Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
4,067 questions
-1
votes
0
answers
20
views
Why are obsurantist approaches to improving password hashing security ineffective? [closed]
For websites that have nothing of value nor any personal data, that only have emails and hashed passwords, the only motivation for attackers (except those who just want to be locally disruptive) is to ...
- 1
7
votes
4
answers
2k
views
Is a password easier to brute force if it contains a repeating pattern?
My question is different from this previous question: Does repeating one word to form a password result in a similar pattern in its encrypted format?. I'm specifically wondering about brute force ...
- 2,727
-4
votes
0
answers
90
views
The neighbors been using her internet and asked for the new password she gave him StheH0A what does that mean it's not the real password [closed]
What does the internet password StheH0A mean it's a fake password meant for a internet thief
- 132k
16
votes
4
answers
3k
views
Why might an operating system require a restart after N failed login attempts?
I continually entered my password incorrectly whilst trying to login to Windows 11. I expected that after N failed attempts I would then start to see an increasing time delay after each subsequent ...
- 3,025
2
votes
1
answer
289
views
What's the best method of securing keys/passwords used by a PowerShell script that runs when no user is logged in, using only one server, for free?
I have a server set up to run a PowerShell script every 15 minutes. This script needs to make API requests with keys and passwords. The script runs even when no user is logged in, so encryption based ...
- 22.9k
5
votes
2
answers
1k
views
How to allow a user to login via client X.509 certificate or username/password?
I have a niche website programmed by a volunteer. Like pretty much every website it's secured via TLS, and the main page doesn't let you do much except login via username & password or request an ...
- 22.9k
0
votes
2
answers
100
views
Is it bad practice to reuse a private key password across multiple keys?
Whether it be a private key for a TLS certificate, an SSH server, or a code signing cert, is it bad practice to use the same password across multiple?
My assumption would be no, seeing as a key ...
- 26.9k
0
votes
0
answers
38
views
How to exploit Python script and sudo subprocess shared file handle?
I am wondering what attacks would be theoretically possible against a Python script that executes a subprocess involving sudo. I know that asking for the sudo password using input() or getpass(), then ...
9
votes
4
answers
3k
views
Does Windows 11 PIN Behavior Break Password Security Conventions?
Building on the theme presented in this previous question, does Window's current PIN input userflow break standard password security practices?
Behavior: When the user inputs the correct number of ...
- 137
7
votes
3
answers
1k
views
Is it safe to store a passphrase encrypted SSH key in git?
I have a bunch of servers that need to access somewhat sensitive data (passwords for ftps, api keys, etc). Currently I copy a plaintext file back-and-forth between the servers via ssh and encrypt all ...
- 493
2
votes
2
answers
687
views
What are the security features of the Microsoft PasswordVault class?
There doesn't seem to be much information on the PasswordVault but it seems to provide for local encryption of credentials.
There are references to it in this source code and this blog.
The reason I'm ...
CommunityBot
- 1
1
vote
1
answer
56
views
Does a Passkey authentication system need bootstrapping by username and password?
The Register has an article on Passkeys, and one of the issues they use to argue that they are unlikely to be widely adopted is:
The process is bootstrapped by getting the user to authenticate using ...
- 22.9k
1
vote
1
answer
84
views
What is the logic of using numbers for Windows PIN?
Windows 10 and 11 have an authentication method based on entering a lower complexity code under certain circumstances. This is widely referred to as a PIN, indicating that these are widely thought of ...
- 22.9k
2
votes
1
answer
373
views
Password checks in backend vs. password encrypted data sent to frontend?
Lets assume I am building a pastebin-like web app: users can upload text notes and share them. Users should be able to password-protect notes. Whenever viewing such a note, other users must first ...
- 22.9k
3
votes
3
answers
5k
views
Securely changing Veracrypt password
How can I change a Veracrypt (master) password efficiently and securely?
Based on the answers here, it is not safe to use system --> change password due to various reasons.
I cannot simply image ...
CommunityBot
- 1
9
votes
5
answers
4k
views
Why don't we use HTML password inputfields for usernames and 2FA codes in the front-end of web applications?
When entering a username and password on a web application I have always wondered why the username often equals personal email address (which is often known or easy to guess or find). A random ...
- 107
3
votes
1
answer
377
views
Can I skip any password hashing for localhost authentication?
Setup
I have several services (Postfix, Apache (PHP)) that access a PostgreSQL database on a Debian Linux 10 system.
everyone is on the same host
they use the loopback interface (127.0.0.1) to ...
