Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options user 655

Specific to the security of passwords: hashing, entropy, cracking, resets, lockouts, etc.

15
votes
; let's call him Bob. Out of (bad) luck, Bob elects to use password 'ILoveBillClinton' too. Such collisions happen in practice; indeed, even if users choose passwords with 30 bits of entropy (an already … . None of these methods is satisfying. The entry of the username would not be necessary if password collisions did not happen (or would happen only with negligible probability). But as long as passwords
answered Apr 10 '13 by Thomas Pornin
3
votes
another guard. This would be ridiculous, but when it comes to passwords most people are ridiculous. So, be smart: don't rely on rituals whose benefits cannot be measured or even estimated numerically. …
answered Jul 11 '14 by Thomas Pornin
11
votes
sudo does not hide input completely because of an alleged security benefit, but because it is much simpler to do in the context of a Unix terminal. A Unix command-line application normally receives us …
answered May 1 '13 by Thomas Pornin
4
votes
'm' you cannot have an 'l' or an 'n'). This means 36*347 = 1890840605184 possible passwords -- but we have to adjust that to account for the other rules: we must remove the all-digits passwords (10*97 … = 47829690 passwords) and also "johnbook" (1 password). The grand total is then: 1890792775493 passwords. If you choose the password with perfect uniformity, then the attacker has exactly 1 chance in …
answered Oct 25 '11 by Thomas Pornin
19
votes
the point of view of an honest researcher, such sites look like trouble. You can have a quiet technical chat with Google or Microsoft; with a site that stores plaintext passwords (and, more often than … not, sends them by email !), drama is a definite possibility. As others have noted, storing passwords in plaintext does not really make attacks more likely; they make them more devastating when they …
answered Jun 17 '14 by Thomas Pornin
22
votes
such: use true, high-entropy passwords as answers to security questions. Of course, since you will not enter these often, you should write them down on a paper, stored in a safe place (they are meant to …
answered Jan 28 '13 by Thomas Pornin
4
votes
Ultimately, if the machine can use the saved password without specific human intervention, then... it can use it. This means that an attacker who gains full control of the machine (either an hostile s …
answered Jul 11 '14 by Thomas Pornin
10
votes
result. Your Web site will see only the result. However, you can exclude passwords which are too short because short passwords are amenable to a very primitive exhaustive search, which means trying all … combinations of letters up to a certain length. The main risk you must avoid is to antagonize users: passwords will be only as strong as the user chooses so, therefore you must make him a voluntary …
answered Jan 29 '13 by Thomas Pornin
24
votes
Applying a transform on passwords before hashing them makes no direct harm to security as long as it is injective: two distinct passwords before apply the transform shall still be distinct once both …
answered Oct 17 '13 by Thomas Pornin
8
votes
A "fuzzy password system" is a system which accepts several distinct passwords as valid (all the variants over a base password). Correspondingly, it decreases the password strength, thus the security … of the system (an attacker who tries possible passwords does not need to hit the exact password, an approximation would be enough). In a password-based system, the password is already the weakest …
answered Mar 1 '13 by Thomas Pornin
3
votes
letters, then two random digits. The lowercase/uppercase mix and the digits allow such passwords to be accepted by most "password rules". The entropy of such passwords is about 32 bits (because 262*102 … employed with proper password-strengthening techniques, i.e. salts and slow hashing (bcrypt). It turns out that I find such passwords easy to remember. There are relatively convincing indirect clues …
answered Sep 18 '12 by Thomas Pornin
10
votes
database directly, in the following way: he first saves the hashed password (including the salt). Then he resets the passwords, and does his tests. Finally, he puts back the old hash value and salt, thus …
answered Sep 11 '13 by Thomas Pornin
3
votes
appropriate for cryptography is the following: a password contains n bits of entropy if the attacker, trying potential passwords in optimal order (starting with the most probable of potential passwords … ), will need an average of 2n-1 tries before hitting the right one. This definition captures non-uniform password distributions; when the password distribution is uniform (all potential passwords have the …
answered Jun 16 '15 by Thomas Pornin
5
votes
is important). Of course, user's reluctance to use the password also adds up, proportionally to the password length. The user has to remember it and type it, so he prefers short passwords, all other things being equal. …
answered Jun 6 '13 by Thomas Pornin
4
votes
With mathematics: Suppose there are n possible passwords. Password number i has probability pi of being selected. It is assumed that the attacker knows the exact values of the pi and tries them in … probability that the password is part of the j most probable passwords (necessarily, qn = 1: the password is part of the space of possible passwords). The following holds true: For all j, qj >= j/n …
answered Aug 22 '12 by Thomas Pornin

15 30 50 per page