The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

1
vote
1answer
39 views

Why do Facebook and Microsoft make you enter a code when reseting a password?

Typically when you reset a website password you receive an email. A lot of sites send you a link with a code on the end of it to click on which will take you to an 'enter new password' form. ...
4
votes
1answer
47 views

Countermeasures for a family-member attack on a password reset procedure

Given an account reset procedures, there are usually some recovery questions, and in better implementations a link will be sent to confirm the password change via email or SMS. Therefore, the attacker ...
1
vote
1answer
28 views

password storage and user authentication [duplicate]

I was going through (https://crackstation.net/hashing-security.htm) about doing password hashing / storage the right way. I understood most of it but i still have some questions and doubts which are ...
2
votes
1answer
151 views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as last pass store passwords in plain text (or hash values that can then be decrypted with the master password) in memory after a user logs into the ...
1
vote
1answer
46 views

If using a different password for every application is considered good practice, why is using a directory so widespread?

The title pretty much sums it all. We are always told that we should use a different password for every site and application, so that if one of those accounts is compromised, the others will still be ...
2
votes
1answer
50 views

Why use a password manager to protect browser logons when e-mail client is neglected?

Friends use password managers like lastpass or dashlane which have plugins for the browser, but not for the email clients (thunderbird or livemail). But surely the email password is the Achilles heel ...
1
vote
1answer
47 views

All UTF-8 characters for generated passwords

Why do a lot of password generators don't generate strong passwords including chinese, arabian...-characters? All generators I saw, also the included one in my password manager keepass, just output ...
22
votes
6answers
4k views

Source code as password

Passwords with a mixture of letters, numbers, and special characters are sometimes hard to remember. Is it secure to instead use a small amount of memorable source code as a 'passphrase'? As an ...
0
votes
2answers
90 views

Why would Gmail ask for the last password I remember? [closed]

Yesterday I tried to recover the password for a Gmail account that I have created few months ago and during the process it asked me for the last password I remember. Why would it ask for that? I'm ...
-2
votes
1answer
40 views

designing secure telnet [closed]

i came across this question and have been thinking about it without a final solution. The question is to design a secure telnet. essentially to login using a username and password using telnet. I do ...
2
votes
1answer
46 views

Is it safe to signup multiple applications with facebook?

Putting all eggs in one basket.. Is it safe to sign-up on different applications with facebook or such similar platforms, linkedin, twitter etc?
1
vote
1answer
72 views

Designing a password auth/reg system

I'm designing a user reg/auth system for a website and came up with this design for password based authentication. I'd like to know if this is reasonable. (ignoring cookies for caching credentials, ...
0
votes
2answers
80 views

Need some docs that say we shouldn't upper the string when saving it as a password [closed]

I'm trying to find on the Internet some manual, guide or policy secure about applications should not convert lower string to upper string to store as password I mean, don't make ...
0
votes
0answers
52 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
1
vote
1answer
68 views

How is password information stored and used on Android accounts?

How difficult would it be for someone who stole your device to gain access to the username and password information stored under the Settings -> More -> Accounts section of an Android device? ...
3
votes
1answer
27 views

Password security when connecting to ldap with rails application

How do you store a username/password securely in a rails app when using it for many ldap searches? The connection in the app requires ldap_bind_authenticate(Net::LDAP.new, username, password) ...
1
vote
1answer
62 views

Password sharing with spouse or mate (bulk-change shared passwords (via cloud service))? [closed]

I've read on New Scientist magazine that in 80% of all cases when people in a relationship share a place where they live one of the spouses knows the other's password, thus making the question I am ...
2
votes
0answers
25 views

sample/starter code to test for TRUSTe password requirements [closed]

Considering its a requirement for Truste certification I figure that the code to test for a password meeting Truste's password strength requirements has been written more than a few times. I was ...
1
vote
1answer
73 views

Why should we focus on protecting root access on a home computer?

I understand why root access should be protected in general, especially in the context of a server environment. An unknown party can essentially control everything you do on a computer remotely ...
-2
votes
4answers
107 views

Getting password cracking time and byte storage from bruteforce?

I am stuck with this question, you can see it in the picture I have included below. PARTS (a and b) I know a-z will be 26^8, A-Z will be 26^8 guesses, and 0-9 will be 10^8 guesses. But I can't relate ...
5
votes
2answers
357 views

Does the secure attention key really increase security?

Are there any statistics on whether requiring the secure attention key to be pressed on login actually increases security ? I personally don't see the point of that : if you're after credentials, ...
0
votes
0answers
55 views

Web app crypto scheme

For learning purposes I am trying to build a web application (Symfony2, PHP) that allows users to post content and have their own password vault, everything encrypted. Since I want to users to be able ...
1
vote
3answers
79 views

Password reset question answer complexity

I need to implement a password reset feature for a system that will be controlled by a security question and answer pair. The problem is that I can't guarantee I'll have a valid e-mail address or cell ...
0
votes
1answer
75 views

Different password for each login - based on some variable

This might sound a silly question, but I was thinking this as and extra option(which is not required) mainly for advanced users, who want to protect their accounts even more. Lets consider that other ...
5
votes
1answer
72 views

How do people keep track of their employee's privileged accounts?

I am curious how the community here keeps track of a user's accounts. For instance, in the event of an employee transitioning from the company, how does security make sure that all user accounts the ...
5
votes
2answers
107 views

Share root access without sharing password

I am looking for a way to share admin privileges on some hosts without providing the admin password. From his link, I was thinking of using a primary host from which every user can sudo -u user to ...
0
votes
1answer
43 views

MD5 before PBKDF2 on legacy software

I am mantaining a legacy software that uses MD5 in the following way: The client asks for a 16 byte salt when authenticating an account. The server generates a 16 byte salt, links it to the account ...
1
vote
2answers
42 views

Asking questions randomly from a set of questions instead of a password?

