Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
3,748
questions
1
vote
0answers
27 views
How to assess security of Argon2 parameters [duplicate]
I would like to hash user password with Argon2id, then use this hash as ECDSA private key. I made some tests with Python and passlib.hash and found following parameters:
memory: 32 MB
iterations: 100
...
2
votes
2answers
197 views
Can your internet provider monitor your data (passwords, etc?)
Was typing in my password into an HTTPS website when I started to wonder if my home WiFi (whether a neighbor could have hacked into and monitoring it) is secure.
When I type in
Username123
Password123
...
1
vote
1answer
109 views
Why do administrators create passwords vulnerable to kerberoasting? [closed]
I was researching a kerberoasting attack on the Active Directory domain. To create the stand, I used a Domain Controller on Windows Server 2016 and one client machine on Windows 10. SQL Server was ...
8
votes
4answers
2k views
Alternatives for sending plaintext password while login
Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
0
votes
0answers
84 views
Is there a better method that this for storing a physical password? [duplicate]
This may be a little unnecessary, but taking into consideration:
There are many ways to hack a computer
There are many ways to hack a network
There is always a possibility of an undetected malware on ...
0
votes
3answers
121 views
Problem understanding salting
I'm a beginner in Information Security and am learning about salting. Unfortunately, most of the time I have to learn by myself since the lecturer doesn't provide deep explanation on these. I now have ...
0
votes
1answer
129 views
Hydra only executes one try per task then hangs
As in the title, hydra will only execute one try per task before hanging.
$ hydra -l admin -P /usr/share/wordlists/wfuzz/general/common.txt -u 10.10.68.141 http-post-form "/admin:user=^USER^&...
1
vote
2answers
46 views
Why does it take longer for my computer to recognize a wrong password than a correct one when logging in?
When I enter the right password to log in to my computer*, I am in instantly. However, if I mistype it, there is around a 2 second pause. Are there significantly more computations taking place to ...
6
votes
2answers
235 views
Can password managers read my secure data? If no, how does sharing work under the hood? [duplicate]
All the popular password managers on the market advertise that they have AES-256 grade security. In a nutshell, the user has the master key and the password manager has the cipher-text. So the ...
1
vote
0answers
52 views
Good use of libsodium?
I am looking to hash user passwords to store in a database that will likely reside on a user's intranet, so I am expecting the database to be classed as open and insecure.
I am using libsodium 1.0.18 ...
28
votes
4answers
8k views
When passwords of a website leak, are all leaked passwords equally easy to read?
As far as I know, when passwords from a website leak, they leak in an encrypted form. Are all those passwords equally easy to decrypt? My hunch is that a 10-character-long password maybe gets ...
3
votes
2answers
721 views
Recommended length for WPA-2 password in 2020
I'm auditing my network setup and trying to determine an appropriate password length with a random set of digits and numbers. I found a Security Stack exchange answer but it was written in 2012 and ...
19
votes
7answers
6k views
Don't one-time recovery codes for 2FA introduce a backdoor?
Although using multi-factor authentication is clearly a good move, I'm struggling with the 'one-time recovery codes' concept. It seems to me that if you choose to use them, what you're doing is ...
0
votes
2answers
71 views
It is common for an account to be locked after X amount of failed logins, what are the best practice of selecting x?
To my understanding, it is common security practice to lock the account after X failed login attempts in N minute. Usually, the account will be locked for M minutes.
I noticed that most of the time X ...
0
votes
2answers
223 views
What happens if you forget your 1Password password?
When using a service like 1Password, what happens if you forget or lose your master password?
My guess is that you can simply reset your passwords on all the sites 1password remembered for you, but I ...
0
votes
1answer
68 views
Is a QR code with a secret URL that changes every 5th minute secure?
I need to verify that survey respondents are in the same physical room or video chat (to prevent industry espionage). The respondents can join by scanning a QR-code that opens a URL which embeds a ...
-1
votes
1answer
78 views
Is there any secure method to have recoverable passwords?
