Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [passwords]

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

Filter by
Sorted by
Tagged with
0 votes
0 answers
4 views

Can you break PBKDF2 if you know the hash of the password? [migrated]

I know that PBKDF2 hashes the password a number of times, the result being a key. Can an attacker find the key if they don't know the password, but know the value of the hash of the password?
user avatar
0 votes
1 answer
41 views

Why force the user to use a secure password throught choosing the password for them to solve the password problem?

I have read in innumerables articles that „Passwords must die“, because they are blamed for being the cause of most cyber attacks. But why no just issue random generated passwords, with the added ...
user avatar
  • 3
0 votes
0 answers
20 views

How do we reliably know why the Master Key hash for a particular SID has changed?

We are developing a VB. NET application where we are building a 'Remember password' feature to store the user's application credentials using DPAPI for encryption (in a Windows domain environment) and ...
user avatar
0 votes
1 answer
28 views

Storing passwords and retrieving them to run an application

I have a web app that I use to run exe programs but the exe programs require a password to be passed. Currently this password is hard coded into the web app file in clear text. Since this is not ...
user avatar
  • 1
1 vote
1 answer
76 views

Databases for compromised passwords that browsers use

I am looking into databases of compromised passwords in order to ensure that passwords on a system I am responsible for are not already compromised. To have complete peace of mind, I prefer to get ...
user avatar
  • 331
0 votes
2 answers
81 views

How much does the strength of the password depend on the variety of characters?

For example, a password consisting only of lower-case characters [a-z], but a length of 10 (26^10), will always be better than all characters, but a length of 7 (95^7). That is, how much is it correct ...
user avatar
  • 25
2 votes
1 answer
137 views

Where to store the password: in RAM or another user's home folder (Linux)

There is user1 and user2. All work is done from under user1. user2 is only created to store important information. If important information is stored in RAM, but in the session of user1, which is ...
user avatar
  • 25
8 votes
3 answers
3k views

Argon2 vs SHA-512, what's better in my case?

First I am very bad in cryptographic algorithms. I found online that Argon2 is more secure than SHA-512, so I used it for password hashing. There're recommended options for Argon2: Memory: 4Gb ...
user avatar
0 votes
0 answers
26 views

Cracking password with static prefix and suffix

I found a pattern password generation that works like that: sha1("very long static prefix text blablabla "+password+" very long static suffix text"); I tried hashcat combined ...
user avatar
1 vote
1 answer
97 views

Potential problems with insecure password hashing

For my job I use some industry-specific software that stores sensitive information. The software has a web interface with a public login page. One time I attempted to log in, but mistyped the last few ...
user avatar
2 votes
3 answers
3k views

Is this a secure approach to store a master password?

I have come up with the following approach to remember master passwords (to use in software like KeePass, etc): Since it is annoying to type the master password every time we power up the PC, we store ...
user avatar
  • 123
-1 votes
3 answers
154 views

Why are there often random email addresses in known password word lists?

In known wordlists like crackstation.lst there are random emails in the list. Why are they there?
user avatar
0 votes
0 answers
66 views

Encrypt SVN for passwords

Could anyone give me advice on the best way to encrypt the SVN version control system on a Amazon Linux 2 instance? I am planning to encrypt or disable the SVN from asking if unencrypted passwords ...
user avatar
0 votes
2 answers
56 views

Storing backup keys (2FA) for online accounts

So I spent the day looking for a good solution of storing the backup keys or the 2FA codes and can't seem to find a convenient way for me, many people have different takes on this, so far I found 2 ...
user avatar
  • 1
2 votes
1 answer
94 views

What would be the most secure way to store and save my passwords on my desktop?

I store my passwords in a multitude of ways, these are all sorts of passwords, not only for websites and browsers. I also have credit card numbers, addresses etc... Now I'm using these methods: ...
user avatar
2 votes
1 answer
91 views

If multiple of the same password have the same hashed value in a database, does that mean the password is not being salted?

I just started a new job last week and I'm asking for a sanity-check before I mention this to anyone. All the new employee accounts are created with the same default password (I know, already a no-no)....
user avatar
2 votes
2 answers
47 views

Mitigating the performance impact of strong hashes with Basic HTTP authentication

I am trying to decide which work factor to use for our hashed passwords, and I am facing the following dilemma. Let me elaborate for a moment. Basic HTTP authentication works as follows: The user ...
user avatar
  • 2,914
0 votes
1 answer
94 views

When my computer says my password is weak, and suggest a new one, is that password safe?

