Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
4,067 questions
1
vote
0
answers
260
views
Unknown Hash Type [closed]
During a CTF, I came across a certain hash type which can't be identified by various tools (hashID, crackstation, hashes.com, etc.)
The data is as so:
- Plaintext : abc123
- Hash : ...
- 11
1
vote
1
answer
140
views
Web app architecture- set a new password for a on-premises AD setup
I need to implement a web app for a self-service change password use case for on-premise Active Directory users,
which is accessible over the internet.
The service must allow the users to set a new ...
10
votes
6
answers
6k
views
What is the best way to calculate true password entropy for human created passwords?
Okay, I know it might seem this has already been beaten to death but, hear me out. I am including a fairly good password strength algorithm for my app for users on sign-up. This one, which I've copied ...
1
vote
3
answers
601
views
SHA256 for hashing 32 cryptographicaly random bytes
I need to hash 32 cryptographically random bytes, but later the verification the value with hash must be very fast, so I decided to use SHA256. Is it a security issue if my passwords are 32 ...
- 9,717
16
votes
4
answers
5k
views
Should one reject login attempts when the correct password is newly added to a password deny list?
Best practices say that when users choose a password (at signup or when changing an existing password), the application should reject that password if it appears on a list of passwords known to be ...
- 337
68
votes
6
answers
61k
views
My email address is being used to enroll for online services. Should I be concerned?
Just before Christmas I received the following message in one of my GMail accounts:
Sign-in attempt was blocked
********@gmail.com [redacted by me]
Someone just used your password to try to ...
- 1
1
vote
1
answer
160
views
What are some well known websites that do not require multiple character sets in passwords? [closed]
NIST guidelines discourage password policies that require multiple character sets.
Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or ...
- 337
1
vote
1
answer
193
views
Windows Fine-Grained Password Policies (FGPP) - Set Policy Duration
Trying to determine if there's a way to configure an FGPP(the policy itself) to last/be enforced only for a specified period of time or ideally, until a triggering event occurs. E.g., create temp ...
CommunityBot
- 1
1
vote
0
answers
250
views
Amnesia and death proof master password
I have been thinking about how to store my master passwords (password manager, email and device passwords) for quite a while and I just haven't been able to come up with a satisfying solution yet. I ...
- 11
1
vote
3
answers
681
views
Should password strength validation also be run server-side or only client-side?
Personally, I think that it's not so important to check the strength of the passwords on server-side, since, if the user evades the validation on the client side, it would be their responsibility to ...
- 12.1k
1
vote
2
answers
10k
views
Brute-Forcing DVWA login page with hydra
I'm learning how to brute force web login pages with a popular brute force tool called "Hydra". I'm using Kali Linux (VirtualBox) to do this. I've installed DVWA (Damn Vulnerable Web Application) and ...
- 132k
2
votes
3
answers
8k
views
How can I extract salt from encoded base64 Salted SHA 256 hashed password
I have a SSHA256 hashed password. Below is the plaintext and hashed password for it.
PlainText -p@ssw0rd
Encrypted -{SSHA256}LGkJJV6e7wPDKEr3BKSg0K0XDllewz9tvSNSaslDmIfPFmyuI5blUK/...
1
vote
1
answer
339
views
Is 2FA based on Google Authenticator Real?
I was reading this response on SE about 2FA:
Well, I hate to break this to you, but Google Authenticator plus
password isn't really two-factor authentication. Proper 2FA is two
separate items out of ...
CommunityBot
- 1
11
votes
3
answers
62k
views
Modern high quality password dictionary [closed]
Has anyone come across any good password dictionary lately? Some of the lists I found dated back to 90's! Some are simply too big that I doubt their quality. I am looking for something hopefully free!
- 132k
1
vote
2
answers
109
views
Autogenerated PINs
PINs secured by TPM or similar hardware are secure even if short and only numeric because the TPM can throttle and lock after several attempts. I'm concerned about PIN reuse. I suspect most people are ...
CommunityBot
- 1
2
votes
2
answers
841
views
Why PAKE or Zero-knowledge password proof didn't replace sending a password via HTTPS
Technologies like Zero-knowledge password proof and PAKE seems to be pretty mature but almost all modern web-sites still send passwords over HTTPS to check authentication. At first glance, this ...
