Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
4,067 questions
50
votes
5
answers
6k
views
Should a bank be able to shorten your password without your involvement?
The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore.
He called his advisor, who ...
- 601
1
vote
1
answer
190
views
Is there a way to store a verification-hash of a secret on a 'consumer HSM' like Yubikey or another WebAuthn device?
Context: I'm trying to design an SRS solution for your personal secrets - "Anki for passwords." (This is mostly a learning-exercise, to help me develop my intuition for writing secure(-ish?) ...
- 285
2
votes
3
answers
225
views
Why does having default router credentials pose a risk? [duplicate]
When I got to 192.168.0.1/login I am greeted with my router login page and can go change some settings. Now let's say I still have the factory default login something like "admin", "...
3
votes
2
answers
260
views
How do I remember passwords for environments where Password Manager is not available?
I am a big fan of 1Password. And I try to save my passwords in 1Password as much as possible.
However, there are environments where 1Password cannot be used. That is the password to protect 1Password ...
user284652
0
votes
4
answers
740
views
Is it safe for my password hint to be synonymous to my password?
Lets say my password is AppleDogFire642!.
What would be the potential security consequences if my password hint was BananaCatSmoke123@?
- 635
1
vote
3
answers
445
views
Asymmetric encryption of user's data
I got to thinking this morning over my coffee, that it would be nice if I could encrypt data for a Tenant with one key, and decrypt it with another key. In such a way that only a logged in User can ...
- 115
11
votes
4
answers
4k
views
Wi-Fi with guest network
I use an old AirPort Extreme to provide WiFi in my home. It provides a 2.4 and 5.0 GHz network with a good password, only available to me and my wife. It also provides a separate guest network without ...
- 2,727
0
votes
1
answer
68
views
Can an email address be added to "Forward To" list in cPanel without accessing the cPanel?
My company is using cPanel emails, recently while reviewing email forwarders, I noticed an email in the "Forward To" list that our sales email is being forwarded to it and that was unknow to ...
- 1
1
vote
1
answer
268
views
Is it secure to expose a salted bcrypt hash IF it is maximum length random secure password?
Is it secure to expose a salted bcrypt hash (minimum 14 cost) if the used password is 72 characters (maximum) byte long, randomly generated letters, numbers, and special characters using secure ...
- 13
1
vote
0
answers
260
views
Unknown Hash Type [closed]
During a CTF, I came across a certain hash type which can't be identified by various tools (hashID, crackstation, hashes.com, etc.)
The data is as so:
- Plaintext : abc123
- Hash : ...
- 11
1
vote
1
answer
140
views
Web app architecture- set a new password for a on-premises AD setup
I need to implement a web app for a self-service change password use case for on-premise Active Directory users,
which is accessible over the internet.
The service must allow the users to set a new ...
- 111
3
votes
3
answers
603
views
Is a sufficiently long password unsafe just because it only consists of 2-3 letter long mixed-case dictionary words and numbers?
Entropy/Length/Complexity of a password is pretty straight forward and cant really vary much.
For Dictionary Similarity, i would assume that a software just checks how many characters in a password ...
- 339
3
votes
1
answer
3k
views
BLAKE-3 vs SHA-256 security
As we can see on this page, BLAKE-3 is about 14 times faster than SHA-256. Is it as safe as SHA-256? I would like to use it for my passwords which are 32 cryptographically random bytes, because my API ...
- 381
10
votes
6
answers
6k
views
What is the best way to calculate true password entropy for human created passwords?
Okay, I know it might seem this has already been beaten to death but, hear me out. I am including a fairly good password strength algorithm for my app for users on sign-up. This one, which I've copied ...
- 261
1
vote
3
answers
601
views
SHA256 for hashing 32 cryptographicaly random bytes
I need to hash 32 cryptographically random bytes, but later the verification the value with hash must be very fast, so I decided to use SHA256. Is it a security issue if my passwords are 32 ...
- 381
16
votes
4
answers
5k
views
Should one reject login attempts when the correct password is newly added to a password deny list?
Best practices say that when users choose a password (at signup or when changing an existing password), the application should reject that password if it appears on a list of passwords known to be ...
- 337
1
vote
0
answers
250
views
Amnesia and death proof master password
I have been thinking about how to store my master passwords (password manager, email and device passwords) for quite a while and I just haven't been able to come up with a satisfying solution yet. I ...
