, showing both my email address and my password. I'm not a security expert, but that was a huge ...
0
votes
2answers
67 views
With Network Security Systems Decrypting SSL traffic to scan for Malware Is Server-Side hashing of Credentials Still Enough?
I am not a Security Expert by any means. Nor am I a Cryptographer. That's why I'm here.
After discovering that the server side of some software I work on was operating on plain text passwords (though ...
0
votes
1answer
65 views
Password list where a password policy was used
I found a list of common passwords (i.e. "123456", "password", etc.) online.
Is there a public / open-source set of common passwords where a password policy was in use?
Example of ...
1
vote
1answer
118 views
Is there any security flaw in this C program to generate a tabula recta?
In order to generate and store my passwords, I decided to use a tabula recta as described in this article.
So I coded a simple C program to create such a table, I wanted to know if it contained a ...
1
vote
3answers
143 views
Does hashing syslog (or similar) make for good passwords?
I thought of an approach to password generation that I haven't heard of anyone else using. It almost seems too good to be true so I wonder what the downsides are. I'm well aware that you shouldn't &...
4
votes
1answer
148 views
How does Firefox protect Logins and Credit Card Data?
I have a question about how Firefox protects Login information (Website passwords) on the one hand and Credit Card data on the other. I noticed that there are two different approaches to how Login ...
0
votes
0answers
89 views
Speed up cracking a wpa2.hccapx file in hashcat
I'm trying to do a brute force with Hashcat on windows with a GPU cracking a wpa2.hccapx handshake. Based on my research I know the password is 10 characters, a mix of random lowercase + numbers only
...
0
votes
1answer
106 views
Why is entropy measured in bits?
I use KeePassXC to generate and store passwords. For example, generating a password with a length of 128 characters without using the extended ASCII character table, the entropy is about 770 - 800 ...
0
votes
0answers
72 views
Get encrypted PDF password
For a CTF challenge, I got a locked PDF file with a data folder that contains images, a plaintext file and a wav audio file.
I used pdf2john.pl to get the password hash and I performed a brute force ...
1
vote
1answer
122 views
Does using a random number of iterations for PKBDF2-SHA256 help if I only have to protect one key used to encrypt a password protecteded file? [duplicate]
I read about Recommended # of iterations when using PBKDF2-SHA256?
I have also read in Why not just use a small but unusual number of hashing rounds? that when there are multiple password to protect, ...
1
vote
1answer
85 views
Cracking Lost Password for encrypted 7z file with most characters known
I forgot password to 7z archive encrypted with AES 256. I am fairly certain of most characters however. I know password length is either 8 or 12 characters and if it is 12 I know the last 4 characters....
0
votes
0answers
49 views
John The Ripper numbers mask
I'm using john on Windows and I use pdf2john.
What do I have to do to crack this password?
I saw previous passwords and they were 4 digits (1234), possibly there may be more now. currently trying to ...
0
votes
1answer
47 views
If a platform/system has brute force protection should I care for a very strong password
If a platform has brute force protection should I worry about creating a very strong password since any attacker would not get a chance to reach enough attempts to crack even the weakest password?
Not ...
7
votes
3answers
4k views
Why not just use a small but unusual number of hashing rounds?
When it comes to hashing passwords, it is nowadays practice to do 100'000 or 200'000 iterations of SHA256/SHA512, or at least something in that ballpark.
But my question is, why is it not safe enough ...
0
votes
2answers
52 views
Sending password in separate email [duplicate]
I've noticed some services will send a username in one email with a note saying the password will come in a different email. Is there any point to this? It seems that if someone can get that email ...
-1
votes
1answer
109 views
What are the security implications of the password policy for this bank? [duplicate]
I am aware of a bank (redacted for obvious reasons) that has the following password policy.
Only English alphanumeric characters
Min of 8, max of 14 characters
No special characters (ex. !@#$%^&* ...
0
votes
0answers
120 views
I can't decrypt chrome passwords offline with sha masterkey
I'm trying to decrypt a Chrome 80+ Login Data file offline using the SHA1 or SHA256 masterkey retrieved either using backupkey or lsass dump but no tool seems to work (I tried mimikatz, sharpdpapi, ...
20
votes
3answers
6k views
Not understanding why I should use public/private key encryption over password?
My knowledge about these topics is very elementary, please "school me" if I said something completely wrong, it would surely help me understand these things better. Now, to my issue.
Now ...
2
votes
0answers
101 views
Why is John returning gibberish for cracked hashes
I've been messing around with John, and when I attempt to crack an SSH hash, I receive this output.
Any clue why the cracked hash is displaying the gibberish??
I used ssh2john to convert the key to a ...
0
votes
2answers
73 views
What are security benefits (if any) of using multiple passwords (device, password manager, …) vs single strong passphrase when paired with FIDO U2F?
I am evaluating security benefits of requiring employees (in enterprise context) to use multiple passwords (or passphrases) vs single strong randomly generated passphrase (minimum of 8 words) when ...
0
votes
1answer
56 views
How to merge two email boxes securely with an email box fetcher?
I have two email boxes: The first one is my main email box in Gmail and the second one is in my website hosting company by Thunderbird which I access from my website hosting manager (WHM) which is ...
0
votes
0answers
79 views
Where to store passwords needed by linux processes?
I am working with C++ processes on a linux (CentOS 8) environment. These processes should be able to access an encrypted file on the system.
Where should I store the password for this encrypted file?
...
1
vote
3answers
148 views
Using Password Managers to store multiple factors, would this reduce security? [duplicate]
Assume I have a password manager that stores the credentials for a login to a 3rd party service. In this credentials the username, password and a TOTP-seed is stored and the current TOTP-token is ...
1
vote
2answers
290 views
What is the point of storing hashed passwords? If that file is read, doesn't that mean the computer has already been compromised?
Why is it necessary to store operating system passwords hashed? From what I've learned, passwords are stored on the hard drive/SSD in /etc/shadow. However, if a malicious agent was able to get access ...
0
votes
1answer
63 views
Can yubikeys prevent cookie stealing?
When you log into a website, it stores cookies that let your browser access the website without having the password.
Given that some sites support yubikey for login, does it mean that the yubikey ...
0
votes
2answers
236 views
Does John the Ripper automatically account for salt and hash?
I have an embedded device running Armbian which I was able to get the drive image from. The entry in /etc/shadow combined with /etc/passwd after unshadowing is this:
root:$6$TV6ML2bG$TncnN/adtU9xaQs/...
0
votes
0answers
67 views
Could I have prevented my Facebook password from being stolen by these trojan apps? [duplicate]
According to this Dr. Web article:
Doctor Web’s malware analysts have discovered malicious apps on Google Play that steal Facebook users’ logins and passwords. These stealer trojans were spread as ...
