Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [passwords]

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

Filter by
Sorted by
Tagged with
1 vote
2 answers
376 views

What is the point of storing hashed passwords? If that file is read, doesn't that mean the computer has already been compromised?

Why is it necessary to store operating system passwords hashed? From what I've learned, passwords are stored on the hard drive/SSD in /etc/shadow. However, if a malicious agent was able to get access ...
user avatar
  • 13
0 votes
1 answer
131 views

Can yubikeys prevent cookie stealing?

When you log into a website, it stores cookies that let your browser access the website without having the password. Given that some sites support yubikey for login, does it mean that the yubikey ...
user avatar
0 votes
2 answers
1k views

Does John the Ripper automatically account for salt and hash?

I have an embedded device running Armbian which I was able to get the drive image from. The entry in /etc/shadow combined with /etc/passwd after unshadowing is this: root:$6$TV6ML2bG$TncnN/adtU9xaQs/...
user avatar
0 votes
0 answers
67 views

Could I have prevented my Facebook password from being stolen by these trojan apps? [duplicate]

According to this Dr. Web article: Doctor Web’s malware analysts have discovered malicious apps on Google Play that steal Facebook users’ logins and passwords. These stealer trojans were spread as ...
user avatar
0 votes
2 answers
396 views

How does having a password hash speed up cracking vs not having a hash (on-site)?

On Windows, user password hashes are not salted and, on Linux, user password hashes are stored in the same root-owned file as the salt. Given this, in what ways might a bruteforce attack to find the ...
user avatar
  • 331
3 votes
1 answer
313 views

Is it OK to save user passwords into plaintext?

I want to easily recover user passwords if required. I hash them using bcrypt but I tried to backup non-hashed passwords into a plain text file (*txt) not accessible over the internet. Is that correct ...
user avatar
2 votes
1 answer
130 views

Security implications of using a non-hash in the password column

Imagine a webapp that uses a traditional email-password-login, with the users-table saving the password salted and hashed using bcrypt. Now a secondary login method should be implemented, like an API ...
user avatar
0 votes
2 answers
131 views

How can scammers reset passwords without accessing the email account?

I've read some of the other questions here but I still can't fully wrap my head around this. I know there are different 2FA implementations but, assuming the hacker can't access the email account, how ...
user avatar
44 votes
2 answers
6k views

Why don't car keys use algorithms like RFC 4226?

I've been reading a bit into car security and all of the ways cars can be stolen through various alterations of replay attacks. Upon researching whether any of the more modern cars are using anything ...
user avatar
0 votes
1 answer
80 views

How to monitor your user accounts for breached logins?

On a few rare instances, I've received an email from a website notifying me that my email and password were found in batch of harvested logins, and they then force me to change my password. This has ...
user avatar
  • 101
10 votes
4 answers
3k views

Password management of emailed cleartext passwords

If a website emails a password in cleartext when you use the "forgot password" function, is there any possibility that the password is hashed? It does generate a different password if you ...
user avatar
  • 103
3 votes
2 answers
328 views

Does HTTPS leak password length?

On a website with user accounts, all HTTP requests coming from the submission of a login form kind of contain the same info, there are only a few things that are different in the HTTP requests, such ...
user avatar
  • 133
0 votes
2 answers
196 views

Password Strength Determination

Recently, I've checked the some articles including R. E. Smith, The Strong Password Dilemma. ch. 6., Password Strength: An Empirical Analysis, Distance between two passwords and Password strength ...
user avatar
  • 103
1 vote
2 answers
180 views

How is a password kept secure before hashing?

I know that once a password is on a server it is hashed and salted. But when it was transferred over the internet it was stored in plain text, right? And also when it is in the memory of the server ...
user avatar
0 votes
1 answer
128 views

Is there data on the most common password strength requirements?

Many websites have different requirements for a strong password (beyond simple length I mean). Anecdotally, I think these requirements are common: Password must contain a mix of upper and lower case ...
user avatar
  • 315
1 vote
0 answers
229 views

Using John the Ripper for Blockchain.info second password

Is there a way to use JtR for Blockchain.info's (v2) secondary password? I already tried the blockchain2john.py file, and it does not ask for primary password (which I know already) so it is going to ...
user avatar
  • 61
0 votes
2 answers
427 views

How would I safely store a password locally?

