New answers tagged

2 votes

RESTful web application security and authentication scheme

Security assessment of your approach to the authentication problem cannot be performed without looking at the actual implementation. This is often the case that people are using standards that are ...
1 vote
Accepted

How can a users plaintext password be acquired while using biometricID with the following security model?

As you noted in your #2, both iOS and modern Android systems allow for secure local storage. Though the details (and security) differ by platform, and with Android can differ by device. At a minimum ...
1 vote

How can a users plaintext password be acquired while using biometricID with the following security model?

POTENTIAL SOLUTION: This solution would not be without its own security risks, and defeat the purpose of not storing the encryption key password derivation hash BUT it could be an option for users who ...
  • 149
4 votes
Accepted

Why can we not store all hash results in a database and look them up?

In theory, this is possible, but it presumes that we have way more storage space than we have in practice. SHA-256 produces results, which are 256 bits long. This in turn means there are 2^256 ...
2 votes

What tools currently allow to retrieve Windows 10/11 password hashes, given admin rights or physical access to unencrypted disks?

LaZagne can recover all kinds of passwords and password hashes stored in Windows, including browsers, programs (like Skype, Thunderbird etc.), WiFi passwords, Windows user password hashes and more. In ...

Top 50 recent answers are included