166 votes
Accepted

Is the BBC’s advice on choosing a password sensible?

My question isn't about the mathematical strength of passwords which obviously will depend on the lyric that is chosen and how one goes about passwordifying it, it is more about the the predictability ...
user avatar
  • 22.5k
161 votes
Accepted

Can one tell if a password guess was close by the hash result?

No, you cannot determine how close you guessed looking at the hash. A hash function is designed with this in mind: one single changed bit on the input must change a lot of bits on the output. Its ...
user avatar
  • 50.3k
126 votes

Why is Sojdlg123aljg a common password?

One of the most logical explanations is that those accounts were associated with a bot. Same goes for password like 18atcskd2w. Graham Cluley wrote an article about this: So, Just Why Is 18atcskd2w ...
user avatar
  • 9,975
118 votes
Accepted

Do 2FA sites leak info by confirming a correct password guess?

If I'm understanding your question properly, the attack you are proposing is to brute-force passwords against a server like this, then once it shows you the MFA screen, go try that password on other ...
user avatar
106 votes

Why is Sojdlg123aljg a common password?

Another possibility : Sojdlg123aljg is latin characters translation from another alphabet. For instance, a common password "ji32k7au4a83" is from mandarin "我的密碼", meaning "my password" (source). ...
user avatar
  • 801
100 votes
Accepted

Secret salts; why do they slow down attacker more than they do me?

This would probably be explained in the auditory lecture that these slides accompany. My guess is that he's calculating this assuming that users generally enter their correct passwords. You only need ...
user avatar
96 votes
Accepted

I found a password with hashcat, but it doesn't work

The password hashes for MS Office 97-2003 are vulnerable to collision attacks. That is, multiple passwords exist that should be able to open the document. That also means that the password "iemuzqau" ...
user avatar
  • 3,623
90 votes

Is the BBC’s advice on choosing a password sensible?

It's horrible :) To provide some numbers to back claims by other answers: This provides some numbers of how many songs are popular per year. For the last decade it was as low as 300-400 Top40 hits ...
user avatar
  • 931
85 votes
Accepted

Are randomly-generated passwords starting with "a" less secure?

It would seem that it depends on how exactly the attacker is going to bruteforce your password. However, my opinion is that in the end it doesn't matter. A serious attacker will never start from the ...
user avatar
  • 15.3k
83 votes

Is there a way to make a WEP-secured AP uncrackable?

There is no method to make WEP uncrackable, or at least secure. So I suggest buying a new router that suports WPA2.
user avatar
  • 2,683
82 votes

Cracking double encrypted router password?

I URL decoded it, then decoded it from base64, then passed it to an online hash database. The result was: Hash Type Result ...
user avatar
  • 123k
81 votes

Is there a threshold for a password so long it doesn't get any more secure or even becomes insecure?

128 bits (of entropy) The main purpose of a longer password is to prevent brute force attacks. It is generally accepted that 128 bits is beyond anyone's capability to brute force, and will remain so ...
user avatar
  • 32.6k
80 votes
Accepted

The most secure way to handle someone forgetting to verify their account?

What I see most commonly is allowing the authentication and signing the user in, but locking meaningful features away until the email is verified. You should bubble up an error reminding the user to ...
user avatar
  • 2,606
79 votes

Are leet passwords easily crackable?

I think Trey Blalocks answer is great, but I would like to complement it with some math. If your password is randomly picked from the 171,476 words in the Oxford English Dictionary you get log2(...
user avatar
  • 64.2k
78 votes
Accepted

Reusing passwords that can possibly never be cracked

You don't need to bruteforce a hash to steal a password. A website might be compromised by an attacker so that they can read the passwords directly from the login form, in plain text. Or the website ...
user avatar
  • 15.3k
75 votes
Accepted

How does the attacker know what algorithm and salt to use in a dictionary attack?

How are plaintext and hashes compared? During the brute force attack, words from the dictionary are hashed with the correct hash algorithm and salt, and then compared to the hash in the database dump. ...
user avatar
  • 64.2k
73 votes
Accepted

Somebody hacked my router and changed my wifi SSID

There are two different passwords that access different functions. If an attacker has the admin password, then he / she can change the SSID, WiFi password, and any other settings on the WiFi router. ...
user avatar
  • 2,012
73 votes

Couldn't we create a string that produces the same hash as another string in SHA-256?

Your premise has a flaw. You say you want to 'reverse engineer' the hash function. There's no need to reverse engineer it - its implementation is public. What you can't do is invert it (perhaps that's ...
user avatar
  • 2,026
71 votes
Accepted

Why is client-side hashing of a password so uncommon?

Inventor of JavaScript password hashing here Way back in 1998 I was building a Wiki, the first web site I'd built with a login system. There was no way I could afford hosting with SSL, but I was ...
user avatar
  • 32.6k
71 votes

Reusing passwords that can possibly never be cracked

TL;DR: I don't need to recover YOUR password, I just have to find a string that generates the same hash, and as you don't control the hash the website developer uses until they all use a secure one, ...
user avatar
  • 784
70 votes
Accepted

Is it acceptable practice to only increment a number when changing a password?

If an attacker has found out your password, he can access the system up until you change the password. Changing passwords often prevents attackers that already have your password to have undetected ...
user avatar
  • 28.6k
70 votes
Accepted

Cracking double encrypted router password?

It's a base64 unsalted sha256 hash. It's not double encryption, but merely an unneeded encoding. An unsalted hash means it's trivial to just search the hash on Google and probably it will find the ...
user avatar
  • 50.3k
69 votes
Accepted

How can I make a strong password that's easy to remember? Is the 4 Word method safe?

The main problem with passwords is not password complexity, but password reuse (obligatory xkcd). One service leaks logins and passwords, suddenly lots of providers see a surge on account hijacks. Why?...
user avatar
  • 50.3k
68 votes
Accepted

How long will it take to crack the passwords stolen in the Yahoo hack announced 14 Dec 2016?

Yes, they were likely able to crack many of the passwords in a short time. From the official Yahoo statement: For potentially affected accounts, the stolen user account information may have ...
user avatar
  • 43.7k
66 votes

Is it possible to determine password strength without knowing the password?

I would figure there are two ways they've come up with the information that they drew that conclusion from. They ran the net accounts /domain command on a users computer which dumped the password ...
user avatar
  • 9,227
63 votes

Is this password scheme legit?

It always depends on what you compare it with! What is the realistic alternative, that users would actually use, to using this card? Clearly, 4uR=?F133Y9Yi31 is a much better password than HELLOWORLD....
user avatar
  • 64.2k
58 votes
Accepted

Would allowing shorter passwords sometimes be more secure?

One related question that you missed in your list is this one: How critical is it to keep your password length secret? The accepted answer there (disclaimer: mine) shows that if you have a password ...
user avatar
56 votes
Accepted

How are GPUs used in brute force attacks?

I'm choosing to assume you're asking why it's a risk rather than how to hack. GPUs are very good at parallelising mathematical operations, which is the basis of both computer graphics and ...
user avatar
  • 1,122
54 votes

What considerations do I need to keep in mind when enforcing passphrases?

It is not necessarily a bad idea. The attacker can know the password is in that format, considering the 4 words are random enough. But here is the thing, there are other good ways to make a memorable ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible