2022 Developer Survey is open! Take survey.

Questions tagged [passwords]

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

Filter by
Sorted by
Tagged with
0 votes
1 answer
146 views

Exchange compromise affected company - should we 100% change administrator password?

We host exchange on premise (exchange 2013). We believe following MS's guides and guidelines that we were compromised regarding the exchange zero days hack. We did find some .aspx files that did not ...
user avatar
  • 137
1 vote
0 answers
649 views

John the ripper output formatting

I'm supposed to crack some passwords from a file. I've done john pwlist.lst > passwords.txt which is outputting the files into my txt file. I'd like to make it such that when John is cracking the ...
user avatar
  • 11
1 vote
3 answers
1k views

Are security questions considered as 2FA?

Many sites have a step during registration when you have to create security questions and answers for them. Is this type of security layer considered as 2FA? From what I know, 2FA is used for the ...
user avatar
  • 41
10 votes
2 answers
571 views

Why is Webauthn not used as primary authentication method?

In theory, authenticating with a public key should be much simpler than with a password. There is nothing to remember for the end-user, and registration can be done just by clicking a button. For all ...
user avatar
2 votes
0 answers
103 views

Authentication in Desktop App

I'm reading the OWASP Authentication Cheat Sheet, but it obviously is focused only on web browser. I'm searching for something similar for a desktop app. I want users to login to a desktop app. The ...
user avatar
1 vote
0 answers
250 views

Hardware for password cracking

I'm planning to extend my pentest services to Password Cracking, to be more precise: Cracking Active Directory Passwords, extracted from the customers Active Directory in order to check users ...
user avatar
  • 131
2 votes
1 answer
205 views

How are passwords stored in the database of a decentralized peer to peer system?

I want to use username and password instead of public key cryptography for a decentralized peer-to-peer application, but since the passwords are stored on users' computers, there is a possibility of ...
user avatar
  • 21
0 votes
4 answers
195 views

Why can't you use the same password for every site, if they are hashed on the site?

I've often heard people talking about not using the same password on every website. What's the deal if servers store passwords in a SHA hash instead of plain text? The most they can do is spam you ...
user avatar
8 votes
3 answers
1k views

Why would password managers provide support for OTP codes? [duplicate]

Can anyone explain me what's this trend of providing passwords and OTP codes on the same service? What benefit or value are they trying to bring to the table? We, as security professionals, have been ...
user avatar
1 vote
1 answer
351 views

In Hashcat, How to generate combinatior attacks consisting of more than two words (in lenght)?

I am trying to make a combinator attack using just one dictionary: word1 word2 word3 word4 word5 ... And would like to try all 4-words-length permutations separated by commas: word1,word2,word3,word4 ...
user avatar
  • 113
4 votes
1 answer
706 views

Bitwarden PIN protection mechanism

I couldn't find any deep dive info about PIN management in Bitwarden. And I'm not able to read their code, not qualified enough. Are there people around here who can explain how PIN protection works ...
user avatar
  • 161
2 votes
3 answers
326 views

Pros vs Cons of Secure Remote Password

We are setting up an authentication system using Cognito and Amplify. We noticed that Amplify suggests Secure Remote Password as the default. I can understand the benefits of SRP for protecting ...
user avatar
  • 121
2 votes
2 answers
228 views

Why should password reset link be single use?

Reading from here: https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html It mentioned that password reset link should be single use and expire after appropriate period. I don'...
user avatar
  • 121
6 votes
2 answers
2k views

How are website passwords cracked? [closed]

What approaches are there for cracking user passwords for website/e-mail accounts? can only think of three strategies, but what else? Algorithmically: Combinatorially attempting different sequences ...
user avatar
13 votes
2 answers
4k views

How does Google save our passwords on their server?

My friend recently told me that: Google doesn't have our passwords saved on their database. Instead they put our password when typed on browser, through an algorithm and it'll produce a unique ...
user avatar
2 votes
1 answer
284 views

Buffer overflow outside gdb

I'm trying to exploit a basic C program (below) which I've written: #include <stdio.h> #include <string.h> void main() { char ch[10]; scanf("%s", ch); if(strcmp(&...
user avatar
2 votes
0 answers
163 views

Why does firebase encrypt with password hashes instead of storing the hashes?

