Questions tagged [passwords]

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

Filter by
Sorted by
Tagged with
0 votes
0 answers
19 views

Any studies on the hardware costs of server-side password hashing? [closed]

I am researching the state of the art in password security on the web and the general consensus seems to be that server-side hashing with a slow hashing algorithm (Argon2id, bcrypt, scrypt etc) is the ...
1 vote
1 answer
69 views

Databases for compromised passwords that browsers use

I am looking into databases of compromised passwords in order to ensure that passwords on a system I am responsible for are not already compromised. To have complete peace of mind, I prefer to get ...
0 votes
2 answers
76 views

How much does the strength of the password depend on the variety of characters?

For example, a password consisting only of lower-case characters [a-z], but a length of 10 (26^10), will always be better than all characters, but a length of 7 (95^7). That is, how much is it correct ...
2 votes
1 answer
116 views

Where to store the password: in RAM or another user's home folder (Linux)

There is user1 and user2. All work is done from under user1. user2 is only created to store important information. If important information is stored in RAM, but in the session of user1, which is ...
0 votes
1 answer
347 views

Hydra only executes one try per task then hangs

As in the title, hydra will only execute one try per task before hanging. $ hydra -l admin -P /usr/share/wordlists/wfuzz/general/common.txt -u 10.10.68.141 http-post-form "/admin:user=^USER^&...
0 votes
1 answer
110 views

What tools currently allow to retrieve Windows 10/11 password hashes, given admin rights or physical access to unencrypted disks?

I was wondering what Windows/Linux/Live tools allow to retrieve user password hashes of modern 2021 Win10/11 installations. I am not sure if password storage differs in these cases (e.g. different ...
8 votes
3 answers
3k views

Argon2 vs SHA-512, what's better in my case?

First I am very bad in cryptographic algorithms. I found online that Argon2 is more secure than SHA-512, so I used it for password hashing. There're recommended options for Argon2: Memory: 4Gb ...
27 votes
4 answers
10k views

Should I implement incorrect password delay in a website or a webservice?

With arguments expressed in this answer, there is a few seconds delay between user enters an incorrect password and when he/she actually learns, that password was incorrect. This security solution is ...
0 votes
3 answers
590 views

is it a standard best practice to *display* the last-logged-in user by default on an individual employee laptop?

My new workplace laptop is configured so that after I log off and log on, rather than the last-logged-in user being selected by default, I have to hit ctrl-alt-del and then enter my username and ...
2 votes
1 answer
261 views

Security of re-encryption with a list of pre-computed password based keys

I have a problem where an encrypted file stored on a server needs to be decrypted through a precomputed list of passwords that are used one time only - OTP applied to encryption basically. The file is ...
2 votes
3 answers
3k views

Is this a secure approach to store a master password?

I have come up with the following approach to remember master passwords (to use in software like KeePass, etc): Since it is annoying to type the master password every time we power up the PC, we store ...
4 votes
2 answers
801 views

How many bits of entropy should a password have to be reasonably future proof (10+ years)?

I’ve seen estimations that the NSA is capable of at least 1 trillion (PGP pass phrase) guesses per second, which would mean a password with 80 bits of entropy would take, on average, over 15,000 years ...
96 votes
10 answers
32k views

If a provider sees the last 4 characters of my password, can they see it in full?

I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
0 votes
0 answers
25 views

Cracking password with static prefix and suffix

I found a pattern password generation that works like that: sha1("very long static prefix text blablabla "+password+" very long static suffix text"); I tried hashcat combined ...
0 votes
1 answer
72 views

Password-less AND E-mail-less user accounts? [closed]

I'm starting a small web project. It won't have that many users, and it is a crappy little game, so any accounts that are stolen aren't the end of the world. I do not want to store (or even ask) the ...
1 vote
1 answer
91 views

Potential problems with insecure password hashing

For my job I use some industry-specific software that stores sensitive information. The software has a web interface with a public login page. One time I attempted to log in, but mistyped the last few ...
1 vote
2 answers
372 views

How to safely use a Key Derivation Function to secure private data - need guidance

I have some secure data created in my client app which I wish to store on the server as backup for the user. The user already has a password to authenticate with the server. The password is never ...
0 votes
1 answer
864 views

What can I do to improve my Keepass XC setup?

