Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
4,067 questions
44
votes
6
answers
29k
views
Confused about (password) entropy
There seem to be many different 'kinds' of entropy. I've come across two different concepts:
A) The XKCD example of correcthorsebatterystaple. It has 44 bits of entropy because four words randomly ...
- 132k
1
vote
2
answers
214
views
Should I worry? Web hosting mailed me my details and returned my password (unencrypted) and IP logged
Unfortunately, I've tried a hosting service and it returned my password value as it was in my inbox (as connection details).
I went to a control panel in an attempt to delete or deactivate my account. ...
- 52.1k
3
votes
1
answer
3k
views
BLAKE-3 vs SHA-256 security
As we can see on this page, BLAKE-3 is about 14 times faster than SHA-256. Is it as safe as SHA-256? I would like to use it for my passwords which are 32 cryptographically random bytes, because my API ...
- 111
1
vote
1
answer
365
views
Is username + password functionally equivalent to a single login string of the same length?
My intuition is failing me with this. Would it make it easier or harder for an attacker trying to gain access to any of the accounts in a database?
I can see that in the case of a single login string, ...
CommunityBot
- 1
0
votes
1
answer
169
views
Best way to connect to user SSH servers
I have a project that calls users' SSH servers to do some tasks.
For now, I am storing users' passwords at my service as hashed (Username, hashed password and salt), but the SSH password (username, ...
- 12.6k
44
votes
6
answers
34k
views
Length of passwords that are rainbow table safe
With large computing power (like what you can get in the Amazon cloud for example) you can generate huge rainbow tables for passwords. There also seems to be some large rainbow tables reachable that ...
- 1
4
votes
2
answers
3k
views
Where to store a pepper?
Assuming you're using a pepper in your password hashing, where should it be stored? I know you shouldn't store it in the database since it can easily be found there during a dump and the idea is to ...
- 103
-1
votes
1
answer
322
views
How can you calculate the entropy of arbitrary password rules with known distributions? [duplicate]
Many online entropy calculators make certain assumptions (like assuming a password is as rare as the set of random characters that will generate it), or handwave away the math. I want to know how to ...
- 132k
97
votes
10
answers
32k
views
If a provider sees the last 4 characters of my password, can they see it in full?
I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
- 1,038
1
vote
3
answers
491
views
Why do I need to provide authentication when accessing a browser's built-in password manager?
Why do I have to provide authentication when I want to read a password stored in my own web browser while I have to do nothing to read the same password on a site's login page?
Is my conclusion ...
- 1,135
1
vote
1
answer
5k
views
security in banking app with 4 digit pin code and social security number
The new banking app (for norwegian bank Gjensidige bank) for my android handset allows me to log in using only my social security number, and a 4 digit pin code. The social security number in norway ...
CommunityBot
- 1
4
votes
3
answers
464
views
Given Diceware, why does the requirement to contain uppercase, numerics & punctuation in passwords still stand?
Example strong diceware password:
widow stout harvey crest zomba zloty butyl
This password will be rejected by most sites, for example by Outlook.com. (Notable exceptions: Gmail, Stackoverflow, ...
- 19.1k
2
votes
1
answer
695
views
How strong do linux user account passwords have to be when using Full Disk Encryption (FDE) too?
Suppose a non-root user was compromised over remote by malware that is now using su (tty or similar) trying to login as root, trying every possible password by bruteforcing.
assume: full disk ...
CommunityBot
- 1
6
votes
3
answers
2k
views
Why are there multiple "Hardcoded Password" Entries in CWE instead of single one?
When I looked up hardcoded password vulnerability in software world, I saw there are three kinds of vulnerabilities. These are that:
CWE-798: Use of Hard-coded Credentials
The Hardcoded Creds ...
- 529
-1
votes
2
answers
154
views
Sign-up/Login/Password reset - Is this a good and secure solution?
I'm working with a dev agency for a web-based platform. Here is how they are planning to handle sign-ups on the platform as well as log-in and password reset.
Is it a good, robust and secure solution?
...
- 132k
2
votes
1
answer
246
views
Why would garbage collection be a problem in password managers?
I was reading an infosec user's take on the LastPass data breach and noted something odd in his commentary on another password manager system (emphasis mine)
I have not done a thorough code review, ...
- 132k
0
votes
2
answers
152
views
What types of software can have "Hardcoded Password" vulnerability?
