Questions tagged [passwords]

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

Filter by
Sorted by
Tagged with
0 votes
0 answers
44 views

Using a spa login page for authentication in a openId connect servic

I am looking to create a brand new authentication service that follows the OpenId connect protocol. I would like to use a username/password combination for the authentication and the authorization ...
user avatar
2 votes
3 answers
119 views

What is the best way to store the verifyer for posession of a high entropy secret?

This is just a thought experiment. I am trying to get an understanding on when we need password hashing functions and when they don't bring any benefits (eg. to save on calculation cost). I know that ...
user avatar
  • 695
0 votes
2 answers
79 views

Construct a strong, (almost) unique password? [duplicate]

After reading Why use random characters in passwords? it seems to me that one can solve the problem of how to remember a zillion passwords while each one remains secure by constructing each password ...
user avatar
18 votes
5 answers
7k views

Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)

Yes, the transfer to the script via arguments is visible through ps -ax, /proc/<pid>/cmdline etc., BUT if someone has already gained access to your account from the outside (e.g. by hacking your ...
user avatar
  • 635
0 votes
0 answers
53 views

Red Hat Password Security Settings(/etc/pam.d/system-auth, /etc/login.defs)

I'm doing Red Hat (RHEL 6.5) security settings. If I set up the two files as shown below, is there no security effect on each other? /etc/pam.d/system-auth password requisite pam_cracklib.so retry=3 ...
user avatar
-1 votes
2 answers
59 views

Sign-up/Login/Password reset - Is this a good and secure solution?

I'm working with a dev agency for a web-based platform. Here is how they are planning to handle sign-ups on the platform as well as log-in and password reset. Is it a good, robust and secure solution? ...
user avatar
  • 101
2 votes
2 answers
119 views

Why do some password fields allow users to see what they type while others do not?

When I type a password somewhere, I see placeholders (black dots) in place of characters. But sometimes, there is also a toggle button to view the password like in a regular input field (typically an ...
user avatar
6 votes
1 answer
142 views

Password hashing algorithms that can transform an existing hash to a different cost setting without knowledge of the password

The password hashing competition, started in 2014 and Argon2 was the winner in 2015, listed evaluation criteria for the competition. There is an interesting one in the Functionality section; Ability ...
user avatar
  • 5,459
0 votes
2 answers
89 views

Is it a good idea to check if the password provided at registration is leaked on any lists? And then, prevent the user from using it?

A while ago, I was tipped off that it's a good idea to check if the password provided at registration is contained in any list of leaked passwords. I'm not in the information security field, but I ...
user avatar
  • 31
0 votes
0 answers
70 views

Allow for login through Tor while preventing brute force/distributed password attacks?

I am making a website with the goal of blocking bots that are trying to login from different IP addresses constantly... while still allowing regular users to login via Tor. One of the approaches to ...
user avatar
0 votes
2 answers
768 views

John The Ripper does not load password hash, how can I fix it?

I want to crack a specific hash password with JTR: 48bb6e862e54f2a795ffc4e541caed4d I put this hash in a txt file like this: echo '48bb6e862e54f2a795ffc4e541caed4d' > hash.txt and I run JTR in ...
user avatar
0 votes
3 answers
115 views

Send password reset email after too many failed logins versus X minutes of lock out

Some sites lock me out for a while after too many failed attempts. For our own site, we want to force a password reset email after X amount of failed attempts. After all, if your email is compromised, ...
user avatar
  • 115
0 votes
1 answer
95 views

Should I be concerned if a website has password restrictions that reduce complexity?

Chase banking has two odd restrictions on their accepted passwords. Passwords have a maximum length of 32 characters Passwords can not contain special characters or punctuation I am a software ...
user avatar
  • 103
0 votes
1 answer
112 views

What tools currently allow to retrieve Windows 10/11 password hashes, given admin rights or physical access to unencrypted disks?

