2022 Developer Survey is open! Take survey.

Questions tagged [passwords]

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

Filter by
Sorted by
Tagged with
0 votes
0 answers
82 views

Is it safe to use a Digital Signature created with a PKI certificate's private key as a password

I'm trying to create application-layer encryption for user data in my database, using password derivation function. But there is a problem, that there must be an admin user, who can access all user's ...
user avatar
1 vote
1 answer
94 views

How can I improve the application administrator's encryption keys security inside database

I am interested in the issue of establishing the security of data of users of a web application in the event of a database leak. It was decided to use the following encryption chain: User data is ...
user avatar
1 vote
2 answers
353 views

How many rounds of Bcrypt to use for security equivalent to SHA256?

We regularly use 10000 iterations of SHA256 for hashing passwords. If we want to have similar security, how many rounds/work factor should we use when hashing passwords with bcrypt?
user avatar
  • 141
0 votes
3 answers
213 views

Github knows where I have used my password

How can the operator of Github detect whether or not my password applied on their website is commonly used by me on other websites? I have received a warning message from them forcing me to change my ...
user avatar
0 votes
2 answers
202 views

How do I secure SQL passwords when distributing executables?

Environment I am creating a python application which writes to SQL. It is compiled into an .exe and distributed to other computers in the business. (Edit: The SQL server is hosted by our business, ...
user avatar
1 vote
1 answer
246 views

OWASP Pentest - "Sensitive data sent in clear text" [closed]

We have our web app / REST API getting tested by potential customer. In the report they came up with this issue: Sensitive data like user credentials on login page, password reset, change password ...
user avatar
  • 121
0 votes
1 answer
218 views

Hacked list of AD logins and passwords

An organization my friend works for was recently hacked, and the hackers published a file with over 100,000 names and passwords, including theirs. An IT person in the organization told me that the ...
user avatar
  • 101
0 votes
1 answer
248 views

How can a Microsoft "unsuccessful sign-in" trigger a 2FA request?

I was certain I'd find a question asking this, but a search didn't return any results. I have 2FA enabled on my Microsoft account, which requires me to approve all sign-ins using the Microsoft ...
user avatar
0 votes
2 answers
229 views

Percent-encoding in WinSCP in SFTP password, why?

I recently discovered the problem with Percent-encoding. It makes perfectly sense when we are dealing with such problem in a browser scenario. But I don't get why a software like WinSCP can be ...
user avatar
2 votes
1 answer
131 views

Not the same password for AWS (root user) and Amazon.com shopping, because that is not secure in my eyes

I use the same email address for the AWS root user and my Amazon shopping account. Unfortunately the password for both parts of Amazon is also the same, when I change the AWS password I automatically ...
user avatar
  • 1,413
18 votes
1 answer
4k views

Crack 7Z password if I also have the original file

Some of my files have been encrypted by ransomware. I can find some backup of files (unfortunately not all of them). Can I find the password of the 7Z zipped+encrypted files if I also have some of the ...
user avatar
  • 283
2 votes
3 answers
198 views

Is using random salt to pbkdf2 for every request to Rest API good/bad?

Here are my conditions: My Rest API must accept username and plain password. But, that's very bad. That's why the client must encrypt the password first and my rest API will decrypt it to get the ...
user avatar
0 votes
1 answer
319 views

VeraCrypt: Is it possible to change the master key?

The password in VeraCrypt is used to en-/decrypt a header, that contains a master key, that is used to en-/decrypt the data. I know, that I can change the password, which will not change the master ...
user avatar
0 votes
1 answer
104 views

ncrack ssl option

There is the following option in ncrack (from the man page): Misc options: ssl: enable SSL over this service ssl (Enable/Disable SSL over service) By enabling SSL, Ncrack will try to open a TCP ...
user avatar
0 votes
1 answer
2k views

John the ripper not able to crack the password

I generated two hashes from this site: Plaintext 1 (p1): world Salt 1 (s1): hello Hash 1 (h1): 936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af Plaintext 2 (p2): world2 Salt 2 (s2)...
user avatar
0 votes
1 answer
199 views

Is pbkdf2 with hmac using md5 still secure?

