Questions tagged [passwords]

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

Filter by
Sorted by
Tagged with
1
vote
3answers
452 views

Using timingSafeEqual

I've seen code like this: if(password.length !== allowedPassword.length || !crypto.timingSafeEqual(password, allowedPassword)) So timingSafeEqual is supposed to use the same amount of time to ...
1
vote
1answer
39 views

Cracking Lost Password for encrypted 7z file with most characters known

I forgot password to 7z archive encrypted with AES 256. I am fairly certain of most characters however. I know password length is either 8 or 12 characters and if it is 12 I know the last 4 characters....
0
votes
0answers
25 views

John The Ripper numbers mask

I'm using john on Windows and I use pdf2john. What do I have to do to crack this password? I saw previous passwords and they were 4 digits (1234), possibly there may be more now. currently trying to ...
5
votes
1answer
17k views

John the ripper passwd file format with salt not working

I'm trying test password strength in one of our e-commerce sites. I'm using john the ripper to brute-force a password file. The algorithm used by PHP is: $hash = md5($salt . $pass) No other ...
0
votes
1answer
43 views

If a platform/system has brute force protection should I care for a very strong password

If a platform has brute force protection should I worry about creating a very strong password since any attacker would not get a chance to reach enough attempts to crack even the weakest password? Not ...
6
votes
3answers
3k views

Why not just use a small but odd number of hashing rounds?

When it comes to hashing passwords, it is nowadays practice to do 100'000 or 200'000 iterations of SHA256/SHA512, or at least something in that ballpark. But my question is, why is it not safe enough ...
4
votes
2answers
29k views

NTLM/LM Hashes on Domain Controller

I've noticed that when extracting password hashes from a domain controller (using Elcomsoft proactive password auditor) sometimes I'll get LM and NTLM hashes and other times I'll only get NTLM hashes. ...
5
votes
2answers
331 views

Which user authentication measures are used nowadays?

I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, ...
0
votes
2answers
46 views

Sending password in separate email [duplicate]

I've noticed some services will send a username in one email with a note saying the password will come in a different email. Is there any point to this? It seems that if someone can get that email ...
0
votes
2answers
235 views

Android phone's lockscreen PIN disappeared?

I own a ZTE Axon 7 (model 2017G) that I purchased secondhand from a reputable vendor in Germany ca. 3 years ago. The phone has been working well, and I updated the OS to Android 8.0. manually earlier ...
0
votes
1answer
116 views

Is typing the PPP password in the PPP username a risk?

I went to my router admin page where first you need to type in the router's admin and password. I am not talking about that. I am talking about PPP account and password (separate from router's ...
2
votes
2answers
240 views

How to improve security of a stored password?

Our application needs to store a password in a database. It‘s not possible to store a hash because the password is needed to access other data that are protected by this password. Currently, the ...
0
votes
1answer
81 views

Is it possible to use pass, the command line PW manager, without leaking details? Does it matter?

I'm familiar with password managers like KeePass, and that there are a variety of interfaces for them. However, I've decided that I rather like the charm of pass. It's command-line oriented, and ...
0
votes
0answers
59 views

I can't decrypt chrome passwords offline with sha masterkey

I'm trying to decrypt a Chrome 80+ Login Data file offline using the SHA1 or SHA256 masterkey retrieved either using backupkey or lsass dump but no tool seems to work (I tried mimikatz, sharpdpapi, ...
-1
votes
1answer
101 views

What are the security implications of the password policy for this bank? [duplicate]

I am aware of a bank (redacted for obvious reasons) that has the following password policy. Only English alphanumeric characters Min of 8, max of 14 characters No special characters (ex. !@#$%^&* ...
1
vote
2answers
163 views

Top contenders to replace passwords?

Passwords and humans don't mix particularly well. We can't come up with random ones very well, we can't remember random ones very well, we re-use them (I'm talking about all humans here, maybe not ...
12
votes
3answers
8k views

How to properly create a password reset token?