I am trying to migrate off of firebase, as in doing so, you can export the hashes of user passwords. Looking at their algorithm, they do not store password hashes, but rather, they use the first 32-...
user avatar
  • 121
0 votes
1 answer
192 views

How Forgot Password Works?

For my website I need to add "forgot password" functionality. As I searched on the internet there are too much vulnerabilities you may encounter in case of wrong implementing this ...
user avatar
  • 3
1 vote
1 answer
195 views

Why don't security conscious websites use a combination of private unique identifier and password to secure their logins?

To be clear when I say "private unique identifier" I mean an identifier, which is not stored on the database for the website, it would be hashed in combination with the password and a good ...
user avatar
  • 115
-1 votes
1 answer
121 views

Does Password Harvesting Happen in Servers?

Maybe someone can explain why my concern is not realistic. If I create a browser-based app with a login (let's say I'm Facebook or Microsoft), why wouldn't I store all the wrong passwords people type?...
user avatar
1 vote
2 answers
459 views

Find encryption key with password and output

One of applications I use has a password manager feature included in it. I can add logins to the password manager and they get stored in a .ini file (for simpler login purpose, I can select an account ...
user avatar
  • 11
0 votes
1 answer
131 views

VPS host shows plain text "root" account password upon reinstall of unmanaged VM

I recently started using a VPS hosting service, that offers unmanaged VPS. It allows me to reinstall the VM at any point in time, choosing from a number of OS ISO files (doesn't have to be the same OS ...
user avatar
0 votes
1 answer
132 views

Knowing when a hacked password is correct

I was recently a victim of the any van data breach and so I started read up on password encryption and security - it is pretty amazing stuff. One thing that confuses me though is, since GPUs can now ...
user avatar
1 vote
1 answer
114 views

Config file contains password hashes and signature keys

First, I am a beginner in IT security. I hope my question is not too dumb. I use a program that can show a live feed from a security camera. You can import a project file, that sets up user accounts ...
user avatar
  • 11
0 votes
0 answers
59 views

Trace Unauthorized login into My Gmail and Facebook Account [duplicate]

I have experienced an unauthorized login into my Gmail and Facebook account, while I was logging into the accounts and doing school assignments. Suddenly, I got an email from Facebook about "...
user avatar
1 vote
1 answer
112 views

Why the need to hardcode passwords? [closed]

Many IOT devices and routers manufacturers hardcode plaintext default passwords in their devices. Why don't they store the hashed password instead? For what functionality do they need the plaintext ...
user avatar
  • 2,099
0 votes
2 answers
164 views

Why don't companies just tie the password to the user name?

One problem with passwords is that if they can be broken as follows: pick a random password hash it compare that hash to other known hashes This way, you have broken the password. Then if you can ...
user avatar
  • 11
81 votes
12 answers
11k views

Password policy for elderly clientele

I work for a company in which the age of our average user is over 70. We have an app* that helps them collect and submit physiological data to their doctors. I found this question that I believe is ...
user avatar
  • 761
1 vote
2 answers
136 views

Do I transmit a plaintext password to my PostgreSQL server?

PostgreSQL supports multiple authentication methods, and I think it supports SSL and plaintext connections. How do I find out which authentication method a server uses? I do not have access to the ...
user avatar
  • 28.6k
0 votes
0 answers
111 views

Isn't this kind of password ultimately secure and insanely easy to remember? [duplicate]

Pick any dictionary word. Think of a number over 10 and below 20. Repeat the word as many times as the number, and end off with the same number (for example, "12"). Example: ...
user avatar
  • 1
1 vote
1 answer
150 views

Allowing a password reset if an account is locked

Similar to another question about keeping an account locked, is it preferable to allow a user to reset their password while the account is locked out due to the wrong password being used too many ...
user avatar
1 vote
1 answer
1k views

Password cracking using Quantum Computers

Suppose that I have a password that is n-digits long. Each digit can take m values. So the number of permutations will be m^n. I wanted to know how much time it would take a quantum computer to crack ...
user avatar
  • 121
0 votes
1 answer
281 views

How password_hash / password_verify can work with any arguments (PHP)

I already know how to use password_verify and password_hash functions, but I don't really understand how they work. When I use them I do something like that: $save_hash = password_hash( $password, ...
user avatar
  • 3
4 votes
0 answers
587 views

