All Questions
13 questions
0
votes
1
answer
1k
views
Are passwords longer than 128 bits useless if hashed with MD5? [duplicate]
Are passwords that are longer than 128 bits useless if they get hashed/transmitted with MD5?
MD5 always uses 128 bits, thus someone would rather try to bruteforce the MD5-hash than the password ...
- 109
26
votes
5
answers
2k
views
What concrete parameters can I change to make my passphrase-protected private gpg key more secure
There are several questions which discuss the resistance of passphrase-protected private gpg keys against brute force attacks. It seems, this kind of discussion could go on forever.
Rather than ...
- 1,771
1
vote
0
answers
3k
views
Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation
I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
- 121
36
votes
2
answers
44k
views
Why are GPUs so good at cracking passwords?
What is it about GPUs that lets them crack passwords so quickly?
It seems like the driving force behind adopting good key-derivation functions for passwords (bcrpyt, PBKDF2, scrypt) instead of ...
- 465
6
votes
3
answers
662
views
How much added security do I really get with a longer key size?
Imagine I have a cipher which supports keys of 128, 192 or 256 bits. Suppose that there are no vulnerabilities in the cipher regardless of key length. I'm going to use it to encrypt something, and I'...
- 196
1
vote
1
answer
490
views
Stripping / appending characters from user password before hashing to conceal it forever?
I had this idea to permanently conceal user password by requiring minimum length then stripping certain characters. For example if the user password is secret123, the system will strip it down to ...
- 2,978
4
votes
2
answers
1k
views
Can key files be brute-forced like passwords?
Let's say you use a program like Truecrypt or Keepass which allows you to have a password + key file. I understand that passwords can be brute-forced/dictionary-attacked but is the same true for key ...
- 2,978
26
votes
5
answers
12k
views
What's the practical limit for rainbow-table based bruteforce?
Say we have a hash of a password. The password can be considered to be made of of totally random characters and has a fixed length of N. The hash is SHA1(password+salt), where the salt is of length M. ...
- 866
7
votes
3
answers
2k
views
It is possible that brute force attempts are successful before the worst case, correct?
When I read about a password being secure and stating that it would take X amount of week, years, etc. isn't that referring to the worst case?
What happens if the brute force method is successul in ...
- 171
11
votes
2
answers
479
views
How much security is compromised if we accept other characters as login (other than the original password)?
I've just realised that facebook accepts 3 forms of a password:
Source:
Facebook actually accepts three forms of your password:
Your original password.
Your original password with the ...
- 3,343
7
votes
2
answers
4k
views
Dictionary Attack on Wifi
I know a few people with pretty weak passwords. What kind of systems exist to prevent dictionary attacks? Would it make sense to restrict the number of connection attempts in a certain timeframe?
...
- 1,411
7
votes
2
answers
16k
views
Can DES-based hashed password be recovered if salt is known?
Can a hashed password be recovered if the hashing is done with DES based crypt function in PHP and both the hash and salt are known by the attacker?
Consider the following example:
$salt = 'mysalt';
...
- 918
8
votes
3
answers
2k
views
time to crack file-encryption password - more than just iteration
I have often seen that takes x amount of time to crack a certain length password. But this just seems to be the amount of time it takes to iterate through all the possibilities. What about the time it ...
- 81