Tagged Questions

The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

1
vote
0answers
12 views

Is there an extension/command line for OSX Chromium to save website passwords in LOCALSTORAGE instead of the system's keychain?

My situation: I want to use a portable-app implementation of Chromium running on a removable drive, so I never leave any passwords stored on the kaychain of any computer I use. Portable Chromium is ...
0
votes
1answer
78 views

How many passwords should I have? [closed]

So I am upgrading my personal security. Most passwords that I use are generated by and stored in a password manager. There are a few places where I cannot use a password manager -- here, I plan to ...
0
votes
1answer
41 views

Which is the best way to secure login password and safeguard user data? (even DBAs couldn't connect data to users)

Lets say that I'm building an website and a app which saves the users' secrets. The user logs in and can save into the app his deepest secrets. I'm worried about two things: - Should I save the ...
2
votes
1answer
190 views

Is Google's password recovery by entering an old password a bad practice?

When you try and recover your password on Google, you will eventually stumble across this screen, and it made me wonder: Isn't this type of password recovery from Google essentially the same as ...
8
votes
1answer
629 views

Browser password manager vs third party password manager

How usable and secure are 3rd-party password managers like Roboform, Lastpass, and 1password from the built-in Chrome and Mozilla password managers? What are the advantages of using 3rd-party password ...
1
vote
0answers
11 views

Pros and cons between HOTP and TOTP [migrated]

I'm reading the RFC6238 (TOTP) and RFC4226 (HOTP) standards and can't get which one is to prefer? I've searched around a bit and it seems like TOTP is the one that is most used, but some argue that ...
3
votes
1answer
101 views

Regarding Windows password and Chromes Remember password Feature

Google Chrome browser helps in password management by prompting users to remember their passwords for the websites. These saved passwords can be accessed from the browsers "settings" menu, and to do ...
1
vote
1answer
80 views

help identifying an IP address from email sent from my gmail account

Someone sent the following email from my gmail account. I believe it was hacked and if I can find the IP address I may be able to identify the person who did it. Here is the information. Please let me ...
5
votes
2answers
136 views

What are the weaknesses of my authentication scheme?

So, recently, after going through some infosec training (FutureLearn's Introduction to Cyber Security, which I heavily recommend as well-explained newbie material), I decided to take the plunge and ...
0
votes
1answer
37 views

how to get mysql user password? [closed]

I have a problem. I am creating a mysql user, and mysql will store the hashed password in user table. The problem is I dont know how to get the password back. As it is hashed, we can't get it back. ...
1
vote
3answers
95 views

Site allows both Partial and Complete password authentication; do they have my password in plain text? [duplicate]

My bank provides online banking facility like most of the banks these days. On the web they have Partial Password Authentication. Although I don't really believe in PPA providing extra security but ...
4
votes
3answers
707 views

Question about a simple strong password management system

I am designing a system which requires access control via a strong password and for that purpose will use a password generation algorithm A that produces a strong password of length L >= 32. The ...
3
votes
1answer
238 views

Perfectly Robust Hashing Scheme, or Completely Over-Engineered?

This is going to get long, so prepare. Basis of the question is, Do all these steps improve security, or am I completely overthinking the problem? Are my assumptions/thought process valid? We all ...
0
votes
2answers
52 views

What is the solution for handling exceptions in password hashing schemes?

There is a technique called password hashing that describes creating unique passwords based on a unique master key and a static and arbitrary hash value. Using this technique, the user only has to ...
0
votes
1answer
42 views

Using PGP to encrypt emailed password reset token

Even if I am careful not to lose/forget my password for some web account, other people are not and so most sites have a password reset mechanism, often being a reset token sent to the registered email ...
9
votes
8answers
1k views

Sequential password updates

Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse. What's to stop the user from changing the ...
5
votes
1answer
161 views

Is Firefox Password Manager less secure than LastPass?

After installing the LastPass password manager, I am presented with a login dialog including the option to "Disable Insecure Firefox Password Manager". (This option appears as long as the Firefox ...
-4
votes
1answer
169 views

Is there any way to hack the password of my neighbour WPA-PSK and WEP connection [closed]

Is there any way to hack the password of my neighbour WPA-PSK and WEP connection of WI-FI without using a keylogger. I tried a lots of softwares and efforts but unsuccessful. Can any one suggest. I ...
5
votes
3answers
282 views

Bash command argument security

Suppose I want to call a program that takes in a username and password to start. What are the risks with calling the program like ./prog --user 'User' --password 'Password' other than the obvious leak ...
12
votes
6answers
2k views

What is the simplest safe way to convey a password to another person? [duplicate]

What is the easiest way for two people – neither of whom are computer specialists and cannot meet in person – to send a password for an encrypted file that is attached to an email? The two simplest ...
1
vote
4answers
90 views

Password recovery flow - Send Password recovery to any email?

I am building a new MVC app. Considering this "forgot password" flow: 1)You enter an email. 2)You press "send recovery password". 3)An email awaits in the inbox, pressing the link in it brings you to ...
-1
votes
2answers
82 views

Can I get past information of what I typed in my computer or laptop with my keyboard [closed]

Once I forget my ID's password. I recovered it and changed it about a month ago but I forget again. Is there any way to see the details stored in laptop what i typed in past to till now from my ...
2
votes
1answer
62 views

Security of shared “super pin” code table at meineschufa.de

The german brank credit report service "Schufa" uses a so called "SuperPIN" to enable users to reset their password. This super pin is a permutation of 30 lower and upper case letters and digits and ...
3
votes
2answers
68 views

How do I respond to a spam server that invalidates my tokens? [duplicate]

Our web application sends a one-time use generated token, in the form of an URL, to clients who forget their passwords. This works except for the case where the client is sitting behind another server ...
3
votes
3answers
204 views

Is it ok for software to store passwords locally in plain-text?

