Collaborate Disseminate
Customers of automaker General Motors (GM) and wedding planning company Zola have had customer accounts compromised through credential stuffing, and the criminals have used the access to redeem gift cards. What is credential stuffing? Credential stuffi… Continue reading GM, Zola customer accounts compromised through credential stuffing
I know that PBKDF2 hashes the password a number of times, the result being a key. Can an attacker find the key if they don’t know the password, but know the value of the hash of the password?
Continue reading Can you break PBKDF2 if you know the hash of the password? [migrated]
We are developing a VB. NET application where we are building a ‘Remember password’ feature to store the user’s application credentials using DPAPI for encryption (in a Windows domain environment) and then save it safely (off the computer)… Continue reading How do we reliably know why the Master Key hash for a particular SID has changed?
I have a web app that I use to run exe programs but the exe programs require a password to be passed. Currently this password is hard coded into the web app file in clear text.
Since this is not secure and I have seen other web apps do thi… Continue reading Storing passwords and retrieving them to run an application
46% of IT, security, and cybersecurity leaders say they still store passwords in shared office documents. That’s despite an overwhelming 93% of respondents that require password management training, with 63% holding training more than once per year, ac… Continue reading 46% of organizations still store passwords in shared documents
I am researching the state of the art in password security on the web and the general consensus seems to be that server-side hashing with a slow hashing algorithm (Argon2id, bcrypt, scrypt etc) is the best. The idea being that considerable… Continue reading Any studies on the hardware costs of server-side password hashing? [closed]
I am looking into databases of compromised passwords in order to ensure that passwords on a system I am responsible for are not already compromised.
To have complete peace of mind, I prefer to get access to the data, and check passwords lo… Continue reading Databases for compromised passwords that browsers use
No matter how annoying juggling too many passwords can be, for better or worse they are one thing end users have control over. But while choosing a password is easy, choosing one that will be easy to remember and good enough to withstand attackers̵… Continue reading The most insecure and easily hackable passwords
For example, a password consisting only of lower-case characters [a-z], but a length of 10 (26^10), will always be better than all characters, but a length of 7 (95^7).
That is, how much is it correct to take into account only the number o… Continue reading How much does the strength of the password depend on the variety of characters?
There is user1 and user2. All work is done from under user1. user2 is only created to store important information.
If important information is stored in RAM, but in the session of user1, which is easier to access for an attacker: the RAM f… Continue reading Where to store the password: in RAM or another user’s home folder (Linux)