I have a local application that normally authenticates against a remote Active Directory server. If the local host loses network connectivity, a special local account becomes available for login. ...
0
votes
3answers
157 views
Is my login script secure – how to improve it?
I have a login system for my website that works as follows:
In the database I have a table called users with the fields user, password and authentication_token.
user gets set manually by request in ...
2
votes
2answers
141 views
On a single user laptop does it make sense to have a separte password for root and the user?
I have a laptop on which I'm the only user. While installing the laptop I was wondering why I should choose a different password for the root account and user account. My reasoning is:
The change of ...
0
votes
0answers
45 views
Storing account data on device
I am trying to make an app that allows the user to connect to a service through an API I am also developing. All passwords and account data are securely stored on the server.
However, how should I ...
1
vote
1answer
69 views
How do sites detect credential sniffing, and what is the purpose of this attack?
I just got an email from the Unsplash service telling me that someone had logged into my account via credential sniffing:
Five minutes later I get three more emails, each one notifying that a (...
7
votes
5answers
248 views
Owner vs IT employee. Security and passwords
I own a company that has hired an IT employee. He has all passwords to servers, work stations and data. He is refusing to share or supply these passwords (Keys to the Kingdom) on the grounds of ...
1
vote
0answers
63 views
Strange cyrus/imaps Logins without valid password
I found apparently successful logins from a foreign ip-address to our cyrus-imap server:
Nov 24 08:16:20 server-1 cyrus/imaps[12101]: starttls: TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits ...
0
votes
2answers
106 views
Is it possible to find a zip password if it is being generated locally?
I have a program that generates a zip file with a password. Is it possible to determine the password if you analyse the program as it is being run? Would calls to function libraries show the password ...
24
votes
7answers
5k views
Are algorithmically-generated personal passwords a security risk?
We all know why password reuse is bad: eventually some site at which you have an account that did not properly hash+salt user passwords will get hacked, and your password will be published in a big ...
0
votes
1answer
56 views
Is client-side hashing secure during password creation when verification is still done server-side?
Trying to do this to distribute the work of creating a lot of users in which their passwords are hashed. This will cause the server to do a very large amount of work. The idea is this:
(Assume ...
1
vote
1answer
144 views
What is the minimum secure length for gpg -c file.txt?
I want to use gpg -c with a user-generated password that I can easily remember. Are 16 characters enough? for example would a password similar to "I own 32 houses." be bruteforcable?
0
votes
1answer
44 views
Difference between access control systems that can/can't be compromised without valid credentials?
Take the following examples:
When I run sshd, it can in theory grant access to anything that the process itself has access to, regardless of provided credentials. For example, I could in theory ...
1
vote
1answer
86 views
Concatenating secure and reused passwords
Would concatenating (i.e. joining together into one string of text) a secure (i.e. Diceware) password and other, much less random, passwords be a good idea? This new password would be used as master ...
21
votes
3answers
4k views
Does complexity of salt in password hashing matter?
I have no cyber security knowledge whatsoever, and am trying to safely store passwords in a database. I understood I need to use salt, to avoid rainbow table attacks and to make sure two users with ...
0
votes
0answers
19 views
Found out that a paid VPN service emails plaintext passwords [duplicate]
I recently found out that a VPN service does not hash their customer passwords and I need professional insight on how to deal with this.
Here's how I found out:
Bought a subscription on the wrong ...
1
vote
0answers
42 views
Is it reasonable to type a bank password in a phone call to the bank? [duplicate]
Recently my friend called their bank (via a normal phone call) to perform an operation with her account and she had to type her password during the call. Everything worked fine, the operation was done ...
1
vote
1answer
155 views
Using Google Docs to share passwords
Background
Often developers and clients need to exchange passwords to be able to access some services. Of course the best option would be to never use someone else's credentials to log in, and instead ...
0
votes
0answers
74 views
How is Firefox importing credentials from other browsers without the need for the admin password?
