Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
154
questions with no upvoted or accepted answers
7
votes
0answers
236 views
How to determine the number of characters changed between two passwords as per DISA Application Developer STIG rule SV-84187r1_rule?
The DISA Application Developer STIG specifies:
Group ID (Vulid): V-69565
Rule ID: SV-84187r1_rule
Rule Version (STIG-ID): APSC-DV-001730
Rule Title: The application must require the change of at ...
4
votes
0answers
166 views
How Are Google Chrome Synced Passwords Encrypted If I Can Reset the Password to My Account
Services like Dashlane and Bitwarden are unable to decrypt your passwords without your Master Password.
So, how does Chrome do it when they also state that your passwords are encrypted using your ...
4
votes
0answers
94 views
How vulnerable are password managers in the real world?
I'm a senior undergraduate majoring in computer science. I recently took a computer security class where instead of exams we had a final project that could be anything related to computer security.
So ...
4
votes
0answers
126 views
How to mitigate insecure password policy that I am forced to use?
The site in question is the UK regulator for companies at https://ewf.companieshouse.gov.uk. Online access to a company on this site enables the user to file/change various critical things on behalf ...
4
votes
1answer
260 views
Which user authentication measures are used nowadays?
I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, ...
4
votes
0answers
265 views
Saved password store on Android Edge browser
Does anyone have knowledge, or better yet, a reference document showing how and where passwords are stored when using the Edge browser on Android?
I'm assuming it's going to be SQLite, as I ...
4
votes
0answers
1k views
How exactly does “Apache Shiro's” hashing work when using a Desktop-Client
I was looking at this question
How does storing hash passwords work?
and every answer essentially says that Hashing is done via the server, or most of it should, as that is the safest way to do it. I ...
3
votes
0answers
60 views
Maximum password length for user accounts on Ubuntu
I have a VPS hosted at a remote location. Obviously the host can login directly (without SSH or any keys) on this box and I want to make brute force password guessing as hard as possible for a bad ...
3
votes
0answers
69 views
Any data on how many users change passwords after a breach notifcation?
Does anyone know of any study or any data whatsoever which might indicate how many users actually change their passwords after they have been notified that their credentials appeared in a breach?
3
votes
0answers
642 views
GPG: how to encrypt using a keyfile? (symmetric)
In Ubuntu this produces a "filename.txt.gpg" file and works:
$ gpg --symmetric --passphrase-file keyfile.key filename.txt
In debian, I get a popup requesting I enter a password...
How do I encrypt ...
3
votes
0answers
754 views
Are enterprises Office 365 accounts overly exposed to brute force attacks?
Earlier this year the Scottish parliament was attacked by what described as a “Brute Force” cyber-attack. It was said that the attack targeted “MSPs and staff with parliamentary email addresses”.
...
3
votes
3answers
454 views
Secure preshared key 2 way authentication
I have the following setup:
A server and a client will be connected over tcp. The server and client both have access to the preshared secret key. When the client connects to the server, the client and ...
3
votes
0answers
465 views
Can we capture security key used in an NFC connection for Mifare Classic?
Millions of NFC Mifare Classic cards are used for public transport, access control and other purposes. These NFC tags use encryption so that the data on NFC tag cannot be read or changed by someone ...
3
votes
2answers
685 views
Is a password or passphrase needed with a keyfile backup to decrypt
In my search for an encrypted NAS i have come across a few products that talk about backing up the encryption key and storing it in a safe location. My question is if this backed up keyfile is enough ...
3
votes
0answers
58 views
Security concerns for long-lasting single use access tokens with secondary identity verification?
I have an application that has a user type that "returns as needed" over the course of 22 days to complete action items. The application handles sensitive/confidential information, but > 90% of users ...
3
votes
1answer
1k views
How secure is automatic authentication in Skype?
How secure is checking the automatic authentication option in Skype client? What if I sign in with Microsoft account instead of Skype id? What if both accounts are merged? Is there any documentation ...
