Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
4,067 questions
0
votes
1
answer
124
views
How does increasing minimum password length affect the size of password space?
I understand that when there are a possible characters and passwords must be of length n there are an possible passwords.
But usually passwords can vary in length between some minimum and maximum ...
- 1
1
vote
1
answer
145
views
Would asking for user input email again in password reset increase security?
I have a workflow like this right now:
User inputs the account email and clicks the "forget password" button
User receives an email containing a link with token for password reset
User ...
- 111
1
vote
1
answer
315
views
What are the risks of reusing the same passphrase for FDE, user account, and password manager?
Consider a home user who runs Linux on a laptop with full-disk encryption and uses a cloud-based password manager. Assume the laptop is firewall-protected with no SSH access. It seems reasonable to ...
- 123
0
votes
1
answer
193
views
2FA implementation security
I am looking to implement 2FA. I know of duo and eg. Eset secure authentication. But both solutions seem to be implemented in a strange way, that is they require some form of communication with either ...
- 471
1
vote
2
answers
443
views
Two different salted hashes of the same password for the same user
I am creating an authentication system that is able to login to the same account with different sets of credentials. I also want to allow users to login with either username or email with the same ...
- 13
0
votes
2
answers
215
views
Is there any good way of calculating a brain-generated password's entropy?
After reading this post, I understand that a password's entropy depends on the assumptions made when it is to be attacked (e.g. if it is generated randomly from a list of 2048 words, etc.).
Let's ...
- 187
2
votes
2
answers
285
views
Why do entropies of passwords significantly differ from site to site?
I read the infamous xkcd cartoon comparing two passwords and their strength. Curious whether their calculation was accurate, I searched many entropy calculators and plugged in the two examples from ...
- 21
0
votes
0
answers
153
views
What is the most resistant way to unlock a device
The standard way to unlock a device is with a password. TPMs have improved this to the point that we can create devices that can be unlocked with very short passwords such as PINs and we can create ...
- 101
24
votes
4
answers
7k
views
Does a password policy with a restriction of repeated characters increase security?
A security value called Restriction of Repeated Characters for Passwords (QPWDLMTREP) can be configured in IBM i. If QPWDLMTREP has a value of 1, then "the same character cannot be used more than ...
- 359
4
votes
1
answer
190
views
Distinguish origin of password prompts
I am wondering how to distinguish (password) prompts that the OS issued from prompts that are delivered application-side. This question first occurred to me when considering Firefox master passwords, ...
user292329
0
votes
3
answers
467
views
Password managing apps seem to have access to my passwords
Keeper used to be free so I had stored most of passwords on that app a few years ago from a past device. When I tried to access the passwords after five years, the app had turned into a subscription ...
14
votes
2
answers
5k
views
Reasoning behind banning '#' from the start of passwords? [duplicate]
Today, on an official government website, I came across the following password rules:
"Your password has to be at least 8 characters long. It can't have any blank spaces. It has to use characters ...
- 141
9
votes
4
answers
855
views
Using Proof of Work to slow down login attempts
For a while I've been pondering a user authentication protocol that aims to ensure that a client does some computational work before the server will attempt to authenticate the password.
The reason ...
- 193
0
votes
1
answer
187
views
Security of using Yubikey to derive Diceware password?
I bought a new Yubikey, and am currently setting it up to use on my desktop PC. Previously the PC was secured with password only, and I'd like to use the Yubikey as an alternative: instead of using ...
- 508
1
vote
0
answers
1k
views
Tool to Decrypt Chrome, Firefox and Edge login information [closed]
Im new to python but Ive created a couple of programs that can collect the user credentials for Google Chrome, Mozilla Firefox and Microsoft Edge and decrypt them then save the decrypted output to ....
- 11
1
vote
3
answers
615
views
How do websites check that password hashes saved in the database are the same as passwords hashed client-side?
How do websites check that password hashes saved in the database are the same as passwords hashed and sent by a client?
I know that client-side hashing is not secure.
- 21
1
vote
0
answers
30
views
Argon2 is worse than bcrypt at runtimes < 1000 ms? [duplicate]
While Argon2 seems to be recommended for password hashing, based on this twit Argon2 is worse than bcrypt at runtimes < 1000 ms.
Based on this answer:
You should tweak the parameters to your own ...
