Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
4,067 questions
50
votes
11
answers
17k
views
Confused about using a password that "would take centuries to break"
I am talking about this password - 23##24$$25%%26 and the similar ones consisting of special characters appearing in a pattern, which the users these days use a lot.
At work (finance company), I was ...
- 2,727
0
votes
0
answers
20
views
Is the Windows PIN sign-in option good protection in case of device theft? [duplicate]
I've been hearing stories about people suffering apartment break-ins. This made me think about what might be stolen from my apartment if something similar happened, and the desktop computer certainly ...
- 132k
2
votes
2
answers
336
views
Storing backup keys (2FA) for online accounts
So I spent the day looking for a good solution of storing the backup keys or the 2FA codes and can't seem to find a convenient way for me, many people have different takes on this, so far I found 2 ...
CommunityBot
- 1
16
votes
4
answers
5k
views
What prevents a browser from saving and tracking passwords entered to a site?
Since we are accessing Gmail from the Edge browser, Microsoft could have access to the Gmail password. Theoretically, Microsoft can track this password along with sending it to Gmail servers. What ...
- 473
4
votes
1
answer
23k
views
Where to download a list of email accounts hacked from Adobe? [closed]
Adobe announced they had been hacked and millions of user accounts and passwords compromised.
These sites allow a search on email address to see if it was compromised:
https://lastpass.com/adobe/
...
- 132k
0
votes
1
answer
860
views
How is a Windows Active Directory Machine Account Password stored in Windows/Samba Clients?
It's said that a Windows Machine Account Password is usually composed of 120 characters in UTF-16-LE format. But when looking at the value stored in the Windows Registry under HKLM\SECURITY\Policy\...
CommunityBot
- 1
1
vote
1
answer
123
views
Is there a private, secure and easy login system?
I am trying to figure out the implications of authentication technologies. Answers to a previous question indicate my real question is more "meta than that.
The primary requirements for an ...
- 1,305
1
vote
2
answers
206
views
Why shouldn't I use the OAuth password grant if I have to implement a custom username+password login anyway?
I'm building a web REST API. Users must be able to authenticate themselves to this API.
I don't know ahead of time which clients will want to use the API. I want to allow for the possibility of anyone ...
- 23k
1
vote
1
answer
70
views
Using a mask for Aircrack [duplicate]
I have been using aircrack with an old router of mine I have given it a password from one of my old networks. It has a simple convention; two numbers, a keyword with a capital at the start then two ...
1
vote
1
answer
86
views
After Flashing BIOS -> Password protection still enabled?
can someone confirm whether it is normal for the BIOS password protection to remain active and unchanged after performing a complete BIOS firmware upgrade? My assumption was that the entire flash ROM ...
- 17.6k
0
votes
0
answers
3k
views
(Re)Hacked Instagram accout even if Two Factor authentication was enabled
A friend of mine, let's call her Alice, had an Instagram account that was hacked. She uses an iPhone. The scenario looks like this:
Alice gets a link from a Business Account via WhatsApp, and clicks ...
CommunityBot
- 1
27
votes
4
answers
77k
views
Password hashing on frontend or backend? [duplicate]
I have a Java Server with Spring Boot and a JS Frontend in AngularJS.
My teacher told me to use HTTPS for passwords, because I cannot hash them securely enough, that nobody can hack them.
With HTTPS,...
- 2,822
1
vote
1
answer
159
views
Storing multiple hashes of the same password
My application requires users to connect via different protocol that each have different auth flows and hash requirements, in particular Argon2 and SHA-256 (for SCRAM-SHA-256).
To allow both types of ...
- 113
2
votes
1
answer
194
views
Does not storing passwords in browser really matter given cookie hijacking exists?
I see lots of articles suggesting not storing passwords in the browser, and it made perfect sense to me, if I can access this data easily, an attacker probably can too.
But then I found out about ...
CommunityBot
- 1
0
votes
1
answer
125
views
Strange way of handling forgotten password
I was about to signup for ebanking solution, but then noticed their instructions for forgotten password are: Create a new account.
So there's no option to reset your password, just a suggestion to ...
- 132k
21
votes
4
answers
110k
views
Does Windows have a built-in password store?
What passwords are stored in Microsoft Windows? How can I know what password are saved in computer?