I searched for a long time, and never really find any articles or posts that fully explain how a password reset token should be created. What I know so far: It should be random. Its hash should be ...
20
votes
3answers
6k views

Not understanding why I should use public/private key encryption over password?

My knowledge about these topics is very elementary, please "school me" if I said something completely wrong, it would surely help me understand these things better. Now, to my issue. Now ...
2
votes
0answers
97 views

Why is John returning gibberish for cracked hashes

I've been messing around with John, and when I attempt to crack an SSH hash, I receive this output. Any clue why the cracked hash is displaying the gibberish?? I used ssh2john to convert the key to a ...
30
votes
6answers
8k views

Is it safe to store 2FA tokens together with passwords in 1password?

I'm using 1password and I've seen 1password allows you to store 2FA tokens in the same place where you store the password. I don't like the idea of having everything in the same place as if someone ...
7
votes
3answers
13k views

Can viruses access passwords that have been saved by a browser?

Say I use Chrome on a new computer to log in to a website, and I select the option to have the browser remember the password. Then I download a straight-up smorgasbord of viruses of every kind. Can ...
0
votes
2answers
63 views

What are security benefits (if any) of using multiple passwords (device, password manager, …) vs single strong passphrase when paired with FIDO U2F?

I am evaluating security benefits of requiring employees (in enterprise context) to use multiple passwords (or passphrases) vs single strong randomly generated passphrase (minimum of 8 words) when ...
1
vote
1answer
320 views

Fully-secured screen lock in Ubuntu with encryption

I have Ubuntu 19.10 with full disk encryption. The encryption is effective as long as the system is turned off or restarted. Otherwise the data is unencrypted behind a locked screen which may not be ...
6
votes
3answers
25k views

Username and password stored under form data in Chrome Dev Tools

When I record the network tab in Chrome Developer Tools when logging in to my site I find that the username and password are stored in plaintext under form data. You can also find it in Safari, ...
0
votes
3answers
3k views

where should I store my application password?

I have a Windows application that does not use a database and is not on the Internet. It contains very important data (data loaded from encrypted files). The user needs a password to enter this ...
1
vote
3answers
133 views

Using Password Managers to store multiple factors, would this reduce security? [duplicate]

Assume I have a password manager that stores the credentials for a login to a 3rd party service. In this credentials the username, password and a TOTP-seed is stored and the current TOTP-token is ...
0
votes
1answer
56 views

How to merge two email boxes securely with an email box fetcher?

I have two email boxes: The first one is my main email box in Gmail and the second one is in my website hosting company by Thunderbird which I access from my website hosting manager (WHM) which is ...
95
votes
10answers
31k views

If a provider sees the last 4 characters of my password, can they see it in full?

I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
0
votes
0answers
41 views

Can't set master password in the tor browser [migrated]

I'm using the tor browser Version 78.11.0esr in whonix 15, everything works, except that I cannot save logins in the tor browser because every time I try to setup a master password, a popup window ...
1
vote
2answers
271 views

What is the point of storing hashed passwords? If that file is read, doesn't that mean the computer has already been compromised?

Why is it necessary to store operating system passwords hashed? From what I've learned, passwords are stored on the hard drive/SSD in /etc/shadow. However, if a malicious agent was able to get access ...
0
votes
1answer
342 views

PHP - Does password_hash/Argon2i effectively truncate passwords after certain length?

If I'm not wrong, by default PHP's password_hash with PASSWORD_ARGON2I outputs a 43-character alphanumeric hash among other things. While this means that simple passwords that are shorter than 43 ...
0
votes
0answers
75 views

Where to store passwords needed by linux processes?

I am working with C++ processes on a linux (CentOS 8) environment. These processes should be able to access an encrypted file on the system. Where should I store the password for this encrypted file? ...
-1
votes
0answers
65 views

Why is storing a password hashed more secure than storing it encrypted? [duplicate]

Assuming the hashing includes properly implemented salting and uses a proper password stretching algorithm such as scrypt, and that the encryption algorithm is a secure symmetric algorithm with a ...
0
votes
2answers
114 views

Does John the Ripper automatically account for salt and hash?

