Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
4,002
questions
0
votes
2
answers
40
views
Is using TOTP from Authenticator app on a mobile device instead of passwords inherently 2FA?
A related discussion can be found, specifically addressing the security implications of using only TOTP for single-factor authentication However, in my view, using a TOTP code from a Google ...
2
votes
0
answers
95
views
Windows AD - Fake User Account with Multiple Passwords to Detect Password Spray
TL;DR
I'm trying to implement a fake user account that has multiple sets of credentials that can be used. Instead of a specific password, any one password from a list of them could be used to ...
- 21
1
vote
1
answer
84
views
Does not storing passwords in browser really matter given cookie hijacking exists?
I see lots of articles suggesting not storing passwords in the browser, and it made perfect sense to me, if I can access this data easily, an attacker probably can too.
But then I found out about ...
0
votes
1
answer
91
views
Does 7z or RAR5 offer better resistance to brute force attacks?
Does 7z or RAR5 offer better resistance to brute force attacks?
- 1
4
votes
0
answers
159
views
How does Google Chrome's "Warn you if passwords are exposed in a data breach" feature work?
This feature is enabled by default. It says the usernames and passwords would be encrypted before sending to google. But google would know the encryption keys it used and to compare it with leaked ...
- 41
0
votes
1
answer
169
views
Verification of Password without Storing Hash - Security Considerations
Question:
I am working on a password-based file encryption and decryption system in Python using the PBKDF2 key derivation function and Fernet encryption. I have a specific requirement: I want to ...
1
vote
1
answer
153
views
Why don't bank verification services use OAuth
I'm going off of this answer, but asking a new question since that's quite old.
It seems to be becoming more common for banks or other "legitimate" institutions to want your banking username ...
- 111
0
votes
1
answer
67
views
base64 encoding inflight credentials
I did not like how my password and other credentials could be viewed in the browser developer console when passed from a form to my api authentication service. So I'm now base64 encoding using atob() ...
- 101
0
votes
0
answers
95
views
Optimal way to securely store password on client with server invalidation but not knowledge
A number of similar questions have been asked about this general topic before (e.g. How to store user credentials in browser securely?), but I wanted to seek some clarification on a specific scenario.
...
- 121
0
votes
0
answers
88
views
Is ISP sending WiFi password in plain text to phone necessarily a bad sign?
The new router I was given by my internet and phone provider can only be configured via their website. I logged in and went to the page where you can set things like the SSID and password for the WiFi ...
- 1
0
votes
0
answers
69
views
Choosing Encryption Strategies for Secure Long-Term Storage of Sensitive Data
When considering external drives for secure long-term storage of sensitive data, what are the pros and cons of using the same password for encrypting all files versus using random passwords for each ...
- 163
0
votes
1
answer
67
views
Best method to store common passwords with multiple users
I've looked around and not seen any solutions to this problem
I work for a company as an automation engineer keeping a network behind a DMZ. I have an AD, switches, etc. We have local passwords for ...
1
vote
1
answer
179
views
Best login flow for username and password authentication
I've been reading countless articles about login flows and what's the best for user auth, but it's all even more confusing now.
My scenario:
I have a simple app (capacitor spa) that has a simple ...
- 13
0
votes
5
answers
464
views
Optimal password minimum length requirement? (In particular, does a 15 character minimum make sense for most university users?)
Is there any professional consensus on what the optimal password minimum length requirement should be?
The University of Michigan recently implemented a 15 character minimum for all users.
To me (...
- 101
-4
votes
1
answer
148
views
How can Linkedin access my account without asking for my password?
A few days ago, I contacted LinkedIn support for an unrelated issue.
They didn't provide any help with the issue at hand and instead responded with this :
Do we have your permission to log in to your ...
- 109
0
votes
0
answers
37
views
Need a way to share credentials for different clientele
I am an independent technology consultant, and I am running into a worrying and recurring issue with my customers regarding sharing account information. Many solution we use I am able to be added as ...
0
votes
2
answers
117
views
Extract Keepass password generator dictionary [closed]
Can I extract a dictionary list from the keepass password generator as my senior forgot his master password?
5
votes
4
answers
603
views
How important is it for WiFi passwords to be secure?
