Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
4,067 questions
-1
votes
0
answers
20
views
Why are obsurantist approaches to improving password hashing security ineffective? [closed]
For websites that have nothing of value nor any personal data, that only have emails and hashed passwords, the only motivation for attackers (except those who just want to be locally disruptive) is to ...
- 1
-4
votes
0
answers
90
views
The neighbors been using her internet and asked for the new password she gave him StheH0A what does that mean it's not the real password [closed]
What does the internet password StheH0A mean it's a fake password meant for a internet thief
- 1
16
votes
4
answers
3k
views
Why might an operating system require a restart after N failed login attempts?
I continually entered my password incorrectly whilst trying to login to Windows 11. I expected that after N failed attempts I would then start to see an increasing time delay after each subsequent ...
- 263
2
votes
1
answer
289
views
What's the best method of securing keys/passwords used by a PowerShell script that runs when no user is logged in, using only one server, for free?
I have a server set up to run a PowerShell script every 15 minutes. This script needs to make API requests with keys and passwords. The script runs even when no user is logged in, so encryption based ...
user258111
5
votes
2
answers
1k
views
How to allow a user to login via client X.509 certificate or username/password?
I have a niche website programmed by a volunteer. Like pretty much every website it's secured via TLS, and the main page doesn't let you do much except login via username & password or request an ...
- 51
0
votes
2
answers
100
views
Is it bad practice to reuse a private key password across multiple keys?
Whether it be a private key for a TLS certificate, an SSH server, or a code signing cert, is it bad practice to use the same password across multiple?
My assumption would be no, seeing as a key ...
- 3,025
0
votes
0
answers
38
views
How to exploit Python script and sudo subprocess shared file handle?
I am wondering what attacks would be theoretically possible against a Python script that executes a subprocess involving sudo. I know that asking for the sudo password using input() or getpass(), then ...
1
vote
1
answer
84
views
What is the logic of using numbers for Windows PIN?
Windows 10 and 11 have an authentication method based on entering a lower complexity code under certain circumstances. This is widely referred to as a PIN, indicating that these are widely thought of ...
- 375
1
vote
1
answer
56
views
Does a Passkey authentication system need bootstrapping by username and password?
The Register has an article on Passkeys, and one of the issues they use to argue that they are unlikely to be widely adopted is:
The process is bootstrapped by getting the user to authenticate using ...
- 375
9
votes
4
answers
3k
views
Does Windows 11 PIN Behavior Break Password Security Conventions?
Building on the theme presented in this previous question, does Window's current PIN input userflow break standard password security practices?
Behavior: When the user inputs the correct number of ...
- 193
2
votes
1
answer
373
views
Password checks in backend vs. password encrypted data sent to frontend?
Lets assume I am building a pastebin-like web app: users can upload text notes and share them. Users should be able to password-protect notes. Whenever viewing such a note, other users must first ...
- 415
9
votes
5
answers
4k
views
Why don't we use HTML password inputfields for usernames and 2FA codes in the front-end of web applications?
When entering a username and password on a web application I have always wondered why the username often equals personal email address (which is often known or easy to guess or find). A random ...
- 7,056
0
votes
1
answer
101
views
Encryption password in program, to secure its centrally-stored settings?
I was thinking of implementing this in software, starting with one password, with each new release being derived from that initial password.
(trying to find the name of this technique, I think it's ...
- 113
10
votes
1
answer
5k
views
Why do best practices recommend against adding your own pepper to passwords before hashing?
According to my research, if you want to store passwords securely, you should use built-in hash functions that have been vetted by the professionals. Best practices recommend that you do not add a ...
- 327
1
vote
1
answer
104
views
Are the encrypted browser-saved passwords randomly overwritten when deleted?
Normal ‘deleting’ of data and actually randomly overwriting it are very different in terms of security. So, just deleting passwords is not considered secure, because they can be recovered.
And ...
- 3,025
2
votes
2
answers
868
views
Preventing authentication (login) timing attacks in a nodejs application
I am using graphql and my login function is resolved using a promise. The username is an email address.
The steps in the logic are the following: -
Validate CRSF token else return generic response (&...
- 31
1
vote
0
answers
38
views
Why are 5-digit PIN-codes so rare? [duplicate]
In case you haven’t noticed, 5-digit PIN-codes are incredibly rare, with their 4-digit and 6-digit counterparts being profusely more common.