I have a program which allows another authorized user (with a password) to access someone else's computer without them having to be there. However, I don't know how to safely store the password ...
user avatar
0 votes
1 answer
143 views

What is the equivalent of "forgot password" in password-less login applications using FIDO2 / Webauthn or later?

I'm assuming instead of saying "forgot password?" the text would say "lost your key?" or "don't have your device?". But what would the process of secondary access look ...
user avatar
0 votes
1 answer
114 views

Password hashing for local servers

I'm running a local web server on my Raspberry Pi and want to have a login screen. My plan is to hash the password and store the result in a text file ( This is where I'm storing settings for the ...
user avatar
0 votes
2 answers
308 views

Is it possible to reverse a hashed password? [duplicate]

Is it possible to reverse a password hashed with bcrypt?
user avatar
  • 17
1 vote
1 answer
259 views

Do I need strong user password for an encrypted VM?

I've just imported Whonix VirtualBox VM, and have encrypted its drive via VirtualBox settings. Now when I booted it, the default credentials are "user/changeme", and setup suggests I change ...
user avatar
  • 121
3 votes
0 answers
218 views

Should I build my own login functionality? [closed]

I've looked at various ways of logging in users and I'm wondering if I should write my own. There are a lot of third party solutions that make it easy and cheap to get started, like Amazon Cognito and ...
user avatar
2 votes
1 answer
209 views

How can I use a unique salt for each user

I know there are various questions that seem similar, for instance, this one. However, it does not answer my question. I'm creating a signup/login system (with node.js to be particular), and I'm ...
user avatar
  • 23
0 votes
0 answers
35 views

What is an SLT1000 password encryption? [duplicate]

The sample password-encryption below. {SLT1000}8kmbGwpGQRS0b8GOdAH4/Wrt8z4= Could anyone identify what type of encryption is this?
user avatar
  • 9
3 votes
1 answer
298 views

How can salted passwords work if you don't "keep the salts in the system"?

In this report on the recent ParkMobile breach, the article has this comment from the company: “You are correct that bcrypt hashed and salted passwords were obtained,” Perkins said when asked about ...
user avatar
1 vote
0 answers
251 views

JTR finishing very quickly with rockyou.txt and not cracking the hash

I've been fumbling through the world of Information Security by going through the HTB challenges, and I've come across an issue I just can't seem to find an answer for. During one of the challenges I'...
user avatar
4 votes
1 answer
580 views

How did Firefox get my passwords?

I just installed Firefox browser, while I have previously used Google Chrome as my main browser. I am using Windows 10. During the installation and setup process for Firefox, I was given the option to ...
user avatar
2 votes
0 answers
75 views

Entering password on third party websites to enable integrations

I've got a third party service that I want to integrate with various other websites/applications, the third party service says they support this however rather than using an API key or OAuth to ...
user avatar
  • 121
1 vote
2 answers
208 views

Passwords verification against a set of breached passwords

NIST and OWASP ASVS recommends checking passwords against those obtained from previous data breaches. The list of such passwords can be downloaded from "Have I Been Pwned" (https://...
user avatar
  • 1,097
1 vote
1 answer
187 views

Passwords stored as obfuscated text, not encrypted

An application I admin (but did not develop or implement) claims to be storing passwords in a database using “reversible encryption.” I have access to the database table, and was able to work out that ...
user avatar
  • 13
1 vote
1 answer
102 views

Is combining salt from two places secure enough and what length

I need to implement some hashing scheme for an open-source project. This is what I currently have and I'd like to hear whether this is secure enough - The password is hashed using PBKDF2-SHA256 (which ...
user avatar
  • 113
0 votes
1 answer
183 views

How to create a secure password for a Java keystore?

What would be the recommended approach (industry standard) for generating a password for a Java keystore that contains TLS certificates? In the event that the keystore is obtained, an attacker would ...
user avatar
0 votes
1 answer
149 views

Is passlib cryptocontext verify method security for timing attacks?

My question is pretty short: is passlib cryptocontext verify method vulnerable to timing attacks, which would an attacker allow to narrow down the real password?
user avatar
  • 103
0 votes
3 answers
118 views

What's the basis for recommending resetting my email password when an unknown account password is compromised?