I was wondering what Windows/Linux/Live tools allow to retrieve user password hashes of modern 2021 Win10/11 installations. I am not sure if password storage differs in these cases (e.g. different ...
user avatar
  • 23
1 vote
3 answers
171 views

Password manager vs Gmail

Is there any security issue if I use for example my Gmail account to store passwords from another resources instead of using any password manager like a KeePass? If my password for Gmail account is ...
user avatar
  • 115
0 votes
0 answers
84 views

John The Ripper fails to find password existing in the wordlist

I made an Ethereum wallet using a complex password containing ?[-_$> characters. I ran john against the hash generated by ether2john.py: $ ethereum2john.py path_to_my_ethereum_wallet >wallet....
user avatar
  • 203
0 votes
1 answer
85 views

Passing password back from server to client? [duplicate]

I've never seen any example of this and I'm just curious why? Why is it not okay just to pass it through HTTPs + encoded in a JWT? I will not be storing the password anywhere on the client side, I ...
user avatar
  • 1
1 vote
0 answers
47 views

Security implications of using a plaintext master password as the salt for PBKDF2 in a zero-knowledge system

I was reading the BitWarden Security Whitepaper (BitWarden is an open source, zero-knowledge password manager that performs encryption/decryption on the client side) and came across the following ...
user avatar
0 votes
0 answers
68 views

password manager and key management

I would love to gather some information on how to program my own password manager properly as I'm pretty new to security. Currently, I'm using pythons cryptography module and a sqlite database. The ...
user avatar
0 votes
0 answers
16 views

Application to archive a file with multiple passwords [duplicate]

Is there an application to create an archive (e.g. 7z, zip, rar, etc) that can be accessed with multiple valid passwords? For example the password protected archive "example.7z" can be ...
user avatar
  • 1
36 votes
8 answers
12k views

Why use random characters in passwords?

I've seen some similar questions but maybe not exactly what I'm asking. Also I can't say that I've followed all the technical jargon in previous posts and am really after more of an intuitive ...
user avatar
3 votes
0 answers
96 views

Security of in-app Forgot Password workflow in Xamarin (Mobile App) without using a website

I decided to implement "forgotten password" functionality, without having to create a website just for that. The usual workflow that I've seen for any app is: User requests password reset ...
user avatar
  • 131
4 votes
2 answers
810 views

How many bits of entropy should a password have to be reasonably future proof (10+ years)?

I’ve seen estimations that the NSA is capable of at least 1 trillion (PGP pass phrase) guesses per second, which would mean a password with 80 bits of entropy would take, on average, over 15,000 years ...
user avatar
0 votes
1 answer
77 views

Cracking hashes of trivially modified passwords

If I started with “password”, then change it to “password2”, “password3” etc, is that easier to crack the hashes of the set of passwords than if I used only the original password? Does having the ...
user avatar
  • 1,823
0 votes
0 answers
44 views

About password ciphertext [duplicate]

I need to decrypt a password. I have the ciphertext for this however, I have many plain text and encrypted equivalents. This device can only be given passwords with a maximum of 8 characters from the ...
user avatar
  • 1
0 votes
1 answer
132 views

Is it bad practice to store passwords in iCloud notes?

I was wondering something about a day ago when I remembered that Apple stores notes in a database (so you can recover them or view them on icloud.com) - What if Apple stores your notes in plaintext? I'...
user avatar
0 votes
1 answer
74 views

Is character restriction ever a safe mechanism against code injection / better than input sanitisation?

Many services still restrict the special characters allowed in passwords and similar with the argument that it prevents injection attacks. Now, there are many good arguments against this such as ...
user avatar
  • 103
0 votes
1 answer
123 views

Creating Wordlist from specific characters and numbers using Mentalist or similar program

I have locked myself out of my Win 10 Microsoft account by forgetting my password and need to get back into it. I have extracted the hash for the account. I've been researching wordlists and hash ...
user avatar
  • 5
0 votes
1 answer
143 views

Can a hacker bypass UEFI password without changing or restting it?

Can a hacker locally bypass UEFI password without changing or resetting it ?
user avatar
  • 1
0 votes
2 answers
154 views

What is the entropy of a password made from the initial letters from an English sentence [duplicate]

One way to build a password is to take the first letter from each word in a sentence. For example, the password "Itsfrqbtwaawwnsl" comes from the sentence "I tried searching for related ...
user avatar
  • 121
0 votes
0 answers
117 views

Is client-side bcrypt sent over tls + server-side sha hmac secure for password storage?

I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password ...
user avatar
30 votes
11 answers
12k views

Why are passwords generated by a password generator a complicated mix of letters and numbers instead of a long phrase?

E.g. if I were to register for a new website and am prompted for a password, my browser might generate a complicated password that looks like uv^2<YGYy}#Vj}=f which might be impossible to crack but ...
user avatar
  • 489
0 votes
0 answers
158 views

What's the alternative to storing plain-text passwords in a MySQL Database?

