166
votes
Accepted
Is the BBC’s advice on choosing a password sensible?
My question isn't about the mathematical strength of passwords which obviously will depend on the lyric that is chosen and how one goes about passwordifying it, it is more about the the predictability ...
- 22.6k
161
votes
Accepted
Can one tell if a password guess was close by the hash result?
No, you cannot determine how close you guessed looking at the hash. A hash function is designed with this in mind: one single changed bit on the input must change a lot of bits on the output. Its ...
- 52.8k
127
votes
Why is Sojdlg123aljg a common password?
One of the most logical explanations is that those accounts were associated with a bot. Same goes for password like 18atcskd2w.
Graham Cluley wrote an article about this: So, Just Why Is 18atcskd2w ...
- 10.1k
118
votes
Accepted
Do 2FA sites leak info by confirming a correct password guess?
If I'm understanding your question properly, the attack you are proposing is to brute-force passwords against a server like this, then once it shows you the MFA screen, go try that password on other ...
- 58.6k
107
votes
Why is Sojdlg123aljg a common password?
Another possibility : Sojdlg123aljg is latin characters translation from another alphabet.
For instance, a common password "ji32k7au4a83" is from mandarin "我的密碼", meaning "my password" (source).
...
- 811
100
votes
Accepted
Secret salts; why do they slow down attacker more than they do me?
This would probably be explained in the auditory lecture that these slides accompany.
My guess is that he's calculating this assuming that users generally enter their correct passwords. You only need ...
- 9,412
96
votes
Accepted
I found a password with hashcat, but it doesn't work
The password hashes for MS Office 97-2003 are vulnerable to collision attacks. That is, multiple passwords exist that should be able to open the document.
That also means that the password "iemuzqau" ...
- 3,798
90
votes
Is the BBC’s advice on choosing a password sensible?
It's horrible :) To provide some numbers to back claims by other answers:
This provides some numbers of how many songs are popular per year. For the last decade it was as low as 300-400 Top40 hits ...
- 931
85
votes
Accepted
Are randomly-generated passwords starting with "a" less secure?
It would seem that it depends on how exactly the attacker is going to bruteforce your password. However, my opinion is that in the end it doesn't matter.
A serious attacker will never start from the ...
- 15.7k
82
votes
Cracking double encrypted router password?
I URL decoded it, then decoded it from base64, then passed it to an online hash database.
The result was:
Hash Type Result
...
- 127k
81
votes
Is there a threshold for a password so long it doesn't get any more secure or even becomes insecure?
128 bits (of entropy)
The main purpose of a longer password is to prevent brute force attacks. It is generally accepted that 128 bits is beyond anyone's capability to brute force, and will remain so ...
- 33.1k
80
votes
Accepted
The most secure way to handle someone forgetting to verify their account?
What I see most commonly is allowing the authentication and signing the user in, but locking meaningful features away until the email is verified. You should bubble up an error reminding the user to ...
- 2,666
79
votes
Are leet passwords easily crackable?
I think Trey Blalocks answer is great, but I would like to complement it with some math.
If your password is randomly picked from the 171,476 words in the Oxford English Dictionary you get log2(...
- 65.2k
78
votes
Accepted
How does the attacker know what algorithm and salt to use in a dictionary attack?
How are plaintext and hashes compared?
During the brute force attack, words from the dictionary are hashed with the correct hash algorithm and salt, and then compared to the hash in the database dump. ...
- 65.2k
78
votes
Accepted
Reusing passwords that can possibly never be cracked
You don't need to bruteforce a hash to steal a password. A website might be compromised by an attacker so that they can read the passwords directly from the login form, in plain text. Or the website ...
- 15.7k
76
votes
Accepted
Why is client-side hashing of a password so uncommon?
Inventor of JavaScript password hashing here
Way back in 1998 I was building a Wiki, the first web site I'd built with a login system. There was no way I could afford hosting with SSL, but I was ...
- 33.1k
73
votes
Accepted
Somebody hacked my router and changed my wifi SSID
There are two different passwords that access different functions. If an attacker has the admin password, then he / she can change the SSID, WiFi password, and any other settings on the WiFi router.
...
- 2,042
73
votes
Couldn't we create a string that produces the same hash as another string in SHA-256?
Your premise has a flaw. You say you want to 'reverse engineer' the hash function. There's no need to reverse engineer it - its implementation is public.
What you can't do is invert it (perhaps that's ...
- 2,036
71
votes
Reusing passwords that can possibly never be cracked
TL;DR:
I don't need to recover YOUR password, I just have to find a string that generates the same hash, and as you don't control the hash the website developer uses until they all use a secure one, ...
- 784
70
votes
Accepted
Is it acceptable practice to only increment a number when changing a password?
If an attacker has found out your password, he can access the system up until you change the password. Changing passwords often prevents attackers that already have your password to have undetected ...
- 29.1k
70
votes
Accepted
How can I make a strong password that's easy to remember? Is the 4 Word method safe?
The main problem with passwords is not password complexity, but password reuse (obligatory xkcd). One service leaks logins and passwords, suddenly lots of providers see a surge on account hijacks. Why?...
- 52.8k
70
votes
Accepted
Cracking double encrypted router password?
It's a base64 unsalted sha256 hash. It's not double encryption, but merely an unneeded encoding.
An unsalted hash means it's trivial to just search the hash on Google and probably it will find the ...
- 52.8k
69
votes
Accepted
How long will it take to crack the passwords stolen in the Yahoo hack announced 14 Dec 2016?
Yes, they were likely able to crack many of the passwords in a short time.
From the official Yahoo statement:
For potentially affected accounts, the stolen user account information may have ...
- 44.5k
66
votes
Is it possible to determine password strength without knowing the password?
I would figure there are two ways they've come up with the information that they drew that conclusion from.
They ran the net accounts /domain command on a users computer which dumped the password ...
- 9,227
63
votes
Is this password scheme legit?
It always depends on what you compare it with! What is the realistic alternative, that users would actually use, to using this card?
Clearly, 4uR=?F133Y9Yi31 is a much better password than HELLOWORLD....
- 65.2k
58
votes
Accepted
Would allowing shorter passwords sometimes be more secure?
One related question that you missed in your list is this one:
How critical is it to keep your password length secret?
The accepted answer there (disclaimer: mine) shows that if you have a password ...
- 58.6k
56
votes
Accepted
How are GPUs used in brute force attacks?
I'm choosing to assume you're asking why it's a risk rather than how to hack.
GPUs are very good at parallelising mathematical operations, which is the basis of both computer graphics and ...
- 1,122
54
votes
What considerations do I need to keep in mind when enforcing passphrases?
It is not necessarily a bad idea. The attacker can know the password is in that format, considering the 4 words are random enough. But here is the thing, there are other good ways to make a memorable ...
- 7,848
53
votes
Accepted
Does a password policy with a restriction of repeated characters increase security?
In general, no, such a policy is counterproductive to security. While many weak passwords use repeated characters, so do many strong passwords... and many weak passwords don't.
Some reasons not to use ...
- 45.4k
Only top scored, non community-wiki answers of a minimum length are eligible