- 111
0
votes
0
answers
109
views
How could one use multi-factor authentication to derive a static secret key?
Scenario:
The setup is that each user has a randomly generated key A used for encrypting data stored on the server and a password-derived key B used to store A on the server without the server getting ...
- 647
1
vote
1
answer
127
views
Sudo user without ability to login
I have a main user with home folder encryption enabled. To avoid typing long phrase each time I want to have another user with sudo privilege and weak password.
In the terminal I would first switch ...
- 121
0
votes
1
answer
301
views
Storing two hashes of same password?
Typically for user passwords we store their hashes and salt alongside in the database - one per user.
I wonder the security implications of hashing the same password twice and storing locally both.
...
0
votes
1
answer
119
views
Practicalities, implementation, and weaknesses of simple symmetric encryption for plain text files
For about 20 years, I've been using gnupg to encrypt a plain-text file containing my passwords. (The actual per-site passwords are generated using a hash function.) It's worked OK for me, but gnupg is ...
6
votes
2
answers
12k
views
How does Google's "on-device encryption" work?
I use Google to store some of my passwords and I noticed a "On-Device encryption" option in Google Chrome settings, that I had disabled. From what I understood, by allowing this, the ...
- 165
0
votes
2
answers
300
views
How to reuse PIN codes in the most secure way?
I've made a list of the services/devices that require a PIN code. Shockingly, it's over 10, which I find impossible to remember, so I need a strategy to reuse the codes.
What could be a strategy for ...
0
votes
1
answer
859
views
How is a Windows Active Directory Machine Account Password stored in Windows/Samba Clients?
It's said that a Windows Machine Account Password is usually composed of 120 characters in UTF-16-LE format. But when looking at the value stored in the Windows Registry under HKLM\SECURITY\Policy\...
- 101
1
vote
1
answer
145
views
Why is it a bad idea to accept passwords one character at a time for an authentication mechanism?
For the purpose of my studies, I am trying to answer the below scenario, in my opinion it is not a good idea, because it would leave the system open to brute-force attacks.
A novel password scheme is ...
- 11
0
votes
3
answers
218
views
How to analyze the security of a custom passphrase?
Let's assume person A chooses 15 words for a passphrase with an average length of 5. The passphrase meets following conditions.
Word conditions:
The first word is not a valid word and can't be found ...
- 56
0
votes
1
answer
255
views
How does this app "hash" their passwords with MD5, but still know the plain-text?
There is a public application that has terrible security practices. When performing an API call to such application, and succesfully logging in, it will return a "user" JSON that includes ...
- 263
3
votes
4
answers
430
views
When resetting password after forgetting it, why is there a need to notify "Password cannot be your previous password"?
This is from the perspective of someone who had supposedly forgotten their password. We're doing this project wherein we "secure" an application that was given to us. We added this "...
- 31
2
votes
1
answer
564
views
Is it safe to enable password sync on Microsoft Edge?
Microsoft Edge, as well as other Chromium browsers, have a password sync feature built into their browsers, which look something like the image below.
Before I enable this feature for convenience and ...
- 121
2
votes
0
answers
184
views
How is "partial" password reuse determined? [closed]
How do environments like Active Directory determine if you reuse parts of previous passwords in a new password? I understand that it keeps a list of your last passwords, hashed. But how do they ...
- 21
0
votes
1
answer
148
views
How do password protected files differ from keygen protected software?
From some posts I read here:
Regarding keygen protected software:
As long as the user has full control of the hardware where the software is running on (i.e. typical PC) it is impossible to fully ...
- 3
0
votes
1
answer
224
views
Are short password length requirements a security risk? [duplicate]
I visited a website that requires me to create a password. One of the password rules was "7 to 15 letters". Is this a security risk, since many people would now enter a weak password instead?...
- 2,727
2
votes
1
answer
334
views
RAR archive password recovery
Hello guys is there some tool or methodic to get into let's say 12 years old RAR file.
I tried Kraken CMD tool and dictionary attack but it will take ages goes through all passwords.
Unfortunately for ...
- 21
23
votes
2
answers
5k
views
Why is 1Password sign-in to new device secure without MFA?
I'm trying to understand why it's not necessary with MFA in 1Password when signing in to a new device.
This was the case that triggered my curiosity:
I created a 1Password account
I downloaded the ...