- 11
1
vote
3
answers
683
views
Should password strength validation also be run server-side or only client-side?
Personally, I think that it's not so important to check the strength of the passwords on server-side, since, if the user evades the validation on the client side, it would be their responsibility to ...
- 13
0
votes
0
answers
198
views
KDF vs hash function in loop for hashing password
I'm trying to grasp which benefit can KDF like PBKDF2, scrypt and bcrypt (I know that bcrypt is technically not KDF) may bring over hashing in loop like sha256sum(sha256sum(sha256sum.....(salt + ...
- 423
2
votes
2
answers
841
views
Why PAKE or Zero-knowledge password proof didn't replace sending a password via HTTPS
Technologies like Zero-knowledge password proof and PAKE seems to be pretty mature but almost all modern web-sites still send passwords over HTTPS to check authentication. At first glance, this ...
- 423
1
vote
1
answer
151
views
Does Google share it's international database of search queries with LEA agencies for purposes of breaking encryption?
So, suppose a person accidentally typed their complex encryption password into Google search. They weren't logged in to any Google services so the search was anonymous, and they continued to use this ...
- 11
3
votes
1
answer
435
views
Why banks require such a low password entropy for web/app access?
Many banks I have worked with require between 4-6 characters passwords. Some even force to use only digits.
Such a poor password is protecting your financial information, because MFA is usually not ...
user15194
1
vote
3
answers
189
views
Why don't applications suggest passwords themselves?
Imagine a web app that, on the login page, has a password field which does not allow user input, but just displays a client-only generated password that is reasonably strong, with a button to re-...
- 227
0
votes
1
answer
466
views
Burp Suite: alphanumeric payload decoded to base64 exposes password, but as an encoded string
I'm learning Web Pentesting using Juice Shop and I successfully used Burp Suite to generate an SQL injection payload in the repeater that exposed the plain text email and encoded password of the admin....
- 101
0
votes
1
answer
2k
views
Offline One Time Password algorithm
Sometimes when we login in some services we should enter One Time Password or OTP that can be received via SMS, e-mail or a voice call.
Among these options, there are some mobile apps that can ...
- 103
1
vote
2
answers
109
views
Autogenerated PINs
PINs secured by TPM or similar hardware are secure even if short and only numeric because the TPM can throttle and lock after several attempts. I'm concerned about PIN reuse. I suspect most people are ...
- 181
5
votes
2
answers
1k
views
Why did WebAuthn beat PAKEs as the preferred password replacement?
Apple and now Google are releasing products that are built on WebAuthn as a replacement for traditional username + passwords. Why did this technology beat out PAKEs?
- 514
2
votes
1
answer
983
views
Is the Web Crypto API secure when the server is trusted?
I've heard a lot of people say that the Web Crypto API is not very safe. For example: https://tonyarcieri.com/whats-wrong-with-webcrypto, Problems with in Browser Crypto. However, I'm looking to use ...
- 73
4
votes
1
answer
619
views
Why would websites ask users to reauthenticate after a password change?
I was discussing with a non-IT friend after he came to me with a question regarding security and password change.
As he puts it: "Why do websites ask me to re-authenticate after a password change?...
- 1,538
0
votes
1
answer
132
views
Using Single Sign-On and the usage of password managers is discouraged. Whay are alternatives for storing tokens for example?
What are the alternatives of storing tokens when password managers are discouraged?
Some of the ideas that come to my mind are storing in a text file and encrypting with GnuPG but that's asks for ...
- 293
1
vote
0
answers
124
views
Why is not there encrypted way of sharing/showing data such as Password to the user (hidden from web app Source code)?
I wonder if there will be (or is) a way to hide data such as passwords from the HTML/DOM structure? As, password fields can hide from external person other than the main user with something like "...
- 11
32
votes
3
answers
9k
views
Why are PIN codes usually of even length (4 or 6)?
A huge problem is PIN guessing from birthdays (dd/mm/yy lends to a 6 digit number that is easily guessed, dd/mm/yyyy for 8 digits). It's very often that a PIN number is taken from someone's birthday ...
- 429
0
votes
0
answers
46
views
On the gains and losses of an additional client side stretching of the user password [duplicate]
Picture a state of the art implementation of a website registration and login system.
I'm interested in analyzing what a defender gains and loses by feeding the user password to a key-stretching KDF ...