One of the banks that provides identity theft monitoring to accountholders notified me that my email address was included in a recent data breach, along with a password, but without any indication of ...
user avatar
0 votes
1 answer
365 views

FIPS compliant passwords protection/encryption?

Do FIPS 140-2 or related documens specify how to protect users' passwords with encryption? Are there any well known schemas for storing passwords in lossless manner and lossy manner?
user avatar
  • 201
0 votes
1 answer
101 views

why is supporting digest authentication necessary instead of other more secure ways like applying non-reversible transformation to password?

Why is supporting digest authentication necessary instead of other more secure ways like applying non-reversible transformation to password to encrypt them? Is it because the receiving end cannot ...
user avatar
1 vote
1 answer
139 views

Are saved passwords in browsers secure, when stored online?

Where are saved passwords stored if you login to a browser, so they sync whenever you login to that browser on another device. Where and how do Google, Firefox etc. save the passwords? Obviously its ...
user avatar
0 votes
1 answer
162 views

What is a secure way to send credentials to the server?

I am currently making a file server (Based on HTTP) for my service. I want an upload key, so a key that is needed for uploading. To get this key, the client has to provide his login data. Let's say my ...
user avatar
1 vote
2 answers
362 views

How to generate all possible combinations of a forgotten password

I have forgotten my password but I know the words used in the password. I remember the password was something like MyPassport@1.82TB. Is there any software that can produce all combinations like ...
user avatar
1 vote
2 answers
163 views

Does Windows log desktop application passwords?

The other day I logged into Discord on my friend's computer using the desktop application. Does Windows log these events somewhere? Does it store the password hash or some sort of authentication token?...
user avatar
  • 13
0 votes
0 answers
34 views

What characters should, and should I absolutely not use in generated passwords? [duplicate]

I'm currently setting up a KeePass database after switching over from another password manager, and it has the option to change the character set for generating a password. This has a lot of options, ...
user avatar
0 votes
1 answer
120 views

Does syncing local data to the cloud count as MFA?

Bitwarden uses TOTP as the multi-factor authenticator method for their password manager. Bitwarden stores and syncs your data so you need the master password + TOTP to get access to your account ...
user avatar
  • 809
3 votes
1 answer
521 views

How does Linux know if a new password is a "wrapped" version of a old one?

How does Linux know if a new password is a "wrapped" version of an old password? (or, the process of creating a new password) know "certain" parts of one's password? Let's say I ...
user avatar
24 votes
6 answers
12k views

Is it safe to publish the hash of my passwords?

How unsafe would be to publish the hash of my passwords? I have written a Python script for helping me to remember my basic passwords (computer password, encrypted backup password, AppleID password, ...
user avatar
  • 359
0 votes
1 answer
136 views

Database password encryption compromised

A company has a database with user's passwords encrypted. An attacker compromised the password encryption now it needs to be changed. In this situation does the company needs to change the encryption ...
user avatar
1 vote
0 answers
92 views

How much time will Fugaku supercomputer take to generate a wordlist? [closed]

How much time will the Fugaku supercomputer take to generate a wordlist? Length: 50 Combination: Alphabet(upper/lower) + numbers (0~9) also, would wordlist generators make a significant time/...
user avatar
15 votes
4 answers
3k views

PBKDF2 usage will slow REST API down?

When implementing password hashing using PBKDF2 for authenticating access to a REST api,when we say that PBKDF2 is slow does it mean that it's going to take a lot of time to hash the password and ...
user avatar
  • 2,099
1 vote
0 answers
67 views

Is there record of a pubilc RDS instance with strong password having been hacked?

I am auditing an AWS account and I found a public RDS instance, that is with public DNS, no Security Group IP connection filtering and in a public Subnet However, the instance has a relatively strong ...
user avatar
-2 votes
1 answer
149 views

Unathorized Access to Google Drive

My Google Account was hacked granting unauthorized access to YouTube and Google Drive. The third party immediately started posting inappropriate content on YT which prompted an email from Google after ...
user avatar
  • 97
0 votes
1 answer
146 views

Exchange compromise affected company - should we 100% change administrator password?

We host exchange on premise (exchange 2013). We believe following MS's guides and guidelines that we were compromised regarding the exchange zero days hack. We did find some .aspx files that did not ...
user avatar
  • 137

1 2 3
4
5
78