Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
915 questions
944
votes
11
answers
332k
views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the database,...
AviD♦
- 73.6k
1288
votes
23
answers
292k
views
XKCD #936: Short complex password, or long dictionary passphrase?
How accurate is this XKCD comic from August 10, 2011?
I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
672
votes
4
answers
337k
views
Do any security experts recommend bcrypt for password storage?
On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
- 6,805
630
votes
7
answers
246k
views
How to store salt?
If you expect to store user password securely, you need to do at least the following:
$pwd=hash(hash($password) + salt)
Then, you store $pwd in your system instead of the real password. I have seen ...
- 6,497
171
votes
13
answers
111k
views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
- 1,945
273
votes
7
answers
118k
views
Password Hashing: add salt + pepper or is salt enough?
Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding.
...
- 7,752
626
votes
23
answers
154k
views
How does changing your password every 90 days increase security?
Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
- 6,821
893
votes
14
answers
179k
views
What technical reasons are there to have low maximum password lengths?
I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites where I actually care ...
- 8,251
546
votes
11
answers
95k
views
Is my developer's home-brew password security right or wrong, and why?
A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below.
His team spent months adopting an industry standard protocol using Bcrypt. ...
- 4,739
258
votes
8
answers
79k
views
Why are salted hashes more secure for password storage?
I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters).
My ...
user40448
68
votes
6
answers
18k
views
How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?
I thought How can a system enforce a minimum number of changed characters... would answer my question, but it seems this is a different case.
When I sign on to my online banking account, I'm prompted ...
- 1,061
205
votes
10
answers
126k
views
How safe are password managers like LastPass?
I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long.
How safe are password ...
- 2,871
83
votes
10
answers
50k
views
Generic error message for wrong password or username - is this really helpful?
It is really common (and I would say it is some kind of security basic) to not show on the login page if the username or the password was wrong when a user tries to log in.
One should show a generic ...
- 933
240
votes
5
answers
115k
views
Recommended # of iterations when using PBKDF2-SHA256?
I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
- 2,588
54
votes
4
answers
13k
views
Password manager vs remembering passwords
I have always thought that you are not supposed to use a password manager but to keep your passwords in your head, but lately I have thought about the pros and cons of having a password manager.
Some ...
- 1,672
190
votes
6
answers
39k
views
Does Facebook store plain-text passwords?
I was about to reset my Facebook password and got this error:
Your new password is too similar to your current password. Please try another password.
I assumed that Facebook stores only password ...
- 4,204
85
votes
10
answers
11k
views
Why improvising your own Hash function out of existing hash functions is so bad
I'm afraid I'll have tomatoes thrown at me for asking this old question, but here goes.
After reading that cooking up your own password hash out of existing hashing functions is dangerous over and ...
- 1,548
26
votes
1
answer
3k
views
Password Managers: encrypted database vs hashing strategy
I'm considering moving to a password-management strategy based on supergenpass or something similar. This is an alternative to other password managers where instead of having a database of passwords ...
- 522
22
votes
5
answers
8k
views
Is including a secret GUID in an URL Security Through Obscurity?
I know that this question is a little bit on the side of Opinion/Discussion, but I think there's a provable answer to it.
I think the common view of "Security Through Obscurity" is that the security ...
- 329
6
votes
4
answers
2k
views
What to do about email threats containing leaked passwords?
A few days ago I got an email from a hacker supposedly using an email of mine (he was using the same email address TO and FROM) from my own email domain, and had a part of a password I use to purchase ...
- 61
126
votes
10
answers
18k
views
How critical is it to keep your password length secret?
Is keeping your password length secret critical to security?
Does someone knowing that you have a password length of say 17 make the password drastically easier to brute force?
- 2,617
108
votes
13
answers
75k
views
Why is client-side hashing of a password so uncommon?
There are very few websites that hash the users password before submitting it to the server. Javascript doesn't even have support for SHA or other algorithms.
But I can think of quite a few ...
- 1,193
88
votes
11
answers
25k
views
What to do about websites that store plain text passwords
I recently received an email from a popular graduate job website (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
- 1,103
53
votes
4
answers
23k
views
Why is using salt more secure?
Storing the hash of users' passwords, e.g. in a database, is insecure since human passwords are vulnerable to dictionary attacks. Everyone suggests that this is mitigated via the use of salts, but the ...
- 1,405
47
votes
2
answers
10k
views
Are there more modern password hashing methods than bcrypt and scrypt?
This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt.
What I'm wondering is if there are any "...
- 2,928
121
votes
11
answers
27k
views
Password rules: Should I disallow "leetspeak" dictionary passwords like XKCD's Tr0ub4dor&3
TLDR: We already require two-factor authentication for some users. I'm hashing, salting, and doing things to encourage long passphrases. I'm not interested in the merits of password complexity rules ...
- 1,593
54
votes
11
answers
8k
views
Is there a method of generating site-specific passwords which can be executed in my own head?
I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
- 803
51
votes
6
answers
10k
views
How valuable is secrecy of an algorithm?
