The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

0
votes
2answers
74 views

Store password in Public Domain using files and md5sum

Whenever I check integrity of a file using md5sum, I get a string of alphanumeric characters to compare and verify if it was downloaded correctly. Couldn't the concatenation of several of those ...
5
votes
3answers
81 views

Forgot password and revealing whether account exists

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...
0
votes
1answer
33 views

Is there any problem using empty salts with PBDKF for this purpose?

The aim is to generate a secure key for symmetric encryption. I have a master password, from which I want to generate the key for symmetric encryption, in order to encrypt other passwords. The idea ...
-3
votes
2answers
67 views

When should a password be hashed? [duplicate]

I develop a Smartphone App and have a little question: When should I hash the user passwords, on the device or upload them in plain text and hash them on the server before stored in the database?
7
votes
2answers
112 views

Do password managers leak information with swap memory?

The post How to find passwords in memory (password managers) concluded, that passwords are visible in plaintext if you login to a website. Password managers tend to store the passwords encrypted in ...
0
votes
2answers
71 views

Several hashing routines support client side work. Doesn't the hash just become a password equivalent?

Isnt Secure Remote Password Protocol (SRP) pretty much client side hashing? Argon2 the winner of the PHC also allows for client side hashing. How do these systems avoid the plaintext equivalence ...
0
votes
1answer
66 views

How secure are the passwords stored at Google Passwords? [closed]

It seems Google activated central place for storing app/website passwords which is accessible at https://passwords.google.com/ and all the remembered Chrome passwords are synched there. In what ...
3
votes
1answer
87 views

Keypass - Needle in a stack of needles

I got the idea from someone saying the best way is to hide the needle in a stack of needles, not in a haystack. I am considering writing a little app to accompany my Keepass installation. The app ...
5
votes
2answers
423 views

How to store passwords in database so that they can be retrieved?

I'm developing a password manager web app. It's just for fun: I'm not exposing anybody's passwords. My idea was to use hashing+salting, and that's what I did for the master password. But then I ...
0
votes
2answers
97 views

Centralized local hosted web based password manager

In our company we have more than 100 employers and everyone use several online applications daily. To access all of this sites they need a password which was now stored very insecurely. so I'm ...
2
votes
3answers
142 views

How does a hash which contains algorithm to choose can be secure?

I was thinking about creating my own hash+salt function, something like sha1(password + md5(login)), then I read here (part 4) that creating it's own hash+salt function is a bad idea, because if the ...
0
votes
0answers
11 views

Secure Distribution of Admin-Defined Credentials to End-Users [duplicate]

Situation: I need to safely send database credentials created by the admin to users in a secure fashion. Currently, creds have been sent to users via plain text email (which is a huge security ...
2
votes
1answer
54 views

Security implications of syncing with off-site keepass database

Is it a safe practice to sync with a Keepass database that is stored on an off-site server? Database is accessed primarily through my Android running 4.4.2. I access/sync my Keepass database by ...
3
votes
1answer
138 views

Are there any passwords managers that use a second hidden encryption drive to hide passwords?

I've heard that encyption program, Truecrypt can create a hidden encrypted drive within an encrypted drive; and even if an attacker accesses the first encrypted drive he/she cannot prove the hidden ...
1
vote
0answers
74 views

Password manager like LastPass with security guarantee or warranty? [closed]

I enjoyed a related question How safe are password managers like LastPass? My question is whether any password management companies (LastPass or similar) are offering a financial or liability ...
11
votes
5answers
2k views

Is this idea for a password manager secure? If so, why doesn't anybody use it? [closed]

I've been thinking of a problem with usual password managers: although they do provide better security than manually using passwords, there's a central database that can get lost, get compromised, ...
3
votes
5answers
121 views

Any security risks for the login authentication and change password on the same page?

I want to ask if there are any security risks for the login authentication and change password on the same page? Normally the user needs to authenticate first in order to see the password change ...
6
votes
3answers
151 views

Is google saving clear text passwords? [closed]

On your GMail account you have the option to add other POP3 accounts to automatically fetch mail from them; Google Mail Fetcher. When enabled you have to specify your username and password, and the ...
5
votes
1answer
209 views

Is Django's approach to password reset tokens secure?

I am implementing a password reset feature for a web application and am contemplating adopting an implementation similar to Django. In a nutshell, Django creates a token who is comprised of a ...
1
vote
2answers
159 views

Is there a way to securely store unsalted passwords?

So, obviously I'm not talking about username/password pairs here, I plan to store passwords with two salts and three hashes, but what occurred to me is that if I had a table where I kept pairs: ...
5
votes
1answer
135 views

Should I change the password of my password manager regurlarly?

A password manager stores many sensitive information like passwords, pins and so on . To access this data my should use a strong password/passphrase in order to protect our data. This password is more ...
0
votes
1answer
160 views

Saving username and pasword inside SQL

I am currently managing a network of around 100 PCs. Many users have different mails/usernames and passwords for different services like login to PC, mail, local applications, ... When an application ...
1
vote
3answers
218 views

How YubiKey Challenge-Response works “locally”?

I have got a YubiKey NEO recently (and a bit disappointed that you can only have two activated second factor authentication methods out of all the listed). In password managers those support YubiKey, ...
37
votes
8answers
6k views

Is “different usernames” as good as “different passwords”

The answers to this question, and the associated xkcd got me wondering: if I use different account names in every service, then can I use the same hard-to-crack password in each? I'm thinking that ...
1
vote
1answer
76 views

Store/retrieve users passwords on server (using password managers ?) [closed]

I am working on a project in wich a school's server will need to use students' passwords periodically to connect to another website for them. I am aware that storing users' passwords in a server ...
0
votes
0answers
55 views

Hashed master password and generated encryption key in a password manager program

I'm writing a WPF password manager application to practice programming, so far this is the scheme I intend to use to store master password and individual site password: Master password: Generate a ...
1
vote
1answer
123 views

Password management: how an administrator should reset password for a user?