- 6,655
0
votes
0
answers
198
views
KDF vs hash function in loop for hashing password
I'm trying to grasp which benefit can KDF like PBKDF2, scrypt and bcrypt (I know that bcrypt is technically not KDF) may bring over hashing in loop like sha256sum(sha256sum(sha256sum.....(salt + ...
- 423
10
votes
1
answer
17k
views
Is Plaid safe if I change the password after deposit?
Many services, like Coinbase or Robinhood, use Plaid to deposit money from Bank. I understand that Plaid stores my login and password, somewhere... somehow... who really knows. A lot of people ...
- 11
3
votes
1
answer
435
views
Why banks require such a low password entropy for web/app access?
Many banks I have worked with require between 4-6 characters passwords. Some even force to use only digits.
Such a poor password is protecting your financial information, because MFA is usually not ...
- 26.9k
5
votes
1
answer
6k
views
What tools currently allow to retrieve Windows 10/11 password hashes, given admin rights or physical access to unencrypted disks?
I was wondering what Windows/Linux/Live tools allow to retrieve user password hashes of modern 2021 Win10/11 installations. I am not sure if password storage differs in these cases (e.g. different ...
- 1,025
13
votes
2
answers
946
views
Why is Webauthn not used as primary authentication method?
In theory, authenticating with a public key should be much simpler than with a password. There is nothing to remember for the end-user, and registration can be done just by clicking a button. For all ...
- 51
1
vote
3
answers
189
views
Why don't applications suggest passwords themselves?
Imagine a web app that, on the login page, has a password field which does not allow user input, but just displays a client-only generated password that is reasonably strong, with a button to re-...
- 12.6k
5
votes
1
answer
10k
views
Chinese or "pinyin" wordlists for dictionary attacks
Background:
I am currently trying to crack a salted md5 hash which I have recovered from an embedded device running busybox and manufactured in china.
I have tried john the ripper using all of the ...
- 621
2
votes
1
answer
982
views
Is the Web Crypto API secure when the server is trusted?
I've heard a lot of people say that the Web Crypto API is not very safe. For example: https://tonyarcieri.com/whats-wrong-with-webcrypto, Problems with in Browser Crypto. However, I'm looking to use ...
- 1,229
0
votes
1
answer
466
views
Burp Suite: alphanumeric payload decoded to base64 exposes password, but as an encoded string
I'm learning Web Pentesting using Juice Shop and I successfully used Burp Suite to generate an SQL injection payload in the repeater that exposed the plain text email and encoded password of the admin....
- 101
0
votes
1
answer
2k
views
Offline One Time Password algorithm
Sometimes when we login in some services we should enter One Time Password or OTP that can be received via SMS, e-mail or a voice call.
Among these options, there are some mobile apps that can ...
- 9,712
107
votes
15
answers
25k
views
Why did customer services say using symbols in a password is insecure?
I am using an online service that I recently had to reset my password because I forgot it. When I went to change password I wanted to use one with a symbol !@£$%^&*(). When I clicked "confirm ...
- 5,406
14
votes
5
answers
9k
views
Security of the KWallet password encrypting application?
According to http://gaganpreet.in/blog/2013/07/24/kwallet-security-analysis/ , the KWallet password management system is quite weak, it uses key splitting, Blowfish 56, and no salt.
The key ...
- 211
5
votes
2
answers
1k
views
Why did WebAuthn beat PAKEs as the preferred password replacement?
Apple and now Google are releasing products that are built on WebAuthn as a replacement for traditional username + passwords. Why did this technology beat out PAKEs?
- 5,589
0
votes
3
answers
896
views
Android phone's lockscreen PIN disappeared?
I own a ZTE Axon 7 (model 2017G) that I purchased secondhand from a reputable vendor in Germany ca. 3 years ago. The phone has been working well, and I updated the OS to Android 8.0. manually earlier ...
CommunityBot
- 1
138
votes
11
answers
85k
views
Why not allow spaces in a password?
"Your password can't contain spaces."
is a message I see from some websites,
including 1 .
Why?
(This question is very similar to Why Disallow Special Characters In a Password? , but the answers ...
- 132k
14
votes
2
answers
22k
views
What is the best way to store password in memory (RAM) in Java?
Imagine there is a login form in Java application. We need assign usename and password to variables. Moment after we can Hash or HMAC password and keep it just for authentication step (no caching). ...
- 21
46
votes
6
answers
11k
views
User Account with no password
I'm currently job searching, and sometimes I come across sites that are just huge databases full job postings, and before you apply you have to create an account. I came across a site, but I'm ...
CommunityBot
- 1
139
votes
9
answers
348k
views
Where can I find good dictionaries for dictionary attacks?
I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?
I've found some through Google, but I’m interested in hearing about where you get your ...
- 103
44
votes
2
answers
8k
views
Why don't car keys use algorithms like RFC 4226?
I've been reading a bit into car security and all of the ways cars can be stolen through various alterations of replay attacks. Upon researching whether any of the more modern cars are using anything ...
- 11.6k
0
votes
1
answer
132
views
Using Single Sign-On and the usage of password managers is discouraged. Whay are alternatives for storing tokens for example?
What are the alternatives of storing tokens when password managers are discouraged?
Some of the ideas that come to my mind are storing in a text file and encrypting with GnuPG but that's asks for ...
- 293
4
votes
1
answer
618
views
Why would websites ask users to reauthenticate after a password change?
I was discussing with a non-IT friend after he came to me with a question regarding security and password change.
As he puts it: "Why do websites ask me to re-authenticate after a password change?...
- 1,025
8
votes
3
answers
9k
views
File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?
I've been using this command to encrypt files for a while now:
openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc
Then I type in a password.
Can someone tell me, roughly speaking, ...
- 24k
32
votes
3
answers
9k
views
Why are PIN codes usually of even length (4 or 6)?
A huge problem is PIN guessing from birthdays (dd/mm/yy lends to a 6 digit number that is easily guessed, dd/mm/yyyy for 8 digits). It's very often that a PIN number is taken from someone's birthday ...
- 12.1k
1
vote
0
answers
124
views
Why is not there encrypted way of sharing/showing data such as Password to the user (hidden from web app Source code)?
I wonder if there will be (or is) a way to hide data such as passwords from the HTML/DOM structure? As, password fields can hide from external person other than the main user with something like "...
- 132k
0
votes
0
answers
46
views
On the gains and losses of an additional client side stretching of the user password [duplicate]
Picture a state of the art implementation of a website registration and login system.
I'm interested in analyzing what a defender gains and loses by feeding the user password to a key-stretching KDF ...
- 1,275
1
vote
1
answer
116
views
Reuse credentials if same data in same security environment
We're managing a shared hosting environment of Wordpress websites on a web server.
Each site has its own database password and FTP password, both are randomly generated and stored in AWS ...
- 136
1
vote
2
answers
308
views
How does /dev/random not leak future bytes from old ones
I want to generate 6 random words using Wiktionary and random numbers from /dev/random. I'll get a random number with /dev/random and then use the word from that index.
I know /dev/random should be ...
- 132k
1
vote
0
answers
243
views
Can OTPs substitute password? [duplicate]
One-time passwords (OTPs) usually serve as the 2nd factor in a 2FA scheme. But, in isolation, I believe they are more secure than passwords, since they are ephemeral and passwords are still badly ...
- 132k
0
votes
3
answers
1k
views
Can a password change via CSRF lead to account takeover?
If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF ...
- 132k
25
votes
8
answers
32k
views
What chars should I not allow in passwords?
I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
1
vote
3
answers
785
views
Is using my phone number as a pin for a phone a security risk?
I just did a factory reset on my smartphone to see if it might fix issues with battery life. I configured a phone number as the lock screen code so I have a code that's both long and easy to remember. ...
- 95
25
votes
6
answers
9k
views
Is a sha256 hash of a unix timestamp a strong password
I am setting up a postgres db that will never be used by humans. In fact, I really don't need to know it myself ever. I assumed that just using a 256bit(64 alphanumeric chars) hash of a unix timestamp ...
- 487
4
votes
2
answers
2k
views
What will happen if I accept this "Change your search setting to: smartwebfinder.com"?
When I want to install Ultrasurf extension it gives me this message:
So I do not understand what this "Change your search setting to: smartwebfinder.com" wants to do.
When I go to this ...
- 95
0
votes
0
answers
35
views
Does having the hash make it easier to crack the password than not having the hash? [duplicate]
For example, a password hash is: edgjcgo4866864rfhobd38790g764hkp
Does having the hash of the password make it easier for the attacker to crack the password than not having the hash?
If yes, why does ...