I'm planning on using KeePass XC for the first time and am trying to create a setup that: (1) would prevent hackers from stealing my passwords (2) would prevent me from losing access to my ...
0 votes
0 answers
66 views

Encrypt SVN for passwords

Could anyone give me advice on the best way to encrypt the SVN version control system on a Amazon Linux 2 instance? I am planning to encrypt or disable the SVN from asking if unencrypted passwords ...
49 votes
5 answers
80k views

SSH key auth, but still need password for sudo?

SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive ...
-1 votes
3 answers
147 views

Why are there often random email addresses in known password word lists?

In known wordlists like crackstation.lst there are random emails in the list. Why are they there?
2 votes
1 answer
141 views

Does the random presence of a common password sequence within a larger password weaken the password?

I have a somewhat basic understanding of how entropy relates to password strength - generating a password with a truly random selection from some set (whether that's characters, or a set of dictionary ...
0 votes
2 answers
44 views

Storing backup keys (2FA) for online accounts

So I spent the day looking for a good solution of storing the backup keys or the 2FA codes and can't seem to find a convenient way for me, many people have different takes on this, so far I found 2 ...
2 votes
1 answer
90 views

What would be the most secure way to store and save my passwords on my desktop?

I store my passwords in a multitude of ways, these are all sorts of passwords, not only for websites and browsers. I also have credit card numbers, addresses etc... Now I'm using these methods: ...
0 votes
0 answers
69 views

Allow for login through Tor while preventing brute force/distributed password attacks?

I am making a website with the goal of blocking bots that are trying to login from different IP addresses constantly... while still allowing regular users to login via Tor. One of the approaches to ...
6 votes
1 answer
132 views

Password hashing algorithms that can transform an existing hash to a different cost setting without knowledge of the password

The password hashing competition, started in 2014 and Argon2 was the winner in 2015, listed evaluation criteria for the competition. There is an interesting one in the Functionality section; Ability ...
23 votes
5 answers
12k views

Best practices for storing 2FA recovery codes

I’ve recently started using 2FA on a bunch of services and I’m not sure how to best store the recovery codes. I can think of 3 options: In a secure note on LastPass In a Dropbox folder On a usb stick ...
2 votes
2 answers
47 views

Mitigating the performance impact of strong hashes with Basic HTTP authentication

I am trying to decide which work factor to use for our hashed passwords, and I am facing the following dilemma. Let me elaborate for a moment. Basic HTTP authentication works as follows: The user ...
2 votes
1 answer
87 views

If multiple of the same password have the same hashed value in a database, does that mean the password is not being salted?

I just started a new job last week and I'm asking for a sanity-check before I mention this to anyone. All the new employee accounts are created with the same default password (I know, already a no-no)....
5 votes
1 answer
2k views

How disable "last password you remember" of Google, after knowing that someone has my password?

I have received this email from Google: Someone just used your password to try to sign in to your Google Account xxxxxx@gmail.com. Details: Sunday, July 9, 2017 11:27 AM (France Time) *****...
23 votes
12 answers
7k views

Storing weakness level of passwords

I am implementing a system where I need to store passwords in a database (hashed and all). My issue is that the business side requires me to not enforce any constraint on them except length (8 ...
1 vote
1 answer
83 views

Rationale behind disallowing the use of similar passwords?

I recently had to change my password on a linux server (RedHat). It wouldn't let me use my password of choice because it was "too similar" to my previous password. Is this really ...
0 votes
1 answer
93 views

When my computer says my password is weak, and suggest a new one, is that password safe?