- 132k
1
vote
2
answers
1k
views
Is it unsecure to use only a passphrase in luks for whole system partition encryption?
When I use only a passphrase in LUKS for my whole system partition encryption, so I need to insert a password to decrypt my system partition to boot up my OS, is this unsecure and can it be cracked ...
- 129
15
votes
4
answers
6k
views
Security of a non-random password but that relies on information an attacker cannot possibly know
I am trying to figure out whether a non-random password that relies on information an attacker cannot possibly know can be secure.
To give an example, let’s say that I generate my password by putting ...
- 2,116
2
votes
1
answer
566
views
Is it safe to enable password sync on Microsoft Edge?
Microsoft Edge, as well as other Chromium browsers, have a password sync feature built into their browsers, which look something like the image below.
Before I enable this feature for convenience and ...
- 52.1k
2
votes
3
answers
2k
views
What are the benefits of logging the username of a failed authentication attempt?
From time to time, some users can accidently type their password in the username field, either because they missed the tab key or because they thought their account was simply locked, not logged out (...
- 1
2
votes
3
answers
225
views
Why does having default router credentials pose a risk? [duplicate]
When I got to 192.168.0.1/login I am greeted with my router login page and can go change some settings. Now let's say I still have the factory default login something like "admin", "...
- 2,490
9
votes
4
answers
855
views
Using Proof of Work to slow down login attempts
For a while I've been pondering a user authentication protocol that aims to ensure that a client does some computational work before the server will attempt to authenticate the password.
The reason ...
- 121
0
votes
3
answers
271
views
How dangerous is it to Google my password? [duplicate]
I have heard numerous, numerous times that Googling your password to anything (like is Pass124 a good password), is a very bad idea- and surprisingly there is no question (that I could find) on this ...
- 132k
0
votes
2
answers
170
views
Multiple Layers of Hashing when storing passwords [duplicate]
A common principle in InfoSec is Defence-In-Depth.
When encrypting sensitive data, it might make sense to have the data encrypted a few times.
Veracrypt does this for example with the AES-Twofish-...
- 132k
0
votes
1
answer
127
views
Passing password through terminal when using pass + gpg
I'm planning to use the pass to store passwords for a web service. My service will need to store passwords for many database servers. So my idea is store these passwords with the Linux pass command. I ...
- 3,035
1
vote
1
answer
116
views
Is there any reliable information on how many places make the mistake of storing passwords in plaintext?
I think the risk of passwords being stored in plain text (or easily reversible encryption) is well known. I'm curious though how frequently does it actually happen? Has there been any study or ...
- 34.4k
21
votes
2
answers
4k
views
Could a Google Chrome extension read my password?
I am concerned about the security of my passwords while using Google Chrome extensions. Specifically, I'd like to know if it's possible for a Chrome extension to read passwords that I enter on ...
- 51
1
vote
1
answer
137
views
How effective is re-entering your password to enable high-risk functions on your account when autofill is always available?
Websites ask for passwords to ensure you are the account owner before you make changes to high-risk settings, but autofill works all the time, even when the browser is in Incognito mode.
If someone ...
- 132k
1
vote
2
answers
443
views
Two different salted hashes of the same password for the same user
I am creating an authentication system that is able to login to the same account with different sets of credentials. I also want to allow users to login with either username or email with the same ...
- 647
0
votes
3
answers
467
views
Password managing apps seem to have access to my passwords
Keeper used to be free so I had stored most of passwords on that app a few years ago from a past device. When I tried to access the passwords after five years, the app had turned into a subscription ...
CommunityBot
- 1
3
votes
2
answers
3k
views
How safe are the password prompts of the SafeNet eToken 5110 or similar cryptographic hardware tokens?
I'll need to use an hardware token, specifically the SafeNet eToken 5110 that comes with DigiCert's EV certificates, for code-signing on Windows.
I know that they issue a prompt to manually enter the ...
CommunityBot
- 1
2
votes
1
answer
134
views
Can I add salt to my salt for password hash? [duplicate]
Following this tutorial, I got a bunch of questions with this code :
const crypto = require("crypto")
async function hash(password) {
return new Promise((resolve, reject) => {
...
- 208k
2
votes
1
answer
3k
views
John the Ripper Custom Dynamic Hash Function Usage
I have created a custom dynamic hash function comprised of a series of different existing hash functions chained together. I'll spare you the exact details because it's for a class assignment.