2
votes
0answers
280 views
Recovered a 7z password with hashcat, but it's not the right one
I am trying to recover a 7z file, but have forgotten the password. It's completely AES-256 encrypted (i.e. not even the filenames are available).
Steps:
Generated hash file with 7z2hashcat.pl
Ran a ...
2
votes
0answers
77 views
Can I skip any password hashing for localhost authentication?
Setup
I have several services (Postfix, Apache (PHP)) that access a PostgreSQL database on a Debian Linux 10 system.
everyone is on the same host
they use the loopback interface (127.0.0.1) to ...
2
votes
2answers
172 views
How to improve security of a stored password?
Our application needs to store a password in a database. It‘s not possible to store a hash because the password is needed to access other data that are protected by this password.
Currently, the ...
2
votes
0answers
176 views
If the given key of a Vigenère Cipher has repeated letters, does it make it any easier to break?
I am studying the Vigenère Cipher that given a passphrase uses rotating Caeser Ciphers to encode the plaintext. The ‘classical’ attacks on Vigenère first deduce the length of the passphrase by ...
2
votes
0answers
111 views
Admin able to set new plaintext user password - security problem?
I am working on this application that can be deployed and run by anyone on their server. Most often, it is run as a web service. In our new version, we removed the possibility for admins to set and ...
2
votes
0answers
29 views
Credential Storage for Partner/Vendor Accounts
We work with many other companies to do data exchange. As an example, we might work with COMPANY A to send them sensitive data over SFTP. This would be done by them giving us an SFTP Host/Account/...
2
votes
0answers
54 views
How do biometric password managers work?
Many password managers for mobile offer the option to unlock the password vault with a fingerprint instead of a password. If you never type in your master password, how is it possible to decrypt the ...
2
votes
0answers
149 views
Add additional rounds on existing SHA-512 salted hashes without knowing clear text password?
Assuming you have a salted SHA-512 password hash with 5000 rounds. For example:
{CRYPT}$6$rounds=5000$6835c5dcf0bb7310$hVod/jy7uONMSa.FVpLHb/2OrWpAj3lB/....
2
votes
0answers
314 views
For cloud-based password managers, is it safe to login using public WiFi?
For cloud-based password managers, is it safe to login when using public WiFi?
To help get good answers to this question, let's define 3 terms:
Cloud-based password managers = Password managers such ...
2
votes
0answers
81 views
User has been authenticated. Now what?
I'm trying to create a user authentication system for an application. I can't use a built in library for that such as ASP.NET Identity, but I can use any simple methods in .net.
Not wanting to ...
2
votes
0answers
155 views
WCF WS - Passing passwords through service
I am implementing security on a WCF service from basicHttp to WShttp, the issue is the service sends some passwords for connections to the database that the user can define,test and save.
The ...
2
votes
0answers
94 views
Protecting the password in a PBE scheme for an application
I am currently formulating security best practices and requirements for ongoing Java software development in my department and have settled with a recommendation of using the Jasypt framework for ...
2
votes
0answers
51 views
Native Mobile App Finger Print Authentication and web service.
I have developed many web based applications and focused a lot on authentication LDAP, SAML and in application passwords. Now I am moving to building native mobile application and would like to take ...
2
votes
0answers
480 views
Mimikatz hash dump of logged-off users
If I want to dump hashes of domain users on my computer, do they have to be logged on, or can I dump hashes of logged off users?
When I try mimikatz in my lab, I can only get dumps from others users ...
2
votes
0answers
91 views
Under what conditions does Safari have access to the Keychain?
The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data.
People who use iCloud, and also enable the keychain synchronization ...
2
votes
0answers
40 views
Syncing service passwords during offline installations
Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of ...
2
votes
0answers
487 views
Digital signature based authentication schema using two passwords
I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
2
votes
0answers
78 views
Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?
It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
2
votes
1answer
277 views
What are the security features of the Microsoft PasswordVault class?
