Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [passwords]

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

Filter by
Sorted by
Tagged with
22 votes
3 answers
5k views

Is there a problem with having a combined login/register screen?

I am designing a new login/register process for a system and want to combine the 2 initial pages for register and login. This would be one page where the user would enter their email and press '...
Ollie's user avatar
  • 221
4 votes
3 answers
2k views

How to track PBKDF2 progress?

Background: We have an application with password authentication. We now need to raise the number of PBKDF2-iterations and this means that the login takes quite a bit longer than before. Therefore, ...
n-l-i's user avatar
  • 326
2 votes
8 answers
402 views

Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password?

Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password? If so, can you give me a password cracker specifically designed to crack non-keyboard characters? If yes, do you think it will crack this one?
Hello's user avatar
  • 21
2 votes
0 answers
92 views

I linked an account with Plaid. If I change my username and password, will that mostly protect me in the event of a breach?

This is very similar to this question from 5 years ago, but I didn't see a clear answer: Is Plaid safe if I change the password after deposit? I've linked an account with Plaid. That account is 2FA ...
TyrannicalDuncery's user avatar
1 vote
1 answer
175 views

Recommended way to store password that needs to be used as plaintext?

I'm making an application that logs multiple accounts into a game server. I'm able to do this by passing in the username and password as argument parameters to the game executable. Unfortunately, I ...
HandmadeWeakness's user avatar
14 votes
4 answers
6k views

Security of a non-random password but that relies on information an attacker cannot possibly know

I am trying to figure out whether a non-random password that relies on information an attacker cannot possibly know can be secure. To give an example, let’s say that I generate my password by putting ...
hb20007's user avatar
  • 559
4 votes
1 answer
336 views

Find password decryption used in MSSQL

I have the 2 encrypted passwords in my MSSQL database and I'm trying to decrypt it. Here's one of the encrypted password: E4-68-3F-BE-91-CC-BE-B9-27-4B-18-B1-5F-1B-39-66 The password to the above ...
Elaine Byene's user avatar
2 votes
2 answers
175 views

"Strong password” leaked message

The Safari browser can suggest and remember strong passwords: 18 random digits and uppercase/lowercase letters separated by hyphens. The browser also tells you if you use a password that is known to ...
gnasher729's user avatar
  • 2,404
1 vote
0 answers
64 views

Hashcat when account name is "Not a real account" [closed]

Couldn't hashcat be applied to godbolt.org given this file data? /etc/passwd ce:x:10240:10240:Not a real account:/app:/bin/bash /etc/shadow ce:$1$rockyou$hty8SH9lK4mcCQXKENxaa1:18723:0:99999:7::: ...
vengy's user avatar
  • 111
0 votes
0 answers
68 views

Is Windows 10 'Backup and Restore' sending my password in plaintext on unencryped link?

[Note: I have a Windows 10 system in an air-gapped network as the only computer on the network where it is the acting "server", as part of an RMF-compliant, DAAPM (link to PDF on dcsa.mil) ...
SeligkeitIstInGott's user avatar
0 votes
2 answers
103 views

Alternatives for password where at least one secret is not know by the server, with similar transparency

Some service like Bitwarden use the password to encrypt part of your personal data, so that nobody except you can access it, and they archive this because the server only gets your password's hash ...
Delfin's user avatar
  • 103
0 votes
0 answers
20 views

How to recover my password from my file.key [duplicate]

I don't remember my passphrase for my PGP key that was created several years ago. How can I decrypt my file.key to recover it? Or what should I do to recover it from my file.key?
BitCoinsBank's user avatar
0 votes
4 answers
2k views

Can somebody explain simply why crypt of a password with a salt (the hash result) is equal to crypt of the password with the hash result itself?

Can somebody explain simply why crypt of a password with a salt (the hash result) is equal to crypt of the password with the hash result itself ? Surely there is a simple mathematical explanation. I ...
Winston L's user avatar
-1 votes
1 answer
261 views

bruteforce local software's password

There is a lot of online tools to bruteforce online server like hydra and offline with hashes like hashcat. Yet it seems very weird that there is not a single offline bruteforcing app for software. ...
the shadow's user avatar
0 votes
0 answers
62 views

Assessing the Implications of Using msoffcrypto for Open Sourcing a Medical Data Processing Pipeline

I am in the process of creating a Python pipeline intended for reading and processing sensitive medical personal data from password-protected Excel files. The pipeline utilizes the msoffcrypto library,...
Eoin's user avatar
  • 1
0 votes
1 answer
183 views

Online password generator vs. offline counterparts? Are there widely adopted guidelines/recommendations?

Are there any widely adopted guidelines/recommendations in regard to online password generators? Are they recommended over offline generators, for example? If so with what justification? References ...
0xC0000022L's user avatar
  • 1,662
2 votes
1 answer
245 views

Why would website block password manager auto-fill?