I was logging into YouTube when Apple said my password was weak, and I should change it. Is this randomly generated password safe?
user avatar
23 votes
12 answers
7k views

Storing weakness level of passwords

I am implementing a system where I need to store passwords in a database (hashed and all). My issue is that the business side requires me to not enforce any constraint on them except length (8 ...
user avatar
0 votes
1 answer
58 views

Voice input as security measures for system authentication

Can voice input as password could be a useful security measure aa a alternative for strong password (Keyboard characters complex), biometric (face, thumb, signature etc)? The voice inputted as a ...
user avatar
0 votes
1 answer
80 views

Is it possible to design a system with two passwords?

Is it possible to design a system with two passwords prompts? The system will have to prompt for two passwords The system would have to validate first password before prompting for second password ...
user avatar
1 vote
1 answer
62 views

how does fingerprint authentication work without trusting the client device?

There are lots of resources discussing the security of fingerprints but I haven't been able to find the answer to a very basic question. In the simplest possible password authentication scenario, the ...
user avatar
  • 251
0 votes
0 answers
25 views

Can a website access your browser password vault using a button that the user clicks? [duplicate]

I'm asking this question because almost all new websites ask us to click Accept Cookies button. So I click it reluctantly. I am afraid that the Accept Cookies button action would trigger some script ...
user avatar
  • 101
-1 votes
1 answer
48 views

Credentials in a POST body over https are visible [duplicate]

Hey so am new to pentesting and I learnt that using https makes the traffic encrypted so hackers cannot decipher credentials passed in a body for example in a login page or read the traffic properly. ...
user avatar
4 votes
2 answers
225 views

If the connection is encrypted, is it still unsafe to login at a public network?

It's common knowledge that one shouldn't login to personal or bank accounts on public wifi such as in a starbucks or a hotel. However, assuming that the connection is HTTPS and the passwords itself ...
user avatar
0 votes
1 answer
111 views

Doesn't 2FA increase the vulnerability of an account?

You create an account on an online service X with login=your email + password. Compare these 2 situations: No 2FA enabled. The only risk is if your email is compromised: the "I lost my password&...
user avatar
  • 3
20 votes
2 answers
5k views

Shouldn’t patterns be just as secure as PINs?

I’ve seen multiple sources online that say that unlock patterns are less safe than ‘random’ PINs. I was thinking; how come? From what I see, they would both be just as secure; you chose different ...
user avatar
  • 303
1 vote
0 answers
25 views

Email supposedly from the future mentioning fairly recent password [duplicate]

Just got an email that mentioned, in very broken english, having hacked my email etc. and actually managed to list my current password of that email account. The mail was, apparently, send by that ...
user avatar
  • 11
0 votes
1 answer
87 views

Brute force alphanumeric passwords between 1 to 7 characters long with ZAP

In BurpSuite, you can brute force a password of any length and any character set (in my case, alphanumeric passwords between 1 to 7 characters long). How does one do it in OWASP ZAP, without actually ...
user avatar
0 votes
1 answer
95 views

Hash collisions in password history

When a user changes password, I'd like to implement a simple check that prevents them from reusing the same password. If the new password matches the old password, reject with an error. Sounds easy, ...
user avatar
  • 1,260
0 votes
2 answers
51 views

Revoke all refresh tokens when account locked?

Scenario: a user enters his password incorrectly x times, so his account is locked for y minutes. Should I revoke all his refresh tokens? Problems: user is logged out of all devices, not just the one ...
user avatar
  • 333
1 vote
1 answer
83 views

Rationale behind disallowing the use of similar passwords?

I recently had to change my password on a linux server (RedHat). It wouldn't let me use my password of choice because it was "too similar" to my previous password. Is this really ...
user avatar
  • 111
1 vote
1 answer
82 views

Is authentication through mail clients safe when encryption is off?

When adding an account on a mail client, the SSL/TLS is usually turned off and the encryption method is 'none' (see Outlook example below). Is the password safely sent through the internet when ...
user avatar
29 votes
7 answers
8k views

Is it safe to store account credentials in an Excel sheet protected with a password?