I was logging into YouTube when Apple said my password was weak, and I should change it. Is this randomly generated password safe?
0 votes
2 answers
142 views

What are security benefits (if any) of using multiple passwords (device, password manager, …) vs single strong passphrase when paired with FIDO U2F?

I am evaluating security benefits of requiring employees (in enterprise context) to use multiple passwords (or passphrases) vs single strong randomly generated passphrase (minimum of 8 words) when ...
0 votes
1 answer
58 views

Voice input as security measures for system authentication

Can voice input as password could be a useful security measure aa a alternative for strong password (Keyboard characters complex), biometric (face, thumb, signature etc)? The voice inputted as a ...
2 votes
2 answers
501 views

What are the security features of the Microsoft PasswordVault class?

There doesn't seem to be much information on the PasswordVault but it seems to provide for local encryption of credentials. There are references to it in this source code and this blog. The reason I'm ...
11 votes
4 answers
8k views

Temporary passwords e-mailed out as plain text

Is this a security issue? Many big ecommerce platform companies use this feature. Where if you forgot your password, they e-mail you a temp password. Could someone potentially figure out the ...
0 votes
1 answer
78 views

Is it possible to design a system with two passwords?

Is it possible to design a system with two passwords prompts? The system will have to prompt for two passwords The system would have to validate first password before prompting for second password ...
1 vote
1 answer
62 views

how does fingerprint authentication work without trusting the client device?

There are lots of resources discussing the security of fingerprints but I haven't been able to find the answer to a very basic question. In the simplest possible password authentication scenario, the ...
2 votes
3 answers
3k views

Securely changing Veracrypt password

How can I change a Veracrypt (master) password efficiently and securely? Based on the answers here, it is not safe to use system --> change password due to various reasons. I cannot simply image ...
0 votes
0 answers
25 views

Can a website access your browser password vault using a button that the user clicks? [duplicate]

I'm asking this question because almost all new websites ask us to click Accept Cookies button. So I click it reluctantly. I am afraid that the Accept Cookies button action would trigger some script ...
151 votes
11 answers
86k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
2 votes
2 answers
190 views

Quantify security strength from entropy and lifetime

Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
10 votes
3 answers
5k views

How can I report PCI-DSS violations?

A large supermarket chain in the UK, are storing their passwords in plaintext. Apparently, Mastercard's security department are already involved. I'd like to report them for violating PCI-DSS, since ...
4 votes
2 answers
225 views

If the connection is encrypted, is it still unsafe to login at a public network?

It's common knowledge that one shouldn't login to personal or bank accounts on public wifi such as in a starbucks or a hotel. However, assuming that the connection is HTTPS and the passwords itself ...
-1 votes
1 answer
46 views

Credentials in a POST body over https are visible [duplicate]

Hey so am new to pentesting and I learnt that using https makes the traffic encrypted so hackers cannot decipher credentials passed in a body for example in a login page or read the traffic properly. ...
3 votes
2 answers
1k views

Does typing something in Notepad but not saving it leave any trace?

Sometimes, if I'm having trouble typing a long password, I'll open up Notepad, type it in there (so I can make sure what I'm typing is correct), and then copy+paste it into the form, and then close ...
31 votes
2 answers
10k views

Should I assign my various passwords to my keyboard's macro keys?

I had an idea to assign my keyboard's macro keys to various passwords so I can just hit the key and it will paste in (the passwords are long and random so I won't remember them). This is on a home ...
20 votes
2 answers
5k views

Shouldn’t patterns be just as secure as PINs?

I’ve seen multiple sources online that say that unlock patterns are less safe than ‘random’ PINs. I was thinking; how come? From what I see, they would both be just as secure; you chose different ...
5 votes
2 answers
442 views

Which user authentication measures are used nowadays?

I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, ...

1
2 3 4 5
78