New answers tagged

0

TL;DR: The safest way to generate a password is by generally using a password manager Someone who cracks hashes or bruteforces login attempts has several tools at hand to find possible passwords (or password hashes respectively) in question. Dictionaries or wordlists are only one of these. So to limit your defensive techniques against dictionaries only is ...


0

I don't know about the Windows 10 behaviour when you tested this. But for Windows 10 1903 this brute force concept doesn't appear to work. If the pin was 1111 for example, and your keystroke injection tool tried any 4 digit number before or after that, eg. 0001, even though it's not hit enter, when it gets to 4 digits windows stops and says the pin is ...


1

"Safer" is a relative term. Safer than what, under which conditions? Under purely theoretical conditions, assuming a brute-force attack of some kind, yes nonsense words are "safer" in the sense that it is highly likely the attacker will try a dictionary attack before an exhaustive search. In real-life conditions, dictionary attacks happen under two ...


0

As far the dictionaries are concerned, they contain a list of most commonly used passwords, and that could be nonsense phrases and words as well. For instance, x+word+123 or x+monkey are some of the most commonly used passwords along with qwerty that don’t really make sense. So, you can use nonsense passwords, but make sure that they are unpredictable and ...


47

Attackers often don't just use dictionaries, but also rules which permute the words in dictionaries. For instance, a rule could be to substitute certain letters for numbers, which look the same. This would turn Password into P455w0rd. A rule, which could apply in this case, would be to remove single letters from a word. That means just permutating the ...


17

This might seem like a question that has an obvious answer, but is not that trivial. Words that do not appear in dictionaries have more randomness ('entropy') and are thus harder to guess for computers. But they're also harder to remember for humans. And that leads to password re-use. That's very bad. If you do not use a password manager (and you should!) ...


3

You don't have enough IVs Plain and simple. Cracking WEP works by statistical analysis, and in order to do that reliably, you will need lots of data. The aircrack-ng FAQ says: How many IVs are required to crack WEP? WEP cracking is not an exact science. The number of required IVs depends on the WEP key length, and it also depends on your luck. ...


1

Yes, in theory, you could just brute-force every secret there is. In practice, it's not feasible. A practical demonstration I'm going to think of a random number between 0 and 10, and you will have to guess which one it is. Did you make your guess? Correct, it was 2! Even if you did not make your guess correctly, if I would stay with the same number and ...


1

KDBX4 can now use Argon2 which is the state-of-the-art in password derivation. The difficulty to guess the password of a KDBX4 database depends on: The chosen Argon2 parameters, which are poorly advised by Keepass, but still better than the previous AES-KDF. The parameters you describe are very poorly chosen, they will not strengthen by much the ...


0

Without more context we won't be able to provide exact guidance. But the following sounds like what you'll need: ncrack -U usernames.txt -P passwords.txt -iL hosts.txt -p8080 -U defines either a single user name or a file containing user names to try. -P defines either a single password or a file containing passwords to try -iL options allows you to ...


0

For S/MIME you can do better: https://www.schneier.com/academic/smime/download.html Note that the tricks used don't work for all protocols. For example SSL does a MD5 to a 128-bit key that makes this not work.


0

The most simplest way is to put your website behind a service like Cloudflare. You can basically do everything you just mentioned + you also get protection against SQLi, XSS, DDOS and many more. Obviously this still allows your web server to be directly accessible without protection, so you need to only allow Cloudflare IP's to be able to access it with a ....


1

Consecutive failures on an account since last success should be a red flag. Increasing lockout time for attempts from devices new to that user might have value. If the account is consistently being rejected at the 2nd factor then you can presume that the password has been compromised and reach out to the user. In any case, pay attention to consecutive ...


Top 50 recent answers are included