Basically the title. For example, how bad is it to store passwords in an Excel sheet protected with a password, instead of storing passwords in Keypass or something else like Zoho Vault? Of course, ...
user avatar
  • 393
0 votes
0 answers
34 views

Saving sensitive data unencrypted

Problem I am currently working on a web project which makes certain API requests with the user's data. I am using the Moodle API (Moodle is a platform for school related stuff) and the WebUntis API (...
user avatar
  • 1
0 votes
0 answers
37 views

Is passwordless OTP based authentication SOC2 compliant?

I have a client requirement to implement login without password. During sign in an otp will be sent to the user's email address and the user can use it to login. This will have an expiry. No password ...
user avatar
2 votes
1 answer
115 views

Static RAM: Detecting presence and wiping?

As I understand from reading another question here, SRAM may be more dangerous than traditional volatile RAM in terms of storing passwords and other sensitive information. I know that when a computer ...
user avatar
  • 39
7 votes
1 answer
2k views

With password cracking, what is the fastest known password cracking rig in hashes per second? [closed]

To properly assess password strength, I have been trying to research what the fastest known password cracking rig is in hashes per second. HashCat claims that their software is the world's fastest, ...
user avatar
1 vote
0 answers
42 views

Attack on home dir encryption with sddm pam_mount by using password in /etc/shadow

I'm using Debian + sddm + KDE with ONLY home directory encrypted with gocryptfs. Decrypting is performed with gocryptfs as follows: PC boots as usual and starts the sddm service I enter my login ...
user avatar
22 votes
6 answers
5k views

Backend database username and password revealed in JSP Page

Recently I came across a website and when clicking on one of hyperlinks it displayed a HTTP 500 error page as shown in the image, which indicated that it is using Java Server Pages and on line 23 the ...
user avatar
0 votes
1 answer
112 views

Will a hacker be able to steal my passwords if they steal my Firefox config folder?

Is it really that simple? I guess having a master password will prevent that, but the drawback is that it is asked each time I open the web browser.
user avatar
0 votes
1 answer
87 views

Encrypting/Decrypting User Secrets with Password

I am designing an account system that will use salting/hashing to securely store and compare passwords. For now, I'm looking at using bcrypt for password hashing. Somewhere along the way I'll need a ...
user avatar
27 votes
6 answers
9k views

Is it safe to store a password using a secure hash followed by an insecure hash?

I'm working with some middleware that requires username/password authentication. The middleware uses MD5 hash for the password. The MD5 hash, of course, is not fit for the purpose of storing passwords....
user avatar
  • 9,061
0 votes
2 answers
92 views

How different ldap implementations are generating random salt?

I am currently generating a salted SHA 256 passwords in the below format $hash = "{SHA256}".base64_encode(hash('sha256', $password . $salt) . $salt) . Using the below libraries of Java ...
user avatar
2 votes
3 answers
405 views

How can I extract salt from encoded base64 Salted SHA 256 hashed password

I have a SSHA256 hashed password. Below is the plaintext and hashed password for it. PlainText -p@ssw0rd Encrypted -{SSHA256}LGkJJV6e7wPDKEr3BKSg0K0XDllewz9tvSNSaslDmIfPFmyuI5blUK/...
user avatar
0 votes
2 answers
125 views

Should I update the way I handle authentication for my website?

For my website that is currently in development, I am trying to figure out a way to handle authentication. I am using mysql as my database and nodejs for my server. Currently, my website does the ...
user avatar
1 vote
0 answers
83 views

Why does a password guessing robot repeatedly test nonsense?

I log repeated invalid login attempts on a small custom made e-shop (no open source system is used). Last year, I started recording repeated failed logins from a single IP address. That's why I ...
user avatar
0 votes
0 answers
50 views

Which password is more secure? [duplicate]

Which password is harder to guess/brute-force: onlysmallletters! Ez65);k And also, can you explain your answer?
user avatar
1 vote
0 answers
71 views

Is it necessary to have keep these 4 accounts separate from password manager?

Microsoft Authenticator requires an: Outlook account Verification account iCloud account The first two are required to set up the authenticator on a new device, the latter stores all the data to be ...
user avatar
  • 9
1 vote
3 answers
199 views

Is there really any benefit in having a separate local admin account

I have been thinking of implementing a new practice where local admin privileges are disabled entirely from all endpoints. For users who need to elevate privileges, they will have a separate admin ...
user avatar

1
2 3 4 5
78