Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
1
vote
1answer
37 views
“Family” apps use shared passwords for different usernames. How bad is it?
There exist several "family" apps available for mobile devices that allow family things to be shared: shopping lists, calendars, occasionally device locations, that kind of thing. At least two of ...
8
votes
1answer
540 views
I found a password with hashcat but it doesn't work
My assignment required me to find the password for a power-point file (97-2003).
I used office2john.py to retrieve the hash and I removed the file name.
The hash is:
$oldoffice$3*...
0
votes
0answers
48 views
How do I investigate a suspicious link? [on hold]
Long story short I made a RuneScape account about a week ago for some reminiscent play as I used to play when I was a kid. I stupidly responded to a scam but only by clicking on a link I was ...
0
votes
0answers
55 views
RAR password (knowing some parts from pass) [on hold]
I need your advice in my case:
I have a RAR file protected with this password is: ( THE****AHMAD** )
The first word from the password is: THE
The second word is contains 4 characters and its maybe ...
1
vote
1answer
75 views
Isn't it almost always not helpful to just change the password of a container after a leak?
Let's assume, an attacker gains access to an encrypted container with a weak password. They start a brute-force attack and I assume they will succeed. To protect any content which has been added to ...
1
vote
1answer
108 views
How to get the password from Windows Application?
I have an application call Metatrader 5. I had logged in way before and now I lost my password. The login could be seen but the password is hidden. I want to know if there is a way to get the hidden ...
0
votes
0answers
86 views
Honest Question - I'm keen to learn from your mistakes [closed]
If you had the opportunity today to warn yourself about one thing and at the same time give yourself a clue how to avoid it, what would it be?
26
votes
4answers
5k views
Does putting salt first make it easier for attacker to bruteforce the hash?
Many recommendations for storing passwords recommend hash(salt + password) rather than hash(password + salt).
Doesn't putting the salt first make it much faster for the attacker to bruteforce the ...
0
votes
0answers
79 views
Custom password security algorithm? [duplicate]
How secure would it be if you applied custom algorithms (that you obviously wouldn't reveal to the public) to a hashed password? Like splitting up a hashed string, shuffling it around, possibly even ...
52
votes
10answers
15k views
Is using haveibeenpwned to validate password strength rational?
I have been hearing more and more that the haveibeenpwned password list is a good way to check if a password is strong enough to use or not.
I am confused by this. My understanding is that the ...
3
votes
1answer
70 views
How is a second password better than TAN?
Postbank will deactivate two-factor authentication via SMS-TAN in August. You are henceforth to instead provide an authentication password, optionally unlockable via (unspecified) biometry. One ...
1
vote
2answers
312 views
Is a company asking for my password over the phone a bad sign?
I am a customer of a company that has quite a bit of personal/financial information about me. I had to call their help desk the other day and was asked to type my online password in on the keypad on ...
-2
votes
1answer
99 views
Algorithm to detect password pattern in source code
From code vulnerability aspect, idea is to detect password embedded in source code(C, C++, Java, whatever)
Problem is, password can be of any pattern.
How to approach in detecting a password within ...
1
vote
3answers
163 views
Storing database password in plain text?
In the context of a web application, I will be providing the user the ability to provide a username and password for their MySQL database.
Right now, the username and password is generated randomly. ...
1
vote
2answers
154 views
Letting client encrypt his/her data. How to ensure the client doesn't lose his/her private data?
I am designing a web service where the client is allowed to encrypt his own data on client-side software & then send it to our server, so they can be sure their data is private on our side. Then, ...
0
votes
1answer
87 views
Safest place for small business to store passwords
Where is the safest place for a small business to store passwords for servers, web domain credentials etc?
4
votes
3answers
377 views
How can a company tell if my password is similar to the previous 5 passwords?
Closely related (but not a duplicate): Company can tell if new and old passwords are too similar. Is there a security problem?
Also closely related (but not a duplicate): How can a system enforce a ...
-4
votes
2answers
130 views
How did Google “decode” my Gsuite password? [closed]
Google has recently admitted they were storing "G Suite" users' passwords un-hashed on their systems.
But if a hashed password was transmitted to Google when I logged in to my account then how did ...
1
vote
1answer
203 views
Store passwords in a text file… is it really much worse than a password manager?
My idea:
Storing my passwords in a text file kept on Dropbox and accessed through a python script to quickly retrieve the password for the site I want to access.
My motives:
I want to be platform-...
63
votes
3answers
8k views
Website returning plaintext password [duplicate]
I have recently logged into a website. When I clicked on the "Update Profile" page, you are displayed with a list of text boxes for all the user fields, e.g. name, email, phone number etc.
There is ...
-1
votes
3answers
94 views
-1
votes
3answers
165 views
Is this a secure way to protect passwords when they must be in plaintext?
I am building a web app which will use my school's online grade reporting system. Students will sign in to my app using their credentials for the grade website. However, it does not provide an API, ...
9
votes
1answer
3k views
What local resources are used when bruteforcing a remote service?
What pc resources are used when bruteforcing ?
I mean bruteforcing something online, not hashes.
Do you need a good amount a RAM and a good CPU or it's just about the internet speed ?
0
votes
2answers
89 views
How secure are the default, randomized passwords that ISP routers come with?
Did a little searching an could not find an answer to this. A lot of ISPs these days are providing combination router/modem units, and they come with a pre-configured password that is a random string ...
0
votes
3answers
138 views
How is the strength of a key/Password determined
I was reading about the Principle of Key Sizes and came across this table:
The deduction I made off this is that after a certain key size, increase in a single bit causes Time required for search to ...
0
votes
0answers
23 views
Password Hashing - Where does the Salt gets stored [duplicate]
I have read that it is a best practice to store Hashed passwords using Hashing algorithms which uses Salt to protect from Rainbow table attack.
