Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
182
questions with no upvoted or accepted answers
8
votes
0
answers
378
views
How to determine the number of characters changed between two passwords as per DISA Application Developer STIG rule SV-84187r1_rule?
The DISA Application Developer STIG specifies:
Group ID (Vulid): V-69565
Rule ID: SV-84187r1_rule
Rule Version (STIG-ID): APSC-DV-001730
Rule Title: The application must require the change of at ...
- 81
4
votes
0
answers
636
views
Maximum password length for user accounts on Ubuntu
I have a VPS hosted at a remote location. Obviously the host can login directly (without SSH or any keys) on this box and I want to make brute force password guessing as hard as possible for a bad ...
- 165
4
votes
0
answers
178
views
How vulnerable are password managers in the real world?
I'm a senior undergraduate majoring in computer science. I recently took a computer security class where instead of exams we had a final project that could be anything related to computer security.
So ...
4
votes
0
answers
179
views
How to mitigate insecure password policy that I am forced to use?
The site in question is the UK regulator for companies at https://ewf.companieshouse.gov.uk. Online access to a company on this site enables the user to file/change various critical things on behalf ...
- 2,001
4
votes
0
answers
322
views
Saved password store on Android Edge browser
Does anyone have knowledge, or better yet, a reference document showing how and where passwords are stored when using the Edge browser on Android?
I'm assuming it's going to be SQLite, as I ...
- 49
4
votes
0
answers
2k
views
How exactly does "Apache Shiro's" hashing work when using a Desktop-Client
I was looking at this question
How does storing hash passwords work?
and every answer essentially says that Hashing is done via the server, or most of it should, as that is the safest way to do it. I ...
- 897
3
votes
0
answers
105
views
Any data on how many users change passwords after a breach notifcation?
Does anyone know of any study or any data whatsoever which might indicate how many users actually change their passwords after they have been notified that their credentials appeared in a breach?
- 638
3
votes
0
answers
1k
views
GPG: how to encrypt using a keyfile? (symmetric)
In Ubuntu this produces a "filename.txt.gpg" file and works:
$ gpg --symmetric --passphrase-file keyfile.key filename.txt
In debian, I get a popup requesting I enter a password...
How do I encrypt ...
- 31
3
votes
0
answers
797
views
Are enterprises Office 365 accounts overly exposed to brute force attacks?
Earlier this year the Scottish parliament was attacked by what described as a “Brute Force” cyber-attack. It was said that the attack targeted “MSPs and staff with parliamentary email addresses”.
...
- 7,639
3
votes
0
answers
654
views
Can we capture security key used in an NFC connection for Mifare Classic?
Millions of NFC Mifare Classic cards are used for public transport, access control and other purposes. These NFC tags use encryption so that the data on NFC tag cannot be read or changed by someone ...
- 199
3
votes
0
answers
91
views
Security concerns for long-lasting single use access tokens with secondary identity verification?
I have an application that has a user type that "returns as needed" over the course of 22 days to complete action items. The application handles sensitive/confidential information, but > 90% of users ...
- 131
3
votes
1
answer
1k
views
How secure is automatic authentication in Skype?
How secure is checking the automatic authentication option in Skype client? What if I sign in with Microsoft account instead of Skype id? What if both accounts are merged? Is there any documentation ...
user31793
2
votes
0
answers
53
views
How are the values of stored firefox credit cards encrypted? And how does one decrypt those?
While researching about the safety of web browsers I made my own program that can decrypt stored credentials, cookies, and other information of different browsers to see for myself how easy it is.
...
- 21
2
votes
0
answers
102
views
Security of in-app Forgot Password workflow in Xamarin (Mobile App) without using a website
I decided to implement "forgotten password" functionality, without having to create a website just for that. The usual workflow that I've seen for any app is:
User requests password reset
...
- 121
2
votes
0
answers
158
views
Why is John returning gibberish for cracked hashes
I've been messing around with John, and when I attempt to crack an SSH hash, I receive this output.
Any clue why the cracked hash is displaying the gibberish??
I used ssh2john to convert the key to a ...
