Questions tagged [passwords]
Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.
3,878
questions
0
votes
0
answers
82
views
Is it safe to use a Digital Signature created with a PKI certificate's private key as a password
I'm trying to create application-layer encryption for user data in my database, using password derivation function. But there is a problem, that there must be an admin user, who can access all user's ...
1
vote
1
answer
94
views
How can I improve the application administrator's encryption keys security inside database
I am interested in the issue of establishing the security of data of users of a web application in the event of a database leak.
It was decided to use the following encryption chain:
User data is ...
1
vote
2
answers
353
views
How many rounds of Bcrypt to use for security equivalent to SHA256?
We regularly use 10000 iterations of SHA256 for hashing passwords.
If we want to have similar security, how many rounds/work factor should we use when hashing passwords with bcrypt?
- 141
0
votes
3
answers
213
views
Github knows where I have used my password
How can the operator of Github detect whether or not my password applied on their website is commonly used by me on other websites?
I have received a warning message from them forcing me to change my ...
0
votes
2
answers
202
views
How do I secure SQL passwords when distributing executables?
Environment
I am creating a python application which writes to SQL.
It is compiled into an .exe and distributed to other computers in the business.
(Edit: The SQL server is hosted by our business, ...
1
vote
1
answer
246
views
OWASP Pentest - "Sensitive data sent in clear text" [closed]
We have our web app / REST API getting tested by potential customer. In the report they came up with this issue:
Sensitive data like user credentials on login page, password reset,
change password ...
- 121
0
votes
1
answer
218
views
Hacked list of AD logins and passwords
An organization my friend works for was recently hacked, and the hackers published a file with over 100,000 names and passwords, including theirs. An IT person in the organization told me that the ...
- 101
0
votes
1
answer
248
views
How can a Microsoft "unsuccessful sign-in" trigger a 2FA request?
I was certain I'd find a question asking this, but a search didn't return any results.
I have 2FA enabled on my Microsoft account, which requires me to approve all sign-ins using the Microsoft ...
user218666
0
votes
2
answers
229
views
Percent-encoding in WinSCP in SFTP password, why?
I recently discovered the problem with Percent-encoding.
It makes perfectly sense when we are dealing with such problem in a browser scenario. But I don't get why a software like WinSCP can be ...
2
votes
1
answer
131
views
Not the same password for AWS (root user) and Amazon.com shopping, because that is not secure in my eyes
I use the same email address for the AWS root user and my Amazon shopping account.
Unfortunately the password for both parts of Amazon is also the same, when I change the AWS password I automatically ...
- 1,413
18
votes
1
answer
4k
views
Crack 7Z password if I also have the original file
Some of my files have been encrypted by ransomware. I can find some backup of files (unfortunately not all of them). Can I find the password of the 7Z zipped+encrypted files if I also have some of the ...
- 283
2
votes
3
answers
198
views
Is using random salt to pbkdf2 for every request to Rest API good/bad?
Here are my conditions:
My Rest API must accept username and plain password. But, that's very bad. That's why the client must encrypt the password first and my rest API will decrypt it to get the ...
- 121
0
votes
1
answer
319
views
VeraCrypt: Is it possible to change the master key?
The password in VeraCrypt is used to en-/decrypt a header, that contains a master key, that is used to en-/decrypt the data.
I know, that I can change the password, which will not change the master ...
- 1,621
0
votes
1
answer
104
views
ncrack ssl option
There is the following option in ncrack (from the man page):
Misc options:
ssl: enable SSL over this service
ssl (Enable/Disable SSL over service)
By enabling SSL, Ncrack will try to open a TCP ...
- 210
0
votes
1
answer
2k
views
John the ripper not able to crack the password
I generated two hashes from this site:
Plaintext 1 (p1): world
Salt 1 (s1): hello
Hash 1 (h1): 936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af
Plaintext 2 (p2): world2
Salt 2 (s2)...
- 103
0
votes
1
answer
199
views
Is pbkdf2 with hmac using md5 still secure?
I have an old system that can do PBKDF2 with HMAC using MD5, but not SHA-2. Now I know that MD5 is insecure and shouldn't be used for new applications, but https://crypto.stackexchange.com/a/9340/...
- 1,126
0
votes
1
answer
138
views
Submitting password over untrusted VPN
Hi，I do not work in IT security and hence am asking some general questions here.
