112 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

In short, it is more than a belief: there is strong evidence that humans are not good entropy sources. There is a test for this Man vs. Machine. Or, why Man is not a Particularly Good Source of ...
user avatar
  • 43.5k
74 votes

Password cracking: What if attacker is lucky?

"lucky" is not a property of the attacker. There's no "lucky" attacker nor "normal" attacker. They both have the same probability (low, very low) to guess the key. You can decrease the probability at ...
user avatar
42 votes

Password cracking: What if attacker is lucky?

Note: This answer assumes that by "lucky" OP meant "able to remove X% of valid answers", because I believe that was intent. Of course you can't measure luck ;) And if he is very lucky, say 90% ...
user avatar
  • 2,910
32 votes
Accepted

Would this be considered a secure password hash?

Except for the iteration amount ( we can argue that is small, too ‡ and some entropy loss *), the answer is no! There is no memory hardness that mainly prevents massive ASIC/GPU searches There are no ...
user avatar
  • 43.5k
31 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

For me, the fraud-related applications of Benford's Law come to mind. When people make up data they tend to create overly uniform data, even when it's not appropriate. There's a definite psychology ...
user avatar
28 votes

Are longer passwords really safer against brute force attacks?

If we take two password strings of different length and attempt to bruteforce match them, it is obvious that the longer one will take longer to crack on average. Actually, that might be obvious to ...
user avatar
  • 134k
25 votes
Accepted

What is the recommended number of iterations for Argon2?

I'm wondering what the recommended number of iterations would be? Unlike bcrypt or traditional crypt, argon2 does not have a single iteration count, but three parameters affecting the computational ...
user avatar
  • 31.3k
25 votes
Accepted

Password cracking: What if attacker is lucky?

So if at each bit he has a 50% chance, that means that 1 bit is actually only half bit. And if he is very lucky, say 90% chance, that means that 1 bit is actually only 0.1 bit.So in face of a very ...
user avatar
24 votes
Accepted

Should you change salt when changing password?

If the attacker had already begun creating a rainbow table or is engaged in some other attack which requires knowledge of the salt, then a password change with a salt change will require the attacker ...
user avatar
  • 12.7k
24 votes
Accepted

How hard is it to guess a 8 digit PIN?

If a computer is doing the selection of PIN numbers, then you would be very lucky indeed to guess a PIN in three times. The entropy - assuming that all numbers are valid - is of course $\log_2{10^8} \...
user avatar
  • 85.9k
23 votes
Accepted

Calculating entropy within xkcd 936: Password Strength

I don't get nearly the amount of entropy stated in the comic. Interestingly enough the reasoning for the entropy rating are actually justified in the comic by the little boxes which each represent 1 ...
user avatar
  • 44.7k
22 votes
Accepted

Is using a broken SHA-1 for password hashing secure?

SHA-1 in itself was never safe for password hashing. The hash algorithm itself doesn't have a work factor parameter nor does it have a salt as input. These are requirements for run-of-the-mill ...
user avatar
  • 85.9k
21 votes
Accepted

Make a Strong, Easy-to-Remember Password Using Classical Cryptography?

I fail to see why one would want to use classical or pencil and paper tools for derivation. For anyone attacking your technique it will make no difference. An attacker with a modern computer will only ...
user avatar
  • 10.7k
20 votes
Accepted

Encryption algorithm used in WPA/WPA2

A key is derived from the password using a Password Based Key Derivation Function, in this case PBKDF2: Key = PBKDF2(HMAC−SHA1, passphrase, ssid, 4096, 256) PBKDF2 ...
user avatar
  • 85.9k
19 votes

Are longer passwords really safer against brute force attacks?

There's a 2013 article in Ars Technica that refutes the notion that long passwords are necessarily hard to crack. It details how security researchers Kevin Young and Josh Dustin turned to text from ...
user avatar
18 votes

Password hash that can be upgraded without plaintext password

This is called Client-Independent Update, according to the Catena paper. It is desirable to be able to compute a new password hash (with some higher security parameter) from the old one (with the ...
user avatar
  • 586
18 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

Why would a dice rolled be "more random" than simply coming up with a sequence in your head, and then changing some of them? Humans have too many biases regarding what a random sequence is. ...
user avatar
18 votes
Accepted

Password hash contained '\x00' in middle, resulting in ValueError from bcrypt.hashpw

You should not be hashing it before passing to bcrypt, which is designed to do the hashing and key-stretching work itself. It's choking on the hash result because it's expecting a redundant, mushy, ...
user avatar
17 votes

What is a cryptographic "salt"?

Can you help me understand what a cryptographic “salt” is? In the context of password creation, a "salt" is data (random or otherwise) added to a hash function in order to make the hashed output of a ...
user avatar
  • 394
17 votes
Accepted

Encrypting user data with their password?

There are a number of considerations here, I'll try to lay them out one at a time for ease of following: What must the site do with the data? Oftentimes, we ask web sites to do things on our behalf ...
user avatar
  • 285
16 votes
Accepted

Practical Uses for Timing Attacks on Hash Comparisons (e.g. MD5)?

There is no timing attack possible on MD5 as practically implemented on most platforms. That's because MD5 uses only 32-bit addition, 32-bit bitwise boolean operators, and constant rotations/shifts, ...
user avatar
  • 125k
16 votes

Cryptography elements needed for a story

Though quantum computers fit the requirements, I'm not sure they are the best option. A general purpose quantum computer capable of attacking modern encryption (RSA, AES) would have serious ...
user avatar
  • 10.7k
15 votes
Accepted

What are the security implications of multiple hashing?

Multiple hashing, in itself, is not a bad idea. What's bad is trying to design your own non-standard password hashing scheme, without understanding what features such a scheme needs in order to be ...
user avatar
15 votes
Accepted

How many KDF rounds for an SSH key?

I did also tried to find a good value for the -a flag, in a MacBook Pro Mid14 (i7), trying to login in to a Debian 8.5, I had this results: ...
user avatar
  • 282
15 votes

Password cracking: What if attacker is lucky?

I'm not sure what you're trying to understand and if the other answers cover it, so I'm trying a different approach and interpret your question like this: What if an attacker guesses the right ...
user avatar
15 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

Randomness is a measurable, statistical property of a set of values. It doesn't mean the same as "hard for a human to guess." Your sample string is hard for a human to guess, but it isn't ...
user avatar
  • 462
14 votes
Accepted

Using 32 hexadecimal digits vs ASCII equivalent 16-character password

They are both equal. Passphrase security is based on the amount of entropy that the passphrase contains. In your case, both of your pieces of data are only different in the encoding. The actual ...
user avatar
  • 1,105
14 votes

Why do some people believe that humans are "bad at" generating random numbers/characters like this?

People are not that bad, but we're slow. See How were one-time pads and keys historically generated? In summary, MB's of 100% secure key material were generated for one time pads by people simply key ...
user avatar
13 votes
Accepted

Password entropy much lower than entropy of encryption keys. Why is this acceptable?

I know that humans would find it impossible to maintain a 128 bit password -- however, I wonder if there is some technical reason why a 52 bit password would not be as weak as a 52-bit encryption key ...
user avatar
  • 31.3k
13 votes

How many KDF rounds for an SSH key?

Slower is better, as slow as you can tolerate. Timing for different -a values, each measured 20 times: ...
user avatar
  • 1,406

Only top scored, non community-wiki answers of a minimum length are eligible