- 21
2
votes
0
answers
76
views
Entering password on third party websites to enable integrations
I've got a third party service that I want to integrate with various other websites/applications, the third party service says they support this however rather than using an API key or OAuth to ...
- 121
2
votes
0
answers
103
views
Authentication in Desktop App
I'm reading the OWASP Authentication Cheat Sheet, but it obviously is focused only on web browser. I'm searching for something similar for a desktop app.
I want users to login to a desktop app. The ...
- 33
2
votes
0
answers
167
views
Why does firebase encrypt with password hashes instead of storing the hashes?
I am trying to migrate off of firebase, as in doing so, you can export the hashes of user passwords. Looking at their algorithm, they do not store password hashes, but rather, they use the first 32-...
- 121
2
votes
1
answer
141
views
Does the random presence of a common password sequence within a larger password weaken the password?
I have a somewhat basic understanding of how entropy relates to password strength - generating a password with a truly random selection from some set (whether that's characters, or a set of dictionary ...
- 121
2
votes
0
answers
2k
views
Recovered a 7z password with hashcat, but it's not the right one
I am trying to recover a 7z file, but have forgotten the password. It's completely AES-256 encrypted (i.e. not even the filenames are available).
Steps:
Generated hash file with 7z2hashcat.pl
Ran a ...
- 21
2
votes
0
answers
123
views
Can I skip any password hashing for localhost authentication?
Setup
I have several services (Postfix, Apache (PHP)) that access a PostgreSQL database on a Debian Linux 10 system.
everyone is on the same host
they use the loopback interface (127.0.0.1) to ...
2
votes
0
answers
572
views
If the given key of a Vigenère Cipher has repeated letters, does it make it any easier to break?
I am studying the Vigenère Cipher that given a passphrase uses rotating Caeser Ciphers to encode the plaintext. The ‘classical’ attacks on Vigenère first deduce the length of the passphrase by ...
- 21
2
votes
0
answers
160
views
Admin able to set new plaintext user password - security problem?
I am working on this application that can be deployed and run by anyone on their server. Most often, it is run as a web service. In our new version, we removed the possibility for admins to set and ...
- 53
2
votes
0
answers
66
views
Credential Storage for Partner/Vendor Accounts
We work with many other companies to do data exchange. As an example, we might work with COMPANY A to send them sensitive data over SFTP. This would be done by them giving us an SFTP Host/Account/...
2
votes
0
answers
96
views
How do biometric password managers work?
Many password managers for mobile offer the option to unlock the password vault with a fingerprint instead of a password. If you never type in your master password, how is it possible to decrypt the ...
- 513
2
votes
2
answers
192
views
Quantify security strength from entropy and lifetime
Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
- 31
2
votes
0
answers
307
views
Add additional rounds on existing SHA-512 salted hashes without knowing clear text password?
Assuming you have a salted SHA-512 password hash with 5000 rounds. For example:
{CRYPT}$6$rounds=5000$6835c5dcf0bb7310$hVod/jy7uONMSa.FVpLHb/2OrWpAj3lB/....
- 31
2
votes
0
answers
409
views
For cloud-based password managers, is it safe to login using public WiFi?
For cloud-based password managers, is it safe to login when using public WiFi?
To help get good answers to this question, let's define 3 terms:
Cloud-based password managers = Password managers such ...
2
votes
0
answers
123
views
User has been authenticated. Now what?
I'm trying to create a user authentication system for an application. I can't use a built in library for that such as ASP.NET Identity, but I can use any simple methods in .net.
Not wanting to ...
- 773
2
votes
0
answers
246
views
WCF WS - Passing passwords through service
I am implementing security on a WCF service from basicHttp to WShttp, the issue is the service sends some passwords for connections to the database that the user can define,test and save.
The ...
- 121
2
votes
0
answers
156
views
Protecting the password in a PBE scheme for an application
I am currently formulating security best practices and requirements for ongoing Java software development in my department and have settled with a recommendation of using the Jasypt framework for ...
- 1,082
2
votes
0
answers
87
views
Native Mobile App Finger Print Authentication and web service.
I have developed many web based applications and focused a lot on authentication LDAP, SAML and in application passwords. Now I am moving to building native mobile application and would like to take ...
