Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
4,067 questions
1
vote
1
answer
315
views
What are the risks of reusing the same passphrase for FDE, user account, and password manager?
Consider a home user who runs Linux on a laptop with full-disk encryption and uses a cloud-based password manager. Assume the laptop is firewall-protected with no SSH access. It seems reasonable to ...
- 19.1k
1
vote
1
answer
151
views
Does Google share it's international database of search queries with LEA agencies for purposes of breaking encryption?
So, suppose a person accidentally typed their complex encryption password into Google search. They weren't logged in to any Google services so the search was anonymous, and they continued to use this ...
CommunityBot
- 1
5
votes
4
answers
561
views
Are there significant problems with a password generation pattern using groups of alternating consonants/vowels?
I'm using a password manager to store unique passwords for all my accounts. Most of the passwords are auto-filled, auto-typed or can be copied and pasted, but occasionally, I have to type them ...
- 146
70
votes
4
answers
10k
views
Does Microsoft's "Password Ban" list insecurely store user passwords?
According to SecurityWeek, Microsoft is banning common passwords, and they will dynamically update their list:
Microsoft says it is dynamically banning common passwords from Microsoft Account and ...
0
votes
1
answer
124
views
How does increasing minimum password length affect the size of password space?
I understand that when there are a possible characters and passwords must be of length n there are an possible passwords.
But usually passwords can vary in length between some minimum and maximum ...
- 9,712
1
vote
1
answer
145
views
Would asking for user input email again in password reset increase security?
I have a workflow like this right now:
User inputs the account email and clicks the "forget password" button
User receives an email containing a link with token for password reset
User ...
- 132k
0
votes
1
answer
301
views
Storing two hashes of same password?
Typically for user passwords we store their hashes and salt alongside in the database - one per user.
I wonder the security implications of hashing the same password twice and storing locally both.
...
2
votes
1
answer
3k
views
Speed up cracking a wpa2.hccapx file in hashcat
I'm trying to do a brute force with Hashcat on windows with a GPU cracking a wpa2.hccapx handshake. Based on my research I know the password is 10 characters, a mix of random lowercase + numbers only
...
CommunityBot
- 1
0
votes
1
answer
193
views
2FA implementation security
I am looking to implement 2FA. I know of duo and eg. Eset secure authentication. But both solutions seem to be implemented in a strange way, that is they require some form of communication with either ...
- 52.1k
0
votes
1
answer
1k
views
Hydra only executes one try per task then hangs
As in the title, hydra will only execute one try per task before hanging.
$ hydra -l admin -P /usr/share/wordlists/wfuzz/general/common.txt -u 10.10.68.141 http-post-form "/admin:user=^USER^&...
CommunityBot
- 1
0
votes
2
answers
215
views
Is there any good way of calculating a brain-generated password's entropy?
After reading this post, I understand that a password's entropy depends on the assumptions made when it is to be attacked (e.g. if it is generated randomly from a list of 2048 words, etc.).
Let's ...
- 24k
24
votes
4
answers
7k
views
Does a password policy with a restriction of repeated characters increase security?
A security value called Restriction of Repeated Characters for Passwords (QPWDLMTREP) can be configured in IBM i. If QPWDLMTREP has a value of 1, then "the same character cannot be used more than ...
2
votes
2
answers
285
views
Why do entropies of passwords significantly differ from site to site?
I read the infamous xkcd cartoon comparing two passwords and their strength. Curious whether their calculation was accurate, I searched many entropy calculators and plugged in the two examples from ...
- 22.9k
0
votes
0
answers
153
views
What is the most resistant way to unlock a device
The standard way to unlock a device is with a password. TPMs have improved this to the point that we can create devices that can be unlocked with very short passwords such as PINs and we can create ...
- 132k
1
vote
1
answer
2k
views
What can I do to improve my Keepass XC setup?
I'm planning on using KeePass XC for the first time and am trying to create a setup that:
(1) would prevent hackers from stealing my passwords
(2) would prevent me from losing access to my ...
CommunityBot
- 1
14
votes
2
answers
5k
views
Reasoning behind banning '#' from the start of passwords? [duplicate]
Today, on an official government website, I came across the following password rules:
"Your password has to be at least 8 characters long. It can't have any blank spaces. It has to use characters ...
