Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
3,743
questions
0
votes
0answers
31 views
What characters should, and should I absolutely not use in generated passwords? [duplicate]
I'm currently setting up a KeePass database after switching over from another password manager, and it has the option to change the character set for generating a password.
This has a lot of options, ...
0
votes
1answer
72 views
Does syncing local data to the cloud count as MFA?
Bitwarden uses TOTP as the multi-factor authenticator method for their password manager. Bitwarden stores and syncs your data so you need the master password + TOTP to get access to your account
...
3
votes
1answer
393 views
How does Linux know if a new password is a “wrapped” version of a old one?
How does Linux know if a new password is a "wrapped" version of an old password?
(or, the process of creating a new password) know "certain" parts of one's password?
Let's say I ...
24
votes
6answers
11k views
Is it safe to publish the hash of my passwords?
How unsafe would be to publish the hash of my passwords?
I have written a Python script for helping me to remember my basic passwords (computer password, encrypted backup password, AppleID password, ...
0
votes
1answer
86 views
Database password encryption compromised
A company has a database with user's passwords encrypted. An attacker compromised the password encryption now it needs to be changed.
In this situation does the company needs to change the encryption ...
1
vote
0answers
50 views
How much time will Fugaku supercomputer take to generate a wordlist? [closed]
How much time will the Fugaku supercomputer take to generate a wordlist?
Length: 50
Combination: Alphabet(upper/lower) + numbers (0~9)
also, would wordlist generators make a significant time/...
15
votes
4answers
3k views
PBKDF2 usage will slow REST API down?
When implementing password hashing using PBKDF2 for authenticating access to a REST api,when we say that PBKDF2 is slow does it mean that it's going to take a lot of time to hash the password and ...
1
vote
0answers
26 views
Is there record of a pubilc RDS instance with strong password having been hacked?
I am auditing an AWS account and I found a public RDS instance, that is with public DNS, no Security Group IP connection filtering and in a public Subnet
However, the instance has a relatively strong ...
-2
votes
1answer
91 views
Unathorized Access to Google Drive
My Google Account was hacked granting unauthorized access to YouTube and Google Drive. The third party immediately started posting inappropriate content on YT which prompted an email from Google after ...
0
votes
1answer
99 views
Exchange compromise affected company - should we 100% change administrator password?
We host exchange on premise (exchange 2013). We believe following MS's guides and guidelines that we were compromised regarding the exchange zero days hack. We did find some .aspx files that did not ...
1
vote
0answers
155 views
John the ripper output formatting
I'm supposed to crack some passwords from a file. I've done john pwlist.lst > passwords.txt which is outputting the files into my txt file.
I'd like to make it such that when John is cracking the ...
1
vote
3answers
286 views
Are security questions considered as 2FA?
Many sites have a step during registration when you have to create security questions and answers for them. Is this type of security layer considered as 2FA? From what I know, 2FA is used for the ...
8
votes
2answers
371 views
Why is Webauthn not used as primary authentication method?
In theory, authenticating with a public key should be much simpler than with a password. There is nothing to remember for the end-user, and registration can be done just by clicking a button. For all ...
2
votes
0answers
82 views
Should a user's password hash and salt be included when a user requests to download their data under privacy laws? [closed]
I have two related questions:
When trying to design for privacy laws that require giving a user access to their data, should we include their password hash and salt in the data we offer for download?
...
2
votes
0answers
58 views
Authentication in Desktop App
I'm reading the OWASP Authentication Cheat Sheet, but it obviously is focused only on web browser. I'm searching for something similar for a desktop app.
I want users to login to a desktop app. The ...
1
vote
0answers
129 views
Hardware for password cracking
I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
2
votes
1answer
121 views
How are passwords stored in the database of a decentralized peer to peer system?
I want to use username and password instead of public key cryptography for a decentralized peer-to-peer application, but since the passwords are stored on users' computers, there is a possibility of ...
