Questions tagged [passwords]

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

Filter by
Sorted by
Tagged with
0
votes
0answers
21 views

John the ripper output formatting

I'm supposed to crack some passwords from a file. I've done john pwlist.lst > passwords.txt which is outputting the files into my txt file. I'd like to make it such that when John is cracking the ...
1
vote
3answers
137 views

Are security questions considered as 2FA?

Many sites have a step during registration when you have to create security questions and answers for them. Is this type of security layer considered as 2FA? From what I know, 2FA is used for the ...
2
votes
1answer
104 views

How are passwords stored in the database of a decentralized peer to peer system?

I want to use username and password instead of public key cryptography for a decentralized peer-to-peer application, but since the passwords are stored on users' computers, there is a possibility of ...
5
votes
2answers
2k views

How do you know if the bios has been compromised?

To secure my PC I have setup a BIOS password, preventing any access from a live-cd. Recently I've noticed that when the BIOS asks for my password, I just have to press Enter to boot. It doesn't work ...
1
vote
1answer
1k views

John the Ripper Custom Dynamic Hash Function Usage

I have created a custom dynamic hash function comprised of a series of different existing hash functions chained together. I'll spare you the exact details because it's for a class assignment. I've ...
8
votes
2answers
285 views

Why is Webauthn not used as primary authentication method?

In theory, authenticating with a public key should be much simpler than with a password. There is nothing to remember for the end-user, and registration can be done just by clicking a button. For all ...
46
votes
4answers
11k views

What to transfer? Password or its hash?

Let's say in my database I store passwords hashed with salt with a fairly expensive hash (scrypt, 1000 rounds of SHA2, whatever). Upon login, what should I transfer over the network and why? Password ...
4
votes
2answers
287 views

Which user authentication measures are used nowadays?

I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, ...
1
vote
0answers
81 views

Hardware for password cracking

I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
1
vote
2answers
101 views

Worst case scenario for compromised private key in server certificate?

Assume that someone gains access to the password used for my key store containing my server certificate and it’s private key. I guess without direct access to the server running my application the ...
4
votes
1answer
5k views

Is Plaid safe if I change the password after deposit?

Many services, like Coinbase or Robinhood, use Plaid to deposit money from Bank. I understand that Plaid stores my login and password, somewhere... somehow... who really knows. A lot of people ...
1
vote
1answer
59 views

Config file contains password hashes and signature keys

First, I am a beginner in IT security. I hope my question is not too dumb. I use a program that can show a live feed from a security camera. You can import a project file, that sets up user accounts ...
104
votes
3answers
47k views

Does bcrypt have a maximum password length?

I was messing around with bcrypt today and noticed something: hashpw('testtdsdddddddddddddddddddddddddddddddddddddddddddddddsddddddddddddddddd', salt) Output: '$2a$15$jQYbLa5m0PIo7eZ6MGCzr....
2
votes
3answers
93 views

Pros vs Cons of Secure Remote Password

We are setting up an authentication system using Cognito and Amplify. We noticed that Amplify suggests Secure Remote Password as the default. I can understand the benefits of SRP for protecting ...
21
votes
8answers
7k views

Is PGP for user authentication a good idea?

I am building a web site that provides user login. For that, I am currently researching good strategies for dealing with authentication. How I'm doing it right now My current concept is modeled ...
6
votes
3answers
238 views

Why would password managers provide support for OTP codes? [duplicate]

Can anyone explain me what's this trend of providing passwords and OTP codes on the same service? What benefit or value are they trying to bring to the table? We, as security professionals, have been ...
9
votes
2answers
6k views

How to properly create a password reset token?