CommunityBot
- 1
4
votes
2
answers
309
views
Quantify security strength from entropy and lifetime
Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
CommunityBot
- 1
1
vote
1
answer
104
views
Are the encrypted browser-saved passwords randomly overwritten when deleted?
Normal ‘deleting’ of data and actually randomly overwriting it are very different in terms of security. So, just deleting passwords is not considered secure, because they can be recovered.
And ...
- 22.9k
1
vote
1
answer
8k
views
How to recover lost zip file password?
I have a folder with very important files on my computer and I zipped it with a password for security reasons. Unfortunately, I'm not able to recover the password. Usually, I always use the same kind ...
0
votes
1
answer
101
views
Encryption password in program, to secure its centrally-stored settings?
I was thinking of implementing this in software, starting with one password, with each new release being derived from that initial password.
(trying to find the name of this technique, I think it's ...
- 113
10
votes
1
answer
5k
views
Why do best practices recommend against adding your own pepper to passwords before hashing?
According to my research, if you want to store passwords securely, you should use built-in hash functions that have been vetted by the professionals. Best practices recommend that you do not add a ...
- 22.9k
13
votes
3
answers
6k
views
Can admin see my password when I enter it?
If the admin is a super user, nothing can prevent them from installing anything on my host, including keystroke logger. Are there any security mechanisms that can protect my account against that?
- 1
2
votes
2
answers
868
views
Preventing authentication (login) timing attacks in a nodejs application
I am using graphql and my login function is resolved using a promise. The username is an email address.
The steps in the logic are the following: -
Validate CRSF token else return generic response (&...
27
votes
4
answers
6k
views
When might it *not* be a good idea to reset your password immediately?
Let's suppose I'm an Evil Hacker™ and I just breached a website, stole all their bcrypt passwords, and defaced their site for the lulz. But since it's bcrypt I can't crack anything.
I feel like what I'...
- 19.1k
1
vote
0
answers
38
views
Why are 5-digit PIN-codes so rare? [duplicate]
In case you haven’t noticed, 5-digit PIN-codes are incredibly rare, with their 4-digit and 6-digit counterparts being profusely more common.
In fact, I’d be impressed if you can name a single popular ...
- 3,025
0
votes
2
answers
10k
views
Facebook messages with a suspicious link, what information can they get if I dont enter any details?
I received one of those messages from a Facebook friend where it says something like "Is this really you in this video?" and then send an accompanying link. I clicked this link from within Messenger ...
CommunityBot
- 1
1
vote
1
answer
72
views
Relative security of ssh password and public key to remote systems
I just know everyone is going to shout at me that public key is better but let me spell out the actual scenario first.
I have a small LAN at home, basically I'm the only regular user but other members ...
- 22.9k
0
votes
2
answers
685
views
Generating a file and a password with matching MD5 hashes?
I'm trying to generate a file full of data with an MD5 hash that matches the hash of some password string.
Because I don't care exactly what the string is, I figure that this is second-preimage, and ...
CommunityBot
- 1
15
votes
2
answers
2k
views
Can the human brain generate cryptographically secure random numbers?
A security conscious friend of mine was attempting to generate entropy using random dice rolls to generate a random password, and I became curious about the security of random number generators and ...
- 3
15
votes
5
answers
5k
views
Should I reset my password on Internet Archive?
Internet Archive was recently hacked. They posted a message:
What we know: DDOS attack-fended off for now; defacement of our website via JS library; breach of usernames/email/salted-encrypted ...
- 2,993
1
vote
3
answers
440
views
Why is it a problem when password hashes are leaked?
I only store password hashes in the database and use them to verify the password entered by the user. As far as I know, reversing a hash is impractical. So even if I have the password hash, I can only ...
- 22.9k
2
votes
2
answers
118
views
Is the Windows Password that's Used for Window Encryption available to Microsoft?
How does Windows manage passwords used for whole disk encryption? Is the password linked to the Windows account in a way where Microsoft has access to the password and thus a legal obligation to ...
- 129
4
votes
1
answer
1k
views
Is using `crypt` in PostgreSQL for password comparison secure against timing attacks?
I'm currently using PostgreSQL with the pgcrypto extension to store and verify user passwords. When a user logs in, I compare the entered password with the stored hash using the following query:
...
