Questions tagged [passwords]

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

174 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
162 views

How does Google Chrome's "Warn you if passwords are exposed in a data breach" feature work?

This feature is enabled by default. It says the usernames and passwords would be encrypted before sending to google. But google would know the encryption keys it used and to compare it with leaked ...
eee's user avatar
  • 41
4 votes
0 answers
2k views

Maximum password length for user accounts on Ubuntu

I have a VPS hosted at a remote location. Obviously the host can login directly (without SSH or any keys) on this box and I want to make brute force password guessing as hard as possible for a bad ...
Jasper Citi's user avatar
4 votes
0 answers
189 views

How vulnerable are password managers in the real world?

I'm a senior undergraduate majoring in computer science. I recently took a computer security class where instead of exams we had a final project that could be anything related to computer security. So ...
martinpetrov1568's user avatar
4 votes
0 answers
201 views

How to mitigate insecure password policy that I am forced to use?

The site in question is the UK regulator for companies at https://ewf.companieshouse.gov.uk. Online access to a company on this site enables the user to file/change various critical things on behalf ...
Jon Bentley's user avatar
  • 2,001
4 votes
0 answers
2k views

GPG: how to encrypt using a keyfile? (symmetric)

In Ubuntu this produces a "filename.txt.gpg" file and works: $ gpg --symmetric --passphrase-file keyfile.key filename.txt In debian, I get a popup requesting I enter a password... How do I encrypt ...
user189798's user avatar
4 votes
0 answers
332 views

Saved password store on Android Edge browser

Does anyone have knowledge, or better yet, a reference document showing how and where passwords are stored when using the Edge browser on Android? I'm assuming it's going to be SQLite, as I ...
Andrew C's user avatar
4 votes
0 answers
2k views

How exactly does "Apache Shiro's" hashing work when using a Desktop-Client

I was looking at this question How does storing hash passwords work? and every answer essentially says that Hashing is done via the server, or most of it should, as that is the safest way to do it. I ...
XaolingBao's user avatar
3 votes
0 answers
188 views

Can a bad guy ever get access to my gmail account using ONLY the 2fa app or ONLY the recovery phone (plus username)?

Let's say X is a malicious person. Let's say I have a gmail account with a recovery phone and with 2fa enabled. Let's say X knows the username but not the password. X doesn't have any other ...
capet's user avatar
  • 131
3 votes
0 answers
113 views

Any data on how many users change passwords after a breach notifcation?

Does anyone know of any study or any data whatsoever which might indicate how many users actually change their passwords after they have been notified that their credentials appeared in a breach?
john doe's user avatar
  • 698
3 votes
2 answers
256 views

Quantify security strength from entropy and lifetime

Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
gethopr's user avatar
  • 41
3 votes
0 answers
809 views

Are enterprises Office 365 accounts overly exposed to brute force attacks?

Earlier this year the Scottish parliament was attacked by what described as a “Brute Force” cyber-attack. It was said that the attack targeted “MSPs and staff with parliamentary email addresses”. ...
TheJulyPlot's user avatar
  • 7,789
3 votes
0 answers
921 views

Can we capture security key used in an NFC connection for Mifare Classic?

Millions of NFC Mifare Classic cards are used for public transport, access control and other purposes. These NFC tags use encryption so that the data on NFC tag cannot be read or changed by someone ...
PMD's user avatar
  • 199
3 votes
0 answers
96 views

Security concerns for long-lasting single use access tokens with secondary identity verification?

I have an application that has a user type that "returns as needed" over the course of 22 days to complete action items. The application handles sensitive/confidential information, but > 90% of users ...
Daniel Brown's user avatar
3 votes
1 answer
2k views

How secure is automatic authentication in Skype?

How secure is checking the automatic authentication option in Skype client? What if I sign in with Microsoft account instead of Skype id? What if both accounts are merged? Is there any documentation ...
user avatar
3 votes
3 answers
4k views

Securely changing Veracrypt password

How can I change a Veracrypt (master) password efficiently and securely? Based on the answers here, it is not safe to use system --> change password due to various reasons. I cannot simply image ...
jvkbzowtb's user avatar
  • 169
2 votes
0 answers
105 views

Windows AD - Fake User Account with Multiple Passwords to Detect Password Spray

TL;DR I'm trying to implement a fake user account that has multiple sets of credentials that can be used. Instead of a specific password, any one password from a list of them could be used to ...
CyberKnight's user avatar
2 votes
0 answers
146 views

How are the values of stored firefox credit cards encrypted? And how does one decrypt those?