Maximum password length for user accounts on Ubuntu

I have a VPS hosted at a remote location. Obviously the host can login directly (without SSH or any keys) on this box and I want to make brute force password guessing as hard as possible for a bad ...
user avatar
23 votes
2 answers
4k views

Why do password requirements exist while limiting the upper character count? [duplicate]

I do not quite understand why it is common practice to require a difficult to remember password with alphanumeric and special character requirements, while also having an upper limit of 32 characters. ...
user avatar
1 vote
0 answers
32 views

How to assess security of Argon2 parameters [duplicate]

I would like to hash user password with Argon2id, then use this hash as ECDSA private key. I made some tests with Python and passlib.hash and found following parameters: memory: 32 MB iterations: 100 ...
user avatar
2 votes
2 answers
255 views

Can your internet provider monitor your data (passwords, etc?)

Was typing in my password into an HTTPS website when I started to wonder if my home WiFi (whether a neighbor could have hacked into and monitoring it) is secure. When I type in Username123 Password123 ...
user avatar
1 vote
1 answer
162 views

Why do administrators create passwords vulnerable to kerberoasting? [closed]

I was researching a kerberoasting attack on the Active Directory domain. To create the stand, I used a Domain Controller on Windows Server 2016 and one client machine on Windows 10. SQL Server was ...
user avatar
  • 13
10 votes
4 answers
3k views

Alternatives for sending plaintext password while login

Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
user avatar
  • 941
0 votes
0 answers
170 views

Is there a better method that this for storing a physical password? [duplicate]

This may be a little unnecessary, but taking into consideration: There are many ways to hack a computer There are many ways to hack a network There is always a possibility of an undetected malware on ...
user avatar
0 votes
3 answers
168 views

Problem understanding salting

I'm a beginner in Information Security and am learning about salting. Unfortunately, most of the time I have to learn by myself since the lecturer doesn't provide deep explanation on these. I now have ...
user avatar
0 votes
1 answer
353 views

Hydra only executes one try per task then hangs

As in the title, hydra will only execute one try per task before hanging. $ hydra -l admin -P /usr/share/wordlists/wfuzz/general/common.txt -u 10.10.68.141 http-post-form "/admin:user=^USER^&...
user avatar
1 vote
2 answers
89 views

Why does it take longer for my computer to recognize a wrong password than a correct one when logging in?

When I enter the right password to log in to my computer*, I am in instantly. However, if I mistype it, there is around a 2 second pause. Are there significantly more computations taking place to ...
user avatar
6 votes
2 answers
299 views

Can password managers read my secure data? If no, how does sharing work under the hood? [duplicate]

All the popular password managers on the market advertise that they have AES-256 grade security. In a nutshell, the user has the master key and the password manager has the cipher-text. So the ...
user avatar
1 vote
0 answers
105 views

Good use of libsodium?

I am looking to hash user passwords to store in a database that will likely reside on a user's intranet, so I am expecting the database to be classed as open and insecure. I am using libsodium 1.0.18 ...
user avatar
  • 111
28 votes
4 answers
8k views

When passwords of a website leak, are all leaked passwords equally easy to read?

As far as I know, when passwords from a website leak, they leak in an encrypted form. Are all those passwords equally easy to decrypt? My hunch is that a 10-character-long password maybe gets ...
user avatar
  • 399
4 votes
2 answers
3k views

Recommended length for WPA-2 password in 2020

I'm auditing my network setup and trying to determine an appropriate password length with a random set of digits and numbers. I found a Security Stack exchange answer but it was written in 2012 and ...
user avatar
19 votes
7 answers
6k views

Don't one-time recovery codes for 2FA introduce a backdoor?

Although using multi-factor authentication is clearly a good move, I'm struggling with the 'one-time recovery codes' concept. It seems to me that if you choose to use them, what you're doing is ...
user avatar
  • 307
0 votes
2 answers
134 views

It is common for an account to be locked after X amount of failed logins, what are the best practice of selecting x?

To my understanding, it is common security practice to lock the account after X failed login attempts in N minute. Usually, the account will be locked for M minutes. I noticed that most of the time X ...
user avatar
  • 1,054
0 votes
2 answers
510 views

What happens if you forget your 1Password password?

When using a service like 1Password, what happens if you forget or lose your master password? My guess is that you can simply reset your passwords on all the sites 1password remembered for you, but I ...
user avatar
  • 1,224

1
3 4
5
6 7
78