All Questions
Tagged with passwords cryptography
209 questions
1
vote
1
answer
129
views
Key Hash With Securely-Optimal Setting : For Encryption vs For Password
Do you have to make a key hash with securely-optimum setting (eg. 100MB memlimit, 3 opslimit) for encryption ?
So I'm making a text encryption function with javascript, using XChaCha20-Poly1305 and ...
0
votes
2
answers
215
views
Is there any good way of calculating a brain-generated password's entropy?
After reading this post, I understand that a password's entropy depends on the assumptions made when it is to be attacked (e.g. if it is generated randomly from a list of 2048 words, etc.).
Let's ...
- 187
5
votes
2
answers
1k
views
Why did WebAuthn beat PAKEs as the preferred password replacement?
Apple and now Google are releasing products that are built on WebAuthn as a replacement for traditional username + passwords. Why did this technology beat out PAKEs?
- 514
0
votes
1
answer
141
views
Cryptographic hash functions and personal password management [duplicate]
Background: I've always reused same username/password on all websites and got hacked regularly. I am considering using a password manager, but I don't like the need of storing a database. So I came up ...
- 103
2
votes
0
answers
279
views
How are the values of stored firefox credit cards encrypted? And how does one decrypt those?
While researching about the safety of web browsers I made my own program that can decrypt stored credentials, cookies, and other information of different browsers to see for myself how easy it is.
...
- 21
4
votes
3
answers
4k
views
Password based RSA encryption
I recently learned (read) the math behind RSA encryption (algorithm). Now, I wonder if there is a way to use a custom password instead of the private key.
Imagine a web application, where user signs ...
- 151
0
votes
1
answer
178
views
Store a password as an identifier (as safely as possible)... since there is no other choice
I have to deal with a place that has some terrible security practices. For example, this place gives people passwords (eg. domain logon on Windows, but paired with their name as the username) that is ...
2
votes
1
answer
1k
views
Why is entropy measured in bits?
I use KeePassXC to generate and store passwords. For example, generating a password with a length of 128 characters without using the extended ASCII character table, the entropy is about 770 - 800 ...
- 157
1
vote
1
answer
520
views
Does using a random number of iterations for PKBDF2-SHA256 help if I only have to protect one key used to encrypt a password protecteded file? [duplicate]
I read about Recommended # of iterations when using PBKDF2-SHA256?
I have also read in Why not just use a small but unusual number of hashing rounds? that when there are multiple password to protect, ...
- 113
2
votes
1
answer
703
views
How can I use a unique salt for each user
I know there are various questions that seem similar, for instance, this one. However, it does not answer my question.
I'm creating a signup/login system (with node.js to be particular), and I'm ...
- 23
0
votes
1
answer
902
views
How to create a secure password for a Java keystore?
What would be the recommended approach (industry standard) for generating a password for a Java keystore that contains TLS certificates? In the event that the keystore is obtained, an attacker would ...
2
votes
1
answer
365
views
How are passwords stored in the database of a decentralized peer to peer system?
I want to use username and password instead of public key cryptography for a decentralized peer-to-peer application, but since the passwords are stored on users' computers, there is a possibility of ...
- 21
2
votes
3
answers
2k
views
Using timingSafeEqual
I've seen code like this:
if(password.length !== allowedPassword.length || !crypto.timingSafeEqual(password, allowedPassword))
So timingSafeEqual is supposed to use the same amount of time to ...
- 527
0
votes
1
answer
835
views
Where and how to store admin account credentials for enterprise systems?
To my understanding, password-protected spreadsheets are not best practice for storing admin creds, whether it's a company of 5 people or a company of 50,000 people. In such a case, what are some best ...
- 123
0
votes
2
answers
432
views
Replace hashing function with asymmetric cryptography when password authentication
I would like to know if the following ideas are feasible:
Hash function is one-way function.
Generate public key from private key is irreversible(asymmetric cryptography).
User password entry -> ...
- 1
1
vote
1
answer
9k
views
John The Ripper and PBKDF2-HMAC-SHA1
I am trying to hash a list of passwords with PBKDF2-HMAC-SHA1 and then crack them using John. However, John does not recognise the hashes and I get a No Hashes Found error. It works with SHA256, but I ...