- 22.9k
0
votes
1
answer
192
views
FFUF command returns status code 400, regardless of mode option: clusterbomb, pitchfork, sniper
I'm working on a lab on PortSwigger.com titled Username enumeration via different responses. While using ffuf to solve the lab, the output keeps returning a 400 status code.
So far this is what I've ...
CommunityBot
- 1
4
votes
1
answer
579
views
Storing password strength information along with password
I'm working on an authentication system that uses passwords. I would like to follow modern NIST best practices with regards to password strength.
However, I also considered it may be nice to store ...
0
votes
1
answer
130
views
Why is "not storing data protection keys" not a popular choice?
In the NIST SP 800-132, they specified two ways to use the data protection key (DPK) that is derived from a password. One of them is to use the DPK to encrypt data, and then, if I am not mistaken, ...
5
votes
3
answers
20k
views
What exactly is 'single' mode in John the Ripper doing?
I'm testing out John the Ripper (1.7.9 Jumbo 7) on a file containing MD5 hashes without any usernames. I've been experimenting with different rules and configurations – I am currently using a wordlist ...
- 9,717
3
votes
1
answer
2k
views
JTR finishing very quickly with rockyou.txt and not cracking the hash
I've been fumbling through the world of Information Security by going through the HTB challenges, and I've come across an issue I just can't seem to find an answer for. During one of the challenges I'...
CommunityBot
- 1
2
votes
4
answers
292
views
Password storage/retrieval for local network server
I have an application server, written in C++ and also uses REST API to serve requests. There is no database, just a simple service which returns if the content of request is valid.
Situation
The ...
CommunityBot
- 1
2
votes
3
answers
768
views
Admin change user details / account information in admin interface
I'm creating this admin dashboard, and I have a question wich I have been stuck on for a while now.
And I'm starting to question what kind of data the admin should be able edit/view on the other ...
CommunityBot
- 1
2
votes
0
answers
138
views
How to investigate further the iOS notification "This password has appeared in a data leak"?
On the iPhone managed by my employer, I recently received 3 notifications of “This password has appeared in a data leak”, and they're all related to instances of outside vendors setting up a ...
- 237
16
votes
3
answers
17k
views
Argon2 vs SHA-512, what's better in my case?
First I am very bad in cryptographic algorithms.
I found online that Argon2 is more secure than SHA-512, so I used it for password hashing.
There're recommended options for Argon2:
Memory: 4Gb
...
1
vote
1
answer
64
views
Is it currently considered strong security to store the encrypted data and encryption key in the same database? [duplicate]
In 2024, is it considered safe to encrypt user data, store the encryption keys in the database, and protect them with user credentials? Deriving keys from user password is not ideal in my design. My ...
- 132k
0
votes
1
answer
522
views
How to change the password hashing scheme in LDAP using an external library with slapd.d config
I am trying to change the password hashing scheme for LDAP. Hypothetically, let's assume it's pw-argon.so
I don't have slapd.conf I have the slapd.d directory where I can make changes dynamically to ...
CommunityBot
- 1
0
votes
2
answers
959
views
Save private key in a database to share between multiple accounts
I don't know if my concept would be secure so I ask here. The main purpose is to log in with password x and also use that password to encrypt an RSA private key with AES to store that in the main ...
CommunityBot
- 1
4
votes
1
answer
40k
views
"john --format=md5" caused "Unknown ciphertext format name requested" error
This is known md5 hash for Kioptrix: Level 1.1 (#2)
Linux unshadow file
wolf@linux:~$ cat md5hash.txt
root:$1$FTpMLT88$VdzDQTTcksukSKMLRSVlc.:0:0:root:/root:/bin/bash
john:$1$wk7kHI5I$...
23
votes
4
answers
10k
views
Whats the safest way to store a password in database?
I read that a password and a salt needs to be combined and then hashed. You save the result and the salt in plaintext. Is it a good practice to use the username as a salt? Why and why not?
I also read ...
50
votes
11
answers
17k
views
Confused about using a password that "would take centuries to break"
I am talking about this password - 23##24$$25%%26 and the similar ones consisting of special characters appearing in a pattern, which the users these days use a lot.
At work (finance company), I was ...
- 2,727
0
votes
0
answers
20
views
Is the Windows PIN sign-in option good protection in case of device theft? [duplicate]
I've been hearing stories about people suffering apartment break-ins. This made me think about what might be stolen from my apartment if something similar happened, and the desktop computer certainly ...
- 132k