- 341
1
vote
2
answers
214
views
Should I worry? Web hosting mailed me my details and returned my password (unencrypted) and IP logged
Unfortunately, I've tried a hosting service and it returned my password value as it was in my inbox (as connection details).
I went to a control panel in an attempt to delete or deactivate my account. ...
- 13
1
vote
3
answers
454
views
Patterns in passwords
I am posting to ask about two conflicting password recommendations. I know only bits and pieces about cryptography. Let me begin by checking a basic assumption: in a cracking attempt, a string is ...
- 11
0
votes
1
answer
169
views
Best way to connect to user SSH servers
I have a project that calls users' SSH servers to do some tasks.
For now, I am storing users' passwords at my service as hashed (Username, hashed password and salt), but the SSH password (username, ...
- 17
-1
votes
1
answer
322
views
How can you calculate the entropy of arbitrary password rules with known distributions? [duplicate]
Many online entropy calculators make certain assumptions (like assuming a password is as rare as the set of random characters that will generate it), or handwave away the math. I want to know how to ...
1
vote
3
answers
491
views
Why do I need to provide authentication when accessing a browser's built-in password manager?
Why do I have to provide authentication when I want to read a password stored in my own web browser while I have to do nothing to read the same password on a site's login page?
Is my conclusion ...
- 3,689
2
votes
1
answer
246
views
Why would garbage collection be a problem in password managers?
I was reading an infosec user's take on the LastPass data breach and noted something odd in his commentary on another password manager system (emphasis mine)
I have not done a thorough code review, ...
- 3,798
6
votes
3
answers
2k
views
Why are there multiple "Hardcoded Password" Entries in CWE instead of single one?
When I looked up hardcoded password vulnerability in software world, I saw there are three kinds of vulnerabilities. These are that:
CWE-798: Use of Hard-coded Credentials
The Hardcoded Creds ...
- 529
0
votes
2
answers
152
views
What types of software can have "Hardcoded Password" vulnerability?
When I investigated the Google results, the software vulnerability "Hardcoded Password" (cwe-798 & cwe-259) is a vulnerability for IoT devices' software (see: link1) and thick client ...
- 529
0
votes
0
answers
525
views
How to find out which data breach my password was in?
HIBP and my password manager both claim that a password that I am using has been seen in a data leak.
Neither of them provide information about which data leak exactly my password was seen in.
The ...
- 101
1
vote
1
answer
375
views
Password restrictions limit Diceware word list - (when) can this get bad enough one should choose another strategy?
Besides “your password must contain this” complexity requirements, some places also have “your password must not contain this” rules, sometimes with fairly short substrings of the username, a day of ...
- 235
15
votes
4
answers
8k
views
Can 777-characters long passphrase be considered too short?
Is Rumkin.com's password tool a reliable tool for password strength checking?
I am asking because:
I am getting confusing suggestions:
(the password in this example is 777 characters long)
D. W.'s ...
- 3,689
3
votes
3
answers
614
views
Why removing just one letter form passwords makes it 20x easier to break according to zxcvbn test
Since I am a decent fan of the XKCD no 936 (or actually conclusions and implications it brings), I wanted to test (using try zxcvbn) the complexity and the possiblity of breaking a password like the ...
- 3,689
1
vote
0
answers
139
views
Resetting a well-protected Google account password
Situation: a new client came to me because of a torrent of identity theft issues. One of the issues: several of their Google accounts were having their passwords changed every few days. Each time, ...
0
votes
1
answer
158
views
Is it a security risk to require passwords to be unique across all users? [duplicate]
More specifically, if Bob Smith uses 123456 as his password, no other user in the system can use 123456. This seems like a security risk to me. Technically, if someone knew something about Bob (he ...
- 11
9
votes
3
answers
4k
views
Can an SSH server in password mode be impersonated if I ignore the fingerprint warning?
Assume that I never check the server fingerprint when logging in to an SSH server. This means that certain configurations of SSH can be impersonated. For example, I can log into a server that only has ...
- 389
0
votes
1
answer
228
views
My Bank Enforces A 6 Character Limit On Passwords. Is This Bad? [duplicate]
A bank I (previously) used in Australia forced users to comply with a 6-character limit on every password. Specifically, the rules were:
6 characters exactly, including at least 1 number and letter
...
- 101