This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Secure Password Project"

From OWASP
Jump to: navigation, search
 
(3 intermediate revisions by 2 users not shown)
Line 1: Line 1:
 +
{|
 +
|-
 +
! width="700" align="center" | <br>
 +
! width="500" align="center" | <br>
 +
|-
 +
| align="right" | [[Image:OWASP Inactive Banner.jpg|800px| link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Inactive_Projects]]
 +
| align="right" |
 +
 +
|}
 
==== Main  ====
 
==== Main  ====
−
Hello Josh Sokol,<br>
+
This project will have a two pronged approach designed to put more nails in the single-factor method of authentication.  First, we will create an interactive portal where penetration testers are able to enter known information about the target.  This known information can then be broken down and converted to create a large downloadable dictionary list that has been customized to the target.  This list will be added to a comprehensive standard dictionary with the character conversions performed on that as well. The result would be a large list of commonly used passwords, dictionary words, target specific passwords, and various derivitives of each which should cover the vast majority of passwords used today. 
−
Please fill in here as you find best.<br>
 
−
Thanks,<br>
 
−
Paulo Coimbra, Project Manager
 
  
 +
The second prong of our approach will be to capture the results of all data collected into a large database.  This data will be hashed with common hashing methods to create what will become the world's largest rainbow tables.  A user can provide us with a hash and we can do a lookup against these tables to search for matching entries.  The goal here is to put a stop to unsalted password hashes for authentication. 
  
 +
We likely have one final non-technical objective here which is to educate end-users on the proper creation of passwords.  Maybe we even have some sort of password generator based on a phrase that somebody types in.  If you are interested in contributing to the project, please contact the Project Leader, Josh Sokol, at josh dot sokol at owasp dot org.
  
  

Latest revision as of 20:02, 23 January 2014
OWASP Inactive Banner.jpg

Main

This project will have a two pronged approach designed to put more nails in the single-factor method of authentication. First, we will create an interactive portal where penetration testers are able to enter known information about the target. This known information can then be broken down and converted to create a large downloadable dictionary list that has been customized to the target. This list will be added to a comprehensive standard dictionary with the character conversions performed on that as well. The result would be a large list of commonly used passwords, dictionary words, target specific passwords, and various derivitives of each which should cover the vast majority of passwords used today.

The second prong of our approach will be to capture the results of all data collected into a large database. This data will be hashed with common hashing methods to create what will become the world's largest rainbow tables. A user can provide us with a hash and we can do a lookup against these tables to search for matching entries. The goal here is to put a stop to unsalted password hashes for authentication.

We likely have one final non-technical objective here which is to educate end-users on the proper creation of passwords. Maybe we even have some sort of password generator based on a phrase that somebody types in. If you are interested in contributing to the project, please contact the Project Leader, Josh Sokol, at josh dot sokol at owasp dot org.


Project About

PROJECT INFO
What does this OWASP project offer you? 		RELEASE(S) INFO
What releases are available for this project?
what is this project?
Name: OWASP Secure Password Project (home page)
Purpose: The majority of the world's authentication systems rely on a single-factor authentication mechanism: the password. A simple internet search yields thousands of pages dedicated to the topic of creating a secure password, but almost all of them are inherently flawed in that they recommend using either joining pieces of known information to compile a secure password or variations of character conversion schemes on commonly known words and phrases. The inherent problem with this approach is that if the pieces are known, then it is fairly trivial to compute the variations that compile the whole password.

This project will have a two pronged approach designed to put more nails in the single-factor method of authentication.

  • First, we will create an interactive portal where penetration testers are able to enter known information about the target. This known information can then be broken down and converted to create a large downloadable dictionary list that has been customized to the target. This list will be added to a comprehensive standard dictionary with the character conversions performed on that as well. The result would be a large list of commonly used passwords, dictionary words, target specific passwords, and various derivitives of each which should cover the vast majority of passwords used today.
  • The second prong of our approach will be to capture the results of all data collected into a large database. This data will be hashed with common hashing methods to create what will become the world's largest rainbow tables. A user can provide us with a hash and we can do a lookup against these tables to search for matching entries. The goal here is to put a stop to unsalted password hashes for authentication.
License: Creative Commons Attribution ShareAlike 3.0
who is working on this project?
Project Leader(s):
Project Contributor(s):
how can you learn more?
Project Pamphlet: Not Yet Created
Project Presentation:
Mailing list: Mailing List Archives
Project Roadmap: View
Key Contacts
current release
Not Yet Published
last reviewed release
Not Yet Reviewed


other releases


Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Secure_Password_Project&oldid=166537"