- 13
0
votes
0
answers
221
views
How does android boot and shows notifications with full encryption but without pre-boot authentication
i have android 5.1 (motorola moto g xt1039). i encrypted the phone and set screen password. then
after every password change i can choose one of an two options:
'require the password at startup'
'...
- 299
3
votes
3
answers
653
views
How can one test if a password generator is cryptographically secured?
Given the plethora of random password generators (RPG) available, I'd like to do some black box testing on some.
Let's take https://passwordsgenerator.net/ for example. Assuming the whole generator ...
- 3,482
0
votes
1
answer
2k
views
What are the steps of hashing and steps of verifying password using salt and key? [duplicate]
What are the steps of hashing password during registration and login to an application using salt and key?
Are the following steps considered correct if applied to an application?:
1- During ...
2
votes
1
answer
716
views
How to store a user's password in a database in 2019? [duplicate]
This question, but focused on .NET's given PBKDF2 implementation, has been asked here now.
Situation
I am currently updating a password storage mechanism for a website.
My plan for storing a ...
- 189
0
votes
0
answers
63
views
How long shall a password be to resist a botnet brute force? [duplicate]
Imagine that I'm an evil genius, and I had the brilliant idea of creating a botnet for brute forcing passwords. Or I'm just the owner of the Echelon, and I have a farm of distributed servers around ...
0
votes
3
answers
1k
views
How is the strength of a key/Password determined
I was reading about the Principle of Key Sizes and came across this table:
The deduction I made off this is that after a certain key size, increase in a single bit causes Time required for search to ...
- 195
3
votes
1
answer
378
views
Plausible way to hack website keeping [username / hashed password] pairs?
I was reading that a lot of authentication systems use cryptographic hash functions, whereby instead of keeping the username and password of their users they just keep the username and a hash of the ...
- 133
0
votes
1
answer
371
views
Decrypt hash using dicionary attack
Let's consider that I'm the attacker and have access to hashes of passwords of a given database against which I will attempt a dictionary attack.
My question is: Will I be able to find out by ...
0
votes
1
answer
782
views
When encrypting password hashes, how to handle nonces?
I know that encrypting password hashes is a contentious issue. However, I have seen it recommended in some quarters. I know for instance that DropBox did this at one time with AES256. In these cases, ...
- 514
0
votes
0
answers
1k
views
bcrypt.checkpw() returning true for different salt+hash
new user here. I've tried searching for an answer but I don't think I know the correct terms to search for. I've tried things like "bcrypt same password different hash" but can't find an answer to my ...
- 1
7
votes
1
answer
392
views
Can password strength be enforced with PAKE protocols?
Can a password strength policy i.e.:
must contain at-least 8 chars
must contain one uppercase letter
must contain one lowercase letter
must contain one number
Be enforced if a PAKE protocol is used, ...
- 138
0
votes
1
answer
234
views
An authentication protocol to prevent phishing & solve the problem of password reuse?
When writing about best practices for authentication, I find that today's best practices still leave gaping holes in security, specifically not solving the problem of password reuse by users - ...
- 138
3
votes
1
answer
1k
views
How should I share the key of the AES algorithm in each client?
My doubt would be the following:
How should each client know the encryption key? Using the AES algorithm.
(or the best way):
Save it in a file encrypted by password?
Save it in a DB?
Send it over ...
- 33
3
votes
1
answer
177
views
How much less secure is a password with a repetitive pattern of characters?
I want to make sure my password is very difficult to bruteforce but also easy to remember and convenient.
So my idea is to just use a short password and repeat it a few times like this:
...
- 31
2
votes
1
answer
4k
views
What is a collision attack in simple terms? [closed]
I'm not a security expert but I've got interested in Cryptography and I'm reading about it.
I was trying to find out which is the best between SHA256, Bcrypt and MD5 when it comes to hashing ...
- 33
6
votes
1
answer
19k
views
OpenSSL: what's the difference between -kfile and -pass?
It seems both -kfile and -pass can be used to encrypt files with a 2048 bit keyfile? I don't understand the difference between the two methods:
$ openssl enc -salt -aes-256-cbc -in inputfile.txt -...
- 63
14
votes
2
answers
17k
views
Why is SHA-256 not good for passwords? [duplicate]
I've just started learning about all of this and I can't really find an answer for that anywhere, namely why is SHA-256 not used for passwords? I found that the reason is that because normal SHA-256 ...