What's the alternative to storing plain-text passwords in a Database? For example, I'm using Node.js to get a POST request for signing up / logging in a user from a webpage. When signing up a user, I ...
user avatar
0 votes
2 answers
109 views

Should login requests be padded to avoid revealing password length?

If an attacker who can watch network traffic knows a victim's username and can figure out which request is a login, then the size of the login request will reveal something about the password length. ...
user avatar
  • 125
1 vote
0 answers
41 views

How Firefox and Google password managers protect your password [duplicate]

Based in this post in Google Chrome help they claim that they encrypt my username and password with a secret key known only to my device. What is the algorithm used to generate this secret which is ...
user avatar
  • 21
4 votes
2 answers
348 views

How does Windows password protect my data?

As far as I know, Windows computers are not encrypted by default in case you are not signed into a Microsoft Account. Considering the aforementioned fact I cannot understand the purpose of the login ...
user avatar
24 votes
7 answers
11k views

After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?

After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe? I assume yes, given that if e.g. the word was "password", and the new ...
user avatar
  • 422
0 votes
1 answer
124 views

What is the impact of someone accidentally getting my IMEI number from my Android phone? [duplicate]

I have a concern regarding how risky it is if someone knows or has the copy of my 2 IMEI numbers. As we all know, on Android phones, the IMEI are at the back cover of the phone like a sticker. So, my ...
user avatar
3 votes
3 answers
2k views

Password based RSA encryption

I recently learned (read) the math behind RSA encryption (algorithm). Now, I wonder if there is a way to use a custom password instead of the private key. Imagine a web application, where user signs ...
user avatar
58 votes
6 answers
8k views

Why does DocuSign require that your password "must not contain the characters <, > or spaces."?

DocuSign requires that your password "must not contain the characters <, > or spaces." Is this not an odd requirement? Despite being a leader in online document signing, my gut tells ...
user avatar
  • 633
0 votes
3 answers
240 views

If email is an insecure medium, why are usernames and passwords sent via email (albeit in separate ones)?

At work we are using a secure file transfer utility that, after setting it up, sends you and the participants you want to share those files with, two emails. One email contains the randomised username,...
user avatar
0 votes
0 answers
97 views

What are the advantages of password "leasing"

One the Hashicorp Vault basic feature is secret leasing. They state: Leasing and Renewal: All secrets in Vault have a lease associated with them. At the end of the lease, Vault will automatically ...
user avatar
  • 101
0 votes
1 answer
123 views

crackmapexec continue after finding first match

I am currently trying to solve the RazorBlack room on tryhackme. After enumerating the machine, I created a list of valid usernames and was also able to crack the password of one of the users. Now I ...
user avatar
0 votes
0 answers
79 views

Is it possible for someone to get my personal information if I log in with their google mail id in my device for some work related thing?

I was working on an app for a client which had a premium subscription with play store with their mail id, so I had to log in with their email on my device to test the application. But right after I ...
user avatar
0 votes
1 answer
120 views

What’s the best way to only allow a file to be opened with multiple people’s authorisation?

Is there software available that makes it easy for multiple authorisations to be required before a file can be opened? The simplest solution I've found online is to encrypt a file with a password, ...
user avatar
0 votes
1 answer
126 views

Are there any other account system attacks I should be aware about?

Not fully sure if these types of questions are allowed here, but don't see anything against it in the help centre so I'm assuming it is. Please point me to a better place to ask if it's not! I'm ...
user avatar
1 vote
1 answer
87 views

Password Based Encryption with Social Login

I have a question about implementing user password-based encryption in a database injunction with the Social Login feature. User private data in my database should be encrypted in order to provide ...
user avatar
0 votes
1 answer
110 views

How to change the password hashing scheme in LDAP using an external library with slapd.d config

I am trying to change the password hashing scheme for LDAP. Hypothetically, let's assume it's pw-argon.so I don't have slapd.conf I have the slapd.d directory where I can make changes dynamically to ...
user avatar
0 votes
0 answers
82 views

Is it safe to use a Digital Signature created with a PKI certificate's private key as a password

I'm trying to create application-layer encryption for user data in my database, using password derivation function. But there is a problem, that there must be an admin user, who can access all user's ...
user avatar
1 vote
1 answer
94 views

How can I improve the application administrator's encryption keys security inside database

I am interested in the issue of establishing the security of data of users of a web application in the event of a database leak. It was decided to use the following encryption chain: User data is ...
user avatar

1
2
3 4 5
78