There are already plenty of questions about what to do when websites store plain-text passwords. But this one is a little different. I use a piece of open-source (see below) software for playing ...
5
votes
0answers
164 views

Decentralised password recovery

Are there good/established techniques for password/key recovery in situations without a centralised service? (Anything goes, but I'd prefer solutions that distribute the recovery information across ...
1
vote
1answer
80 views

Could Mental Cryptography(?) be useful to ordinary users?

I recently read about 'Mental cryptography' or 'Metal hash' process from this post: Mental cryptography and good passwords (via this message board ...
4
votes
1answer
100 views

How to store a group password for multi-user server-client web-application?

In a web application, accessed by browser via https, users need to be able to access data stored on a server in a MySQL database. Data has to be encrypted for several groups of users, where one group ...
2
votes
1answer
172 views

Storing a user's password in a retrievable manner

I currently store my users passwords as PBKDF2 hashes, for the authentication part of my web application. Each user also has their own private key and public key (also stored in their user profile in ...
0
votes
2answers
47 views

How to decide whether to password protect key files in addition to full disk encryption

It is customary to protect certain critical files with a password. For example: PGP keys, VPN keys, password managers, etc. The practice dates back to before full disk encryption being common. These ...
-4
votes
1answer
61 views

what if an operating system can change your password [closed]

Everyone want security for their pc/laptops... NO DOUBT... So we protect them by some password. 'Longer password, more security' this is the tag line. But what if our computer can change our ...
23
votes
2answers
1k views

Juggling bus factor & separation of duties on a small team?

I am lead dev on a team of five people. Only three are coders. And only the coders are really technical enough to do a roll-out of our application to a production server. Our app is pretty ...
5
votes
3answers
174 views

How secure is this method to remember security questions?

So I found an interesting method of remembering those pesky security questions. Basically, the guy takes a hash of the question (IE what is your mother's maiden name?) and then appends his own ...
-1
votes
3answers
79 views

What does one call the strategy of using “pre-password transforms” as passwords?

Suppose that instead of using, say, Google, let me in! as my Google password, I used some consistent transform of this string, say ZWE1NjMyNm? What search keywords would be helpful to search for ...
-4
votes
3answers
136 views

Is MS Windows more secure than Linux on this aspect?

The administrator account can be renamed which means the hacker needs to figure out two pieces of information : the user name and the password while there is always one root account in Linux named ...
2
votes
2answers
74 views

Should security phrases be hashed?

I didn't think of this before but today I just realised that in soke sites, pw recovery is possible if you know the answers to security questions like What is your mother's maiden name? In this ...
2
votes
1answer
98 views

How can I design a password reset function, which does not reduce security for users who can remember their password?

We have a web app for which some users want to have a password reset function. I don't want to enforce a particular level of security for the users. So if a user picks a strong password which she is ...
2
votes
1answer
274 views

Correct way to perform secure two way encryption on a web site

I'm currently working a project that requires me to store sensitive information (mainly passwords and other information) on a web server via a standard python/flask website. This information is to be ...
0
votes
1answer
115 views

Can any App Store app access all of my passwords?

Whilst researching another question, I've noticed that on OS X 10.9.4 there are many instances of Library/Keychains/login.keychain from ~ within the Data folder of what looks like apps from Apple App ...
0
votes
0answers
55 views

What do I do when a ISP stores passwords as plaintext

I am living in a student housing in UK. Today, I was suddenly asked to put in my log in credentials for the internet service and because I forgot the credentials, I went to find my password section. ...
3
votes
1answer
91 views

Hard Coded Credentials in Equipment Serviced by Many People

According to National Public Radio, Ruben Santamarta has reported that gear aboard airliners and accessible through on-board WiFi or in-flight entertainment equipment uses hard-coded login ...
50
votes
6answers
7k views

Is it safe to send clear usernames/passwords on a https connection to authenticate users?

I'm setting up a home HTTP server which can send and receive JSON data to/from different clients (Android and iPhone apps). I'd like to allow access only to certain users and I'm considering using a ...
0
votes
0answers
24 views

Syncing service passwords during offline installations

Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of ...
0
votes
2answers
174 views

Does cPanel store my login password as plaintext

On attempt to change my cPanel password I was warned that: Your password could not be changed because the new password failed with the following reason : (is too similar to the old one), please try ...
0
votes
1answer
72 views

I store my passwordstore.org data in the cloud. Are my passwords safe?

I use pass to manage my passwords and sync this manually to a private git repo in the cloud. I believe this is safe because the repo is not public and, more importantly, the data is GPG encrypted. ...
0
votes
2answers
129 views

Want to build a password manager using OpenPGP.js

I'm kind of tired of the password managers that are available around... I need one that's open source, that works on OSX, that lets me store .pem files and that I can trust. As I haven't found one, I ...
4
votes
1answer
69 views

How to help users manage password portfolios based on risks of compromise?

A framework for modeling password management risks and costs, and the beginnings of a good strategy for users to help them manage passwords for their often large portfolios of accounts is outlined in ...
1
vote
2answers
72 views

How Empathy - a messaging program, is storing my passwords

I am connected to my chat accounts via Empathy, a messaging program, and it has my password stored in it. I am really curious to know how it is storing the passwords, and if there is any they can ...
4
votes
5answers
430 views

How to memorise multiple xkcd-style passwords for particular services?

I could use a password manager, but I don't like relying on another entity than myself to store my passwords, and it would screw me over if I find myself on the internet in a new location without the ...
3
votes
2answers
191 views

How do web email clients store my passwords from other providers?

The situation comes down to this: When I enter in hotmail, it retrieves my messages connecting to other providers: they could only do so by using my email and password. Since I had signed in a ...