I have an old system that can do PBKDF2 with HMAC using MD5, but not SHA-2. Now I know that MD5 is insecure and shouldn't be used for new applications, but https://crypto.stackexchange.com/a/9340/...
user avatar
  • 1,126
0 votes
1 answer
138 views

Submitting password over untrusted VPN

Hi,I do not work in IT security and hence am asking some general questions here. I read https://security.stackexchange.com/a/172821/266785 and have questions that would appreciate answers. Is my ...
user avatar
0 votes
1 answer
128 views

Store a password as an identifier (as safely as possible)... since there is no other choice

I have to deal with a place that has some terrible security practices. For example, this place gives people passwords (eg. domain logon on Windows, but paired with their name as the username) that is ...
user avatar
1 vote
1 answer
136 views

Is username + password functionally equivalent to a single login string of the same length?

My intuition is failing me with this. Would it make it easier or harder for an attacker trying to gain access to any of the accounts in a database? I can see that in the case of a single login string, ...
user avatar
  • 111
0 votes
1 answer
338 views

strength of 64 character long password with containing only Hexadecimal digits (xdigit)

I wrote a small shell function to generate random passwords. Such a password may look like the below. D2fdAbE5e9bcAFDBE5bEeED3b795ecf44B35e99B6D28591429fEE6B7C0BcCed1 I started to wonder if this is ...
user avatar
  • 115
2 votes
3 answers
203 views

Is it sensible to accept a password + any other random characters for successful authentication?

Supposing a user of my system has set their password to Password123 At the login screen, what would be the security implications of me accepting: Password123 or Password1234 or Password123ABC Based on ...
user avatar
  • 21
1 vote
1 answer
178 views

Is 2FA based on Google Authenticator Real?

I was reading this response on SE about 2FA: Well, I hate to break this to you, but Google Authenticator plus password isn't really two-factor authentication. Proper 2FA is two separate items out of ...
user avatar
2 votes
3 answers
375 views

To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?

I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
user avatar
  • 131
1 vote
0 answers
123 views

Can SMB/CIFS credentials be extracted from Linux?

On a penetration test, I have completely compromised a Linux machine and I am now trying to move around the network. The Linux machine has a mounted CIFS share, and I want to get the password used to ...
user avatar
  • 79
0 votes
4 answers
235 views

Forget Me Not? Abandoning the Forgot Password Functionality

They say a chain is only as secure as its weakest link. When it comes to account security it seems to me that the Forgot My Password functionality is the weakest link in the security chain because it ...
user avatar
30 votes
6 answers
7k views

Is it insecure to display the number of characters when users enter a new passphrase?

When users are entering a new passphrase somewhere, it's helpful to provide feedback on the number of characters received by the system. In a user experience (UX) test I just ran, my user created a ...
user avatar
  • 409
0 votes
0 answers
129 views

Specification of AES-based PKCS#5 Password-Based Encryption (PBE)

recently I had a look at the capabilities of the Java keytool to create PKCS#12 containers with a protected private key. According to the standard a private key is protected using a PKCS#8 shrouded ...
user avatar
0 votes
0 answers
178 views

What are security risks of a domain user accounts with denied interactive logon?

When I create domain user account with denied interactive logon, what are real security risks when hacker gets the password? http://paulasitblog.blogspot.com/2017/01/deny-interactive-logon-for-service....
user avatar
0 votes
1 answer
143 views

Company sent me a registration email with a clear text password [duplicate]

I recently signed up for a company's product, and promptly received an email confirming my registration, showing both my email address and my password. I'm not a security expert, but that was a huge ...
user avatar
0 votes
2 answers
122 views

With Network Security Systems Decrypting SSL traffic to scan for Malware Is Server-Side hashing of Credentials Still Enough?

I am not a Security Expert by any means. Nor am I a Cryptographer. That's why I'm here. After discovering that the server side of some software I work on was operating on plain text passwords (though ...
user avatar
0 votes
1 answer
112 views

Password list where a password policy was used

I found a list of common passwords (i.e. "123456", "password", etc.) online. Is there a public / open-source set of common passwords where a password policy was in use? Example of ...
user avatar
1 vote
1 answer
164 views

Is there any security flaw in this C program to generate a tabula recta?

In order to generate and store my passwords, I decided to use a tabula recta as described in this article. So I coded a simple C program to create such a table, I wanted to know if it contained a ...
user avatar
1 vote
3 answers
187 views

Does hashing syslog (or similar) make for good passwords?

I thought of an approach to password generation that I haven't heard of anyone else using. It almost seems too good to be true so I wonder what the downsides are. I'm well aware that you shouldn't &...
user avatar
  • 11
4 votes
1 answer
241 views

How does Firefox protect Logins and Credit Card Data?

