Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
4,067 questions
8
votes
4
answers
2k
views
Web browser password management security [duplicate]
Possible Duplicate:
How are browser saved passwords vulnerable?
How secure are the password managers that are built into modern web browsers?
Currently I use lastpass plugin as I believed the ...
CommunityBot
- 1
8
votes
2
answers
553
views
Is cascading cryptographic algorithm better than using a single one?
Am I wrong to think that scrypt(bcrypt(password)) would be better than using sole (s|b)crypt? Especially when considering two different key for the two algorithms.
I am also interested in some papers....
AviD♦
- 73.6k
14
votes
2
answers
11k
views
Why limit passwords to ascii printable characters? [duplicate]
Possible Duplicate:
Do non-keyboard characters make my password less susceptible to brute forcing?
Every article on password security that I read tells people to make the password more ...
CommunityBot
- 1
0
votes
2
answers
1k
views
Best ways to store a password Server side [closed]
I was using Lotus Notes today and I realized that the program asks password is encrypted in many ways. even without access to the stored passwords notes I can say that they are at least as recorded in ...
AviD♦
- 73.6k
5
votes
4
answers
7k
views
Brute force vs other methods of recovering passwords from shadow file
Do you know any good approach for de-hashing/actually bruteforcing hashed passwords in the shadow file?
On various operating systems, any good solutions/methods/programs.
Or is it better to upload ...
CommunityBot
- 1
16
votes
3
answers
2k
views
Is it OK to tell your password to an admin? [duplicate]
Possible Duplicate:
From a security point : Is it OK to tell your password to an admin?
I am working in a small company (20 employees) as a senior SW engineer.
After having some email problems, ...
CommunityBot
- 1
7
votes
2
answers
16k
views
Can DES-based hashed password be recovered if salt is known?
Can a hashed password be recovered if the hashing is done with DES based crypt function in PHP and both the hash and salt are known by the attacker?
Consider the following example:
$salt = 'mysalt';
...
AviD♦
- 73.6k
12
votes
2
answers
2k
views
Salting password with the first 8 bit of the password itself
Do you guys think salting password with the first 8 bit of the password itself will have same result as using stored salt to hash password?
[Clarification]
I am not storing salt but creating from the ...
- 1,236
10
votes
4
answers
7k
views
How to protect ftp account information in the source code of a program
I wrote a game which stores high score information on an ftp server.
In the the source code I need to write out the ftp link with the account name and password in it.
For example:
url = new URL("ftp:...
- 27.3k
4
votes
1
answer
2k
views
Will using unicode chars in my password increase security? [duplicate]
Possible Duplicate:
Do non-keyboard characters make my password less susceptible to brute forcing?
Bruteforce tries cracking the hash with every possible combination of letters.
Then, If I'll ...
CommunityBot
- 1
9
votes
3
answers
578
views
Should I restrict access to the username and passwords in a web app?
I'm starting to write my first serious web application and am thinking about how to store username and password information. There are plenty of articles detailing how storing plain text passwords is ...
- 5,833
11
votes
2
answers
616
views
What problems does this "recover account" procedure have?
On a website I run I have implemented this procedure for account recovery (forgotten password procedure). I would like to know whether there are any issues with it that I have not spotted, that make ...
- 100k
3
votes
0
answers
231
views
Checking whether a password is derived from previous passwords [duplicate]
Possible Duplicate:
How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?
On a system I used several years ago ...
CommunityBot
- 1
3
votes
2
answers
646
views
BlackBerry client authenticating to Java Web Service
I already asked this question at StackOverflow here: https://stackoverflow.com/questions/4970681/blackberry-app-security and was directed to this site, can anyone pitch in as to how I can solve this ...
CommunityBot
- 1
9
votes
6
answers
616
views
How can I ensure that default passwords are no longer in use?
There are two situations in which 'default' passwords get used on a network:
A new user is registered. In her registration pack, along with her new username, e-mail address and so on is her initial ...
CommunityBot
- 1
18
votes
7
answers
602
views
Is a "security measure" that doesn't provide a security benefit actually harmful?
If a security measure is implemented that doesn't provide any additional security benefit, can it be considered harmful?
As an example, consider a login page where the user is asked to enter their ...
- 329k
9
votes
2
answers
2k
views
Storing third-party auth info securely
Suppose there's a multi-user web application that requires access to user's mailbox (on third-party service, like gmail, etc.). This access needs to be persistent. Which means we'd have to store user ...
CommunityBot
- 1