- 101
171
votes
13
answers
111k
views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
- 117
-1
votes
1
answer
6k
views
How to run .exe on windows startup without having admin access? [closed]
I want to know how to bypass the requirement of an admin user in order to have a program run upon windows startup.
- 52.1k
0
votes
1
answer
187
views
Security of using Yubikey to derive Diceware password?
I bought a new Yubikey, and am currently setting it up to use on my desktop PC. Previously the PC was secured with password only, and I'd like to use the Yubikey as an alternative: instead of using ...
- 1,135
1
vote
1
answer
127
views
Sudo user without ability to login
I have a main user with home folder encryption enabled. To avoid typing long phrase each time I want to have another user with sudo privilege and weak password.
In the terminal I would first switch ...
- 121
4
votes
2
answers
2k
views
Is it safe to leave MySQL root user without a password if it uses auth_socket?
Since MySQL 5.7, the root user is configured to use the auth_socket authentication plugin instead of a password.
Is it safe to leave the root user that way (without a password)?
- 1,827
1
vote
0
answers
1k
views
Tool to Decrypt Chrome, Firefox and Edge login information [closed]
Im new to python but Ive created a couple of programs that can collect the user credentials for Google Chrome, Mozilla Firefox and Microsoft Edge and decrypt them then save the decrypted output to ....
- 132k
1
vote
3
answers
615
views
How do websites check that password hashes saved in the database are the same as passwords hashed client-side?
How do websites check that password hashes saved in the database are the same as passwords hashed and sent by a client?
I know that client-side hashing is not secure.
- 101
0
votes
1
answer
255
views
How does this app "hash" their passwords with MD5, but still know the plain-text?
There is a public application that has terrible security practices. When performing an API call to such application, and succesfully logging in, it will return a "user" JSON that includes ...
CommunityBot
- 1
1
vote
0
answers
30
views
Argon2 is worse than bcrypt at runtimes < 1000 ms? [duplicate]
While Argon2 seems to be recommended for password hashing, based on this twit Argon2 is worse than bcrypt at runtimes < 1000 ms.
Based on this answer:
You should tweak the parameters to your own ...
- 111
10
votes
2
answers
7k
views
Is this a secure way to generate passwords at the command line?
Occasionally I need to generate a password while working at the Unix command line. I have the following alias in my zshrc:
alias randpass='openssl rand -base64 32 | tr -d /=+ | cut -c -30'
These ...
- 192
0
votes
0
answers
109
views
How could one use multi-factor authentication to derive a static secret key?
Scenario:
The setup is that each user has a randomly generated key A used for encrypting data stored on the server and a password-derived key B used to store A on the server without the server getting ...
- 647
0
votes
2
answers
301
views
How to reuse PIN codes in the most secure way?
I've made a list of the services/devices that require a PIN code. Shockingly, it's over 10, which I find impossible to remember, so I need a strategy to reuse the codes.
What could be a strategy for ...
0
votes
1
answer
119
views
Practicalities, implementation, and weaknesses of simple symmetric encryption for plain text files
For about 20 years, I've been using gnupg to encrypt a plain-text file containing my passwords. (The actual per-site passwords are generated using a hash function.) It's worked OK for me, but gnupg is ...
- 52.1k
1
vote
2
answers
1k
views
Is it secure to store my mysql password in a const std::string?
I am implementing a C++ server with a mariadb backend. I have to access my database and I do so using the mariadbpp (its c++ connector). Though I can use mysql_config_editor and store the passwords in ...
- 11
1
vote
1
answer
145
views
Why is it a bad idea to accept passwords one character at a time for an authentication mechanism?
For the purpose of my studies, I am trying to answer the below scenario, in my opinion it is not a good idea, because it would leave the system open to brute-force attacks.
A novel password scheme is ...
- 132k
11
votes
4
answers
1k
views
Why do salts for hashing passwords need to be globally unique, not just system/site-unique?
I was reading an answer by Terry Chia to another question about the requirements for a salt, in which he/she (among others) specified that salts need to be globally unique, but don't go into any ...
- 2,727
0
votes
3
answers
218
views
How to analyze the security of a custom passphrase?