I was thinking about this for a while. Say we have an app for which there is an admin console, and we need to provide access to the admin console over the browser (yes, HTTPS). For authentication, ...
1
vote
2answers
53 views

Should a password ever be presented in plain text to a user (On a website)? Is this illegal under UK Data protections act? [closed]

There is a website I use at work, external to our own. They have just presented with every employee with their plain text password and username via our internal website which requires our own logins. ...
1
vote
0answers
62 views

Store 2-legged one-time password's key securely

I have a system with a OTP authentication and I need a method to encrypt the main "secret algorithm". In my system each OTP has a pair named "solution" and it is also changing like the OTP. I need to ...
1
vote
2answers
110 views

Encrypting short data with RSA only?

I have a case where I need to create recovery accounts and I want to create them so that nobody knows the password to them until/unless necessary. Hence, I thought that I would do it using RSA - when ...
2
votes
0answers
101 views

TrueCrypt LUKS keyfile and password

I understand that a TrueCrypt volume may be encrypted with a password AND a keyfile. As far as I can tell, A LUKS volume may use EITHER a password OR a keyfile, but not both simultaneously for ...
0
votes
1answer
38 views

Does Linux and Mac OSX have built-in Credential/Password Managers with API access? [closed]

Does Linux and Mac OSX have built-in Credential/Password Managers with API access like Windows has with its CredMan (CredWrite, etc). It would be preferrable if they could be used without the need to ...
2
votes
1answer
53 views

Is the same decryption key used for data on the server as locally with Lastpass?

Lastpass stores the password databases encrypted on the server. Does it give a database to anyone who asks? If no, then what authentication (i.e. password) is used? I use Lastpass on multiple devices ...
2
votes
2answers
93 views

Randomness of hash token in password reset link [duplicate]

I want to know what are the points to be kept in mind while creating a hash token for my password reset links. In particular, how to make it un-predictable for an attacker?
2
votes
3answers
93 views

How could a shared password database be implemented?

In the traditional form, a password database is similar to any other database file, except the contents are encrypted using a key derived from a passphrase entered by the user. The user enters their ...
1
vote
1answer
78 views

Secure copy-paste from phone to computer

Some computers on my university block the keepass application which I use as a password manager. I'm thinking of building a small web application + Android app which lets me securely copy a string ...
4
votes
3answers
310 views

Hashing vs “One-way Encryption”

When working on a website application, me and a friend asked a security expert (works at IBM) how to handle storing passwords. After hours of google searches (resulting in hours of ...
4
votes
1answer
144 views

Protecting my high-value passwords against offline attacks

Summary I'm a LastPass user, but I have concerns about storing high-value passwords, like my bank password, online. I've read some posts on this topic but still have questions. How safe are ...
2
votes
2answers
147 views

Storing lots of passwords that different levels of employees need access to

I am wondering what other people do for storing passwords. Our current model at my employer is fundamentally flawed in my opinion, so I am trying to see what other people do so I can select the best ...
0
votes
2answers
36 views

Using bcrypt in chrome extension [closed]

I am developing a chrome extension for this non profit. Im also working on the server side component as well. Im not a full time developer so most of my knowledge has simply come from years of ...
2
votes
1answer
54 views

Is it sensible to use application password bypassing two factor authentication? [duplicate]

I discovered that some applications (like Sylpheed) seems unable to support two factor authentication. Google has a feature called application passwords - a separate password that "grants complete ...
0
votes
1answer
58 views

How to change font so simillar characters can be distinguished in Keepass 2? [closed]

I've had problems at work and at home where password managers display similar letters virtually identically. For example it's impossible to distinguish between an 1, l and I. Is there a recommended ...
4
votes
5answers
117 views

What would be a good way to send sensitive information to users that are not very tech-savvy?

As web developers we need to supply sensitive data to the clients. Clients are usually not very good with computers. They can send an email, pick up a phone call or open a webpage. But won't be able ...
0
votes
1answer
81 views

Why doesn't SSH use a better algorithm for encrypting keys?

According to the answers in this question, SSH still uses a very basic algorithm for encrypting keys with a passphrase, which can be attacked at a rate of billions tries per second using dedicated ...
-1
votes
1answer
27 views

Double step verification system for homepage

I want to share some of my work with some double step verification system. PGP is not enough, since some of my clients cannot use it. First, you need a password to login but you also need the code ...
1
vote
1answer
72 views

Are there best practices concerning application account credentials?

I am looking for best practices concerning application account credentials. For example, suppose I got a corporate application which uses an Active Directory application user account to communicate ...
0
votes
3answers
195 views

Testing a password for similarity to previous hashes

This question is a follow-up to a comment by Tobias Kienzler to an answer to "What is the purpose of the “Password minimum age” setting?". Consider a password policy that new passwords cannot be ...
1
vote
3answers
204 views

Why are keyloggers a problem for password managers?

Reading the API definition of SetWindowsHookEx, I see Calling the CallNextHookEx function to chain to the next hook procedure is optional, but it is highly recommended; otherwise, other ...
1
vote
2answers
101 views

Unregistering keyboard hooks by timeout expiration

I'm writing a password manager for Windows which I want to protect against keyloggers. There is a timeout of 5000 ms for keyboard hooks. The hook procedure should process a message in less time ...