While researching about the safety of web browsers I made my own program that can decrypt stored credentials, cookies, and other information of different browsers to see for myself how easy it is. ...
Void's user avatar
  • 21
2 votes
0 answers
300 views

Security of in-app Forgot Password workflow in Xamarin (Mobile App) without using a website

I decided to implement "forgotten password" functionality, without having to create a website just for that. The usual workflow that I've seen for any app is: User requests password reset ...
Varin's user avatar
  • 121
2 votes
1 answer
1k views

JTR finishing very quickly with rockyou.txt and not cracking the hash

I've been fumbling through the world of Information Security by going through the HTB challenges, and I've come across an issue I just can't seem to find an answer for. During one of the challenges I'...
Jordan Wheeler's user avatar
2 votes
0 answers
84 views

Entering password on third party websites to enable integrations

I've got a third party service that I want to integrate with various other websites/applications, the third party service says they support this however rather than using an API key or OAuth to ...
Grant's user avatar
  • 121
2 votes
0 answers
151 views

Authentication in Desktop App

I'm reading the OWASP Authentication Cheat Sheet, but it obviously is focused only on web browser. I'm searching for something similar for a desktop app. I want users to login to a desktop app. The ...
Majascript's user avatar
2 votes
0 answers
253 views

Why does firebase encrypt with password hashes instead of storing the hashes?

I am trying to migrate off of firebase, as in doing so, you can export the hashes of user passwords. Looking at their algorithm, they do not store password hashes, but rather, they use the first 32-...
Humdinger's user avatar
  • 121
2 votes
0 answers
118 views

Making custom wordlists for languages besides English

I'm testing a site whose audience doesn't usually have English as their main language. When it comes to non-English, I consider there to be 3 groups The target language's alphabet is a subset of the ...
ChocolateOverflow's user avatar
2 votes
1 answer
224 views

Can I skip any password hashing for localhost authentication?

Setup I have several services (Postfix, Apache (PHP)) that access a PostgreSQL database on a Debian Linux 10 system. everyone is on the same host they use the loopback interface (127.0.0.1) to ...
problemofficer - n.f. Monica's user avatar
2 votes
0 answers
892 views

If the given key of a Vigenère Cipher has repeated letters, does it make it any easier to break?

I am studying the Vigenère Cipher that given a passphrase uses rotating Caeser Ciphers to encode the plaintext. The ‘classical’ attacks on Vigenère first deduce the length of the passphrase by ...
tim6her's user avatar
  • 21
2 votes
0 answers
178 views

Admin able to set new plaintext user password - security problem?

I am working on this application that can be deployed and run by anyone on their server. Most often, it is run as a web service. In our new version, we removed the possibility for admins to set and ...
Chimarr's user avatar
  • 53
2 votes
0 answers
71 views

Credential Storage for Partner/Vendor Accounts

We work with many other companies to do data exchange. As an example, we might work with COMPANY A to send them sensitive data over SFTP. This would be done by them giving us an SFTP Host/Account/...
David Borough's user avatar
2 votes
0 answers
103 views

How do biometric password managers work?

Many password managers for mobile offer the option to unlock the password vault with a fingerprint instead of a password. If you never type in your master password, how is it possible to decrypt the ...
jan's user avatar
  • 513
2 votes
0 answers
532 views

Add additional rounds on existing SHA-512 salted hashes without knowing clear text password?

Assuming you have a salted SHA-512 password hash with 5000 rounds. For example: {CRYPT}$6$rounds=5000$6835c5dcf0bb7310$hVod/jy7uONMSa.FVpLHb/2OrWpAj3lB/....
LuHa's user avatar
  • 31
2 votes
0 answers
554 views

For cloud-based password managers, is it safe to login using public WiFi?

For cloud-based password managers, is it safe to login when using public WiFi? To help get good answers to this question, let's define 3 terms: Cloud-based password managers = Password managers such ...
End Anti-Semitic Hate's user avatar
2 votes
0 answers
148 views

User has been authenticated. Now what?