- 1,275
1
vote
1
answer
116
views
Reuse credentials if same data in same security environment
We're managing a shared hosting environment of Wordpress websites on a web server.
Each site has its own database password and FTP password, both are randomly generated and stored in AWS ...
- 345
1
vote
2
answers
308
views
How does /dev/random not leak future bytes from old ones
I want to generate 6 random words using Wiktionary and random numbers from /dev/random. I'll get a random number with /dev/random and then use the word from that index.
I know /dev/random should be ...
- 13
1
vote
0
answers
243
views
Can OTPs substitute password? [duplicate]
One-time passwords (OTPs) usually serve as the 2nd factor in a 2FA scheme. But, in isolation, I believe they are more secure than passwords, since they are ephemeral and passwords are still badly ...
- 121
0
votes
0
answers
35
views
Does having the hash make it easier to crack the password than not having the hash? [duplicate]
For example, a password hash is: edgjcgo4866864rfhobd38790g764hkp
Does having the hash of the password make it easier for the attacker to crack the password than not having the hash?
If yes, why does ...
25
votes
6
answers
9k
views
Is a sha256 hash of a unix timestamp a strong password
I am setting up a postgres db that will never be used by humans. In fact, I really don't need to know it myself ever. I assumed that just using a 256bit(64 alphanumeric chars) hash of a unix timestamp ...
- 497
0
votes
1
answer
166
views
Why is it not possible to override password hashes
I know that a password is stored as a hash, because then it is not possible to get the password even if you have access to the password database/file/...
But if you have access, couldn't you just ...
0
votes
1
answer
141
views
Cryptographic hash functions and personal password management [duplicate]
Background: I've always reused same username/password on all websites and got hacked regularly. I am considering using a password manager, but I don't like the need of storing a database. So I came up ...
- 103
1
vote
2
answers
1k
views
Is it unsecure to use only a passphrase in luks for whole system partition encryption?
When I use only a passphrase in LUKS for my whole system partition encryption, so I need to insert a password to decrypt my system partition to boot up my OS, is this unsecure and can it be cracked ...
- 129
9
votes
1
answer
7k
views
PAT vs. SSH - Why Bother with SSH?
Are there any advantages to using SSH keys vs. a PAT when interacting with a site like Github?
Github claims SSH keys are a way to not have to enter your username + password (personal access token) ...
- 212
0
votes
0
answers
2k
views
Best practices for storing passwords for PHP and MySQL applications [duplicate]
I am creating a simplified lead and call management system for a friend's small business.
I would like to know the best practices for hardening password storage and verification using PHP 7.4 and ...
1
vote
1
answer
1k
views
Storing password in config file - best practice
I am configuring an application server hosted on EC2 instance to send e-mail notifications.
This requires configuring SMTP settings and storing them, including password, in a config file:
gitlab_rails[...
- 11
1
vote
0
answers
154
views
Displaying a user's password in plaintext on login pages. Why is this practice becoming more widespread? [duplicate]
Over the years I've noticed that more and more login pages implement an eye icon next to the password field, that on click toggles between hidden and plaintext view of the password typed in that field....
- 111
4
votes
2
answers
2k
views
What will happen if I accept this "Change your search setting to: smartwebfinder.com"?
When I want to install Ultrasurf extension it gives me this message:
So I do not understand what this "Change your search setting to: smartwebfinder.com" wants to do.
When I go to this ...
- 41
0
votes
2
answers
8k
views
Fastest way to brute force SSH
I'm doing a CTF on vulnhub and I need to brute force SSH. I've got 6 usernames and 15.000.000 passwords to try so I'm brute-forcing with hydra by running
hydra -L users.txt -P $LIST/rockyou.txt -t 64 -...
1
vote
2
answers
414
views
Is a very long and random password theoretically immune to password cracking?
Suppose a password’s stored hash is exposed in a theoretical mass security breach of a popular service given the following assumptions:
The password is very long (30+ characters)
The password uses a ...
0
votes
1
answer
482
views
Make certificate and private key available only to a single app
I want to make a smart card reader app, that sends read data to a server. In order to be certain in the integrity of the data, I want to use a client certificate to communicate with the server and I ...
- 11
2
votes
0
answers
280
views
How are the values of stored firefox credit cards encrypted? And how does one decrypt those?
While researching about the safety of web browsers I made my own program that can decrypt stored credentials, cookies, and other information of different browsers to see for myself how easy it is.
...
- 21