I have an embedded device running Armbian which I was able to get the drive image from. The entry in /etc/shadow combined with /etc/passwd after unshadowing is this: root:$6$TV6ML2bG$TncnN/adtU9xaQs/...
0
votes
1answer
61 views

Can yubikeys prevent cookie stealing?

When you log into a website, it stores cookies that let your browser access the website without having the password. Given that some sites support yubikey for login, does it mean that the yubikey ...
0
votes
0answers
66 views

Could I have prevented my Facebook password from being stolen by these trojan apps? [duplicate]

According to this Dr. Web article: Doctor Web’s malware analysts have discovered malicious apps on Google Play that steal Facebook users’ logins and passwords. These stealer trojans were spread as ...
4
votes
1answer
19k views

Decrypting SAM hive after Windows 10 anniversary update?

After a lot of frustration, I've finally cracked my local Windows 10 password using mimikatz to extract the proper NTLM hash. In particular, samdump2 decrypted the SAM hive into a list of users with &...
1
vote
1answer
1k views

John the Ripper Custom Dynamic Hash Function Usage

I have created a custom dynamic hash function comprised of a series of different existing hash functions chained together. I'll spare you the exact details because it's for a class assignment. I've ...
0
votes
2answers
173 views

How does having a password hash speed up cracking vs not having a hash (on-site)?

On Windows, user password hashes are not salted and, on Linux, user password hashes are stored in the same root-owned file as the salt. Given this, in what ways might a bruteforce attack to find the ...
3
votes
3answers
14k views

How Facebook hashes passwords

I found this presentation how Facebook stores customer passwords and how they do authentication. This slide shows how they hash passwords: Is it a good idea to do such operations with a raw password?...
35
votes
4answers
19k views

Can a dictionary attack crack a Diceware passphrase?

Everyone knows the words used in Diceware passwords (all 6^5 = 7776 words are published) -- they're all common words. Everyone seems to know that we're not supposed to use dictionary words for ...
124
votes
10answers
20k views

Does an ISO27001 audit require users to reveal their passwords?

My company's system administrator is asking for our passwords for an ISO audit and my VP IT operations support says it's mandatory for ISMS (ISO27001). Can someone confirm if this is true?
898
votes
12answers
283k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
3
votes
1answer
263 views

Is it OK to save user passwords into plaintext?

I want to easily recover user passwords if required. I hash them using bcrypt but I tried to backup non-hashed passwords into a plain text file (*txt) not accessible over the internet. Is that correct ...
2
votes
1answer
98 views

Security implications of using a non-hash in the password column

Imagine a webapp that uses a traditional email-password-login, with the users-table saving the password salted and hashed using bcrypt. Now a secondary login method should be implemented, like an API ...
34
votes
4answers
29k views

Is it safe to store the database password in a PHP file?

My connection.php file stores the credentials to connect to the database: <?php $objConnect = mysql_connect("localhost","username","password"); mysql_select_db("selectDB", $objConnect); ?...
32
votes
5answers
4k views

Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?

I just wanted to know if you can increase the cost (iterations) of those two algorithms off-line. I want to increase the cost every year of my users passwords. One solution is to recalculate them when ...
74
votes
11answers
15k views

Will typing my password twice make it more secure? Or typing each character twice?

If I type my password twice (like: PwdThingPwdThing), OR type every character twice (like: PPwwddTThhiinngg) will that make it substantially more secure than it already is? Assume that it is already 8 ...
0
votes
2answers
89 views

How can scammers reset passwords without accessing the email account?

I've read some of the other questions here but I still can't fully wrap my head around this. I know there are different 2FA implementations but, assuming the hacker can't access the email account, how ...
9
votes
3answers
9k views

Does NIST really recommend PBKDF2 for password hashing?

We hesitated between BCrypt and PBKDF2 for password hashing. In many forums and blogs people say something like "In their Special Publication SP 800-132 NIST basically recommends using PBKDF2 for ...

1
2 3 4 5
75