- 1,092
2
votes
0
answers
554
views
Mimikatz hash dump of logged-off users
If I want to dump hashes of domain users on my computer, do they have to be logged on, or can I dump hashes of logged off users?
When I try mimikatz in my lab, I can only get dumps from others users ...
- 31
2
votes
0
answers
128
views
Under what conditions does Safari have access to the Keychain?
The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data.
People who use iCloud, and also enable the keychain synchronization ...
- 50k
2
votes
2
answers
504
views
What are the security features of the Microsoft PasswordVault class?
There doesn't seem to be much information on the PasswordVault but it seems to provide for local encryption of credentials.
There are references to it in this source code and this blog.
The reason I'm ...
- 50k
2
votes
0
answers
82
views
Syncing service passwords during offline installations
Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of ...
- 121
2
votes
0
answers
533
views
Digital signature based authentication schema using two passwords
I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
- 121
2
votes
0
answers
113
views
Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?
It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
- 21
2
votes
2
answers
217
views
Use delay with a fixed total time to defend against timing attacks
Consider this common example used to demonstrate timing attacks:
async def sign_in(username, password):
user = await get_user_from_db(username)
if user is None:
return False # early return :(...
- 131
2
votes
3
answers
3k
views
Securely changing Veracrypt password
How can I change a Veracrypt (master) password efficiently and securely?
Based on the answers here, it is not safe to use system --> change password due to various reasons.
I cannot simply image ...
- 161
1
vote
1
answer
84
views
Rationale behind disallowing the use of similar passwords?
I recently had to change my password on a linux server (RedHat). It wouldn't let me use my password of choice because it was "too similar" to my previous password. Is this really ...
- 111
1
vote
0
answers
43
views
Attack on home dir encryption with sddm pam_mount by using password in /etc/shadow
I'm using Debian + sddm + KDE with ONLY home directory encrypted with gocryptfs.
Decrypting is performed with gocryptfs as follows:
PC boots as usual and starts the sddm service
I enter my login ...
1
vote
0
answers
85
views
Why does a password guessing robot repeatedly test nonsense?
I log repeated invalid login attempts on a small custom made e-shop (no open source system is used). Last year, I started recording repeated failed logins from a single IP address. That's why I ...
- 11
1
vote
0
answers
71
views
Is it necessary to have keep these 4 accounts separate from password manager?
Microsoft Authenticator requires an:
Outlook account
Verification account
iCloud account
The first two are required to set up the authenticator on a new device, the latter stores all the data to be ...
- 9
1
vote
0
answers
50
views
Security implications of using a plaintext master password as the salt for PBKDF2 in a zero-knowledge system
I was reading the BitWarden Security Whitepaper (BitWarden is an open source, zero-knowledge password manager that performs encryption/decryption on the client side) and came across the following ...
- 163
1
vote
1
answer
152
views
Is username + password functionally equivalent to a single login string of the same length?
My intuition is failing me with this. Would it make it easier or harder for an attacker trying to gain access to any of the accounts in a database?
I can see that in the case of a single login string, ...
- 111
1
vote
1
answer
194
views
Is 2FA based on Google Authenticator Real?
I was reading this response on SE about 2FA:
Well, I hate to break this to you, but Google Authenticator plus
password isn't really two-factor authentication. Proper 2FA is two
separate items out of ...
- 141
1
vote
0
answers
129
views
Can SMB/CIFS credentials be extracted from Linux?
On a penetration test, I have completely compromised a Linux machine and I am now trying to move around the network. The Linux machine has a mounted CIFS share, and I want to get the password used to ...
- 79
1
vote
0
answers
232
views
Using John the Ripper for Blockchain.info second password
Is there a way to use JtR for Blockchain.info's (v2) secondary password?
I already tried the blockchain2john.py file, and it does not ask for primary password (which I know already) so it is going to ...
- 61
1
vote
0
answers
266
views
JTR finishing very quickly with rockyou.txt and not cracking the hash
I've been fumbling through the world of Information Security by going through the HTB challenges, and I've come across an issue I just can't seem to find an answer for. During one of the challenges I'...