When I investigated the Google results, the software vulnerability "Hardcoded Password" (cwe-798 & cwe-259) is a vulnerability for IoT devices' software (see: link1) and thick client ...
- 12.6k
0
votes
0
answers
525
views
How to find out which data breach my password was in?
HIBP and my password manager both claim that a password that I am using has been seen in a data leak.
Neither of them provide information about which data leak exactly my password was seen in.
The ...
- 101
3
votes
3
answers
614
views
Why removing just one letter form passwords makes it 20x easier to break according to zxcvbn test
Since I am a decent fan of the XKCD no 936 (or actually conclusions and implications it brings), I wanted to test (using try zxcvbn) the complexity and the possiblity of breaking a password like the ...
- 12.1k
5
votes
2
answers
2k
views
How Are Google Chrome Synced Passwords Encrypted If I Can Reset the Password to My Account
Services like Dashlane and Bitwarden are unable to decrypt your passwords without your Master Password.
So, how does Chrome do it when they also state that your passwords are encrypted using your ...
- 136
1
vote
1
answer
375
views
Password restrictions limit Diceware word list - (when) can this get bad enough one should choose another strategy?
Besides “your password must contain this” complexity requirements, some places also have “your password must not contain this” rules, sometimes with fairly short substrings of the username, a day of ...
- 12.6k
15
votes
4
answers
8k
views
Can 777-characters long passphrase be considered too short?
Is Rumkin.com's password tool a reliable tool for password strength checking?
I am asking because:
I am getting confusing suggestions:
(the password in this example is 777 characters long)
D. W.'s ...
0
votes
2
answers
354
views
Is it possible to design a system with two passwords?
Is it possible to design a system with two passwords prompts?
The system will have to prompt for two passwords
The system would have to validate first password before prompting for second password
...
672
votes
4
answers
337k
views
Do any security experts recommend bcrypt for password storage?
On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
- 1
2
votes
2
answers
183
views
Rationale behind disallowing the use of similar passwords?
I recently had to change my password on a linux server (RedHat). It wouldn't let me use my password of choice because it was "too similar" to my previous password. Is this really ...
- 2,727
1
vote
0
answers
139
views
Resetting a well-protected Google account password
Situation: a new client came to me because of a torrent of identity theft issues. One of the issues: several of their Google accounts were having their passwords changed every few days. Each time, ...
- 132k
0
votes
1
answer
158
views
Is it a security risk to require passwords to be unique across all users? [duplicate]
More specifically, if Bob Smith uses 123456 as his password, no other user in the system can use 123456. This seems like a security risk to me. Technically, if someone knew something about Bob (he ...
- 16.5k
9
votes
3
answers
4k
views
Can an SSH server in password mode be impersonated if I ignore the fingerprint warning?
Assume that I never check the server fingerprint when logging in to an SSH server. This means that certain configurations of SSH can be impersonated. For example, I can log into a server that only has ...
- 1,241
0
votes
1
answer
228
views
My Bank Enforces A 6 Character Limit On Passwords. Is This Bad? [duplicate]
A bank I (previously) used in Australia forced users to comply with a 6-character limit on every password. Specifically, the rules were:
6 characters exactly, including at least 1 number and letter
...
CommunityBot
- 1
50
votes
5
answers
6k
views
Should a bank be able to shorten your password without your involvement?
The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore.
He called his advisor, who ...
- 105
1
vote
1
answer
2k
views
What is the plaintext password of 'hash part 1' in the shadow file?
In Immersive Labs lab "Password Hashes II"
What is the plaintext password of 'hash part 1' in the shadow file?
shadow.txt contains:
part1:$6$WJ9Y7LHr$S3SdnPsXhCzHetPz0CL6TL7gZdeVK/...
- 132k
11
votes
5
answers
2k
views
My ISP shows my WiFi password on their public site in plain text. Should I be worried?
I recently noticed that when logged into my ISPs (Spectrum) public, external site that can be accessed outside my network, I can see my home network's WPA2 password in plain text.
This clearly means ...
- 2,490
13
votes
3
answers
1k
views
Is it okay to normalize unicode passwords with NFC/NFD?
I am currently designing a login for a web service. I will use a PBKDF2 implementation for hashing the passwords.
However, I intend to allow unicode for passwords, as I will have international users, ...
- 143
1
vote
1
answer
382
views
What’s the best way to only allow a file to be opened with multiple people’s authorisation?
Is there software available that makes it easy for multiple authorisations to be required before a file can be opened? The simplest solution I've found online is to encrypt a file with a password, ...
