New answers tagged password-cracking
0
votes
Accepted
How long would it take to crack hashed password stored in plain sight?
If I am using a dictionary to crack an Argon2 hashed password that I am storing in plain sight, how long will it take? (--assuming my password is reasonably complex).
The success of brute-forcing ...
- 10.8k
1
vote
Accepted
Why does Hydra SMB attack not work while Metasploit does?
TL;DR - Hydra defaults to NTLM dialect but in your use case it requires LMv2.
Hydra v8.6 (c) 2017 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal ...
- 1,332
0
votes
Why do salts for hashing passwords need to be globally unique, not just system/site-unique?
The salt hides the fact that two people use the same passwords. That has a minor effect - cracking one persons password doesn’t give me another password for free. There is a big effect - an attacker ...
- 2,107
2
votes
Accepted
How to analyze the security of a custom passphrase?
Consider alternatives
Security does not necessarily correlate with entropy. If a password is too complex, it cannot be memorized and many users may write it down. A potential attacker can easily see ...
- 10.8k
1
vote
How to analyze the security of a custom passphrase?
For this assignment, you should assume that:
the attacker knows exactly how you are generating the passphrase, including the exact wordlist(s) that the words were selected from (Kerckhoffs' Principle)...
- 9,328
0
votes
How to analyze the security of a custom passphrase?
To quote a co-worker of mine: "It's always the people with the most secure passwords, who worry about their passwords not being secure enough."
To answer the question directly: Your ...
- 115
0
votes
Why do salts for hashing passwords need to be globally unique, not just system/site-unique?
Note that you can freely use any site-only/non-globally-unique salts, even like a simple user-id, if you also use a pepper as well.
This is because if you generate one random pepper (e.g., with 128 or ...
- 411
0
votes
Not storing the salt? Is that an option?
There is no need to generate random salt. The requirement for salt is that it is globally unique. You can derive a globally unique salt from the conditions of a user's login.
For example, if your ...
- 119
Top 50 recent answers are included