Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [passwords]

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

Filter by
Sorted by
Tagged with
1261 votes
22 answers
274k views

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
918 votes
11 answers
299k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
user avatar
  • 71.8k
859 votes
14 answers
166k views

What technical reasons are there to have low maximum password lengths?

I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites where I actually care ...
user avatar
  • 7,901
652 votes
4 answers
308k views

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
user avatar
  • 6,605
615 votes
23 answers
149k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
user avatar
592 votes
7 answers
202k views

How to store salt?

If you expect to store user password securely, you need to do at least the following: $pwd=hash(hash($password) + salt) Then, you store $pwd in your system instead of the real password. I have seen ...
user avatar
  • 6,107
540 votes
11 answers
90k views

Is my developer's home-brew password security right or wrong, and why?

A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
user avatar
  • 4,669
463 votes
13 answers
103k views

Are passwords stored in memory safe?

I just realized that, in any language, when you save a password in a variable, it is stored as plain text in the memory. I think the OS does its job and forbids processes from accessing each other's ...
user avatar
294 votes
10 answers
72k views

Why is Gbt3fC79ZmMEFUFJ a weak password?

On https://passwordsgenerator.net/, it says Examples of weak passwords: qwert12345, Gbt3fC79ZmMEFUFJ, 1234567890, 987654321, nortonpassword The first, third, and fourth examples are obviously weak....
user avatar
  • 2,241
262 votes
7 answers
107k views

Password Hashing: add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
user avatar
  • 7,352
259 votes
4 answers
162k views

How does Google Authenticator work?

Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent. It works without any connectivity; it even works on plane mode. This ...
user avatar
254 votes
8 answers
76k views

Why are salted hashes more secure for password storage?

I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters). My ...
user avatar
  • 2,611
253 votes
2 answers
42k views

Can ads on a page read my password?

Disclaimer: I have minimal web-dev/security knowledge so please answer as if talking to a "layman." I've heard that web-advertisements need to be able to run their own JavaScript so that they can ...
user avatar
  • 1,023
245 votes
17 answers
29k views

Passwords being sent in clear text due to users' mistake in typing it in the username field

Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
user avatar
  • 4,227
236 votes
10 answers
89k views

Is "the oft-cited XKCD scheme [...] no longer good advice"?

I was stumbling around and happened onto this essay by Bruce Schneier claiming that the XKCD password scheme was effectively dead. Modern password crackers combine different words from their ...
user avatar
  • 3,372
233 votes
7 answers
47k views

Why would you not permit Q or Z in passwords?

Jetblue's password requirements specify that, among other stringent requirements: Cannot contain a Q or Z I can't fathom a logical reason for this, unless it were say, extremely common for the ...
user avatar
  • 1,893
231 votes
10 answers
34k views

Is there any reason to disable paste password on login?

Today I logged in to pay my cellphone bill, and I found that the site has disabled paste functionality in password field. I'm a webdev and I know how to fix this, but for regular user is REALLY ...
user avatar
223 votes
13 answers
27k views

Is there any reason to not show users incorrectly entered passwords after a successful login?

Our client has come up with the requirement that in case the username in question has had multiple failed login attempts, the incorrectly entered password(s) must be shown once a successful login is ...
user avatar
  • 2,043
220 votes
4 answers
90k views

Recommended # of iterations when using PBKDF2-SHA256?

I'm curious if anyone has any advice or points of reference when it comes to determining how many iterations is 'good enough' when using PBKDF2 (specifically with SHA-256). Certainly, 'good enough' is ...
user avatar
  • 2,388
201 votes
10 answers
124k views

How safe are password managers like LastPass?

I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long. How safe are password ...
user avatar
  • 2,831
193 votes
6 answers
30k views

Isn't Ubuntu's system prompt for my password spoofable?

Sometimes, Ubuntu shows the following window: This window can be caused by some background processes running, such as an automatic update, or a process which reports bugs to Canonical which manifests ...
user avatar
190 votes
6 answers
38k views

Does Facebook store plain-text passwords?

I was about to reset my Facebook password and got this error: Your new password is too similar to your current password. Please try another password. I assumed that Facebook stores only password ...
user avatar
186 votes
9 answers
25k views

Is the NHS wrong about passwords?

An NHS doctor I know recently had to do their online mandatory training questionnaire, which asks a bunch of questions about clinical practice, safety and security. This same questionnaire will have ...
user avatar
177 votes
18 answers
22k views

What is a good analogy to explain to a layman why passwords should be hashed?

Note: This is not an actual situation I'm currently in. Assume your boss is one of those old-fashioned computer-illiterate managers and wants to store the passwords in plaintext to simplify ...
user avatar
  • 7,333
172 votes
26 answers
22k views

Convince people not to share their password with trusted others

IT workers are usually trusted by their family members who readily share passwords (Facebook, email, twitter, you-name-it!) so they can get easy help to set what-ever-parameter they don't find or ...
user avatar
  • 1,518
157 votes
8 answers
60k views

Is "Have I Been Pwned's" Pwned Passwords List really that useful?

My understanding of Have I Been Pwned is that it checks your password to see if someone else in the world has used it. This really doesn't seem that useful to me. It seems equivalent to asking if ...
user avatar
  • 2,606
157 votes
17 answers
22k views

Is the BBC’s advice on choosing a password sensible?

In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows. Step 1: Choose an artist (a recording artist I presume) Lets choose as an example ...
user avatar
  • 7,629
156 votes
3 answers
21k views

If my password was able to be printed on a form sent home from my child's school, does it imply insecure password storage policies?

