Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
3,876
questions
0
votes
0
answers
44
views
Using a spa login page for authentication in a openId connect servic
I am looking to create a brand new authentication service that follows the OpenId connect protocol. I would like to use a username/password combination for the authentication and the authorization ...
- 1
2
votes
3
answers
119
views
What is the best way to store the verifyer for posession of a high entropy secret?
This is just a thought experiment. I am trying to get an understanding on when we need password hashing functions and when they don't bring any benefits (eg. to save on calculation cost).
I know that ...
- 695
0
votes
2
answers
79
views
Construct a strong, (almost) unique password? [duplicate]
After reading Why use random characters in passwords? it seems to me that one can solve the problem of how to remember a zillion passwords while each one remains secure by constructing each password ...
- 1
18
votes
5
answers
7k
views
Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)
Yes, the transfer to the script via arguments is visible through ps -ax, /proc/<pid>/cmdline etc., BUT if someone has already gained access to your account from the outside (e.g. by hacking your ...
- 635
0
votes
0
answers
53
views
Red Hat Password Security Settings(/etc/pam.d/system-auth, /etc/login.defs)
I'm doing Red Hat (RHEL 6.5) security settings.
If I set up the two files as shown below, is there no security effect on each other?
/etc/pam.d/system-auth
password requisite pam_cracklib.so retry=3 ...
-1
votes
2
answers
59
views
Sign-up/Login/Password reset - Is this a good and secure solution?
I'm working with a dev agency for a web-based platform. Here is how they are planning to handle sign-ups on the platform as well as log-in and password reset.
Is it a good, robust and secure solution?
...
- 101
2
votes
2
answers
119
views
Why do some password fields allow users to see what they type while others do not?
When I type a password somewhere, I see placeholders (black dots) in place of characters. But sometimes, there is also a toggle button to view the password like in a regular input field (typically an ...
- 21
6
votes
1
answer
142
views
Password hashing algorithms that can transform an existing hash to a different cost setting without knowledge of the password
The password hashing competition, started in 2014 and Argon2 was the winner in 2015, listed evaluation criteria for the competition. There is an interesting one in the Functionality section;
Ability ...
- 5,459
0
votes
2
answers
89
views
Is it a good idea to check if the password provided at registration is leaked on any lists? And then, prevent the user from using it?
A while ago, I was tipped off that it's a good idea to check if the password provided at registration is contained in any list of leaked passwords. I'm not in the information security field, but I ...
- 31
0
votes
0
answers
70
views
Allow for login through Tor while preventing brute force/distributed password attacks?
I am making a website with the goal of blocking bots that are trying to login from different IP addresses constantly... while still allowing regular users to login via Tor.
One of the approaches to ...
0
votes
2
answers
768
views
John The Ripper does not load password hash, how can I fix it?
I want to crack a specific hash password with JTR:
48bb6e862e54f2a795ffc4e541caed4d
I put this hash in a txt file like this:
echo '48bb6e862e54f2a795ffc4e541caed4d' > hash.txt
and I run JTR in ...
0
votes
3
answers
115
views
Send password reset email after too many failed logins versus X minutes of lock out
Some sites lock me out for a while after too many failed attempts.
For our own site, we want to force a password reset email after X amount of failed attempts. After all, if your email is compromised, ...
- 115
0
votes
1
answer
95
views
Should I be concerned if a website has password restrictions that reduce complexity?
Chase banking has two odd restrictions on their accepted passwords.
Passwords have a maximum length of 32 characters
Passwords can not contain special characters or punctuation
I am a software ...
- 103
0
votes
1
answer
112
views
What tools currently allow to retrieve Windows 10/11 password hashes, given admin rights or physical access to unencrypted disks?
I was wondering what Windows/Linux/Live tools allow to retrieve user password hashes of modern 2021 Win10/11 installations. I am not sure if password storage differs in these cases (e.g. different ...
- 23
1
vote
3
answers
171
views
Password manager vs Gmail
Is there any security issue if I use for example my Gmail account to store passwords from another resources instead of using any password manager like a KeePass?
If my password for Gmail account is ...
- 115
0
votes
0
answers
84
views
John The Ripper fails to find password existing in the wordlist
I made an Ethereum wallet using a complex password containing ?[-_$> characters. I ran john against the hash generated by ether2john.py:
$ ethereum2john.py path_to_my_ethereum_wallet >wallet....