I searched for a long time, and never really find any articles or posts that fully explain how a password reset token should be created. What I know so far: It should be random. Its hash should be ...
2
votes
0answers
75 views

Should a user's password hash and salt be included when a user requests to download their data under privacy laws? [closed]

I have two related questions: When trying to design for privacy laws that require giving a user access to their data, should we include their password hash and salt in the data we offer for download? ...
2
votes
0answers
50 views

Authentication in Desktop App

I'm reading the OWASP Authentication Cheat Sheet, but it obviously is focused only on web browser. I'm searching for something similar for a desktop app. I want users to login to a desktop app. The ...
0
votes
1answer
184 views

how good is “Chrome Password Checkup” extension for checking passwords?

From what I read so far Google "Chrome Password Checkup" extension (https://chrome.google.com/webstore/detail/password-checkup/pncabnpcffmalkkjpajodfhijclecjno) checking the password that you use for ...
10
votes
1answer
906 views

Is BitWarden trusted?

I've been using BitWarden as my main password keeper, would like to ask if it's safe? I know that everything is not 100% safe but still want to know if they are worth it. All my passwords are ...
0
votes
4answers
126 views

Why can't you use the same password for every site, if they are hashed on the site?

I've often heard people talking about not using the same password on every website. What's the deal if servers store passwords in a SHA hash instead of plain text? The most they can do is spam you ...
1
vote
1answer
50 views

In Hashcat, How to generate combinatior attacks consisting of more than two words (in lenght)?

I am trying to make a combinator attack using just one dictionary: word1 word2 word3 word4 word5 ... And would like to try all 4-words-length permutations separated by commas: word1,word2,word3,word4 ...
3
votes
1answer
1k views

Does the Ophcrack LiveCD require hash collection via programs like pwdump?

When I used the Ophcrack LiveCD recently, the program automatically ran without me manually loading any hashes. Question is: If Ophcrack does not automatically find hashes, how can I go about ...
2
votes
1answer
209 views

Bitwarden PIN protection mechanism

I couldn't find any deep dive info about PIN management in Bitwarden. And I'm not able to read their code, not qualified enough. Are there people around here who can explain how PIN protection works ...
1
vote
3answers
99 views

Admin change user details / account information in admin interface

I'm creating this admin dashboard, and I have a question wich I have been stuck on for a while now. And I'm starting to question what kind of data the admin should be able edit/view on the other ...
3
votes
1answer
3k views

What would be the best way to authenticate a user in an offline, multi-user mobile environment?

I'm currently working on an offline authentication system for a multi-user mobile environment. In order to avoid storing all passwords locally, which seems to be a bad idea, I proceed this way: A ...
41
votes
15answers
8k views

Why do people think that this is bad way to hash passwords?

What's wrong with this code? $password = "hello"; $password = md5($password); for ($i = 1; $i < 20; $i++) { $password = md5($password); } I don't think an attacker with access to the ...
1
vote
2answers
267 views

Linux and Windows Password Security Settings

I'm asking a client why some password parameters are not defined in the Linux OS level and he's saying that, internally, Linux and Windows complexity and timeout settings are different. If they set ...
2
votes
2answers
80 views

Why should password reset link be single use?

Reading from here: https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html It mentioned that password reset link should be single use and expire after appropriate period. I don'...
2
votes
1answer
739 views

How do Field Programmable Gate Arrays (FPGAs) compare to Graphics Processing Units (GPUs); for cracking hashes?

As a general rule, GPUs are more effective than CPUs when it comes to performing acutely repetitive tasks, like iterating over lists and generating permutations of a set (i.e. exhausting dictionaries &...
6
votes
2answers
2k views

How are website passwords cracked? [closed]

What approaches are there for cracking user passwords for website/e-mail accounts? can only think of three strategies, but what else? Algorithmically: Combinatorially attempting different sequences ...
62
votes
5answers
40k views

Logged out of Facebook on all devices on a sudden. Should I be worried about being hacked?