Im currently looking into the security of different browser password storing mechanisms. My main focus lies on the new Chromium based Microsoft Edge browser.
As far as I can see, Chromium based ...
0
votes
1answer
148 views
Can I consider files compressed with password safe at all?
A follow up to my 7,5 years old question. Back 10-15 years ago, when I wanted to send an executable file over Gmail from my PC, all I had to do was to change file's extension to some meaningless one ...
0
votes
0answers
56 views
Password leak to malicious AP with the same SSID [duplicate]
I was just surprised to find out that devices when connecting to WiFi networks compare the SSID to known ones and try the saved password.
In other terms: I have replaced my home router, and my device ...
1
vote
1answer
106 views
Can I use the same password for my Computer, Mobile and Password Manager?
I am considering using the same password for my Computer, Mobile and Password Manager.
The premise of the "password reusing is bad" rule is that if one website leak the password then all of ...
0
votes
1answer
116 views
Is typing the PPP password in the PPP username a risk?
I went to my router admin page where first you need to type in the router's admin and password. I am not talking about that. I am talking about PPP account and password (separate from router's ...
1
vote
0answers
28 views
Making custom wordlists for languages besides English
I'm testing a site whose audience doesn't usually have English as their main language. When it comes to non-English, I consider there to be 3 groups
The target language's alphabet is a subset of the ...
0
votes
0answers
17 views
Why not just make the Forgot Username/Password the standard login procedure? [duplicate]
With increasing password complexity requirements, I've found myself just hitting forgot every time on almost every website, because it has become more convenient. It made me start to wonder, what ...
0
votes
1answer
81 views
Is it possible to use pass, the command line PW manager, without leaking details? Does it matter?
I'm familiar with password managers like KeePass, and that there are a variety of interfaces for them. However, I've decided that I rather like the charm of pass. It's command-line oriented, and ...
0
votes
0answers
108 views
Is caching the credentials hash and auth result secure?
I have an API that is handling a lot of volume and is using Basic authorization. This is causing me some performance issues and I'd like to move to token based auth but for various reasons, including ...
1
vote
1answer
231 views
Pass the Hash & Unix
Purpose: test if PtH (Pass the hash) is feasible against Unix box
Scenario:
Windows host (Windows Server 2008) vulnerable to eternalblue
got Administration hash as part of the post-exploitation ...
2
votes
1answer
107 views
Password salting vs. length extension attacks
I read that when salting passwords, it is advised to use a h(pwd||salt) construction instead of h(salt||pwd), the latter being vulnerable to a length extension attack.
What are possible scenarios in ...
0
votes
0answers
67 views
Javascript PDF Brute Forcing
I am trying to learn PDF Brute forcing with javascript.
I've read about encryption algorithm of PDF 1.4 documentation here https://www.adobe.com/content/dam/acom/en/devnet/pdf/pdf_reference_archive/...
1
vote
2answers
214 views
Best Way to hash passwords in database [duplicate]
We have a user table where we store the user passwords. Now what we do is that we have a static salt, that we append to plaintext password and do a SHA-256 of the complete text and store in DB.
We ...
39
votes
14answers
7k views
How to safely save passwords for a future administrator?
I am the volunteer IT administrator for a local non-profit organization. The organization has a few systems - specifically security cameras, network hardware, and telephones - that have local ...
9
votes
1answer
499 views
Why do some sites enforce low-security passwords? [duplicate]
I get that what comprises a good password is a bit of a moving target and not everyone agrees - just run a password through a number of checkers to see how it is rated differently depending on the ...
3
votes
2answers
93 views
Password security against Brute Force - local vs online attack?
I always wonder about the generic statements about the security of passwords. Isn't it a huge difference if the password is used for an online account or for local data encryption? For example an ebay ...
1
vote
0answers
65 views
Strange account activity - how to investigate
Today I have observed very strange scenario which appears to be attempts to hack an account. So first, let me tell the pre-story:
I have started to receive 2-factor authentication SMS messages from ...