- 251
7
votes
2
answers
1k
views
What could an attacker do if they gained access to PBKDF2 hashes?
This is regarding a web application where a user has to login with their personal email as the ID, and a password they have chosen personally.
If an attacker somehow gained access to a credential ...
- 237
0
votes
1
answer
222
views
Is there a way to send a password over JSONP (GET) over HTTPS (SSL)? Crypto maybe?
I understand sending passwords in the clear over GET is not considered secure because the query string can be logged by multiple eavesdroppers.
However if I REALLY need to use JSONP to submit a ...
- 101
2
votes
2
answers
9k
views
Bcrypt data type and length?
I'm using the following library for hashing my password.
string password = BCrypt.Net.BCrypt.HashPassword("stackoverflow");
The length is apparently 60 each time. My question is, I'm planning to ...
0
votes
1
answer
291
views
How to securely handle a login system [duplicate]
I'm making a desktop application in C# and I want to know If I'm handling this (from security perspective) as should be or not.
My Users table have both hashed_password and salt, both are binary(32).
...
5
votes
1
answer
1k
views
Bruteforce FileVault Encryption?
I've been getting into forensics and penetration testing lately and hoping someone can explain what the below data is and how it might be used to perform a bruteforce (hashcat) attacks against ...
- 51
1
vote
1
answer
319
views
Is it good practice to store information about a subkey inside a hash?
I recently wrote out a small javascript library that allows you to verify identity server password hashes in nodeJS. While I was doing the research I learnt that the type of hash, iterations and salt ...
- 462
2
votes
2
answers
394
views
Using an in-browser tabula recta to generate passwords
I've been working on an idea for a stateless password manager, inspired by this blog post. I'm using a in-browser pseudo-random number generator (seedrandom.js) seeded with a user's master password to ...
- 23
0
votes
1
answer
1k
views
Are passwords longer than 128 bits useless if hashed with MD5? [duplicate]
Are passwords that are longer than 128 bits useless if they get hashed/transmitted with MD5?
MD5 always uses 128 bits, thus someone would rather try to bruteforce the MD5-hash than the password ...
- 109
3
votes
3
answers
316
views
Password Hashing Flaw
Disclaimer: I know about the dangers of rolling your own auth, this example is intended to be used in a demo for various hashing methods.
I wrote this Node.js func to run server side to reinforce ...
- 2,859
0
votes
1
answer
2k
views
Encryption key split into parts and stored in different places
Say, I have encrypted data in a database. How wise is it to break a secret encryption key into several parts and save each one in a different place?
Namely:
key1 = get_key1_from_remote_server()
...
- 2,267
0
votes
1
answer
634
views
Is my BCrypt variant ($2a$) fine, up to date and secure?
As far as I know, there are a couple of BCrypt variants and I also understood that some of those variants have security flaws so I was wondering whether it is fine or not that the library which I am ...
- 185
8
votes
2
answers
20k
views
Is SHA-256 + Salt still safe for password storage? [duplicate]
I am developing a website which requires users to register to it in order to use it's functions and I was wondering if SHA-256 + salt (random salt provided by RNGCryptoServiceProvider in C#) is ...
- 185
2
votes
5
answers
1k
views
Cryptography: Encrypting with password without storing it
I'm working on a desktop application where we handle sensitive data and we want to encrypt local files with a password that we ask the user when he opens the application. On most similar project, we ...
- 23
1
vote
1
answer
3k
views
Append or prepend a salt to a password? [duplicate]
Does it matter how I add a salt to a password in my application: by appending it or by prepending?
# 1
res = sha256(salt + password)
# 2
res2 = sha256(password + salt)
I've been told that the 2nd ...
- 2,267
2
votes
1
answer
525
views
Storing user's social media passwords
I'm trying to understand how a service Snaplytics trusted by some high brand companies is able to collect their clients password for snapchat and store them in their db while being able to log in to ...
1
vote
2
answers
325
views
Securing passphrase on DB
I have stored encryption keys on the database that are encrypted with a passphrase. To decrypt it the owner/user must login using his passphrase, and that will be used to decrypt the encrypted keys on ...
- 111
4
votes
4
answers
667
views
Nesting bcrypt + PHPass for improving the security of password storage in legacy software?
I've been tasked with improving the security of the password storage of a site which currently uses Openwall's PHPass. All the hashes will be converted at once, i. e. we don't want to wait for the ...
- 143