My question is- if i store the hashed password in my ...
2
votes
0answers
140 views
For cloud-based password managers, is it safe to login using public WiFi?
For cloud-based password managers, is it safe to login when using public WiFi?
To help get good answers to this question, let's define 3 terms:
Cloud-based password managers = Password managers such ...
4
votes
1answer
203 views
Why are WPA2 passwords longer than 16 bytes more secure than 16 byte passwords?
In this good Information Security StackExchange question, the answers reveal that a long WPA2-PSK password does not degrade performance of the network. The reasoning is that the password itself is ...
1
vote
2answers
88 views
Is LocalStorage in web browsers safe enough to store passwords?
I currently have a system I'm building where users can enter an email address and password into my login page, and if they click the signup button after doing that, it stores that data in LocalStorage,...
29
votes
1answer
4k views
Why should password hash verification be time constant?
In the asp.net core PasswordHasher type there is is remark on the VerifyHashedPassword method
/// <remarks>Implementations of this method should be time consistent.</remarks>
And then ...
-1
votes
2answers
91 views
is it a standard best practice to *display* the last-logged-in user by default on an individual employee laptop?
My new workplace laptop is configured so that after I log off and log on, rather than the last-logged-in user being selected by default, I have to hit ctrl-alt-del and then enter my username and ...
0
votes
1answer
72 views
user account management: is it acceptable to keep an account locked after the password is already reset
Is it alright to keep an account locked after the password reset? Say, for example, I have an account locking mechanism that will lock the account for 5 minutes after 3 tries.
Now the user performs a ...
1
vote
2answers
58 views
Is problem with string length in token (read password) randomization a security flaw? Is there any impact for the same?
this application sends a password to user's email when user click on forgot password on login page. However, the password is not the same in length always something it will be a 25+ string and ...
1
vote
1answer
72 views
Setting passwords for domain users, not expiring them, and not allowing them to be changed by users
We are in a mid-sized enterprise environment and are looking at forcing specific passwords for all users. I've found nothing recent or relevant about this.
Justification:
The main reason is to ...
0
votes
0answers
25 views
if password hash algorithm is broken, is best practice to re-hash the hashes with a new hash? [duplicate]
Suppose you store a bunch of hashed passwords, but your hashing algorithm gets broken. What is the best practice?
It seems like the only safe practice would be to take the old password hashes (...
41
votes
3answers
8k views
What are the differences between credential stuffing and password spraying?
Wikipedia describes credential stuffing as
a type of cyberattack where stolen account credentials typically
consisting of lists of usernames and/or email addresses and the
corresponding ...
23
votes
5answers
6k views
Selecting a secure PIN for building access
What are the general criteria for rejecting an insecure PIN to access a building?
There has been a lot of discussion about password selection security. Minimum length requirements, mandatory classes ...
1
vote
1answer
88 views
Can my open Firefox Sync session be used to circumvent a Master Password?
In short I'm wondering what's stopping someone with access to my computer account to exploit an open Firefox Sync session to view my synced passwords, even if a Master Password has been set.
On this ...
28
votes
2answers
4k views
Does password expiry provide any benefit at all (when using randomly generated passwords)?
I have been seeing a shift in password policy, this has been going on for a while (Article from 2017) but I have only just picked up on this. In my organization we expire the user passwords every 90 ...
0
votes
1answer
72 views
On a mobile, does using a password instead of a PIN make encryption stronger?
On a mobile, does using a password instead of a PIN make encryption stronger?
What key does the phone use for its encryption? Would it use the PIN itself?
3
votes
0answers
77 views
Bug in pay by phone screen accepts credit card information [duplicate]
I recently noticed some strange behavior in a pay-as you go mobile hotspot service when I was adding money to my account via phone.
I forgot my pin so I guessed. I was wrong. I guessed again, and it ...
1
vote
3answers
285 views
Exactly how is a pseudorandom number generator a security risk?
I was recently reading about Diceware, which is essentially a list of words from which several can be picked to form a long passphrase. The website stresses that these words should be picked randomly ...
1
vote
1answer
46 views
Multi Factor and order of authentication [duplicate]
I'm questionning the design and architecture around 2FA/MFA controls while authenticating to services and servers.
On major platforms(*), the end-user is:
first prompted for credentials (username/...
2
votes
1answer
92 views
Plausible way to hack website keeping [username / hashed password] pairs?
I was reading that a lot of authentication systems use cryptographic hash functions, whereby instead of keeping the username and password of their users they just keep the username and a hash of the ...
0
votes
2answers
166 views
How to brute force only username not password?
I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is ...
0
votes
2answers
1k views
Password Security Length vs. Complexity [duplicate]
I am working on a password policy and had some questions about password/passphrase strength:
For password strength, is a shorter more complex password stronger or weaker than a much longer, less ...
44
votes
4answers
10k views
Is Diceware more secure than a long passphrase?
I recently investigated best-practices in regards to passwords, and the overwhelming majority of sources recommended using a password manager. This is great advice, but not usable in every situation. ...
9
votes
3answers
2k views
How does Comcast know my WiFi password?
How does Comcast know my WiFi password? I generated it via KeePass and entered it into my Arris router/cable modem myself, and I bought the router used from a friend. When I went to the account web ...
0
votes
0answers
89 views
Browser passwords used on multiple domains?
I have 100 domains with authentication backed by the same LDAP database. There is a single-sign on, but it's not implemented with OAuth. That is to say, per user, each domain accepts the same user/...
0
votes
1answer
86 views
Decrypt hash using dicionary attack
Let's consider that I'm the attacker and have access to hashes of passwords of a given database against which I will attempt a dictionary attack.
My question is: Will I be able to find out by ...