There doesn't seem to be much information on the PasswordVault but it seems to provide for local encryption of credentials.
There are references to it in this source code and this blog.
The reason I'...
2
votes
3answers
2k views
Securely changing Veracrypt password
How can I change a Veracrypt (master) password efficiently and securely?
Based on the answers here, it is not safe to use system --> change password due to various reasons.
I cannot simply image ...
1
vote
0answers
43 views
Good use of libsodium?
I am looking to hash user passwords to store in a database that will likely reside on a user's intranet, so I am expecting the database to be classed as open and insecure.
I am using libsodium 1.0.18 ...
1
vote
0answers
45 views
Strange cyrus/imaps Logins without valid password
I found apparently successful logins from a foreign ip-address to our cyrus-imap server:
Nov 24 08:16:20 server-1 cyrus/imaps[12101]: starttls: TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits ...
1
vote
1answer
68 views
What is the minimum secure length for gpg -c file.txt?
I want to use gpg -c with a user-generated password that I can easily remember. Are 16 characters enough? for example would a password similar to "I own 32 houses." be bruteforcable?
1
vote
0answers
26 views
Making custom wordlists for languages besides English
I'm testing a site whose audience doesn't usually have English as their main language. When it comes to non-English, I consider there to be 3 groups
The target language's alphabet is a subset of the ...
1
vote
0answers
65 views
Strange account activity - how to investigate
Today I have observed very strange scenario which appears to be attempts to hack an account. So first, let me tell the pre-story:
I have started to receive 2-factor authentication SMS messages from ...
1
vote
0answers
44 views
Entered FDE password in GRUB by mistake
For several reasons (I have an external monitor, etc.) when I booted the laptop I typed the FDE (Full Disk Encryption on Linux, LUKS) without looking at the monitor, and I ended up typing the full ...
1
vote
0answers
86 views
SECURITY VIOLATION: Root login attempted - Which password is affected?
Logwatch shows that proftpd was tried to be logged into using root
0.0.0.0 (111.254.68.221[111.254.68.221]) - SECURITY VIOLATION: Root login attempted
I found:
Normally, proftpd does not allow root ...
1
vote
1answer
69 views
Securely storing a master key client-side
My company is currently evaluating a product which comes with a browser-extension-based password manager. The password manager is peripheral to their core product, but is the only way to use it. We're ...
1
vote
2answers
132 views
Hardware components based on which to generate password
I want to generate a password for a Keystore in java on Windows platform.
I would like to make a HASH out of some hardware information from my computer and some salt.
My question is: which hardware or ...
1
vote
1answer
109 views
Firefox: What would be more secure/private: storing session cookies or saving password in the browser?
I am wondering, assuming the latest version of Firefox, which of the following options would be more preferable security-wise (e.g. assess and/or password to user account will be stolen) and which one ...
1
vote
0answers
757 views
John the Ripper doesn't crack passwords when I use wordlists
Title says it all, I can't tell if John is just crashing or "gives up" on cracking the hash. First I start off by creating an md5 hash out of a word I KNOW is on the rockyou.txt wordlist:
echo -n '...
1
vote
0answers
65 views
Got a failed log-in attempt message. Is it possible someone tried to enter my PC remotely?
A while ago my PC kind of got frozen. The mouse was moving but I couldn't open other windows and I couldn't open the task manager pressing ctrl-shift-Esc. After a couple of minutes I just pressed the ...
1
vote
1answer
199 views
Fully-secured screen lock in Ubuntu with encryption
I have Ubuntu 19.10 with full disk encryption. The encryption is effective as long as the system is turned off or restarted. Otherwise the data is unencrypted behind a locked screen which may not be ...
1
vote
2answers
131 views
2FA: Do app passwords render the second factor invalid?
I am currently in the process of employing a 2FA authentication on as many services as I can. If it is relevant for the question: I use a time-based OTP authenticator app.
When setting up, I noticed ...
