Questions tagged [passwords]

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

Filter by
Sorted by
Tagged with
4 votes
1 answer
101 views

Why would websites ask users to reauthenticate after a password change?

I was discussing with a non-IT friend after he came to me with a question regarding security and password change. As he puts it: "Why do websites ask me to re-authenticate after a password change?...
user avatar
  • 686
0 votes
1 answer
61 views

Using Single Sign-On and the usage of password managers is discouraged. Whay are alternatives for storing tokens for example?

What are the alternatives of storing tokens when password managers are discouraged? Some of the ideas that come to my mind are storing in a text file and encrypting with GnuPG but that's asks for ...
user avatar
  • 293
0 votes
0 answers
47 views

Why is not there encrypted way of sharing/showing data such as Password to the user (hidden from web app Source code)?

I wonder if there will be (or is) a way to hide data such as passwords from the HTML/DOM structure? As, password fields can hide from external person other than the main user with something like "...
user avatar
29 votes
3 answers
6k views

Why are PIN codes usually of even length (4 or 6)?

A huge problem is PIN guessing from birthdays (dd/mm/yy lends to a 6 digit number that is easily guessed, dd/mm/yyyy for 8 digits). It's very often that a PIN number is taken from someone's birthday ...
user avatar
  • 399
0 votes
0 answers
36 views

On the gains and losses of an additional client side stretching of the user password [duplicate]

Picture a state of the art implementation of a website registration and login system. I'm interested in analyzing what a defender gains and loses by feeding the user password to a key-stretching KDF ...
user avatar
1 vote
1 answer
37 views

Reuse credentials if same data in same security environment

We're managing a shared hosting environment of Wordpress websites on a web server. Each site has its own database password and FTP password, both are randomly generated and stored in AWS ...
user avatar
  • 355
1 vote
2 answers
155 views

How does /dev/random not leak future bytes from old ones

I want to generate 6 random words using Wiktionary and random numbers from /dev/random. I'll get a random number with /dev/random and then use the word from that index. I know /dev/random should be ...
user avatar
0 votes
0 answers
33 views

Can OTPs substitute password? [duplicate]

One-time passwords (OTPs) usually serve as the 2nd factor in a 2FA scheme. But, in isolation, I believe they are more secure than passwords, since they are ephemeral and passwords are still badly ...
user avatar
  • 111
0 votes
0 answers
32 views

Does having the hash make it easier to crack the password than not having the hash? [duplicate]

For example, a password hash is: edgjcgo4866864rfhobd38790g764hkp Does having the hash of the password make it easier for the attacker to crack the password than not having the hash? If yes, why does ...
user avatar
24 votes
6 answers
8k views

Is a sha256 hash of a unix timestamp a strong password

I am setting up a postgres db that will never be used by humans. In fact, I really don't need to know it myself ever. I assumed that just using a 256bit(64 alphanumeric chars) hash of a unix timestamp ...
user avatar
-1 votes
0 answers
78 views

Is my use of AES for password sharing secure?

I'm trying to create a tool to create secure passwords and sends them to the client - previously I've used passwordsgenerator and pwpush.com for this. Unlike pwpush I don't want to store passwords in ...
user avatar
  • 1
0 votes
1 answer
115 views

Why is it not possible to override password hashes

I know that a password is stored as a hash, because then it is not possible to get the password even if you have access to the password database/file/... But if you have access, couldn't you just ...
user avatar
0 votes
1 answer
61 views

Cryptographic hash functions and personal password management [duplicate]

Background: I've always reused same username/password on all websites and got hacked regularly. I am considering using a password manager, but I don't like the need of storing a database. So I came up ...
user avatar
  • 103
0 votes
2 answers
93 views

Is it unsecure to use only a passphrase in luks for whole system partition encryption?

When i use only a passphrase in luks for my whole system partition encryption, so i need to insert a password to decrypt my system partition to boot up my os, is this unsecure and can it be cracked ...
user avatar
3 votes
1 answer
196 views

PAT vs. SSH - Why Bother with SSH?