I implement simple user management. How an administrator should reset password for a user? Just provide a new password for a user (as in Active Directory)? Is it secure enough? Added Is it secure ...
2
votes
3answers
231 views

Why do banks still hack-up autocomplete=off functionality?

With Bug #1025703 in the latest Firefox 38, Mozilla has finally decided to stand up for its users instead of catering to the banks that don't want the passwords remembered. However, I've noticed ...
2
votes
2answers
93 views

Best practice for identity management methods with regards to confirming user existence

I'm working on a new site that uses asp.net identity to register users. I'm making use of email addresses as usernames and the email address has to be confirmed before the user can log in. I've been ...
5
votes
6answers
216 views

Is hashing a string a secure manner for generating passwords?

I have several servers that I'm using for an online business. I have passwords for MySQL, Wordpress, SSH, FTP, Domain Provider, Paypal, and many more. I wanted to have a different, very long password ...
12
votes
4answers
1k views

Why will Google no longer allow me to end or begin passwords with a space? [closed]

Why won't Google allow me to use a password ending in a space anymore? Backstory: I have memorized a cipher that allows me to generate a different and very strong password across many different ...
0
votes
1answer
47 views

Is secure tokens send by email secure? [duplicate]

I'm struggling with the reset password function of a web app, the way i'm inclined to do it is by sending a token based url to the email of the user and than the user can access and reset its ...
2
votes
1answer
76 views

Is drag-and-drop safer than using the clipboard when it comes to protecting sensitive data from keyloggers?

I noticed that multiple password-locker applications recommend that you use the drag-and-drop feature to transfer passwords to login forms instead of copying the passwords to the clipboard or having ...
4
votes
3answers
729 views

Which passwords to exclude from a password manager?

The benefits of a password manager are clear. Still, it seems that there might be a case to keep at least some passwords out of it: Your primary e-mail, to minimize the "single point of attack" ...
2
votes
1answer
128 views

Where to store hashes, salts, keys in Desktop Applications

I am trying to figure out where or how i should store application secrets and keys inside a desktop application. For example a facebook app key or dropbox key and secret. So I've read that i should ...
21
votes
6answers
2k views

Is there a use-case that renders the password manager obsolete?

Background Trevor posed a question about the nature and validity of using a password manager, given the current prevailing model of authentication on most web resources. Caveat: this is not the ...
5
votes
3answers
166 views

How do I convince others of the importance of password management?

I just got married, and my wife and I are in the midst of combining finances, etc. We set up a joint bank account and the first thing I do during the account setup phase is generate a 16-character ...
11
votes
2answers
1k views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
2
votes
2answers
95 views

How significant is the risk in having someone email/IM an htpasswd hash?

I need to set users up for subversion access, and we're currently stuck using htpasswd for our credential storage. If a user sends me an htpasswd record via email (or GChat / off the record?), what's ...
2
votes
1answer
78 views

Why do Facebook and Microsoft make you enter a code when reseting a password?

Typically when you reset a website password you receive an email. A lot of sites send you a link with a code on the end of it to click on which will take you to an 'enter new password' form. ...
4
votes
1answer
61 views

Countermeasures for a family-member attack on a password reset procedure

Given an account reset procedures, there are usually some recovery questions, and in better implementations a link will be sent to confirm the password change via email or SMS. Therefore, the attacker ...
1
vote
1answer
43 views

password storage and user authentication [duplicate]

I was going through (https://crackstation.net/hashing-security.htm) about doing password hashing / storage the right way. I understood most of it but i still have some questions and doubts which are ...
5
votes
3answers
389 views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as last pass store passwords in plain text (or hash values that can then be decrypted with the master password) in memory after a user logs into the ...
1
vote
1answer
97 views

If using a different password for every application is considered good practice, why is using a directory so widespread?

The title pretty much sums it all. We are always told that we should use a different password for every site and application, so that if one of those accounts is compromised, the others will still be ...
3
votes
1answer
81 views

Why use a password manager to protect browser logons when e-mail client is neglected?

Friends use password managers like lastpass or dashlane which have plugins for the browser, but not for the email clients (thunderbird or livemail). But surely the email password is the Achilles heel ...
1
vote
1answer
75 views

All UTF-8 characters for generated passwords

Why do a lot of password generators don't generate strong passwords including chinese, arabian...-characters? All generators I saw, also the included one in my password manager keepass, just output ...
23
votes
6answers
4k views

Source code as password

Passwords with a mixture of letters, numbers, and special characters are sometimes hard to remember. Is it secure to instead use a small amount of memorable source code as a 'passphrase'? As an ...
0
votes
2answers
153 views

Why would Gmail ask for the last password I remember? [closed]

Yesterday I tried to recover the password for a Gmail account that I have created few months ago and during the process it asked me for the last password I remember. Why would it ask for that? I'm ...
-3
votes
1answer
53 views

designing secure telnet [closed]

i came across this question and have been thinking about it without a final solution. The question is to design a secure telnet. essentially to login using a username and password using telnet. I do ...
2
votes
1answer
56 views

Is it safe to signup multiple applications with facebook?

Putting all eggs in one basket.. Is it safe to sign-up on different applications with facebook or such similar platforms, linkedin, twitter etc?