I have a user account for each of my children in our district website, which oversees registration, grades, identification, etc. I was recently sent home a form from both of my children's classrooms ...
user avatar
  • 1,227
153 votes
5 answers
13k views

What to do if stuck with website that has poor security?

I have a student loan account with a company, not the biggest company but big enough to where they should have their act together. Today I couldn't remember my password to log into my account ...
user avatar
  • 1,756
152 votes
11 answers
86k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
user avatar
  • 1,755
149 votes
6 answers
25k views

Is password entry being recorded on camera a realistic concern?

I live in a city where CCTV camera coverage is comprehensive and increasing. Cameras are getting cheaper and higher resolution. Everyone has a video camera in their pocket already, and we are starting ...
user avatar
  • 1,231
141 votes
5 answers
26k views

Is it secure to store passwords with 2 way encryption?

I'm a parent who has a parent account with my local school district so that I can log in to their website to view my child's grades etc. I clicked the "forgot password' button, and my password was ...
user avatar
  • 1,083
141 votes
9 answers
92k views

How secure is Chrome storing a password?

Whenever I enter a login into a new site, Chrome asks me if it should store the login details. I used to believe this was fairly secure. If someone found my computer unlocked, they could get past the ...
user avatar
  • 1,353
140 votes
7 answers
20k views

Internet courtship: Why would a hacker buy me poker chips?

Believe me, I never expected to ever write a title like that on a Stack Exchange site either! Yesterday evening I got a call from my mother. She is quite tech savvy and generally knows her way around ...
user avatar
138 votes
10 answers
311k views

Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...
user avatar
  • 16.1k
136 votes
10 answers
71k views

Why not allow spaces in a password?

"Your password can't contain spaces." is a message I see from some websites, including 1 . Why? (This question is very similar to Why Disallow Special Characters In a Password? , but the answers ...
user avatar
  • 2,700
133 votes
3 answers
14k views

Is HostGator storing my password in plaintext?

I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss. I asked a customer care representative to help me add an SSL certificate to a site I host with them. ...
user avatar
  • 1,907
126 votes
10 answers
20k views

Does an ISO27001 audit require users to reveal their passwords?

My company's system administrator is asking for our passwords for an ISO audit and my VP IT operations support says it's mandatory for ISMS (ISO27001). Can someone confirm if this is true?
user avatar
  • 1,322
125 votes
11 answers
163k views

Are password-protected ZIP files secure?

Following my answer. If I can list contents of a password-protected ZIP file, check the file types of each stored file and even replace it with another one, without actually knowing the password, then ...
user avatar
  • 3,287
124 votes
10 answers
17k views

How critical is it to keep your password length secret?

Is keeping your password length secret critical to security? Does someone knowing that you have a password length of say 17 make the password drastically easier to brute force?
user avatar
  • 2,597
120 votes
11 answers
25k views

Password rules: Should I disallow "leetspeak" dictionary passwords like XKCD's Tr0ub4dor&3

TLDR: We already require two-factor authentication for some users. I'm hashing, salting, and doing things to encourage long passphrases. I'm not interested in the merits of password complexity rules ...
user avatar
  • 1,583
118 votes
2 answers
140k views

How difficult to crack keepass master password?

How easily could someone crack my keepass .kdbx file if that person steals the file but never obtains the Master Password? Is this a serious threat, or would a brute force attack require massive ...
user avatar
  • 1,807
117 votes
15 answers
28k views

When choosing a numeric PIN, does it help or hurt to make each digit unique?

Imagine a typical 4-digit PIN scheme containing the digits [0-9]. If I choose my PIN at random, I will get one out of 10 * 10 * 10 * 10 = 10,000 codes. Based on my own experience, more than half of ...
user avatar
  • 2,025
116 votes
3 answers
58k views

Does bcrypt have a maximum password length?

I was messing around with bcrypt today and noticed something: hashpw('testtdsdddddddddddddddddddddddddddddddddddddddddddddddsddddddddddddddddd', salt) Output: '$2a$15$jQYbLa5m0PIo7eZ6MGCzr....
user avatar
  • 1,263
111 votes
5 answers
17k views

What should I do about Gmail ad asking me for password?

I just got a pop-up after having logged on to Gmail. It said it was from https://googleads.g.doubleclick.net and asked for username and password. What should I do about this? Has anyone else seen ...
user avatar
  • 881
109 votes
11 answers
37k views

"Username and/or Password Invalid" - Why do websites show this kind of message instead of informing the user which one was wrong?

Lets say a user is logging into a typical site, entering their username and password, and they mistype one of their inputs. I have noticed that most, if not all, sites show the same message (something ...
user avatar
  • 1,345
109 votes
13 answers
42k views

Why do sites implement locking after three failed password attempts?

I know the reasoning behind not letting infinite password attempts - brute force attempts is not a meatspace weakness, but a problem with computer security - but where did they get the number three ...
user avatar
108 votes
7 answers
148k views

Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?

Justin Schuh defended Google's reasoning in the wake of this post detailing the "discovery" (sic) that passwords saved in the Chrome password manager can be viewed in plaintext. Let me just directly ...
user avatar
107 votes
17 answers
25k views

Is "password knocking" a good idea?

With port knocking, you have to "knock" on specific ports in defined order to expose a port on which service is running. How about password knocking? For example you have three passwords: A, B and C. ...
user avatar
  • 1,289
107 votes
2 answers
19k views

Is a redirect showing the password in plain text a security vulnerability?

A couple of days ago, I attempted to log into the website of a well-known SaaS provider. I used a password manager on my browser (so user/pass were correct) and the NoScript plugin which had limited ...
user avatar
  • 1,023

1
2 3 4 5
78