In fact, I’d be impressed if you can name a single popular ...
- 3,025
1
vote
1
answer
72
views
Relative security of ssh password and public key to remote systems
I just know everyone is going to shout at me that public key is better but let me spell out the actual scenario first.
I have a small LAN at home, basically I'm the only regular user but other members ...
- 351
27
votes
4
answers
6k
views
When might it *not* be a good idea to reset your password immediately?
Let's suppose I'm an Evil Hacker™ and I just breached a website, stole all their bcrypt passwords, and defaced their site for the lulz. But since it's bcrypt I can't crack anything.
I feel like what I'...
- 783
15
votes
5
answers
5k
views
Should I reset my password on Internet Archive?
Internet Archive was recently hacked. They posted a message:
What we know: DDOS attack-fended off for now; defacement of our website via JS library; breach of usernames/email/salted-encrypted ...
1
vote
3
answers
440
views
Why is it a problem when password hashes are leaked?
I only store password hashes in the database and use them to verify the password entered by the user. As far as I know, reversing a hash is impractical. So even if I have the password hash, I can only ...
- 113
2
votes
2
answers
118
views
Is the Windows Password that's Used for Window Encryption available to Microsoft?
How does Windows manage passwords used for whole disk encryption? Is the password linked to the Windows account in a way where Microsoft has access to the password and thus a legal obligation to ...
- 1,956
4
votes
1
answer
1k
views
Is using `crypt` in PostgreSQL for password comparison secure against timing attacks?
I'm currently using PostgreSQL with the pgcrypto extension to store and verify user passwords. When a user logs in, I compare the entered password with the stored hash using the following query:
...
- 45
4
votes
1
answer
579
views
Storing password strength information along with password
I'm working on an authentication system that uses passwords. I would like to follow modern NIST best practices with regards to password strength.
However, I also considered it may be nice to store ...
- 163
0
votes
1
answer
130
views
Why is "not storing data protection keys" not a popular choice?
In the NIST SP 800-132, they specified two ways to use the data protection key (DPK) that is derived from a password. One of them is to use the DPK to encrypt data, and then, if I am not mistaken, ...
- 13
2
votes
0
answers
138
views
How to investigate further the iOS notification "This password has appeared in a data leak"?
On the iPhone managed by my employer, I recently received 3 notifications of “This password has appeared in a data leak”, and they're all related to instances of outside vendors setting up a ...
- 237
1
vote
1
answer
64
views
Is it currently considered strong security to store the encrypted data and encryption key in the same database? [duplicate]
In 2024, is it considered safe to encrypt user data, store the encryption keys in the database, and protect them with user credentials? Deriving keys from user password is not ideal in my design. My ...
- 13
0
votes
0
answers
20
views
Is the Windows PIN sign-in option good protection in case of device theft? [duplicate]
I've been hearing stories about people suffering apartment break-ins. This made me think about what might be stolen from my apartment if something similar happened, and the desktop computer certainly ...
1
vote
1
answer
123
views
Is there a private, secure and easy login system?
I am trying to figure out the implications of authentication technologies. Answers to a previous question indicate my real question is more "meta than that.
The primary requirements for an ...
- 375
1
vote
2
answers
205
views
Why shouldn't I use the OAuth password grant if I have to implement a custom username+password login anyway?
I'm building a web REST API. Users must be able to authenticate themselves to this API.
I don't know ahead of time which clients will want to use the API. I want to allow for the possibility of anyone ...
- 11
23
votes
4
answers
10k
views
Whats the safest way to store a password in database?
I read that a password and a salt needs to be combined and then hashed. You save the result and the salt in plaintext. Is it a good practice to use the username as a salt? Why and why not?
I also read ...
- 369
16
votes
4
answers
5k
views
What prevents a browser from saving and tracking passwords entered to a site?
Since we are accessing Gmail from the Edge browser, Microsoft could have access to the Gmail password. Theoretically, Microsoft can track this password along with sending it to Gmail servers. What ...
- 473
1
vote
1
answer
70
views
Using a mask for Aircrack [duplicate]
I have been using aircrack with an old router of mine I have given it a password from one of my old networks. It has a simple convention; two numbers, a keyword with a capital at the start then two ...