I read https://security.stackexchange.com/a/172821/266785 and have questions that would appreciate answers.
Is my ...
0
votes
1
answer
128
views
Store a password as an identifier (as safely as possible)... since there is no other choice
I have to deal with a place that has some terrible security practices. For example, this place gives people passwords (eg. domain logon on Windows, but paired with their name as the username) that is ...
1
vote
1
answer
136
views
Is username + password functionally equivalent to a single login string of the same length?
My intuition is failing me with this. Would it make it easier or harder for an attacker trying to gain access to any of the accounts in a database?
I can see that in the case of a single login string, ...
- 111
0
votes
1
answer
338
views
strength of 64 character long password with containing only Hexadecimal digits (xdigit)
I wrote a small shell function to generate random passwords. Such a password may look like the below.
D2fdAbE5e9bcAFDBE5bEeED3b795ecf44B35e99B6D28591429fEE6B7C0BcCed1
I started to wonder if this is ...
- 115
2
votes
3
answers
203
views
Is it sensible to accept a password + any other random characters for successful authentication?
Supposing a user of my system has set their password to Password123
At the login screen, what would be the security implications of me accepting:
Password123 or
Password1234 or
Password123ABC
Based on ...
- 21
1
vote
1
answer
178
views
Is 2FA based on Google Authenticator Real?
I was reading this response on SE about 2FA:
Well, I hate to break this to you, but Google Authenticator plus
password isn't really two-factor authentication. Proper 2FA is two
separate items out of ...
- 141
2
votes
3
answers
375
views
To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?
I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
- 131
1
vote
0
answers
123
views
Can SMB/CIFS credentials be extracted from Linux?
On a penetration test, I have completely compromised a Linux machine and I am now trying to move around the network. The Linux machine has a mounted CIFS share, and I want to get the password used to ...
- 79
0
votes
4
answers
235
views
Forget Me Not? Abandoning the Forgot Password Functionality
They say a chain is only as secure as its weakest link. When it comes to account security it seems to me that the Forgot My Password functionality is the weakest link in the security chain because it ...
- 141
30
votes
6
answers
7k
views
Is it insecure to display the number of characters when users enter a new passphrase?
When users are entering a new passphrase somewhere, it's helpful to provide feedback on the number of characters received by the system.
In a user experience (UX) test I just ran, my user created a ...
- 409
0
votes
0
answers
129
views
Specification of AES-based PKCS#5 Password-Based Encryption (PBE)
recently I had a look at the capabilities of the Java keytool to create PKCS#12 containers with a protected private key. According to the standard a private key is protected using a PKCS#8 shrouded ...
0
votes
0
answers
178
views
What are security risks of a domain user accounts with denied interactive logon?
When I create domain user account with denied interactive logon, what are real security risks when hacker gets the password?
http://paulasitblog.blogspot.com/2017/01/deny-interactive-logon-for-service....
0
votes
1
answer
143
views
Company sent me a registration email with a clear text password [duplicate]
I recently signed up for a company's product, and promptly received an email confirming my registration, showing both my email address and my password. I'm not a security expert, but that was a huge ...
- 3
0
votes
2
answers
122
views
With Network Security Systems Decrypting SSL traffic to scan for Malware Is Server-Side hashing of Credentials Still Enough?
I am not a Security Expert by any means. Nor am I a Cryptographer. That's why I'm here.
After discovering that the server side of some software I work on was operating on plain text passwords (though ...
- 1
0
votes
1
answer
112
views
Password list where a password policy was used
I found a list of common passwords (i.e. "123456", "password", etc.) online.
Is there a public / open-source set of common passwords where a password policy was in use?
Example of ...
- 715
1
vote
1
answer
164
views
Is there any security flaw in this C program to generate a tabula recta?
In order to generate and store my passwords, I decided to use a tabula recta as described in this article.
So I coded a simple C program to create such a table, I wanted to know if it contained a ...
user264866
1
vote
3
answers
187
views
Does hashing syslog (or similar) make for good passwords?
I thought of an approach to password generation that I haven't heard of anyone else using. It almost seems too good to be true so I wonder what the downsides are. I'm well aware that you shouldn't &...
- 11
4
votes
1
answer
241
views
How does Firefox protect Logins and Credit Card Data?
I have a question about how Firefox protects Login information (Website passwords) on the one hand and Credit Card data on the other. I noticed that there are two different approaches to how Login ...
