Questions tagged [passphrase]
A passphrase is a longer password that typically consists of multiple words.
138 questions
0 votes
1 answer
69 views
Biometry or complex passphrase for accessing a remote server [duplicate]
What would be considered more secure for accessing the terminal server via a GPO: a complex passphrase of minimum 14 characters with complexity enabled or the use of biometry like a fingerprint via a ...
- 11
0 votes
1 answer
114 views
How many passphrases should I use? [closed]
I have a password manager, an email, two computers with full disk encryption, their corresponding encrypted backup (two in total) on an external disk and user. How many passphrases should I use? I was ...
5 votes
1 answer
1k views
Doesn't saving an SSH passphrase (as suggested by GitHub) negate the security benefits of using a passphrase?
From GitHub Docs: With SSH keys, if someone gains access to your computer, the attacker can gain access to every system that uses that key. To add an extra layer of security, you can add a passphrase ...
- 153
3 votes
8 answers
2k views
Passphrase entropy calculation, Wikipedia version
I've been looking at entropy calculations for passphrases, in the context of estimating how long an attacker would take to guess that passphrase. On the way, I passed through the Wikipedia article on ...
- 149
1 vote
1 answer
249 views
Auto-unlock private key: which implications?
On my system (Ubuntu 22.04) I have encrypted my private key with a passphrase and added it to the ssh agent with ssh-add. On use of the key, I am prompted with the option "Automatically unlock ...
- 151
4 votes
3 answers
3k views
How resiliant is a private key passphase to brute force attacks?
in the documentation of Ubuntu ssh keys, I was surprised to read "If your RSA key has a strong passphrase, it might take your attacker a few hours to guess by brute force.". Really? A good ...
- 151
1 vote
1 answer
297 views
Hide password from server
I’m a beginner in cryptography and for my first project I use the client’s password to encrypt some data. More specifically, I use the password as passphrase in RSA private key generation). However, I ...
- 15
0 votes
0 answers
21 views
Relation between plain text and encrypted in URL [duplicate]
There are several plain text and encrypted text like: Plain text Encrypted text 10101004535 7Za9kHM9OH6tKTrtxy86gw== 10860586924 /nwjXW3MYkcATRS5Xyjx/A== 10480090635 /F0D9ePZffTIiH/P8mK+kw== ...
1 vote
0 answers
147 views
Windows decrypting TC volume without passphrase?
I remember having read a blog post or a forum post, some years ago, about a TrueCrypt user whose Windows machine sometimes, at boot, did not ask for the TC passphrase and decrypted automatically the ...
- 5,203
0 votes
3 answers
270 views
How to analyze the security of a custom passphrase?
Let's assume person A chooses 15 words for a passphrase with an average length of 5. The passphrase meets following conditions. Word conditions: The first word is not a valid word and can't be found ...
- 56
1 vote
1 answer
191 views
ssh server encrypted key vs password login [duplicate]
In an openssh-server login to a GNU/Linux machine to use a private ssh key encrypted with an N-characters passphrase, then sshd_config: PasswordAuthentication no PubkeyAuthentication yes is it ...
- 121
2 votes
1 answer
389 views
Static RAM: Detecting presence and wiping?
As I understand from reading another question here, SRAM may be more dangerous than traditional volatile RAM in terms of storing passwords and other sensitive information. I know that when a computer ...
- 39
0 votes
0 answers
372 views
GPG passphrase in the cache as a hash?
I understand that nowadays passwords are not stored in plaintext, only as password + salt and hashed (minimum). But I haven't found any exact confirmation that gpg does NOT store (cache, place in RAM) ...
- 735
29 votes
6 answers
7k views
Is it insecure to display the number of characters when users enter a new passphrase?
When users are entering a new passphrase somewhere, it's helpful to provide feedback on the number of characters received by the system. In a user experience (UX) test I just ran, my user created a ...
- 409
-1 votes
2 answers
2k views
Why should we only keep the private key secret, why not the public key? [duplicate]
If I am not wrong, both private key and public key are the same since communication is possible only if both keys are matching. So, why we should only keep the private key secret, why not public key? ...
- 53