On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
- 83.8k
105
votes
5
answers
67k
views
Is sending password to user email secure?
How secure is sending passwords through email to a user, since email isn't secured by HTTPS.
What is the best way to secure it? Should i use encryption?
- 1,403
59
votes
38
answers
13k
views
What is your way to create good passwords that can actually be remembered?
What are the methodologies which can be used to generate "human" good quality password?
They have to ensure a good strength and also easy to remember for a human being.
58
votes
2
answers
8k
views
What should end-users do about Heartbleed?
What should a website operator do about the Heartbleed OpenSSL exploit? mainly talks about what people running websites should do about Heartbleed.
What should end-users of websites be doing?
Do ...
- 2,112
48
votes
4
answers
13k
views
What to transfer? Password or its hash?
Let's say in my database I store passwords hashed with salt with a fairly expensive hash (scrypt, 1000 rounds of SHA2, whatever).
Upon login, what should I transfer over the network and why? Password ...
- 755
48
votes
5
answers
72k
views
openssl: recover key and IV by passphrase
A large amount of files were encrypted by
openssl enc -aes-256-cbc -pass pass:MYPASSWORD
Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
39
votes
8
answers
8k
views
Are password complexity rules counterproductive?
In creating a login for this site I chose a nondictionary password that would be extremely hard to guess, but easy to remember.
I was told that it did not meet complexity rules.
After several ...
- 501
35
votes
3
answers
7k
views
For an HTTPS web application, is it worthwhile to encrypt the password before POSTing it, to keep a MITM attacker from harversting it?
Our application has recently gone through penetration testing. The test found one critical security breach, which is essentially:
The problem:
Attacker sets up a WiFi spot.
User enters our site (...
- 665
23
votes
5
answers
6k
views
Is this idea for a password manager secure? If so, why doesn't anybody use it? [closed]
I've been thinking of a problem with usual password managers: although they do provide better security than manually using passwords, there's a central database that can get lost, get compromised, etc....
- 576
11
votes
4
answers
6k
views
Alternatives for sending plaintext password while login
Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
- 953
241
votes
10
answers
95k
views
Is "the oft-cited XKCD scheme [...] no longer good advice"?
I was stumbling around and happened onto this essay by Bruce Schneier claiming that the XKCD password scheme was effectively dead.
Modern password crackers combine different words from their ...
- 3,462
65
votes
2
answers
39k
views
I just send username and password over https. Is this ok?
When a user's logging in to my site, they send their username and password to me over https. Besides the ssl, there's no special obfuscation of the password - it lives in memory in the browser in the ...
- 1,017
74
votes
13
answers
17k
views
How reliable is a password strength checker?
I've tested the tool from Microsoft available here which tests password strength and rates them. For a password such as "i am going to have lunch tonight", the tool rates it's strength as "BEST" and ...
- 749
35
votes
4
answers
10k
views
Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?
I am developing an application in PHP and it uses bcrypt encryption to store passwords. I want to keep the history of hashes whenever the user changes the password. By doing this I want to stop the ...
- 526
30
votes
5
answers
5k
views
Recommended policy on password complexity
Is there any research on how how a password complexity policy can increase or decrease the quality of passwords?
If you don't have any requirements on the password then probably 90% of users will use ...
- 1,672
30
votes
3
answers
12k
views
How secure is asking for specific characters of passwords instead of the entire thing?
In some password-authenticated sites, you are asked to enter a random selection of specific characters from your password rather than the whole word/phrase. For example, it might say 'Enter the 1st, ...
- 505
25
votes
3
answers
15k
views
Calculating password entropy?
Whenever I look at password entropy, the only equation I ever see is E = log2(RL) = log2(R) * L, where E is password entropy, R is the range of available characters, and L is the password length.
I ...
- 2,167
23
votes
3
answers
96k
views
Four-way Handshake in WPA-Personal (WPA-PSK)
Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
- 399
17
votes
8
answers
5k
views
Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?
I don't know why do we authenticate by prompting the user to enter both username and password.
In my mental model, prompting password only suffices.
The reason is as follows:
Assume there are x ...
- 375
81
votes
9
answers
28k
views
Is it OK to tell your password to your company's sysadmin?
I'm working in a small company (20 employees) as a senior software engineer.
After having problems with my email, our newly employed IT administrator asked me to write my user password to someone in ...
- 1,219
30
votes
3
answers
4k
views
Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers?
I just saw for the first time a new way to enter a password, at the Banque Postale (French Bank). You are given a virtual numeric keyboard and to type you can just leave the mouse cursor over a number ...
- 402
28
votes
7
answers
19k
views
Do salts have to be random, or just unique and unknown?
First of all, my objective is to avoid storing the salt in the database as plain text. As far as this question is concerned, the salt is not stored in the database.
After discussion in comments and in ...
user26547
476
votes
14
answers
110k
views
Are passwords stored in memory safe?
I just realized that, in any language, when you save a password in a variable, it is stored as plain text in the memory.
I think the OS does its job and forbids processes from accessing each other's ...
- 4,707