- 153
0
votes
0
answers
442
views
Speed up cracking a wpa2.hccapx file in hashcat
I'm trying to do a brute force with Hashcat on windows with a GPU cracking a wpa2.hccapx handshake. Based on my research I know the password is 10 characters, a mix of random lowercase + numbers only
...
- 1
1
vote
1
answer
307
views
Why is entropy measured in bits?
I use KeePassXC to generate and store passwords. For example, generating a password with a length of 128 characters without using the extended ASCII character table, the entropy is about 770 - 800 ...
- 137
0
votes
0
answers
196
views
Get encrypted PDF password
For a CTF challenge, I got a locked PDF file with a data folder that contains images, a plaintext file and a wav audio file.
I used pdf2john.pl to get the password hash and I performed a brute force ...
- 1
1
vote
1
answer
206
views
Does using a random number of iterations for PKBDF2-SHA256 help if I only have to protect one key used to encrypt a password protecteded file? [duplicate]
I read about Recommended # of iterations when using PBKDF2-SHA256?
I have also read in Why not just use a small but unusual number of hashing rounds? that when there are multiple password to protect, ...
- 113
1
vote
1
answer
1k
views
Cracking Lost Password for encrypted 7z file with most characters known
I forgot password to 7z archive encrypted with AES 256. I am fairly certain of most characters however. I know password length is either 8 or 12 characters and if it is 12 I know the last 4 characters....
- 13
0
votes
0
answers
228
views
John The Ripper numbers mask
I'm using john on Windows and I use pdf2john.
What do I have to do to crack this password?
I saw previous passwords and they were 4 digits (1234), possibly there may be more now. currently trying to ...
- 1
0
votes
1
answer
87
views
If a platform/system has brute force protection should I care for a very strong password
If a platform has brute force protection should I worry about creating a very strong password since any attacker would not get a chance to reach enough attempts to crack even the weakest password?
Not ...
- 101
7
votes
3
answers
4k
views
Why not just use a small but unusual number of hashing rounds?
When it comes to hashing passwords, it is nowadays practice to do 100'000 or 200'000 iterations of SHA256/SHA512, or at least something in that ballpark.
But my question is, why is it not safe enough ...
- 221
0
votes
2
answers
379
views
Sending password in separate email [duplicate]
I've noticed some services will send a username in one email with a note saying the password will come in a different email. Is there any point to this? It seems that if someone can get that email ...
- 121
-1
votes
1
answer
154
views
What are the security implications of the password policy for this bank? [duplicate]
I am aware of a bank (redacted for obvious reasons) that has the following password policy.
Only English alphanumeric characters
Min of 8, max of 14 characters
No special characters (ex. !@#$%^&* ...
0
votes
0
answers
346
views
I can't decrypt chrome passwords offline with sha masterkey
I'm trying to decrypt a Chrome 80+ Login Data file offline using the SHA1 or SHA256 masterkey retrieved either using backupkey or lsass dump but no tool seems to work (I tried mimikatz, sharpdpapi, ...
20
votes
3
answers
6k
views
Not understanding why I should use public/private key encryption over password?
My knowledge about these topics is very elementary, please "school me" if I said something completely wrong, it would surely help me understand these things better. Now, to my issue.
Now ...
2
votes
0
answers
155
views
Why is John returning gibberish for cracked hashes
I've been messing around with John, and when I attempt to crack an SSH hash, I receive this output.
Any clue why the cracked hash is displaying the gibberish??
I used ssh2john to convert the key to a ...
- 21
0
votes
2
answers
142
views
What are security benefits (if any) of using multiple passwords (device, password manager, …) vs single strong passphrase when paired with FIDO U2F?
I am evaluating security benefits of requiring employees (in enterprise context) to use multiple passwords (or passphrases) vs single strong randomly generated passphrase (minimum of 8 words) when ...
- 169
0
votes
1
answer
92
views
How to merge two email boxes securely with an email box fetcher?
I have two email boxes: The first one is my main email box in Gmail and the second one is in my website hosting company by Thunderbird which I access from my website hosting manager (WHM) which is ...
0
votes
0
answers
156
views
Where to store passwords needed by linux processes?
I am working with C++ processes on a linux (CentOS 8) environment. These processes should be able to access an encrypted file on the system.
Where should I store the password for this encrypted file?
...
- 75