Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
4,067 questions
55
votes
1
answer
44k
views
Why use an authentication token instead of the username/password per request?
The author of https://stackoverflow.com/a/477578/14731 recommends:
DO NOT STORE THE PERSISTENT LOGIN COOKIE (TOKEN) IN YOUR DATABASE, ONLY A HASH OF IT! [...] use strong salted hashing (bcrypt / ...
- 2,169
54
votes
5
answers
16k
views
Is it bad practice to prefix my hash with the algorithm used?
Let's say I have a database with a bunch of users in it. This user database would typically have a hashed password per user. Would it be bad practice to prefix this hash with the hashing algorithm ...
54
votes
4
answers
58k
views
Is using SHA-512 for storing passwords tolerable?
I know that the best options to use for storing passwords are bcrypt/PBKDF2/scrypt.
However, suppose you have to audit a system and it uses SHA-512 with salt. Is that "fine"? Or it is a vulnerability ...
- 1,233
54
votes
7
answers
10k
views
Is it possible to determine password strength without knowing the password?
I have just got some report of a penetration test and one of the recommendations was to strengthen passwords. I however realized that no passwords were provided for the testers, and I wanted to find ...
- 653
54
votes
3
answers
11k
views
Secret salts; why do they slow down attacker more than they do me?
When studying Dan Boneh's slides for 'Session Management and
User Authentication' (2011) he mentions 'secret salts' on the slide 'Further defences' (slide 48 out of 58).
He suggest to store in the ...
- 593
54
votes
4
answers
23k
views
Is Diceware more secure than a long passphrase?
I recently investigated best-practices in regards to passwords, and the overwhelming majority of sources recommended using a password manager. This is great advice, but not usable in every situation. ...
user163495
54
votes
11
answers
8k
views
Is there a method of generating site-specific passwords which can be executed in my own head?
I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
- 803
54
votes
4
answers
13k
views
Password manager vs remembering passwords
I have always thought that you are not supposed to use a password manager but to keep your passwords in your head, but lately I have thought about the pros and cons of having a password manager.
Some ...
- 1,672
53
votes
4
answers
11k
views
Why would a password be hashed before being used to encrypt something?
When reading some documentation about the security of a product, I found that the vendor uses the SHA-2 of a password to encrypt data (AES-256), instead of using this password directly.
Are there any ...
- 9,088
53
votes
10
answers
6k
views
Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?
I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
- 631
53
votes
5
answers
73k
views
How does an attacker get access to hashed passwords?
The way that we hash passwords and the strength of password is important because if someone gets access to the hashed passwords, it's possible to try lots and lots of passwords in a surprisingly short ...
- 3,099
53
votes
8
answers
6k
views
You're an IT consultant. Should you discourage a client from telling you their password?
I'm an IT consultant. One client has known me for a few years. He wants me to do some work on his kids' laptop again. I'll need to log into his kids' Windows user account. (I'm guessing that multiple ...
53
votes
4
answers
23k
views
Why is using salt more secure?
Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
- 1,405
53
votes
3
answers
20k
views
Is a password in the clipboard vulnerable to attacks?
I see situations where you may have to input the same password more than once. You may type it in a text editor and copy it to clipboard, to paste it two or more times.
In what scenarios this could ...
- 3,089
52
votes
12
answers
28k
views
Is it bad to use special characters in passwords? [duplicate]
I'm trying to find the best degree of entropy for a password template, and after carrying out several tests, the best result came from this: à.
This symbol alone adds 160 characters to the set (...
- 655
52
votes
7
answers
15k
views
What are the cons of stateless password generators?
Does anybody have hands-on experience with stateless password generators (managers) like Getpass?
It seems like it does most of the work of cloud password managers, but leans more to the security ...
- 631
52
votes
10
answers
18k
views
Is using haveibeenpwned to validate password strength rational?
I have been hearing more and more that the haveibeenpwned password list is a good way to check if a password is strong enough to use or not.
I am confused by this. My understanding is that the ...
- 935
52
votes
5
answers
11k
views
How can I know that developers will be ethical and not record my password in plaintext
I am not asking why hashing should be done. Instead, I want to know how to prevent that developers record user passwords to hack their user's other accounts, especially their email.
Couldn't they ...
- 625
52
votes
6
answers
11k
views
Why does one need a strong password on Unix?
SSH Server: I only allow public-key authentication.
Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
- 819
52
votes
6
answers
9k
views
Why do some sites block pasting into username or password input fields?
I use a few websites that prevent me from copying & pasting into the username or password fields. It's quite frustrating when using a password manager, and if anything I'd think it discourages ...
- 1,163
52
votes
5
answers
95k
views
SSH key auth, but still need password for sudo?
SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive ...
- 621
51
votes
6
answers
10k
views
How valuable is secrecy of an algorithm?
On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
- 83.8k
51
votes
4
answers
12k
views
Is it good practice to ban an IP address if too many login attempts are made from it?
Since an IP address does not necessarily represent a specific device, but probably a whole network/company/etc. does it at all make sense to block an IP address if there is a significant amount of ...
- 819
51
votes
9
answers
12k
views
Can users make use of a password manager when banks tell them never to write passwords down?
Consider a user who wants to use a password manager for their banking passwords. Advice from banks usually says they should never write down their password. The user would be concerned about going ...
- 34.7k
51
votes
3
answers
6k
views
Security Review - password_hash implementation for PHP
I'm currently working on a "helper function" for PHP's core to make password hashing more secure and easier for the majority of developers. Basically, the goal is to make it so easy, that it's harder ...
- 1,426
50
votes
11
answers
19k
views
Is there a good way to store credentials outside of a password manager?