1
vote
1
answer
86
views
After Flashing BIOS -> Password protection still enabled?
can someone confirm whether it is normal for the BIOS password protection to remain active and unchanged after performing a complete BIOS firmware upgrade? My assumption was that the entire flash ROM ...
- 43
1
vote
1
answer
159
views
Storing multiple hashes of the same password
My application requires users to connect via different protocol that each have different auth flows and hash requirements, in particular Argon2 and SHA-256 (for SCRAM-SHA-256).
To allow both types of ...
- 113
0
votes
1
answer
125
views
Strange way of handling forgotten password
I was about to signup for ebanking solution, but then noticed their instructions for forgotten password are: Create a new account.
So there's no option to reset your password, just a suggestion to ...
- 103
0
votes
1
answer
127
views
Passing password through terminal when using pass + gpg
I'm planning to use the pass to store passwords for a web service. My service will need to store passwords for many database servers. So my idea is store these passwords with the Linux pass command. I ...
- 45
0
votes
2
answers
169
views
Multiple Layers of Hashing when storing passwords [duplicate]
A common principle in InfoSec is Defence-In-Depth.
When encrypting sensitive data, it might make sense to have the data encrypted a few times.
Veracrypt does this for example with the AES-Twofish-...
- 715
0
votes
3
answers
271
views
How dangerous is it to Google my password? [duplicate]
I have heard numerous, numerous times that Googling your password to anything (like is Pass124 a good password), is a very bad idea- and surprisingly there is no question (that I could find) on this ...
- 3,025
1
vote
1
answer
116
views
Is there any reliable information on how many places make the mistake of storing passwords in plaintext?
I think the risk of passwords being stored in plain text (or easily reversible encryption) is well known. I'm curious though how frequently does it actually happen? Has there been any study or ...
- 115
1
vote
1
answer
137
views
How effective is re-entering your password to enable high-risk functions on your account when autofill is always available?
Websites ask for passwords to ensure you are the account owner before you make changes to high-risk settings, but autofill works all the time, even when the browser is in Incognito mode.
If someone ...
- 121
21
votes
2
answers
4k
views
Could a Google Chrome extension read my password?
I am concerned about the security of my passwords while using Google Chrome extensions. Specifically, I'd like to know if it's possible for a Chrome extension to read passwords that I enter on ...
- 321
2
votes
1
answer
134
views
Can I add salt to my salt for password hash? [duplicate]
Following this tutorial, I got a bunch of questions with this code :
const crypto = require("crypto")
async function hash(password) {
return new Promise((resolve, reject) => {
...
0
votes
1
answer
98
views
Is there a good case of passwords to be hidden on the screen to the extent it is? [closed]
In the olden days most computer displays involved a coaxial lead attached to a cathode ray tube. This functioned as a radio transmitter of what was displayed on the screen. I understood the response ...
- 375
-2
votes
1
answer
291
views
Why are passwords in the Linux terminal unmasked? [closed]
When entering a password into the password field in a Linux terminal- the password is just in the clear!
This is a commonly known fact.
But what if I'm in public, like in an office, and need to enter ...
- 3,025
2
votes
0
answers
62
views
Is it possible to create a random alphanumeric password with built in error detection? [closed]
A friend told me about a giant alphanumeric password that he had to enter somewhere. Although he was initially worried that he would need multiple attempts due to typos. He was pleasantly surprised ...
- 121
22
votes
3
answers
5k
views
Is there a problem with having a combined login/register screen?
I am designing a new login/register process for a system and want to combine the 2 initial pages for register and login.
This would be one page where the user would enter their email and press '...
- 221
4
votes
3
answers
2k
views
How to track PBKDF2 progress?
Background:
We have an application with password authentication. We now need to raise the number of PBKDF2-iterations and this means that the login takes quite a bit longer than before. Therefore, ...
- 647
2
votes
8
answers
518
views
Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password?
Will "☺ ¹²³ µ‼µ ÚÛÙ ♥♦♣♠" work as a password? If so, can you give me a password cracker specifically designed to crack non-keyboard characters? If yes, do you think it will crack this one?
- 21
2
votes
0
answers
572
views
I linked an account with Plaid. If I change my username and password, will that mostly protect me in the event of a breach?
This is very similar to this question from 5 years ago, but I didn't see a clear answer: Is Plaid safe if I change the password after deposit?
I've linked an account with Plaid. That account is 2FA ...