- 203
0
votes
1
answer
85
views
Passing password back from server to client? [duplicate]
I've never seen any example of this and I'm just curious why? Why is it not okay just to pass it through HTTPs + encoded in a JWT? I will not be storing the password anywhere on the client side, I ...
- 1
1
vote
0
answers
47
views
Security implications of using a plaintext master password as the salt for PBKDF2 in a zero-knowledge system
I was reading the BitWarden Security Whitepaper (BitWarden is an open source, zero-knowledge password manager that performs encryption/decryption on the client side) and came across the following ...
- 163
0
votes
0
answers
68
views
password manager and key management
I would love to gather some information on how to program my own password manager properly as I'm pretty new to security. Currently, I'm using pythons cryptography module and a sqlite database.
The ...
- 1
0
votes
0
answers
16
views
Application to archive a file with multiple passwords [duplicate]
Is there an application to create an archive (e.g. 7z, zip, rar, etc) that can be accessed with multiple valid passwords?
For example the password protected archive "example.7z" can be ...
- 1
36
votes
8
answers
12k
views
Why use random characters in passwords?
I've seen some similar questions but maybe not exactly what I'm asking. Also I can't say that I've followed all the technical jargon in previous posts and am really after more of an intuitive ...
- 487
3
votes
0
answers
96
views
Security of in-app Forgot Password workflow in Xamarin (Mobile App) without using a website
I decided to implement "forgotten password" functionality, without having to create a website just for that. The usual workflow that I've seen for any app is:
User requests password reset
...
- 131
4
votes
2
answers
810
views
How many bits of entropy should a password have to be reasonably future proof (10+ years)?
I’ve seen estimations that the NSA is capable of at least 1 trillion (PGP pass phrase) guesses per second, which would mean a password with 80 bits of entropy would take, on average, over 15,000 years ...
0
votes
1
answer
77
views
Cracking hashes of trivially modified passwords
If I started with “password”, then change it to “password2”, “password3” etc, is that easier to crack the hashes of the set of passwords than if I used only the original password?
Does having the ...
- 1,823
0
votes
0
answers
44
views
About password ciphertext [duplicate]
I need to decrypt a password. I have the ciphertext for this
however, I have many plain text and encrypted equivalents.
This device can only be given passwords with a maximum of 8 characters from the ...
- 1
0
votes
1
answer
132
views
Is it bad practice to store passwords in iCloud notes?
I was wondering something about a day ago when I remembered that Apple stores notes in a database (so you can recover them or view them on icloud.com) - What if Apple stores your notes in plaintext?
I'...
- 231
0
votes
1
answer
74
views
Is character restriction ever a safe mechanism against code injection / better than input sanitisation?
Many services still restrict the special characters allowed in passwords and similar with the argument that it prevents injection attacks. Now, there are many good arguments against this such as ...
- 103
0
votes
1
answer
123
views
Creating Wordlist from specific characters and numbers using Mentalist or similar program
I have locked myself out of my Win 10 Microsoft account by forgetting my password and need to get back into it. I have extracted the hash for the account.
I've been researching wordlists and hash ...
- 5
0
votes
1
answer
143
views
Can a hacker bypass UEFI password without changing or restting it?
Can a hacker locally bypass UEFI password without changing or resetting it ?
- 1
0
votes
2
answers
154
views
What is the entropy of a password made from the initial letters from an English sentence [duplicate]
One way to build a password is to take the first letter from each word in a sentence. For example, the password "Itsfrqbtwaawwnsl" comes from the sentence
"I tried searching for related ...
- 121
0
votes
0
answers
117
views
Is client-side bcrypt sent over tls + server-side sha hmac secure for password storage?
I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password ...
30
votes
11
answers
12k
views
Why are passwords generated by a password generator a complicated mix of letters and numbers instead of a long phrase?
E.g. if I were to register for a new website and am prompted for a password, my browser might generate a complicated password that looks like uv^2<YGYy}#Vj}=f which might be impossible to crack but ...
- 489
0
votes
0
answers
158
views
What's the alternative to storing plain-text passwords in a MySQL Database?
What's the alternative to storing plain-text passwords in a Database?