Let's assume person A chooses 15 words for a passphrase with an average length of 5. The passphrase meets following conditions.
Word conditions:
The first word is not a valid word and can't be found ...
- 12.6k
36
votes
4
answers
36k
views
Can password-protected zip files be broken without brute force?
You have a zip file that you created with 7z to password-protect it with AES 128. Can a smart adversary extract the data only through brute force, or is the file vulnerable to other attacks - such as, ...
- 1
30
votes
4
answers
9k
views
Security of LastPass together with YubiKey
I'm looking at password manager solutions and came across LastPass. I see that they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What ...
- 132k
5
votes
1
answer
1k
views
Non English password dictionaries [closed]
What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
- 132k
2
votes
1
answer
334
views
RAR archive password recovery
Hello guys is there some tool or methodic to get into let's say 12 years old RAR file.
I tried Kraken CMD tool and dictionary attack but it will take ages goes through all passwords.
Unfortunately for ...
CommunityBot
- 1
6
votes
4
answers
3k
views
Is it safe to store my login credentials in a Veracrypt volume?
I have a list of login credentials (usernames and passwords) that I wanna keep safe. I'm planning to keep it in an encrypted Veracrypt virtual drive with AES, SHA-512, and an 8-character password. Is ...
CommunityBot
- 1
107
votes
14
answers
14k
views
Could keystroke timing improve security on a password?
When I was young, and had just started out in my software-development career 20 years ago, I wrote a little bit of code on my Amiga that took a password, but also recorded (within some threshold), the ...
- 121
4
votes
6
answers
2k
views
Not storing the salt? Is that an option?
Please read as I did many searches and believe this is NOT a duplicate question.
For your reference, I've read these articles and other questions already:
How do you overcome the problem of the salt ...
- 119
2
votes
0
answers
184
views
How is "partial" password reuse determined? [closed]
How do environments like Active Directory determine if you reuse parts of previous passwords in a new password? I understand that it keeps a list of your last passwords, hashed. But how do they ...
- 208k
0
votes
1
answer
148
views
How do password protected files differ from keygen protected software?
From some posts I read here:
Regarding keygen protected software:
As long as the user has full control of the hardware where the software is running on (i.e. typical PC) it is impossible to fully ...
- 208k
53
votes
8
answers
6k
views
You're an IT consultant. Should you discourage a client from telling you their password?
I'm an IT consultant. One client has known me for a few years. He wants me to do some work on his kids' laptop again. I'll need to log into his kids' Windows user account. (I'm guessing that multiple ...
32
votes
3
answers
13k
views
Should I assign my various passwords to my keyboard's macro keys?
I had an idea to assign my keyboard's macro keys to various passwords so I can just hit the key and it will paste in (the passwords are long and random so I won't remember them). This is on a home ...
- 21
45
votes
7
answers
33k
views
Is it okay for API secret to be stored in plain text or decrypt-able?
Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
- 132k
0
votes
1
answer
224
views
Are short password length requirements a security risk? [duplicate]
I visited a website that requires me to create a password. One of the password rules was "7 to 15 letters". Is this a security risk, since many people would now enter a weak password instead?...
- 132k
2
votes
1
answer
1k
views
What is the minimum secure length for gpg -c file.txt?
I want to use gpg -c with a user-generated password that I can easily remember. Are 16 characters enough? for example would a password similar to "I own 32 houses." be bruteforcable?
CommunityBot
- 1
4
votes
1
answer
4k
views
Recovered a 7z password with hashcat, but it's not the right one
I am trying to recover a 7z file, but have forgotten the password. It's completely AES-256 encrypted (i.e. not even the filenames are available).
Steps:
Generated hash file with 7z2hashcat.pl
Ran a ...
- 41
23
votes
2
answers
5k
views
Why is 1Password sign-in to new device secure without MFA?
I'm trying to understand why it's not necessary with MFA in 1Password when signing in to a new device.
This was the case that triggered my curiosity:
I created a 1Password account
I downloaded the ...
- 6,655
3
votes
3
answers
1k
views
Is password dependent iteration count a good practice?
I consider the possibility of improving password security by increasing the hashing iteration count for short passwords.
The security benefits I see of this practice are:
Short passwords are better ...
- 185