All Questions
46 questions
0
votes
1
answer
141
views
Cryptographic hash functions and personal password management [duplicate]
Background: I've always reused same username/password on all websites and got hacked regularly. I am considering using a password manager, but I don't like the need of storing a database. So I came up ...
- 103
0
votes
2
answers
355
views
Is it possible to design a system with two passwords?
Is it possible to design a system with two passwords prompts?
The system will have to prompt for two passwords
The system would have to validate first password before prompting for second password
...
- 1
0
votes
2
answers
157
views
Construct a strong, (almost) unique password? [duplicate]
After reading Why use random characters in passwords? it seems to me that one can solve the problem of how to remember a zillion passwords while each one remains secure by constructing each password ...
- 1
6
votes
4
answers
5k
views
Storing Username and salt in separate table
You have a User table:
UserID (auto-incrementing Integer)
Password hash
LastLogin
All related tables are linked by the UserID.
You also have a Username table:
Username
Salt
IncorrectLoginCount
...
- 63
0
votes
1
answer
229
views
What vulnerabilities would this type of "password manager" have?
When I was searching for a password manager to use I stumbled upon the concept of Master Password which instead of encrypting and saving your passwords, generates them by using your master password ...
user233399
2
votes
2
answers
296
views
What wrong with this system to proactively check if customers' passwords have been found in a breach?
Let's say that during account creation, I already prohibit passwords known to be reused from breaches of other sites, like if it's in the Have I Been Pwned list. But breaches happen all the time, so ...
- 121
2
votes
1
answer
949
views
Is better to have as password a sentence or first letter of the sentence?
Which is better master KeePass password to prevent any type of bruteforce between theses two type of password :
Complete sentence invented by user like : I like cheeseburger,
tomatoes and fries ! :)
...
- 274
3
votes
2
answers
388
views
How strong is a password consisting of words arbitrarily chosen from the dictionary?
Diceware wants us to actually randomly pick n words from a given set of m=65 words.
Assume a user does not actually use a dice. Instead they take a physical dictionary of m words and "randomly" picks ...
- 6,595
102
votes
3
answers
20k
views
Why is Sojdlg123aljg a common password?
I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
- 763
5
votes
1
answer
259
views
Do ciphers and encoding schemes make passwords more secure?
I recently came across a tech professional advising a user to take some plaintext of their choice, run it through one of these ciphers, convert it to Base64, and then use the result as their master ...
- 979
21
votes
2
answers
5k
views
Store Credit Card Information in Password Manager?
For convenience purposes I manage my passwords with the password manager Bitwarden on my personal computer and smartphone with autofill function (but with asking for the master password or fingerprint ...
- 385
0
votes
1
answer
859
views
Recommended length of password [duplicate]
Why are we recommended to have at least 8 characters, and not 6 or 7 etc.? and the different set of character?. I only know that the longer the password is, the harder it is for brute force attack to ...
- 67
0
votes
1
answer
418
views
Choose a sentence, a number, and the name as password [duplicate]
I would like to have your point of view about something I found on internet.
The goal here is to help people to use stronger passwords, it's not perfect, but I believe that asking people to use ...
- 3
3
votes
2
answers
630
views
How to choose between password derivation or encryption?
Suppose you use a password manager having all possible features of modern password managers: encryption with a key derived from your master password, auto-filling, cloud or local storage, browser ...
- 183
1
vote
1
answer
165
views
Do hacks of mainstream web applications tend to happen more from random attackers brute forcing or from targeted heuristic attacks?
I'm writing up advice for selecting a master password for a password manager, and I'm wondering if there is available data about the likelihood of different attacks that result in a cracked password. ...
- 211
40
votes
14
answers
20k
views
How can I make a strong password that's easy to remember? Is the 4 Word method safe? [duplicate]
I have heard of the method of using 4 random dictionary words, it gives you lots of characters and is easy to remember.
But that seems to be open to dictionary attacks, especially if the attacker has ...
- 574
4
votes
5
answers
2k
views
What is the most secure way to store the password on a physical medium (paper, etc)? [duplicate]
Let's assume that I have to store the password on a material medium (paper, etc). What is the most secure way to do that? I mean a way of storing the password that does not needs any electronic tools ...
- 209
3
votes
2
answers
662
views
Is there a cryptographic disadvantage to applying bcrypt to an already hashed password
I originally asked this on stackoverflow, but due to lack of traction and a recommendation by a user there I have asked it here too.
Imagine a scenario where a client application is sending a ...
- 177
29
votes
9
answers
7k
views
What considerations do I need to keep in mind when enforcing passphrases?
According to XKCD: Password Strength, if the password consists of “four random common words”, it will be secure and memorable.
I want to make a web application and make users create their passwords ...
0
votes
1
answer
286
views
Is hashing the concatenation of my password and account type secure? [duplicate]
Concept
The goal of a password manager is to reduce the number of passwords which one must memorize down to one, and then have all other passwords be encrypted under that master password. My solution ...
- 101
2
votes
2
answers
394
views
Using an in-browser tabula recta to generate passwords
I've been working on an idea for a stateless password manager, inspired by this blog post. I'm using a in-browser pseudo-random number generator (seedrandom.js) seeded with a user's master password to ...
- 23
1
vote
0
answers
101
views
Asus tablet/laptop [closed]
I need to crack my Asus. My roommate put a password on it and I can't figure it out. The password hint on the login page says crazed. If anybody knows how to get in this M.F. P.O.S. It would be ...
- 11
10
votes
4
answers
7k
views
Password manager vs password book
I have seen a lot of discussion online surrounding whether using password management software is more secure than writing your passwords down on paper and vice versa. However, a lot of this discussion ...
- 223
0
votes
1
answer
113
views
Is there a way to customize the authentication mechanism on an Android Device?