0
votes
4answers
147 views
Why can't you use the same password for every site, if they are hashed on the site?
I've often heard people talking about not using the same password on every website. What's the deal if servers store passwords in a SHA hash instead of plain text? The most they can do is spam you ...
8
votes
3answers
426 views
Why would password managers provide support for OTP codes? [duplicate]
Can anyone explain me what's this trend of providing passwords and OTP codes on the same service? What benefit or value are they trying to bring to the table?
We, as security professionals, have been ...
1
vote
1answer
109 views
In Hashcat, How to generate combinatior attacks consisting of more than two words (in lenght)?
I am trying to make a combinator attack using just one dictionary:
word1
word2
word3
word4
word5
...
And would like to try all 4-words-length permutations separated by commas:
word1,word2,word3,word4
...
3
votes
1answer
450 views
Bitwarden PIN protection mechanism
I couldn't find any deep dive info about PIN management in Bitwarden.
And I'm not able to read their code, not qualified enough.
Are there people around here who can explain how PIN protection works ...
2
votes
3answers
134 views
Pros vs Cons of Secure Remote Password
We are setting up an authentication system using Cognito and Amplify. We noticed that Amplify suggests Secure Remote Password as the default.
I can understand the benefits of SRP for protecting ...
2
votes
2answers
100 views
Why should password reset link be single use?
Reading from here: https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html
It mentioned that password reset link should be single use and expire after appropriate period. I don'...
6
votes
2answers
2k views
How are website passwords cracked? [closed]
What approaches are there for cracking user passwords for website/e-mail accounts? can only think of three strategies, but what else?
Algorithmically: Combinatorially attempting different sequences ...
2
votes
1answer
59 views
Buffer overflow outside gdb
I'm trying to exploit a basic C program (below) which I've written:
#include <stdio.h>
#include <string.h>
void main()
{
char ch[10];
scanf("%s", ch);
if(strcmp(&...
2
votes
0answers
77 views
Why does firebase encrypt with password hashes instead of storing the hashes?
I am trying to migrate off of firebase, as in doing so, you can export the hashes of user passwords. Looking at their algorithm, they do not store password hashes, but rather, they use the first 32-...
0
votes
1answer
123 views
How Forgot Password Works?
For my website I need to add "forgot password" functionality. As I searched on the internet there are too much vulnerabilities you may encounter in case of wrong implementing this ...
1
vote
1answer
137 views
Why don't security conscious websites use a combination of private unique identifier and password to secure their logins?
To be clear when I say "private unique identifier" I mean an identifier, which is not stored on the database for the website, it would be hashed in combination with the password and a good ...
-1
votes
1answer
85 views
Does Password Harvesting Happen in Servers?
Maybe someone can explain why my concern is not realistic. If I create a browser-based app with a login (let's say I'm Facebook or Microsoft), why wouldn't I store all the wrong passwords people type?...
1
vote
2answers
118 views
Find encryption key with password and output
One of applications I use has a password manager feature included in it. I can add logins to the password manager and they get stored in a .ini file (for simpler login purpose, I can select an account ...
0
votes
1answer
80 views
VPS host shows plain text “root” account password upon reinstall of unmanaged VM
I recently started using a VPS hosting service, that offers unmanaged VPS. It allows me to reinstall the VM at any point in time, choosing from a number of OS ISO files (doesn't have to be the same OS ...
0
votes
1answer
91 views
Knowing when a hacked password is correct
I was recently a victim of the any van data breach and so I started read up on password encryption and security - it is pretty amazing stuff. One thing that confuses me though is, since GPUs can now ...
0
votes
0answers
46 views
Does an OpenVPN client attemtping to connect a wrong server IP poses a security risk?
I have an OpenVPN server setup at home and the public IP address I get from my Internet Service Provider is dynamic, not fixed. In the configuration file of a VPN client, the IP address of the server ...
