User Royce Williams

124 votes

Accepted

Is a redirect showing the password in plain text a security vulnerability?

answered Jul 5, 2018 at 4:09

92 votes

Accepted

Is bcrypt(strtolower(hex(md5(pass)))) ok for storing passwords?

answered Jul 17, 2020 at 13:52

48 votes

Which password policy is more secure: one password of length 9 vs. two passwords each of length 8?

answered Feb 28, 2019 at 4:56

31 votes

Accepted

After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?

answered Nov 9, 2021 at 21:11

30 votes

Is it better to use an unsuitable hashing algorithm instead of none at all?

answered Nov 19, 2018 at 15:45

23 votes

Accepted

How secure is BCRYPT(SHA1(Password))

answered Apr 10, 2018 at 5:19

21 votes

How long would it take to brute force an 11 character single-case alphanumeric password?

answered Apr 24, 2018 at 14:55

20 votes

Strength of passwords with patterns

answered Sep 10, 2017 at 18:25

17 votes

Why use entropy at all in considering password strength?

answered Sep 18, 2020 at 1:01

16 votes

Argon2 vs SHA-512, what's better in my case?

answered May 11, 2022 at 17:29

14 votes

How to strike a balance between security policies and practical implementation challenges?

answered Jul 1, 2018 at 13:41

14 votes

Accepted

Why do salts for hashing passwords need to be globally unique, not just system/site-unique?

answered Nov 29, 2017 at 5:29

12 votes

Is it safe to store a password using a secure hash followed by an insecure hash?

answered Feb 8, 2022 at 1:16

12 votes

Why would password managers provide support for OTP codes?

answered Feb 22, 2021 at 6:36

10 votes

How do Yubikeys improve security if I am typically also forced to enable other, weaker 2FA methods?

answered Jan 24 at 19:35

10 votes

Which is faster - brute-forcing, or using a dictionary attack that contains all possible permutations?

answered Mar 5, 2017 at 1:15

9 votes

What vulnerabilities could be caused by a wildcard SSL cert?

answered Apr 4, 2014 at 19:10

9 votes

Accepted

Find salt from md5 hash if password is known

answered Oct 23, 2017 at 4:48

9 votes

hashcat - is there a way to set minimum password length?

answered Jun 11, 2018 at 21:29

9 votes

Is password information dumped from the MySQL user table sensitive?

answered Aug 30, 2018 at 15:48

8 votes

Accepted

Hash list for practicing password cracking

answered Sep 14, 2017 at 18:57

8 votes

LM (Lan Manager) Hash - Brute Force Failing

answered Mar 2, 2017 at 16:23

8 votes

Accepted

How to read password from Windows credentials?

answered Jan 16, 2018 at 5:44

8 votes

Accepted

Can you use an FPGA with hashcat?

answered Apr 16, 2022 at 23:01

7 votes

How many rounds of Bcrypt to use for security equivalent to SHA256?

answered Oct 8, 2021 at 21:55

7 votes

How to crack 10 digits with prefix password in John the Ripper?

answered Oct 23, 2017 at 7:15

7 votes

Accepted

Attack WPA password with hashcat - Settings and resources for "german" passwords?

answered Mar 26, 2017 at 16:50

7 votes

How do I bruteforce a WPA2 password given the following conditions?

answered Apr 9, 2017 at 15:27

7 votes

Accepted

Bruteforce with hashcat, how to set the mask properly?

answered May 7, 2017 at 14:56

7 votes

Accepted

Details of a good WPA2 pre-shared key (password)?

answered Oct 7, 2018 at 2:11

Stack Exchange Network

174 Answers

Is a redirect showing the password in plain text a security vulnerability?

Is bcrypt(strtolower(hex(md5(pass)))) ok for storing passwords?

Which password policy is more secure: one password of length 9 vs. two passwords each of length 8?

After a password leak, is there a Levenshtein distance from which one a newly derivated password can be considered safe?

Is it better to use an unsuitable hashing algorithm instead of none at all?

How secure is BCRYPT(SHA1(Password))

How long would it take to brute force an 11 character single-case alphanumeric password?

Strength of passwords with patterns

Why use entropy at all in considering password strength?

Argon2 vs SHA-512, what's better in my case?

How to strike a balance between security policies and practical implementation challenges?

Why do salts for hashing passwords need to be globally unique, not just system/site-unique?

Is it safe to store a password using a secure hash followed by an insecure hash?

Why would password managers provide support for OTP codes?

How do Yubikeys improve security if I am typically also forced to enable other, weaker 2FA methods?

Which is faster - brute-forcing, or using a dictionary attack that contains all possible permutations?

What vulnerabilities could be caused by a wildcard SSL cert?

Find salt from md5 hash if password is known

hashcat - is there a way to set minimum password length?

Is password information dumped from the MySQL user table sensitive?

Hash list for practicing password cracking

LM (Lan Manager) Hash - Brute Force Failing

How to read password from Windows credentials?

Can you use an FPGA with hashcat?

How many rounds of Bcrypt to use for security equivalent to SHA256?

How to crack 10 digits with prefix password in John the Ripper?

Attack WPA password with hashcat - Settings and resources for "german" passwords?

How do I bruteforce a WPA2 password given the following conditions?

Bruteforce with hashcat, how to set the mask properly?

Details of a good WPA2 pre-shared key (password)?