New answers tagged

0 votes
Accepted

How long would it take to crack hashed password stored in plain sight?

If I am using a dictionary to crack an Argon2 hashed password that I am storing in plain sight, how long will it take? (--assuming my password is reasonably complex). The success of brute-forcing ...
  • 10.8k
1 vote
Accepted

Why does Hydra SMB attack not work while Metasploit does?

TL;DR - Hydra defaults to NTLM dialect but in your use case it requires LMv2. Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal ...
  • 1,332
0 votes

Why do salts for hashing passwords need to be globally unique, not just system/site-unique?

The salt hides the fact that two people use the same passwords. That has a minor effect - cracking one persons password doesn’t give me another password for free. There is a big effect - an attacker ...
  • 2,107
2 votes
Accepted

How to analyze the security of a custom passphrase?

Consider alternatives Security does not necessarily correlate with entropy. If a password is too complex, it cannot be memorized and many users may write it down. A potential attacker can easily see ...
  • 10.8k
1 vote

How to analyze the security of a custom passphrase?

For this assignment, you should assume that: the attacker knows exactly how you are generating the passphrase, including the exact wordlist(s) that the words were selected from (Kerckhoffs' Principle)...
0 votes

How to analyze the security of a custom passphrase?

To quote a co-worker of mine: "It's always the people with the most secure passwords, who worry about their passwords not being secure enough." To answer the question directly: Your ...
  • 115
0 votes

Why do salts for hashing passwords need to be globally unique, not just system/site-unique?

Note that you can freely use any site-only/non-globally-unique salts, even like a simple user-id, if you also use a pepper as well. This is because if you generate one random pepper (e.g., with 128 or ...
  • 411
0 votes

Not storing the salt? Is that an option?

There is no need to generate random salt. The requirement for salt is that it is globally unique. You can derive a globally unique salt from the conditions of a user's login. For example, if your ...

Top 50 recent answers are included