1
vote
1answer
65 views
Config file contains password hashes and signature keys
First, I am a beginner in IT security. I hope my question is not too dumb.
I use a program that can show a live feed from a security camera. You can import a project file, that sets up user accounts ...
0
votes
0answers
52 views
Trace Unauthorized login into My Gmail and Facebook Account [duplicate]
I have experienced an unauthorized login into my Gmail and Facebook account, while I was logging into the accounts and doing school assignments. Suddenly, I got an email from Facebook about "...
1
vote
1answer
76 views
Why the need to hardcode passwords? [closed]
Many IOT devices and routers manufacturers hardcode plaintext default passwords in their devices.
Why don't they store the hashed password instead?
For what functionality do they need the plaintext ...
1
vote
2answers
128 views
Why don't companies just tie the password to the user name?
One problem with passwords is that if they can be broken as follows:
pick a random password
hash it
compare that hash to other known hashes
This way, you have broken the password. Then if you can ...
80
votes
12answers
11k views
Password policy for elderly clientele
I work for a company in which the age of our average user is over 70. We have an app* that helps them collect and submit physiological data to their doctors.
I found this question that I believe is ...
1
vote
2answers
77 views
Do I transmit a plaintext password to my PostgreSQL server?
PostgreSQL supports multiple authentication methods, and I think it supports SSL and plaintext connections. How do I find out which authentication method a server uses? I do not have access to the ...
0
votes
0answers
71 views
Isn't this kind of password ultimately secure and insanely easy to remember? [duplicate]
Pick any dictionary word.
Think of a number over 10 and below 20.
Repeat the word as many times as the number, and end off with the same number (for example, "12").
Example:
...
1
vote
1answer
101 views
Allowing a password reset if an account is locked
Similar to another question about keeping an account locked, is it preferable to allow a user to reset their password while the account is locked out due to the wrong password being used too many ...
1
vote
1answer
259 views
Password cracking using Quantum Computers
Suppose that I have a password that is n-digits long. Each digit can take m values. So the number of permutations will be m^n. I wanted to know how much time it would take a quantum computer to crack ...
0
votes
1answer
125 views
How password_hash / password_verify can work with any arguments (PHP)
I already know how to use password_verify and password_hash functions, but I don't really understand how they work.
When I use them I do something like that:
$save_hash = password_hash( $password, ...
3
votes
0answers
205 views
Maximum password length for user accounts on Ubuntu
I have a VPS hosted at a remote location. Obviously the host can login directly (without SSH or any keys) on this box and I want to make brute force password guessing as hard as possible for a bad ...
22
votes
2answers
3k views
Why do password requirements exist while limiting the upper character count? [duplicate]
I do not quite understand why it is common practice to require a difficult to remember password with alphanumeric and special character requirements, while also having an upper limit of 32 characters. ...
1
vote
0answers
27 views
How to assess security of Argon2 parameters [duplicate]
I would like to hash user password with Argon2id, then use this hash as ECDSA private key. I made some tests with Python and passlib.hash and found following parameters:
memory: 32 MB
iterations: 100
...
2
votes
2answers
196 views
Can your internet provider monitor your data (passwords, etc?)
Was typing in my password into an HTTPS website when I started to wonder if my home WiFi (whether a neighbor could have hacked into and monitoring it) is secure.
When I type in
Username123
Password123
...
1
vote
1answer
109 views
Why do administrators create passwords vulnerable to kerberoasting? [closed]
I was researching a kerberoasting attack on the Active Directory domain. To create the stand, I used a Domain Controller on Windows Server 2016 and one client machine on Windows 10. SQL Server was ...
8
votes
4answers
2k views
Alternatives for sending plaintext password while login
Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
0
votes
0answers
83 views
Is there a better method that this for storing a physical password? [duplicate]
This may be a little unnecessary, but taking into consideration:
There are many ways to hack a computer
There are many ways to hack a network
There is always a possibility of an undetected malware on ...