Are there any advantages to using SSH keys vs. a PAT when interacting with a site like Github? Github claims SSH keys are a way to not have to enter your username + password (personal access token) ...
user avatar
  • 142
0 votes
0 answers
30 views

Auto-login (password stored on device) vs refresh token

I’m asking myself what are the benefits of refresh token over saving the user password (securely) on user device and perform a transparent login (background) with its credentials to get a fresh new ...
user avatar
0 votes
0 answers
55 views

Best practices for storing passwords for PHP and MySQL applications [duplicate]

I am creating a simplified lead and call management system for a friend's small business. I would like to know the best practices for hardening password storage and verification using PHP 7.4 and ...
user avatar
1 vote
1 answer
101 views

Storing password in config file - best practice

I am configuring an application server hosted on EC2 instance to send e-mail notifications. This requires configuring SMTP settings and storing them, including password, in a config file: gitlab_rails[...
user avatar
  • 11
1 vote
0 answers
84 views

Displaying a user's password in plaintext on login pages. Why is this practice becoming more widespread? [duplicate]

Over the years I've noticed that more and more login pages implement an eye icon next to the password field, that on click toggles between hidden and plaintext view of the password typed in that field....
user avatar
  • 111
0 votes
2 answers
927 views

What will happen if I accept this "Change your search setting to: smartwebfinder.com"?

When I want to install Ultrasurf extension it gives me this message: So I do not understand what this "Change your search setting to: smartwebfinder.com" wants to do. When I go to this ...
user avatar
  • 1
0 votes
2 answers
113 views

Fastest way to brute force SSH

I'm doing a CTF on vulnhub and I need to brute force SSH. I've got 6 usernames and 15.000.000 passwords to try so I'm brute-forcing with hydra by running hydra -L users.txt -P $LIST/rockyou.txt -t 64 -...
user avatar
1 vote
2 answers
191 views

Is a very long and random password theoretically immune to password cracking?

Suppose a password’s stored hash is exposed in a theoretical mass security breach of a popular service given the following assumptions: The password is very long (30+ characters) The password uses a ...
user avatar
0 votes
1 answer
94 views

Make certificate and private key available only to a single app

I want to make a smart card reader app, that sends read data to a server. In order to be certain in the integrity of the data, I want to use a client certificate to communicate with the server and I ...
user avatar
2 votes
0 answers
62 views

How are the values of stored firefox credit cards encrypted? And how does one decrypt those?

While researching about the safety of web browsers I made my own program that can decrypt stored credentials, cookies, and other information of different browsers to see for myself how easy it is. ...
user avatar
  • 21
0 votes
1 answer
61 views

Why force the user to use a secure password throught choosing the password for them to solve the password problem?

I have read in innumerables articles that „Passwords must die“, because they are blamed for being the cause of most cyber attacks. But why no just issue random generated passwords, with the added ...
user avatar
  • 3
0 votes
0 answers
27 views

How do we reliably know why the Master Key hash for a particular SID has changed?

We are developing a VB. NET application where we are building a 'Remember password' feature to store the user's application credentials using DPAPI for encryption (in a Windows domain environment) and ...
user avatar
0 votes
1 answer
51 views

Storing passwords and retrieving them to run an application

I have a web app that I use to run exe programs but the exe programs require a password to be passed. Currently this password is hard coded into the web app file in clear text. Since this is not ...
user avatar
  • 1
1 vote
1 answer
89 views

Databases for compromised passwords that browsers use

I am looking into databases of compromised passwords in order to ensure that passwords on a system I am responsible for are not already compromised. To have complete peace of mind, I prefer to get ...
user avatar
  • 331
0 votes
2 answers
96 views

How much does the strength of the password depend on the variety of characters?

For example, a password consisting only of lower-case characters [a-z], but a length of 10 (26^10), will always be better than all characters, but a length of 7 (95^7). That is, how much is it correct ...
user avatar
  • 25
2 votes
1 answer
174 views

Where to store the password: in RAM or another user's home folder (Linux)

There is user1 and user2. All work is done from under user1. user2 is only created to store important information. If important information is stored in RAM, but in the session of user1, which is ...
user avatar
  • 25
8 votes
3 answers
3k views

Argon2 vs SHA-512, what's better in my case?

First I am very bad in cryptographic algorithms. I found online that Argon2 is more secure than SHA-512, so I used it for password hashing. There're recommended options for Argon2: Memory: 4Gb ...
user avatar
0 votes
0 answers
78 views

Cracking password with static prefix and suffix

I found a pattern password generation that works like that: sha1("very long static prefix text blablabla "+password+" very long static suffix text"); I tried hashcat combined ...
user avatar
1 vote
1 answer
111 views

Potential problems with insecure password hashing

For my job I use some industry-specific software that stores sensitive information. The software has a web interface with a public login page. One time I attempted to log in, but mistyped the last few ...
user avatar
2 votes
3 answers
3k views

Is this a secure approach to store a master password?