I have a question about how Firefox protects Login information (Website passwords) on the one hand and Credit Card data on the other. I noticed that there are two different approaches to how Login ...
user avatar
  • 153
0 votes
0 answers
442 views

Speed up cracking a wpa2.hccapx file in hashcat

I'm trying to do a brute force with Hashcat on windows with a GPU cracking a wpa2.hccapx handshake. Based on my research I know the password is 10 characters, a mix of random lowercase + numbers only ...
user avatar
  • 1
1 vote
1 answer
307 views

Why is entropy measured in bits?

I use KeePassXC to generate and store passwords. For example, generating a password with a length of 128 characters without using the extended ASCII character table, the entropy is about 770 - 800 ...
user avatar
  • 137
0 votes
0 answers
196 views

Get encrypted PDF password

For a CTF challenge, I got a locked PDF file with a data folder that contains images, a plaintext file and a wav audio file. I used pdf2john.pl to get the password hash and I performed a brute force ...
user avatar
1 vote
1 answer
206 views

Does using a random number of iterations for PKBDF2-SHA256 help if I only have to protect one key used to encrypt a password protecteded file? [duplicate]

I read about Recommended # of iterations when using PBKDF2-SHA256? I have also read in Why not just use a small but unusual number of hashing rounds? that when there are multiple password to protect, ...
user avatar
  • 113
1 vote
1 answer
1k views

Cracking Lost Password for encrypted 7z file with most characters known

I forgot password to 7z archive encrypted with AES 256. I am fairly certain of most characters however. I know password length is either 8 or 12 characters and if it is 12 I know the last 4 characters....
user avatar
0 votes
0 answers
228 views

John The Ripper numbers mask

I'm using john on Windows and I use pdf2john. What do I have to do to crack this password? I saw previous passwords and they were 4 digits (1234), possibly there may be more now. currently trying to ...
user avatar
  • 1
0 votes
1 answer
87 views

If a platform/system has brute force protection should I care for a very strong password

If a platform has brute force protection should I worry about creating a very strong password since any attacker would not get a chance to reach enough attempts to crack even the weakest password? Not ...
user avatar
  • 101
7 votes
3 answers
4k views

Why not just use a small but unusual number of hashing rounds?

When it comes to hashing passwords, it is nowadays practice to do 100'000 or 200'000 iterations of SHA256/SHA512, or at least something in that ballpark. But my question is, why is it not safe enough ...
user avatar
0 votes
2 answers
379 views

Sending password in separate email [duplicate]

I've noticed some services will send a username in one email with a note saying the password will come in a different email. Is there any point to this? It seems that if someone can get that email ...
user avatar
-1 votes
1 answer
154 views

What are the security implications of the password policy for this bank? [duplicate]

I am aware of a bank (redacted for obvious reasons) that has the following password policy. Only English alphanumeric characters Min of 8, max of 14 characters No special characters (ex. !@#$%^&* ...
user avatar
0 votes
0 answers
346 views

I can't decrypt chrome passwords offline with sha masterkey

I'm trying to decrypt a Chrome 80+ Login Data file offline using the SHA1 or SHA256 masterkey retrieved either using backupkey or lsass dump but no tool seems to work (I tried mimikatz, sharpdpapi, ...
user avatar
20 votes
3 answers
6k views

Not understanding why I should use public/private key encryption over password?

My knowledge about these topics is very elementary, please "school me" if I said something completely wrong, it would surely help me understand these things better. Now, to my issue. Now ...
user avatar
2 votes
0 answers
155 views

Why is John returning gibberish for cracked hashes

I've been messing around with John, and when I attempt to crack an SSH hash, I receive this output. Any clue why the cracked hash is displaying the gibberish?? I used ssh2john to convert the key to a ...
user avatar
0 votes
2 answers
142 views

What are security benefits (if any) of using multiple passwords (device, password manager, …) vs single strong passphrase when paired with FIDO U2F?

I am evaluating security benefits of requiring employees (in enterprise context) to use multiple passwords (or passphrases) vs single strong randomly generated passphrase (minimum of 8 words) when ...
user avatar
0 votes
1 answer
92 views

How to merge two email boxes securely with an email box fetcher?

I have two email boxes: The first one is my main email box in Gmail and the second one is in my website hosting company by Thunderbird which I access from my website hosting manager (WHM) which is ...
user avatar
0 votes
0 answers
156 views

Where to store passwords needed by linux processes?

I am working with C++ processes on a linux (CentOS 8) environment. These processes should be able to access an encrypted file on the system. Where should I store the password for this encrypted file? ...
user avatar

1 2
3
4 5
78