For example, I'm using Node.js to get a POST request for signing up / logging in a user from a webpage.
When signing up a user, I ...
- 231
0
votes
2
answers
109
views
Should login requests be padded to avoid revealing password length?
If an attacker who can watch network traffic knows a victim's username and can figure out which request is a login, then the size of the login request will reveal something about the password length.
...
- 125
1
vote
0
answers
41
views
How Firefox and Google password managers protect your password [duplicate]
Based in this post in Google Chrome help they claim that they encrypt my username and password with a secret key known only to my device.
What is the algorithm used to generate this secret which is ...
- 21
4
votes
2
answers
348
views
How does Windows password protect my data?
As far as I know, Windows computers are not encrypted by default in case you are not signed into a Microsoft Account. Considering the aforementioned fact I cannot understand the purpose of the login ...
24
votes
7
answers
11k
views
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?
I assume yes, given that if e.g. the word was "password", and the new ...
- 422
0
votes
1
answer
124
views
What is the impact of someone accidentally getting my IMEI number from my Android phone? [duplicate]
I have a concern regarding how risky it is if someone knows or has the copy of my 2 IMEI numbers. As we all know, on Android phones, the IMEI are at the back cover of the phone like a sticker.
So, my ...
3
votes
3
answers
2k
views
Password based RSA encryption
I recently learned (read) the math behind RSA encryption (algorithm). Now, I wonder if there is a way to use a custom password instead of the private key.
Imagine a web application, where user signs ...
- 141
58
votes
6
answers
8k
views
Why does DocuSign require that your password "must not contain the characters <, > or spaces."?
DocuSign requires that your password "must not contain the characters <, > or spaces."
Is this not an odd requirement? Despite being a leader in online document signing, my gut tells ...
- 633
0
votes
3
answers
240
views
If email is an insecure medium, why are usernames and passwords sent via email (albeit in separate ones)?
At work we are using a secure file transfer utility that, after setting it up, sends you and the participants you want to share those files with, two emails. One email contains the randomised username,...
- 195
0
votes
0
answers
97
views
What are the advantages of password "leasing"
One the Hashicorp Vault basic feature is secret leasing. They state:
Leasing and Renewal: All secrets in Vault have a lease associated with them. At the end of the lease, Vault will automatically ...
- 101
0
votes
1
answer
123
views
crackmapexec continue after finding first match
I am currently trying to solve the RazorBlack room on tryhackme. After enumerating the machine, I created a list of valid usernames and was also able to crack the password of one of the users. Now I ...
0
votes
0
answers
79
views
Is it possible for someone to get my personal information if I log in with their google mail id in my device for some work related thing?
I was working on an app for a client which had a premium subscription with play store with their mail id, so I had to log in with their email on my device to test the application.
But right after I ...
0
votes
1
answer
120
views
What’s the best way to only allow a file to be opened with multiple people’s authorisation?
Is there software available that makes it easy for multiple authorisations to be required before a file can be opened? The simplest solution I've found online is to encrypt a file with a password, ...
- 1
0
votes
1
answer
126
views
Are there any other account system attacks I should be aware about?
Not fully sure if these types of questions are allowed here, but don't see anything against it in the help centre so I'm assuming it is. Please point me to a better place to ask if it's not!
I'm ...
1
vote
1
answer
87
views
Password Based Encryption with Social Login
I have a question about implementing user password-based encryption in a database injunction with the Social Login feature.
User private data in my database should be encrypted in order to provide ...
0
votes
1
answer
110
views
How to change the password hashing scheme in LDAP using an external library with slapd.d config
I am trying to change the password hashing scheme for LDAP. Hypothetically, let's assume it's pw-argon.so
I don't have slapd.conf I have the slapd.d directory where I can make changes dynamically to ...
0
votes
0
answers
82
views
Is it safe to use a Digital Signature created with a PKI certificate's private key as a password
I'm trying to create application-layer encryption for user data in my database, using password derivation function. But there is a problem, that there must be an admin user, who can access all user's ...
1
vote
1
answer
94
views
How can I improve the application administrator's encryption keys security inside database
I am interested in the issue of establishing the security of data of users of a web application in the event of a database leak.
It was decided to use the following encryption chain:
User data is ...