I've ...
CommunityBot
- 1
0
votes
1
answer
98
views
Is there a good case of passwords to be hidden on the screen to the extent it is? [closed]
In the olden days most computer displays involved a coaxial lead attached to a cathode ray tube. This functioned as a radio transmitter of what was displayed on the screen. I understood the response ...
- 375
-2
votes
1
answer
291
views
Why are passwords in the Linux terminal unmasked? [closed]
When entering a password into the password field in a Linux terminal- the password is just in the clear!
This is a commonly known fact.
But what if I'm in public, like in an office, and need to enter ...
- 208k
4
votes
1
answer
190
views
Distinguish origin of password prompts
I am wondering how to distinguish (password) prompts that the OS issued from prompts that are delivered application-side. This question first occurred to me when considering Firefox master passwords, ...
CommunityBot
- 1
69
votes
9
answers
31k
views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
- 2,993
1
vote
2
answers
1k
views
Benchmark Password Cracking Tools
I want to perform a benchmark for the most popular offline password cracking tools (john the ripper and hashcat)?
What metrics or approach should i take about benchmarking in order to determine what ...
- 16.5k
2
votes
0
answers
62
views
Is it possible to create a random alphanumeric password with built in error detection? [closed]
A friend told me about a giant alphanumeric password that he had to enter somewhere. Although he was initially worried that he would need multiple attempts due to typos. He was pleasantly surprised ...
- 121
121
votes
3
answers
82k
views
Does bcrypt have a maximum password length?
I was messing around with bcrypt today and noticed something:
hashpw('testtdsdddddddddddddddddddddddddddddddddddddddddddddddsddddddddddddddddd', salt)
Output: '$2a$15$jQYbLa5m0PIo7eZ6MGCzr....
CommunityBot
- 1
22
votes
3
answers
5k
views
Is there a problem with having a combined login/register screen?
I am designing a new login/register process for a system and want to combine the 2 initial pages for register and login.
This would be one page where the user would enter their email and press '...
- 717
4
votes
3
answers
2k
views
How to track PBKDF2 progress?
Background:
We have an application with password authentication. We now need to raise the number of PBKDF2-iterations and this means that the login takes quite a bit longer than before. Therefore, ...
- 132k
2
votes
8
answers
518
views
Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password?
Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password? If so, can you give me a password cracker specifically designed to crack non-keyboard characters? If yes, do you think it will crack this one?
- 2,727
28
votes
7
answers
19k
views
Do salts have to be random, or just unique and unknown?
First of all, my objective is to avoid storing the salt in the database as plain text. As far as this question is concerned, the salt is not stored in the database.
After discussion in comments and in ...
- 2,727
12
votes
2
answers
12k
views
How many bits of entropy should a password have to be reasonably future proof (10+ years)?
I’ve seen estimations that the NSA is capable of at least 1 trillion (PGP pass phrase) guesses per second, which would mean a password with 80 bits of entropy would take, on average, over 15,000 years ...
- 12.1k
8
votes
5
answers
5k
views
Does it really improve a password if at least one character of each group (a-z,A-Z,0-9) is included? [duplicate]
Many password policies required at least one character of each group (upper case, lower case, symbols, and numbers) in the password.
Does this really improve a passwords strength?
e.g.: Is (number ...
- 12.1k
121
votes
11
answers
27k
views
Password rules: Should I disallow "leetspeak" dictionary passwords like XKCD's Tr0ub4dor&3
TLDR: We already require two-factor authentication for some users. I'm hashing, salting, and doing things to encourage long passphrases. I'm not interested in the merits of password complexity rules ...
- 12.1k
56
votes
7
answers
5k
views
Do security questions subvert passwords?
If a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone try cracking the password instead of the security question? I ...
- 2,993
1
vote
1
answer
204
views
Recommended way to store password that needs to be used as plaintext?
I'm making an application that logs multiple accounts into a game server. I'm able to do this by passing in the username and password as argument parameters to the game executable.
Unfortunately, I ...
2
votes
0
answers
576
views
I linked an account with Plaid. If I change my username and password, will that mostly protect me in the event of a breach?
This is very similar to this question from 5 years ago, but I didn't see a clear answer: Is Plaid safe if I change the password after deposit?
I've linked an account with Plaid. That account is 2FA ...