I use a password manager and have a browser plugin installed for it to simplify entering passwords into websites. I recently encountered a website (enterprise SaaS solution I use at work), which ...
Aleks G's user avatar
  • 271
0 votes
1 answer
103 views

FFUF command returns status code 400, regardless of mode option: clusterbomb, pitchfork, sniper

I'm working on a lab on PortSwigger.com titled Username enumeration via different responses. While using ffuf to solve the lab, the output keeps returning a 400 status code. So far this is what I've ...
Michael Sodeke's user avatar
2 votes
3 answers
209 views

Should my password contain part of the service's name?

Let's assume that I have chosen a password X which is both hard to guess and easy to remember. I have the feeling that instead of using X for, say, Gmail, Stackoverflow, Ebay, ... I could use gX, sX, ...
I. Haage's user avatar
  • 453
0 votes
2 answers
311 views

XKCD #936 Why not both?

This "correct horse battery staple" XKCD comic #936 was a topic discussed here already. However, I saw no one suggesting combining the second method of using dictionary words with an "...
CrazyMan's user avatar
0 votes
1 answer
107 views

Are Apple TOTP verification codes the HOTP secret?

Apple provided the capability of using TOTP within iOS itself and I noticed there was a section for Use a verification code on a website or in an app which bypasses the QR Code. My question is whether ...
Archimedes Trajano's user avatar
-2 votes
1 answer
190 views

Biometrics the only real security

Since 2FA exploits are increasing, and most end-users are hellbent on using the least secure passwords available, are biometrics the only real security left?
brain404's user avatar
0 votes
2 answers
386 views

If someone knows your wifi password AND is out of wifi range, does it present any particular risks?

This is a close matchup for If someone knows your wifi password can they hack your router? I gave someone my general (not the guest-specific) wifi password, but they flew home to another continent. ...
Italian Philosophers 4 Monica's user avatar
0 votes
3 answers
174 views

Is using TOTP from Authenticator app on a mobile device instead of passwords inherently 2FA?

A related discussion can be found, specifically addressing the security implications of using only TOTP for single-factor authentication However, in my view, using a TOTP code from a Google ...
Luka Demetrashvili's user avatar
2 votes
0 answers
221 views

Windows AD - Fake User Account with Multiple Passwords to Detect Password Spray

TL;DR I'm trying to implement a fake user account that has multiple sets of credentials that can be used. Instead of a specific password, any one password from a list of them could be used to ...
CyberKnight's user avatar
1 vote
1 answer
165 views

Does not storing passwords in browser really matter given cookie hijacking exists?

I see lots of articles suggesting not storing passwords in the browser, and it made perfect sense to me, if I can access this data easily, an attacker probably can too. But then I found out about ...
Arthur Moraes Do Lago's user avatar
0 votes
1 answer
175 views

Does 7z or RAR5 offer better resistance to brute force attacks?

Does 7z or RAR5 offer better resistance to brute force attacks?
oqdn's user avatar
  • 1
4 votes
0 answers
259 views

How does Google Chrome's "Warn you if passwords are exposed in a data breach" feature work?

This feature is enabled by default. It says the usernames and passwords would be encrypted before sending to google. But google would know the encryption keys it used and to compare it with leaked ...
eee's user avatar
  • 41
0 votes
1 answer
321 views

Verification of Password without Storing Hash - Security Considerations

Question: I am working on a password-based file encryption and decryption system in Python using the PBKDF2 key derivation function and Fernet encryption. I have a specific requirement: I want to ...
Patrickliu's user avatar
1 vote
1 answer
316 views

Why don't bank verification services use OAuth

I'm going off of this answer, but asking a new question since that's quite old. It seems to be becoming more common for banks or other "legitimate" institutions to want your banking username ...
Silvio Mayolo's user avatar
0 votes
1 answer
111 views

base64 encoding inflight credentials

I did not like how my password and other credentials could be viewed in the browser developer console when passed from a form to my api authentication service. So I'm now base64 encoding using atob() ...
Martlark's user avatar
  • 101
0 votes
0 answers
196 views

Optimal way to securely store password on client with server invalidation but not knowledge

A number of similar questions have been asked about this general topic before (e.g. How to store user credentials in browser securely?), but I wanted to seek some clarification on a specific scenario. ...
InterLinked's user avatar
0 votes
0 answers
147 views

Is ISP sending WiFi password in plain text to phone necessarily a bad sign?