I'm trying to create a user authentication system for an application. I can't use a built in library for that such as ASP.NET Identity, but I can use any simple methods in .net. Not wanting to ...
ispiro's user avatar
  • 773
2 votes
0 answers
266 views

WCF WS - Passing passwords through service

I am implementing security on a WCF service from basicHttp to WShttp, the issue is the service sends some passwords for connections to the database that the user can define,test and save. The ...
mahlatse's user avatar
  • 121
2 votes
0 answers
179 views

Protecting the password in a PBE scheme for an application

I am currently formulating security best practices and requirements for ongoing Java software development in my department and have settled with a recommendation of using the Jasypt framework for ...
maple_shaft's user avatar
  • 1,092
2 votes
0 answers
94 views

Native Mobile App Finger Print Authentication and web service.

I have developed many web based applications and focused a lot on authentication LDAP, SAML and in application passwords. Now I am moving to building native mobile application and would like to take ...
Darragh's user avatar
  • 1,102
2 votes
0 answers
643 views

Mimikatz hash dump of logged-off users

If I want to dump hashes of domain users on my computer, do they have to be logged on, or can I dump hashes of logged off users? When I try mimikatz in my lab, I can only get dumps from others users ...
Guesttt's user avatar
  • 31
2 votes
0 answers
138 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
makerofthings7's user avatar
2 votes
2 answers
605 views

What are the security features of the Microsoft PasswordVault class?

There doesn't seem to be much information on the PasswordVault but it seems to provide for local encryption of credentials. There are references to it in this source code and this blog. The reason I'm ...
makerofthings7's user avatar
2 votes
0 answers
86 views

Syncing service passwords during offline installations

Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of ...
UtopiaLtd's user avatar
  • 121
2 votes
0 answers
542 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
shesek's user avatar
  • 121
2 votes
0 answers
118 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
user2951545's user avatar
2 votes
3 answers
436 views

Admin change user details / account information in admin interface

I'm creating this admin dashboard, and I have a question wich I have been stuck on for a while now. And I'm starting to question what kind of data the admin should be able edit/view on the other ...
user242001's user avatar
1 vote
1 answer
90 views

Does not storing passwords in browser really matter given cookie hijacking exists?

I see lots of articles suggesting not storing passwords in the browser, and it made perfect sense to me, if I can access this data easily, an attacker probably can too. But then I found out about ...
Arthur Moraes Do Lago's user avatar
1 vote
0 answers
1k views

John not cracking an NTLM hash

I have been trying to do it with john the ripper as the following: john --FORMAT=NT --wordlist=~/usr/share/wordlists/rockyou.txt hash.txt the hash I am trying to crack is: Computer:1001:...
kimemo 000's user avatar
1 vote
1 answer
147 views

Two different salted hashes of the same password for the same user

I am creating an authentication system that is able to login to the same account with different sets of credentials. I also want to allow users to login with either username or email with the same ...
the Radek's user avatar
1 vote
0 answers
188 views

Is it safe to enable password sync on Microsoft Edge?

Microsoft Edge, as well as other Chromium browsers, have a password sync feature built into their browsers, which look something like the image below. Before I enable this feature for convenience and ...
Skeleton Bow's user avatar
1 vote
0 answers
87 views

Resetting a well-protected Google account password

Situation: a new client came to me because of a torrent of identity theft issues. One of the issues: several of their Google accounts were having their passwords changed every few days. Each time, ...
Stanley Krute's user avatar
1 vote
0 answers
145 views

Amnesia and death proof master password

I have been thinking about how to store my master passwords (password manager, email and device passwords) for quite a while and I just haven't been able to come up with a satisfying solution yet. I ...
Americat's user avatar
1 vote
0 answers
132 views

Attack on home dir encryption with sddm pam_mount by using password in /etc/shadow

I'm using Debian + sddm + KDE with ONLY home directory encrypted with gocryptfs. Decrypting is performed with gocryptfs as follows: PC boots as usual and starts the sddm service I enter my login ...
Dzmitry Sankouski's user avatar
1 vote
0 answers
124 views

Why does a password guessing robot repeatedly test nonsense?

I log repeated invalid login attempts on a small custom made e-shop (no open source system is used). Last year, I started recording repeated failed logins from a single IP address. That's why I ...
user1367527's user avatar
1 vote
0 answers
83 views

Is it necessary to have keep these 4 accounts separate from password manager?

Microsoft Authenticator requires an: Outlook account Verification account iCloud account The first two are required to set up the authenticator on a new device, the latter stores all the data to be ...
Ganon's user avatar
  • 9