A while ago, I was opening Facebook app on Android and then I got the message "Session expired. Please log in again.". I then tried logging in with my current password and was success to log in my ...
2
votes
1answer
43 views

Buffer overflow outside gdb

I'm trying to exploit a basic C program (below) which I've written: #include <stdio.h> #include <string.h> void main() { char ch[10]; scanf("%s", ch); if(strcmp(&...
1
vote
1answer
250 views

How to securely store decryptable passwords

I'll quickly outline the purpose of our application: The user logs in using his username and password. He will receive a list of servers he can connect to. After choosing a server the connection to ...
44
votes
6answers
60k views

Most secure password hash algorithm(s)?

What is/are currently the most cryptographically secure hashing algorithm(s)? (available in PHP) Speed is irrelevant, because I'm iterating the hash over a fixed time (rather than a fixed number of ...
7
votes
1answer
5k views

How to crack 10 digits with prefix password in John the Ripper?

I want to crack a password which pattern was 10 digits start with 0910 or 0912. So possible passwords would be e.g. 0910333444, 0910444566, 0912111222, 0912145632. How to configure the incremental ...
2
votes
2answers
207 views

Wordlist generator with a certain pattern

I am trying to generate a wordlist. I am using crunch but I am stuck at defining the pattern I want the words to be generated. For example, I want to define a rule such as this: Password: Ameri948 ca# ...
2
votes
0answers
41 views

Why does firebase encrypt with password hashes instead of storing the hashes?

I am trying to migrate off of firebase, as in doing so, you can export the hashes of user passwords. Looking at their algorithm, they do not store password hashes, but rather, they use the first 32-...
0
votes
1answer
85 views

Windows Fine-Grained Password Policies (FGPP) - Set Policy Duration

Trying to determine if there's a way to configure an FGPP(the policy itself) to last/be enforced only for a specified period of time or ideally, until a triggering event occurs. E.g., create temp ...
46
votes
6answers
10k views

User Account with no password

I'm currently job searching, and sometimes I come across sites that are just huge databases full job postings, and before you apply you have to create an account. I came across a site, but I'm ...
0
votes
1answer
105 views

How Forgot Password Works?

For my website I need to add "forgot password" functionality. As I searched on the internet there are too much vulnerabilities you may encounter in case of wrong implementing this ...
1
vote
1answer
108 views

Why don't security conscious websites use a combination of private unique identifier and password to secure their logins?

To be clear when I say "private unique identifier" I mean an identifier, which is not stored on the database for the website, it would be hashed in combination with the password and a good ...
0
votes
2answers
141 views

Disconnected wireless router security

I've changed ISP and am using their router. I wish to donate my old NETGEAR router still with its original Network Key (password). Would someone obtaining this router somehow get access to my ...
58
votes
13answers
78k views

Storing KeePass database in cloud. How safe?

It certainly would be more convenient to store my KeePass database on either S3, Dropbox, or better yet SpiderOak. My fear is having my cloud storage account compromised then having the credentials ...
9
votes
4answers
2k views

Is it good practice to SHA512 passwords prior to passing them to bcrypt?

I want to allow any-sized passwords to be allowed to be submitted. I currently use bcrypt as a key derivation function for passwords, however I have realized that it has a maximum input length of 72. ...
0
votes
2answers
375 views

Secure way to encrypt (not hash) passwords?

I'm building a system that for reasons I'll outline below, can't used hashed passwords, but I'd still like to encrypt them so that it's as hard as possible to crack them, in the (unlikely) event the ...
-1
votes
1answer
82 views

Does Password Harvesting Happen in Servers?

Maybe someone can explain why my concern is not realistic. If I create a browser-based app with a login (let's say I'm Facebook or Microsoft), why wouldn't I store all the wrong passwords people type?...
0
votes
2answers
333 views

Save private key in a database to share between multiple accounts

I don't know if my concept would be secure so I ask here. The main purpose is to log in with password x and also use that password to encrypt an RSA private key with AES to store that in the main ...
22
votes
5answers
3k views

Why do some websites and programs restrict password characteristics?

There are some websites and even programs that I use that have ridiculous password restrictions. Lots of forums for instance restrict passwords to ~32 characters. Others enforce a restricted charset. ...

1
2 3 4 5
74