The new router I was given by my internet and phone provider can only be configured via their website. I logged in and went to the page where you can set things like the SSID and password for the WiFi ...
insecure's user avatar
0 votes
0 answers
119 views

Choosing Encryption Strategies for Secure Long-Term Storage of Sensitive Data

When considering external drives for secure long-term storage of sensitive data, what are the pros and cons of using the same password for encrypting all files versus using random passwords for each ...
S. G.'s user avatar
  • 173
0 votes
1 answer
193 views

Best method to store common passwords with multiple users

I've looked around and not seen any solutions to this problem I work for a company as an automation engineer keeping a network behind a DMZ. I have an AD, switches, etc. We have local passwords for ...
user2304953's user avatar
3 votes
1 answer
705 views

Best login flow for username and password authentication

I've been reading countless articles about login flows and what's the best for user auth, but it's all even more confusing now. My scenario: I have a simple app (capacitor spa) that has a simple ...
HRdev's user avatar
  • 33
1 vote
5 answers
2k views

Optimal password minimum length requirement? (In particular, does a 15 character minimum make sense for most university users?)

Is there any professional consensus on what the optimal password minimum length requirement should be? The University of Michigan recently implemented a 15 character minimum for all users. To me (...
user103496's user avatar
-4 votes
1 answer
238 views

How can Linkedin access my account without asking for my password?

A few days ago, I contacted LinkedIn support for an unrelated issue. They didn't provide any help with the issue at hand and instead responded with this : Do we have your permission to log in to your ...
Astariul's user avatar
  • 109
0 votes
0 answers
84 views

Need a way to share credentials for different clientele

I am an independent technology consultant, and I am running into a worrying and recurring issue with my customers regarding sharing account information. Many solution we use I am able to be added as ...
user297809's user avatar
0 votes
2 answers
171 views

Extract Keepass password generator dictionary [closed]

Can I extract a dictionary list from the keepass password generator as my senior forgot his master password?
ligma_ball's user avatar
5 votes
4 answers
1k views

How important is it for WiFi passwords to be secure?

Anecdotally, I've noticed that many people's WiFi passwords (based on visiting their homes, etc.) don't seem terribly secure; they're usually fairly short and don't always contains numbers or special ...
Very Tiny Brain's user avatar
0 votes
2 answers
178 views

Should I be concerned that my bank told me that I have a strong password? [duplicate]

I recently ran an account security check through my bank's web site, and my bank "reassured" me that I have a strong password. Should I be concerned that they know that? I had assumed that ...
Very Tiny Brain's user avatar
0 votes
0 answers
87 views

What are password encryption schemes that result in variable length common in MySQL and PHP?

I have stumbled across passwords on a MySQL database behind a PHP webapp. Here are some examples. 753a524d56b48d825328ce27 789e0ad30d15 7ba0868c23e0a2 d327e265ca2abcd7c 48276b3d5618850 ...
knods's user avatar
  • 1
0 votes
0 answers
30 views

Bank employees asked random 2 characters of password during verification! [duplicate]

Let me ask to experts how bank BBVA and Santander en España can check dedicated digits of my password during call to their hot line? They said me that it is verification procedure but I am not sure it ...
Oleksandr Ismailov's user avatar
0 votes
1 answer
120 views

Is Edge (Enterprise) Password feature less secure than open source local password manager? [closed]

For Enterprise, how to know if Edge Password AutoSave is less secure than copy/paste to a desktop password manager which is open source? IMHO Edge should be more secure because: copy/paste has ...
panes-rubrics's user avatar
1 vote
2 answers
1k views

Encrypted 7z file password not working

I'm in an interesting predicament. I have an encrypted 7z file that I made myself. The password for the file is a 60 character generated password that I saved to my password manager. I made sure to ...
CSstudent's user avatar
  • 113
0 votes
0 answers
103 views

Is pass -> [via pbkdf2] -> seed -> ECDSA key pair better than pass(word) hashing?

For a web service, I am considering generating random 25-49 recovery codes as a kind of pass that can be stored in a pass manager (no usernames). Instead of pass(word) hashing on the server, I ...
r j's user avatar
  • 138
0 votes
0 answers
118 views

Passkeys versus passwords for intranet websites

Do passkeys offer more security for intranet websites compared to passwords? I know there are additional methods like 2FA to get more security, but I just want to look at a optional replacement for ...
fitcfitcfatc's user avatar
1 vote
1 answer
782 views

Where are wifi passwords stored? [duplicate]

I'm looking for technical details on how Windows, Linux, and macOS all store the SSIDs and passwords for every wireless network you've ever connected to. I've tried searching for this, but my Google-...
Wes Sayeed's user avatar
1 vote
1 answer
147 views

Is using the computer for MFA safe?

Recently, I discovered that MFA apps just calculate that codes based on a private key and the time clock, so it's easy to use tools like gnu pass to replace those apps with your computer. But what are ...
Vitor Figueredo Marques's user avatar

1
2 3 4 5
81