Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
4,067 questions
1288
votes
23
answers
292k
views
XKCD #936: Short complex password, or long dictionary passphrase?
How accurate is this XKCD comic from August 10, 2011?
I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
944
votes
11
answers
332k
views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the database,...
AviD♦
- 73.6k
893
votes
14
answers
179k
views
What technical reasons are there to have low maximum password lengths?
I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites where I actually care ...
- 8,251
672
votes
4
answers
337k
views
Do any security experts recommend bcrypt for password storage?
On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
- 6,805
630
votes
7
answers
246k
views
How to store salt?
If you expect to store user password securely, you need to do at least the following:
$pwd=hash(hash($password) + salt)
Then, you store $pwd in your system instead of the real password. I have seen ...
- 6,497
626
votes
23
answers
154k
views
How does changing your password every 90 days increase security?
Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
- 6,821
546
votes
11
answers
95k
views
Is my developer's home-brew password security right or wrong, and why?
A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below.
His team spent months adopting an industry standard protocol using Bcrypt. ...
- 4,739
475
votes
13
answers
110k
views
Are passwords stored in memory safe?
I just realized that, in any language, when you save a password in a variable, it is stored as plain text in the memory.
I think the OS does its job and forbids processes from accessing each other's ...
- 4,697
302
votes
10
answers
74k
views
Why is Gbt3fC79ZmMEFUFJ a weak password?
On https://passwordsgenerator.net/, it says
Examples of weak passwords: qwert12345, Gbt3fC79ZmMEFUFJ, 1234567890, 987654321, nortonpassword
The first, third, and fourth examples are obviously weak....
- 2,331
273
votes
7
answers
118k
views
Password Hashing: add salt + pepper or is salt enough?
Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding.
...
- 7,752
269
votes
4
answers
171k
views
How does Google Authenticator work?
Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent.
It works without any connectivity; it even works on plane mode. This ...
user15194
258
votes
8
answers
79k
views
Why are salted hashes more secure for password storage?
I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters).
My ...
user40448
252
votes
2
answers
42k
views
Can ads on a page read my password?
Disclaimer: I have minimal web-dev/security knowledge so please answer as if talking to a "layman."
I've heard that web-advertisements need to be able to run their own JavaScript so that they can ...
- 1,045
245
votes
18
answers
31k
views
Passwords being sent in clear text due to users' mistake in typing it in the username field
Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
- 4,287
241
votes
10
answers
95k
views
Is "the oft-cited XKCD scheme [...] no longer good advice"?
I was stumbling around and happened onto this essay by Bruce Schneier claiming that the XKCD password scheme was effectively dead.
Modern password crackers combine different words from their ...
- 3,462
240
votes
5
answers
115k
views
Recommended # of iterations when using PBKDF2-SHA256?
I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
- 2,588
236
votes
10
answers
38k
views
Is there any reason to disable paste password on login?
Today I logged in to pay my cellphone bill, and I found that the site has disabled paste functionality in password field.
I'm a webdev and I know how to fix this, but for regular user is REALLY ...
- 2,505
234
votes
7
answers
48k
views
Why would you not permit Q or Z in passwords?
Jetblue's password requirements specify that, among other stringent requirements:
Cannot contain a Q or Z
I can't fathom a logical reason for this, unless it were say, extremely common for the ...
- 1,923
222
votes
13
answers
27k
views
Is there any reason to not show users incorrectly entered passwords after a successful login?
Our client has come up with the requirement that in case the username in question has had multiple failed login attempts, the incorrectly entered password(s) must be shown once a successful login is ...
- 2,043
205
votes
10
answers
126k
views
How safe are password managers like LastPass?
I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long.
How safe are password ...
- 2,871
194
votes
6
answers
31k
views
Isn't Ubuntu's system prompt for my password spoofable?
Sometimes, Ubuntu shows the following window:
This window can be caused by some background processes running, such as an automatic update, or a process which reports bugs to Canonical which manifests ...
- 4,824
190
votes
6
answers
39k
views
Does Facebook store plain-text passwords?
I was about to reset my Facebook password and got this error:
Your new password is too similar to your current password. Please try another password.
I assumed that Facebook stores only password ...
- 4,204
186
votes
9
answers
26k
views
Is the NHS wrong about passwords?
An NHS doctor I know recently had to do their online mandatory training questionnaire, which asks a bunch of questions about clinical practice, safety and security. This same questionnaire will have ...
- 1,768
178
votes
18
answers
23k
views
What is a good analogy to explain to a layman why passwords should be hashed?
Note: This is not an actual situation I'm currently in.
Assume your boss is one of those old-fashioned computer-illiterate managers and wants to store the passwords in plaintext to simplify ...
- 7,583
171
votes
26
answers
24k
views
Convince people not to share their password with trusted others
IT workers are usually trusted by their family members who readily share passwords (Facebook, email, twitter, you-name-it!) so they can get easy help to set what-ever-parameter they don't find or ...
- 1,518
171
votes
13
answers
111k
views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
- 1,945
158
votes
8
answers
62k
views
Is "Have I Been Pwned's" Pwned Passwords List really that useful?
My understanding of Have I Been Pwned is that it checks your password to see if someone else in the world has used it.
This really doesn't seem that useful to me. It seems equivalent to asking if ...
- 2,646
155
votes
17
answers
22k
views
Is the BBC’s advice on choosing a password sensible?
In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows.
Step 1: Choose an artist (a recording artist I presume)
Lets choose as an example ...
- 7,859
155
votes
3
answers
21k
views
If my password was able to be printed on a form sent home from my child's school, does it imply insecure password storage policies?