I have come up with the following approach to remember master passwords (to use in software like KeePass, etc): Since it is annoying to type the master password every time we power up the PC, we store ...
user avatar
  • 123
-1 votes
3 answers
178 views

Why are there often random email addresses in known password word lists?

In known wordlists like crackstation.lst there are random emails in the list. Why are they there?
user avatar
0 votes
0 answers
102 views

Encrypt SVN for passwords

Could anyone give me advice on the best way to encrypt the SVN version control system on a Amazon Linux 2 instance? I am planning to encrypt or disable the SVN from asking if unencrypted passwords ...
user avatar
0 votes
2 answers
73 views

Storing backup keys (2FA) for online accounts

So I spent the day looking for a good solution of storing the backup keys or the 2FA codes and can't seem to find a convenient way for me, many people have different takes on this, so far I found 2 ...
user avatar
  • 1
2 votes
1 answer
111 views

What would be the most secure way to store and save my passwords on my desktop?

I store my passwords in a multitude of ways, these are all sorts of passwords, not only for websites and browsers. I also have credit card numbers, addresses etc... Now I'm using these methods: ...
user avatar
2 votes
1 answer
107 views

If multiple of the same password have the same hashed value in a database, does that mean the password is not being salted?

I just started a new job last week and I'm asking for a sanity-check before I mention this to anyone. All the new employee accounts are created with the same default password (I know, already a no-no)....
user avatar
2 votes
2 answers
63 views

Mitigating the performance impact of strong hashes with Basic HTTP authentication

I am trying to decide which work factor to use for our hashed passwords, and I am facing the following dilemma. Let me elaborate for a moment. Basic HTTP authentication works as follows: The user ...
user avatar
  • 2,914
0 votes
1 answer
96 views

When my computer says my password is weak, and suggest a new one, is that password safe?

I was logging into YouTube when Apple said my password was weak, and I should change it. Is this randomly generated password safe?
user avatar
23 votes
12 answers
7k views

Storing weakness level of passwords

I am implementing a system where I need to store passwords in a database (hashed and all). My issue is that the business side requires me to not enforce any constraint on them except length (8 ...
user avatar
0 votes
1 answer
86 views

Voice input as security measures for system authentication

Can voice input as a password be a useful security measure as an alternative to a strong password and biometrics (face, thumb, signature etc)? The voice inputted as a password will be saved as a sound ...
user avatar
0 votes
1 answer
91 views

Is it possible to design a system with two passwords?

Is it possible to design a system with two passwords prompts? The system will have to prompt for two passwords The system would have to validate first password before prompting for second password ...
user avatar
1 vote
1 answer
70 views

how does fingerprint authentication work without trusting the client device?

There are lots of resources discussing the security of fingerprints but I haven't been able to find the answer to a very basic question. In the simplest possible password authentication scenario, the ...
user avatar
  • 253
0 votes
0 answers
27 views

Can a website access your browser password vault using a button that the user clicks? [duplicate]

I'm asking this question because almost all new websites ask us to click Accept Cookies button. So I click it reluctantly. I am afraid that the Accept Cookies button action would trigger some script ...
user avatar
  • 101
-1 votes
1 answer
120 views

Credentials in a POST body over https are visible [duplicate]

Hey so am new to pentesting and I learnt that using https makes the traffic encrypted so hackers cannot decipher credentials passed in a body for example in a login page or read the traffic properly. ...
user avatar
4 votes
2 answers
232 views

If the connection is encrypted, is it still unsafe to login at a public network?

It's common knowledge that one shouldn't login to personal or bank accounts on public wifi such as in a starbucks or a hotel. However, assuming that the connection is HTTPS and the passwords itself ...
user avatar
0 votes
1 answer
125 views

Doesn't 2FA increase the vulnerability of an account?

You create an account on an online service X with login=your email + password. Compare these 2 situations: No 2FA enabled. The only risk is if your email is compromised: the "I lost my password&...
user avatar
  • 3
20 votes
2 answers
5k views

Shouldn’t patterns be just as secure as PINs?

I’ve seen multiple sources online that say that unlock patterns are less safe than ‘random’ PINs. I was thinking; how come? From what I see, they would both be just as secure; you chose different ...
user avatar
  • 303

1
2 3 4 5
78