CommunityBot
- 1
1
vote
1
answer
190
views
Is there a way to store a verification-hash of a secret on a 'consumer HSM' like Yubikey or another WebAuthn device?
Context: I'm trying to design an SRS solution for your personal secrets - "Anki for passwords." (This is mostly a learning-exercise, to help me develop my intuition for writing secure(-ish?) ...
- 2,077
1
vote
1
answer
1k
views
Fully-secured screen lock in Ubuntu with encryption
I have Ubuntu 19.10 with full disk encryption. The encryption is effective as long as the system is turned off or restarted. Otherwise the data is unencrypted behind a locked screen which may not be ...
CommunityBot
- 1
1
vote
2
answers
503
views
Strange activity on my computer, possibly hacking?
So yesterday I got on my computer and changed my desktop, the next day I got on my computer and it froze so I rebooted it. But when I did my desktop background had changed and when I went on google ...
- 115
52
votes
7
answers
15k
views
What are the cons of stateless password generators?
Does anybody have hands-on experience with stateless password generators (managers) like Getpass?
It seems like it does most of the work of cloud password managers, but leans more to the security ...
- 14.7k
2
votes
5
answers
3k
views
What are the possible rules to identify password sharing- to prevent fraud
I am trying to build correlation/ potential red flag rules to detect if passwords are being shared or stolen... the primary driver for this is guidance from our compliance team, that much of our ...
- 11
24
votes
4
answers
25k
views
How to properly create a password reset token?
I searched for a long time, and never really find any articles or posts that fully explain how a password reset token should be created.
What I know so far:
It should be random.
Its hash should be ...
- 113
3
votes
2
answers
260
views
How do I remember passwords for environments where Password Manager is not available?
I am a big fan of 1Password. And I try to save my passwords in 1Password as much as possible.
However, there are environments where 1Password cannot be used. That is the password to protect 1Password ...
CommunityBot
- 1
0
votes
4
answers
740
views
Is it safe for my password hint to be synonymous to my password?
Lets say my password is AppleDogFire642!.
What would be the potential security consequences if my password hint was BananaCatSmoke123@?
CommunityBot
- 1
1
vote
3
answers
445
views
Asymmetric encryption of user's data
I got to thinking this morning over my coffee, that it would be nice if I could encrypt data for a Tenant with one key, and decrypt it with another key. In such a way that only a logged in User can ...
- 136k
12
votes
4
answers
17k
views
HMACSHA512 versus Rfc2898DeriveBytes for password hash
We are currently using HMACSHA512 in .net, with a 128Char (64byte) validation key
The salt is 64 char randomly generated string.
We allocated 2048 length on the database for the hashed base64 string ...
- 895
35
votes
6
answers
27k
views
Is it safe to store account credentials in an Excel sheet protected with a password?
Basically the title. For example, how bad is it to store passwords in an Excel sheet protected with a password, instead of storing passwords in Keypass or something else like Zoho Vault? Of course, ...
- 33
11
votes
4
answers
4k
views
Wi-Fi with guest network
I use an old AirPort Extreme to provide WiFi in my home. It provides a 2.4 and 5.0 GHz network with a good password, only available to me and my wife. It also provides a separate guest network without ...
- 2,727
0
votes
2
answers
1k
views
Storing passwords and retrieving them to run an application
I have a web app that I use to run exe programs but the exe programs require a password to be passed. Currently this password is hard coded into the web app file in clear text.
Since this is not ...
- 52.1k
0
votes
1
answer
68
views
Can an email address be added to "Forward To" list in cPanel without accessing the cPanel?
My company is using cPanel emails, recently while reviewing email forwarders, I noticed an email in the "Forward To" list that our sales email is being forwarded to it and that was unknow to ...
- 1
1
vote
1
answer
268
views
Is it secure to expose a salted bcrypt hash IF it is maximum length random secure password?
Is it secure to expose a salted bcrypt hash (minimum 14 cost) if the used password is 72 characters (maximum) byte long, randomly generated letters, numbers, and special characters using secure ...
- 9,717
3
votes
3
answers
602
views
Is a sufficiently long password unsafe just because it only consists of 2-3 letter long mixed-case dictionary words and numbers?
Entropy/Length/Complexity of a password is pretty straight forward and cant really vary much.
For Dictionary Similarity, i would assume that a software just checks how many characters in a password ...
- 12.1k