Anecdotally, I've noticed that many people's WiFi passwords (based on visiting their homes, etc.) don't seem terribly secure; they're usually fairly short and don't always contains numbers or special ...
- 151
0
votes
2
answers
132
views
Should I be concerned that my bank told me that I have a strong password? [duplicate]
I recently ran an account security check through my bank's web site, and my bank "reassured" me that I have a strong password.
Should I be concerned that they know that? I had assumed that ...
- 151
0
votes
0
answers
46
views
What are password encryption schemes that result in variable length common in MySQL and PHP?
I have stumbled across passwords on a MySQL database behind a PHP webapp. Here are some examples.
753a524d56b48d825328ce27
789e0ad30d15
7ba0868c23e0a2
d327e265ca2abcd7c
48276b3d5618850
...
- 1
0
votes
0
answers
29
views
Bank employees asked random 2 characters of password during verification! [duplicate]
Let me ask to experts how bank BBVA and Santander en España can check dedicated digits of my password during call to their hot line?
They said me that it is verification procedure but I am not sure it ...
0
votes
1
answer
69
views
Is Edge (Enterprise) Password feature less secure than open source local password manager? [closed]
For Enterprise, how to know if Edge Password AutoSave is less secure than copy/paste to a desktop password manager which is open source?
IMHO Edge should be more secure because:
copy/paste has ...
1
vote
2
answers
416
views
Encrypted 7z file password not working
I'm in an interesting predicament. I have an encrypted 7z file that I made myself. The password for the file is a 60 character generated password that I saved to my password manager. I made sure to ...
- 113
0
votes
0
answers
59
views
Is pass -> [via pbkdf2] -> seed -> ECDSA key pair better than pass(word) hashing?
For a web service, I am considering generating random 25-49 recovery codes as a kind of pass that can be stored in a pass manager (no usernames).
Instead of pass(word) hashing on the server, I ...
- 101
0
votes
0
answers
57
views
Passkeys versus passwords for intranet websites
Do passkeys offer more security for intranet websites compared to passwords?
I know there are additional methods like 2FA to get more security, but I just want to look at a optional replacement for ...
- 53
1
vote
1
answer
320
views
Where are wifi passwords stored? [duplicate]
I'm looking for technical details on how Windows, Linux, and macOS all store the SSIDs and passwords for every wireless network you've ever connected to. I've tried searching for this, but my Google-...
- 777
0
votes
1
answer
91
views
Is using the computer for MFA safe?
Recently, I discovered that MFA apps just calculate that codes based on a private key and the time clock, so it's easy to use tools like gnu pass to replace those apps with your computer.
But what are ...
0
votes
0
answers
90
views
How does user activity affect entropy generation process in GnuPG?
Earlier today, I was using gpg to generate keys for work. While doing so, I noticed:
We need to generate a lot of random bytes. It is a good idea to
perform some other action (type on the keyboard, ...
1
vote
1
answer
72
views
Key Hash With Securely-Optimal Setting : For Encryption vs For Password
Do you have to make a key hash with securely-optimum setting (eg. 100MB memlimit, 3 opslimit) for encryption ?
So I'm making a text encryption function with javascript, using XChaCha20-Poly1305 and ...
1
vote
0
answers
942
views
John not cracking an NTLM hash
I have been trying to do it with john the ripper as the following:
john --FORMAT=NT --wordlist=~/usr/share/wordlists/rockyou.txt hash.txt
the hash I am trying to crack is:
Computer:1001:...
- 11
1
vote
1
answer
206
views
Can I protect against password shucking just by salting the pre-hash?
I'm working on a new web app, and I chose Bcrypt to hash the passwords. To overcome the 72 byte limit on Bcrypt, I'm planning to pre-hash the passwords with SHA-256. However I researched a little and ...
- 13
0
votes
1
answer
213
views
What's stopping attackers from brute forcing SSH passwords over new sessions?
I know that when you attempt to log in to a device via SSH, upon inputting an incorrect password, you must wait several seconds before you get another attempt. This is obviously a deterrent against ...
- 246
0
votes
1
answer
47
views
libxcrypt "failure token" *0
An number of years ago, the libxcrypt project has decided to change the crypt interface such that instead of returning a null pointer on failure, it returns a valid string starting with *, such as *0. ...