A lot of the users in my company are using their agendas to write down their password and usernames, or Excel sheets with a protected password. I'm hesitant to install software for password management ...
- 589
50
votes
11
answers
17k
views
Confused about using a password that "would take centuries to break"
I am talking about this password - 23##24$$25%%26 and the similar ones consisting of special characters appearing in a pattern, which the users these days use a lot.
At work (finance company), I was ...
- 835
50
votes
7
answers
15k
views
Is this password scheme legit?
I received an invitation for an IT security fair (https://www.it-sa.de/en).
They additionally delivered a password "Kryptonizer". That is a little card to hang on your keychain with the following (...
- 619
50
votes
4
answers
6k
views
Why submit a website to plaintext offenders?
I've read this question and to quote from the accepted answer
Besides that, by submitting the site to plaintext offenders, you will provide a third-party point of view, which might help your case.
...
- 543
50
votes
5
answers
6k
views
Should a bank be able to shorten your password without your involvement?
The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore.
He called his advisor, who ...
- 601
50
votes
3
answers
8k
views
Why would a password requirement prohibit a number in the last character?
In configuring a new system today (Juniper Space, Linux-based Network Management platform), I came across a bizarre password requirement that I'm curious about. Upon logging into the web UI with the ...
- 3,417
50
votes
7
answers
5k
views
Is the option to jump to blanks in password fields a security risk?
Using Ctrl + ← / →, it's a common behavior across different operating systems to jump from word to word (or from blank to blank) in text input fields.
Now I've discovered that this also applies on ...
- 679
49
votes
11
answers
13k
views
Why are only passwords hashed?
I just learned a few things about hashing algorithms – MD5 and SHA-1. So, if I am not wrong passwords are hashed so that in a rare situation of your database being compromised a hacker can not see all ...
- 625
48
votes
5
answers
72k
views
openssl: recover key and IV by passphrase
A large amount of files were encrypted by
openssl enc -aes-256-cbc -pass pass:MYPASSWORD
Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
48
votes
4
answers
13k
views
What to transfer? Password or its hash?
Let's say in my database I store passwords hashed with salt with a fairly expensive hash (scrypt, 1000 rounds of SHA2, whatever).
Upon login, what should I transfer over the network and why? Password ...
- 755
48
votes
3
answers
13k
views
Is there any advantage to splitting a password?
I've been reading about the LANMAN (LM) hash and I'm curious about a particular part of the algorithm.
The LM hash is computed as follows:
The user’s ASCII password is converted to uppercase.
This ...
- 6,821
48
votes
5
answers
11k
views
Should I log that a user changed their password?
Are there any security concerns with logging that a user changed their password? I'm already logging whenever an admin changes a users password for audit purposes, but is there a reason to not have a ...
- 561
48
votes
1
answer
10k
views
Facebook password lowercase and uppercase [duplicate]
Recently I logged into my Facebook account and then noticed that my caps lock was on. So I tried to log in again with and without capslock on. I got in both times. Then I tried to log in with the ...
- 639
48
votes
2
answers
27k
views
HMAC - Why not HMAC for password storage?
Nota bene: I'm aware that the good answer to secure password storage is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding.
Let's say ...
user2122
47
votes
6
answers
5k
views
"Real" Salt and "Fake" Salt
During a Q&A period at DEFCON this year, one member of the audience mentioned that we're using "fake salt" when concatenating a random value and a password before hashing. He defined "real salt" ...
- 38.6k
47
votes
2
answers
10k
views
Are there more modern password hashing methods than bcrypt and scrypt?
This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt.
What I'm wondering is if there are any "...
- 2,928
47
votes
4
answers
25k
views
What should be used as a salt?
I always hear that it is best to use salts on top of stored passwords, which then somehow gets concatenated and hashed afterwards. But I don't know what to use as a the salt. What would be a good salt?...
- 641
47
votes
3
answers
18k
views
Should password reset tokens be hashed when stored in a database?
Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in.
If I can get a valid password reset token ...
- 1,177
47
votes
4
answers
19k
views
Security of passphrase-protected private key
If an attacker obtains a private key that was created with no passphrase, he obviously gains access to everything protected with that key. How secure are private keys set up with a passphrase? If an ...
- 13.2k
46
votes
12
answers
15k
views
Is it better to use an unsuitable hashing algorithm instead of none at all?
I have to store passwords on a system which doesn't offer any of the algorithms recommended for hashing passwords (e.g. bcrypt, scrypt or PBKDF2). Would it be better to use an unsuitable algorithm (e....
- 1,697
46
votes
6
answers
11k
views
User Account with no password
I'm currently job searching, and sometimes I come across sites that are just huge databases full job postings, and before you apply you have to create an account. I came across a site, but I'm ...
user181505
45
votes
3
answers
10k
views
Is bcrypt(strtolower(hex(md5(pass)))) ok for storing passwords? [duplicate]
I have a large database where passwords are stored as strtolower(hex(md5(pass))) (which is a bad way to store passwords, prone to rainbow tables, cheap to dictionary attack, no salt, etc.),
and I'm ...
- 583
45
votes
5
answers
5k
views
Is it safe to tell your users what kind of hashing algorithm you use?
For example, on the user registration page, is it safe to tell people "Your password will be stored as a one-way hash using the (whatever) algorithm."
- 733
45
votes
4
answers
10k
views
Paypal sent an email addressing me with one of my old passwords as my name
I got this email from [email protected], with the title:
Your account has been limited until we hear from you.
I think this is a scam / spoof email because I don't see any notification in my ...
- 562
45
votes
7
answers
33k
views
Is it okay for API secret to be stored in plain text or decrypt-able?
Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
- 2,978