I have a user account for each of my children in our district website, which oversees registration, grades, identification, etc.
I was recently sent home a form from both of my children's classrooms ...
- 1,247
150
votes
6
answers
27k
views
Is password entry being recorded on camera a realistic concern?
I live in a city where CCTV camera coverage is comprehensive and increasing. Cameras are getting cheaper and higher resolution. Everyone has a video camera in their pocket already, and we are starting ...
- 1,251
150
votes
5
answers
13k
views
What to do if stuck with website that has poor security?
I have a student loan account with a company, not the biggest company but big enough to where they should have their act together. Today I couldn't remember my password to log into my account ...
- 1,796
143
votes
9
answers
99k
views
How secure is Chrome storing a password?
Whenever I enter a login into a new site, Chrome asks me if it should store the login details. I used to believe this was fairly secure. If someone found my computer unlocked, they could get past the ...
- 1,383
140
votes
5
answers
27k
views
Is it secure to store passwords with 2 way encryption?
I'm a parent who has a parent account with my local school district so that I can log in to their website to view my child's grades etc.
I clicked the "forgot password' button, and my password was ...
- 1,083
139
votes
9
answers
348k
views
Where can I find good dictionaries for dictionary attacks?
I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?
I've found some through Google, but I’m interested in hearing about where you get your ...
- 16.2k
138
votes
11
answers
85k
views
Why not allow spaces in a password?
"Your password can't contain spaces."
is a message I see from some websites,
including 1 .
Why?
(This question is very similar to Why Disallow Special Characters In a Password? , but the answers ...
- 2,750
137
votes
7
answers
21k
views
Internet courtship: Why would a hacker buy me poker chips?
Believe me, I never expected to ever write a title like that on a Stack Exchange site either!
Yesterday evening I got a call from my mother. She is quite tech savvy and generally knows her way around ...
- 991
136
votes
11
answers
196k
views
Are password-protected ZIP files secure?
Following my answer. If I can list contents of a password-protected ZIP file, check the file types of each stored file and even replace it with another one, without actually knowing the password, then ...
- 3,689
132
votes
3
answers
15k
views
Is HostGator storing my password in plaintext?
I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss.
I asked a customer care representative to help me add an SSL certificate to a site I host with them. ...
- 1,947
126
votes
10
answers
18k
views
How critical is it to keep your password length secret?
Is keeping your password length secret critical to security?
Does someone knowing that you have a password length of say 17 make the password drastically easier to brute force?
- 2,617
124
votes
10
answers
21k
views
Does an ISO27001 audit require users to reveal their passwords?
My company's system administrator is asking for our passwords for an ISO audit and my VP IT operations support says it's mandatory for ISMS (ISO27001).
Can someone confirm if this is true?
- 1,312
122
votes
2
answers
146k
views
How difficult to crack keepass master password?
How easily could someone crack my keepass .kdbx file if that person steals the file but never obtains the Master Password?
Is this a serious threat, or would a brute force attack require massive ...
- 1,857
121
votes
11
answers
27k
views
Password rules: Should I disallow "leetspeak" dictionary passwords like XKCD's Tr0ub4dor&3
TLDR: We already require two-factor authentication for some users. I'm hashing, salting, and doing things to encourage long passphrases. I'm not interested in the merits of password complexity rules ...
- 1,593
121
votes
3
answers
82k
views
Does bcrypt have a maximum password length?
I was messing around with bcrypt today and noticed something:
hashpw('testtdsdddddddddddddddddddddddddddddddddddddddddddddddsddddddddddddddddd', salt)
Output: '$2a$15$jQYbLa5m0PIo7eZ6MGCzr....
- 1,313
119
votes
15
answers
32k
views
When choosing a numeric PIN, does it help or hurt to make each digit unique?
Imagine a typical 4-digit PIN scheme containing the digits [0-9]. If I choose my PIN at random, I will get one out of 10 * 10 * 10 * 10 = 10,000 codes. Based on my own experience, more than half of ...
- 2,115
112
votes
11
answers
40k
views
"Username and/or Password Invalid" - Why do websites show this kind of message instead of informing the user which one was wrong?
Lets say a user is logging into a typical site, entering their username and password, and they mistype one of their inputs. I have noticed that most, if not all, sites show the same message (something ...
- 1,385
111
votes
13
answers
44k
views
Why do sites implement locking after three failed password attempts?
I know the reasoning behind not letting infinite password attempts - brute force attempts is not a meatspace weakness, but a problem with computer security - but where did they get the number three ...
- 6,212
110
votes
5
answers
17k
views
What should I do about Gmail ad asking me for password?
I just got a pop-up after having logged on to Gmail. It said it was from https://googleads.g.doubleclick.net and asked for username and password.
What should I do about this? Has anyone else seen ...
- 881
109
votes
8
answers
156k
views
Certificate based authentication vs Username and Password authentication
What are the advantages and drawbacks of the certificate based authentication over username and password authentication?
I know some, but I would appreciate a structured and detailed answer.
UPDATE
...
- 1,287
109
votes
7
answers
150k
views
Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?
Justin Schuh defended Google's reasoning in the wake of this post detailing the "discovery" (sic) that passwords saved in the Chrome password manager can be viewed in plaintext. Let me just directly ...
- 1,269
108
votes
17
answers
25k
views
Is "password knocking" a good idea?
With port knocking, you have to "knock" on specific ports in defined order to expose a port on which service is running.
How about password knocking? For example you have three passwords: A, B and C. ...
- 1,300