- 2,295
0
votes
1
answer
112
views
One Time Password Mobile phone authentication
Can the Mobile phone One Time Password authentication be alphanumeric with special characters?
If Yes, There will be more pros and less cons with increased security?
One Time password
Can a One Time ...
- 123
3
votes
0
answers
186
views
Can a bad guy ever get access to my gmail account using ONLY the 2fa app or ONLY the recovery phone (plus username)?
Let's say X is a malicious person.
Let's say I have a gmail account with a recovery phone and with 2fa
enabled. Let's say X knows the username but not the password. X doesn't have any other ...
- 131
0
votes
1
answer
61
views
How does increasing minimum password length affect the size of password space?
I understand that when there are a possible characters and passwords must be of length n there are an possible passwords.
But usually passwords can vary in length between some minimum and maximum ...
- 1
1
vote
1
answer
80
views
Would asking for user input email again in password reset increase security?
I have a workflow like this right now:
User inputs the account email and clicks the "forget password" button
User receives an email containing a link with token for password reset
User ...
- 111
1
vote
1
answer
174
views
What are the risks of reusing the same passphrase for FDE, user account, and password manager?
Consider a home user who runs Linux on a laptop with full-disk encryption and uses a cloud-based password manager. Assume the laptop is firewall-protected with no SSH access. It seems reasonable to ...
- 123
0
votes
1
answer
86
views
2FA implementation security
I am looking to implement 2FA. I know of duo and eg. Eset secure authentication. But both solutions seem to be implemented in a strange way, that is they require some form of communication with either ...
- 461
1
vote
1
answer
145
views
Two different salted hashes of the same password for the same user
I am creating an authentication system that is able to login to the same account with different sets of credentials. I also want to allow users to login with either username or email with the same ...
- 11
0
votes
2
answers
140
views
Is there any good way of calculating a brain-generated password's entropy?
After reading this post, I understand that a password's entropy depends on the assumptions made when it is to be attacked (e.g. if it is generated randomly from a list of 2048 words, etc.).
Let's ...
- 165
1
vote
2
answers
155
views
Why do entropies of passwords significantly differ from site to site?
I read the infamous xkcd cartoon comparing two passwords and their strength. Curious whether their calculation was accurate, I searched many entropy calculators and plugged in the two examples from ...
- 11
0
votes
0
answers
106
views
What is the most resistant way to unlock a device
The standard way to unlock a device is with a password. TPMs have improved this to the point that we can create devices that can be unlocked with very short passwords such as PINs and we can create ...
- 101
25
votes
4
answers
6k
views
Does a password policy with a restriction of repeated characters increase security?
A security value called Restriction of Repeated Characters for Passwords (QPWDLMTREP) can be configured in IBM i. If QPWDLMTREP has a value of 1, then "the same character cannot be used more than ...
- 369
2
votes
1
answer
115
views
Distinguish origin of password prompts
I am wondering how to distinguish (password) prompts that the OS issued from prompts that are delivered application-side. This question first occurred to me when considering Firefox master passwords, ...
- 21
0
votes
3
answers
316
views
Password managing apps seem to have access to my passwords
Keeper used to be free so I had stored most of passwords on that app a few years ago from a past device. When I tried to access the passwords after five years, the app had turned into a subscription ...
14
votes
2
answers
4k
views
Reasoning behind banning '#' from the start of passwords? [duplicate]
Today, on an official government website, I came across the following password rules:
"Your password has to be at least 8 characters long. It can't have any blank spaces. It has to use characters ...
- 141
5
votes
3
answers
390
views
Using Proof of Work to slow down login attempts
For a while I've been pondering a user authentication protocol that aims to ensure that a client does some computational work before the server will attempt to authenticate the password.
The reason ...
- 153
0
votes
1
answer
108
views
Security of using Yubikey to derive Diceware password?
I bought a new Yubikey, and am currently setting it up to use on my desktop PC. Previously the PC was secured with password only, and I'd like to use the Yubikey as an alternative: instead of using ...
- 163
1
vote
0
answers
463
views
Tool to Decrypt Chrome, Firefox and Edge login information [closed]
Im new to python but Ive created a couple of programs that can collect the user credentials for Google Chrome, Mozilla Firefox and Microsoft Edge and decrypt them then save the decrypted output to ....
- 11