Android comes with authentication mechanisms like the lockscreen pattern. Is there a way to customize those patterns (e.g. adding nodes, changing colors, modifying the ruleset)? Or can I even ...
1
vote
2
answers
337
views
Protecting Passwords Using Short Hash Length
Does anybody use deliberately short hash lengths for passwords to increase the chance of false positive collisions in the event of a brute force attack on the database?
When trying to decide on a ...
- 113
3
votes
1
answer
232
views
Is there a convenient way for a CS representative to verify the caller's id without compromising security (too much)?
As of now, we're accomplishing this by hashing, salting and storing the first three characters of the customers' passwords in one table and hashing, salting, and storing the full password in another ...
- 133
2
votes
1
answer
510
views
Is there a well-researched and user-friendly solution to the password problem? [closed]
The Password Problem has been spoken on many times, but most places I've seen offer terrible solutions such as modifying a dictionary word, changing your password requirements to include special ...
- 1,024
0
votes
0
answers
49
views
Should I use a Password manager or just use different passwords? [duplicate]
Reading this article on the BBC titled: Password guru regrets past advice
It advises that people now use Password Managers:
It recommended that organisations abandoned a policy of pushing their
...
- 3,041
1
vote
1
answer
222
views
Password manager or two -actor authentication
For the critical services, is it safer to have different complex passwords and a password manager or the same password for every service and a two-factor authentication?
The password manager is risky ...
- 433
5
votes
4
answers
1k
views
How secure is this method of password generation?
Introduction:
I used to use the same password for everything (it was at least a really random password with fake words). Then I found out that I should have different passwords for different sites ...
- 149
8
votes
5
answers
7k
views
A password manager a single point of failure. Then why is it so often recommended nowadays? [duplicate]
The conclusion of this article is that to protect passwords in 2017, you need length and randomness. It recommends giving up all little hacks and techniques like turning "o" into 0 in favor of picking ...
- 81
5
votes
2
answers
1k
views
Hashed passwords storage: iterations vs entropy [duplicate]
Context: A website is hosted on multiple dedicated servers. There are frontend webservers, backend DB servers and other servers between them.
The DB holds user's accounts passwords. All connections ...
- 53
54
votes
3
answers
11k
views
Secret salts; why do they slow down attacker more than they do me?
When studying Dan Boneh's slides for 'Session Management and
User Authentication' (2011) he mentions 'secret salts' on the slide 'Further defences' (slide 48 out of 58).
He suggest to store in the ...
- 593
1
vote
1
answer
154
views
Security implications of using an algorithm to lengthen and salt passwords before using them?
I have created a JavaScript bookmarklet which, among other things, base64 encodes my plain-text passwords combined with information from the site's domain name. The idea is that base64 output is ...
- 11
6
votes
1
answer
190
views
Is Google's objective to kill passwords justified?
Google's Trust API has already been tested out in “several very large financial institutions” in June. It apparently uses a combination of multiple weaker indicators such as biometric indicators as ...
- 335
1
vote
3
answers
344
views
Are there any security advantages to forcing a password-character limit on reset, but allowing unlimited character in password-login?
I was resetting a password a few moments ago, and I was given a character limit of around 10 characters to make a secure password with.
After resetting the password, I went to enter my password, and ...
- 907
5
votes
4
answers
1k
views
What are possible methods for calculating password entropy?
I noticed there are tons of questions and answers about password entropy on this forum, some even suggesting formulas for calculating it. None did answer my exact question.
What are possible or ...
- 7,085
0
votes
2
answers
244
views
Secure password generation for different websites [duplicate]
I came up with the idea to generate passwords for internet sites by the following shema:
$masterpassword
$hostname
$TLD
hashfunction($TDL.$masterpassword.$hostname)
So the actual password is a hash ...
- 1,072
0
votes
2
answers
861
views
Will hashing a password, and then splitting it into multiple db fields increase security? [duplicate]
I've been reading up on Password hashing, and it seems like there is a lot of opinions on "What's right."
I'm curious about the possibility of storing a split of a Hashed password in multiple user ...
- 907
-3
votes
3
answers
177
views
Is there something other than "if" and "else"
There are many ways for protecting a password like using strong algorithms like SHA-512, using salts, encrypting the database where the password is stored, packing the license file with UPX etc and ...
0
votes
2
answers
643
views
How to properly hash a key? big vs small digest
We have to roll (decommission) database access keys often, but it's important to know which key each system is using in order to avoid removing a key in use thus creating unavailability. We want each ...
- 254
0
votes
1
answer
211
views
Can anyone help me build a combo file suitable for my problem? [closed]
I have a router model C1000A
company: CenturyLink Actiontec
I bought it through eBay, my problem is that I can not connect to the Settings page because I do not have the admin password (the password ...
- 1
25
votes
7
answers
7k
views
Source code as password
Passwords with a mixture of letters, numbers, and special characters are sometimes hard to remember. Is it secure to instead use a small amount of memorable source code as a 'passphrase'?
As an ...
- 765
2
votes
1
answer
131
views
Is it safe to signup multiple applications with facebook?
Putting all eggs in one basket.. Is it safe to sign-up on different applications with facebook or such similar platforms, linkedin, twitter etc?
- 23
2
votes
1
answer
2k
views
How is password information stored and used on Android accounts?
How difficult would it be for someone who stole your device to gain access to the username and password information stored under the Settings -> More -> Accounts section of an Android device?
...
5
votes
2
answers
3k
views
Would a massive blacklist of guessable passwords be useful? [duplicate]
Suggestions to make a good password all focus on creating a string that a computer (or more likely, a network of computers with multiple GPUs) can not guess. Putting a password meter for when users ...
- 1,269