Password Management includes the definition of strength rules, expiration, reset, reuse, creation and storage of passwords, as well as the manual and automated processes by which passwords are managed in an organisation. This may include automated tools for forgotten password reset procedures, ...
4
votes
2answers
54 views
iPhone - logging out user when app goes into background
Our (financial/banking) mobile app requires user to enter username/password in order to get data via webservice calls. Once user is logged in, credentials are stored in global variable until user logs ...
1
vote
0answers
35 views
Lastpass - Can I just keep the previous autofills? [closed]
I just installed the Lastpass Firefox plugin, and it seems like a useful tool thus far. The only thing that drives me crazy is that I am used to the Firefox saved passwords where it will show the last ...
2
votes
6answers
220 views
Password sent via email upon registration
I was wondering what the pros and cons are about sending an email with the password to a user registering on a website (like wordpress.org does).
They use pretty good passwords (12 characters long ...
1
vote
2answers
97 views
Using a tabula recta to store passwords
Reading an answer to another question ("Is there a method of generating site-specific passwords which can be executed in my own head?") I came across this link, describing a way to use a physical ...
3
votes
1answer
116 views
Hashing length for storing password
Does larger hash size improve the security? Is it overkill to use 512 bit hash?
If I stored only 256 bits of the PBKDF2-SHA512 derived key, is it less, equal or more safe than 256 bits of ...
5
votes
3answers
234 views
Password in file .php
My connection.php file stores the credentials to connect to the database.
<?php
$objConnect = mysql_connect("localhost","username","password");
mysql_select_db("selectDB", $objConnect);
...
5
votes
3answers
151 views
What are some good ways to verify user identity for password resets?
I'm wondering how others verify the identity of users they're resetting passwords for. We currently try to speak to a manager at work, but it frustrates end users and seems like we don't trust them. ...
6
votes
4answers
213 views
Is there any reason to show the same message for invalid username as password?
I've seen a security question/requirement that a website login return the same error message for invalid password as for non-existent user. The idea being that this it makes it impossible to discover ...
0
votes
1answer
55 views
If password is changed on Active Directory, can I ensure that PC must be restarted before logon with new password
Basically, if I have a Windows computer connected to a domain, how can I ensure that if the password is changed on Active Directory that the computer must be restarted before the new password takes ...
9
votes
11answers
671 views
Best practice for password distribution
I am about to set up a new account on my Linux server for a user that lives in another state in the U.S.
I can't think of a good way to get them this user their password. There must be a standard ...
3
votes
3answers
201 views
What to do when asked for a weak password
The guys who made the security for my country's state bank are completely nuts in all senses. Their internet banking password must be between 8 and 10 characters, and contain only letters and digits.
...
7
votes
2answers
121 views
How can I share sensitive information with my team?
I need to share information with my team, like passwords and credit card numbers.
The needs are pretty minimal -- just an encrypted "spreadsheet". Keepass is potentially a solution but
the user ...
6
votes
2answers
140 views
Should an admin user be able to edit passwords?
For your typical web app, should an admin superuser have the right to edit a user's password, or should only that user have the right? (Even with edit ability, the admin would never see the current ...
4
votes
6answers
181 views
Prevent denial of service attacks against slow hashing functions?
I've been thinking about bcrypt recently, and what I wonder is if there's a way to deal with the inherent (D)DoS problems with slow hashing functions. Namely, if I set up bcrypt so my machine takes ...
2
votes
11answers
477 views
Definitely safest password storage scheme?
I already asked this on StackOverflow but I was suggested this would be a better suited place and I found no way to "move" the question so I have to copy it.
Believe, I know, there are hundreds ...
0
votes
1answer
116 views
Should I mount my mac Truecrypt Volume elsewhere?
I've read in various places to not mount your truecrypt volume in the same place as your Dropbox or Sugarsync folder. I believe this only matter for Mac/Linux, but I need some verification.
On a Mac, ...
3
votes
2answers
210 views
How big salt should be?
I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2).
Having that in mind, how big salt should I use?
Should it be ...
8
votes
4answers
145 views
What is the best way to hand out passwords to a widely spread diverse employee base?
I have a problem I need to solve - specifically, how to hand out passwords to people in a variety of locations, and with a wide variety of access.
I've thought of some options, but there are ...
0
votes
1answer
76 views
Can accounts still be logged onto if Password Caching is not enabled?
This is kind of an extension of my other question.. If you were not storing any of the passwords locally (caching disabled), would a user some how still be able to circumvent around this security ...
1
vote
1answer
152 views
Best security algorith for storing passwords [closed]
Possible Duplicate:
Which password hashing method should I use?
I want the best cryptography algorithm for storing passwords in database, which one should I use and how can I implement ...
18
votes
5answers
822 views
Do spaces in a passphrase really add any more security/entropy?
I often see passphrase suggestions written as a sentence, with spaces. In that format are they more susceptible to a dictionary attack because each word is on it's own as opposed to a large unbroken ...
2
votes
1answer
107 views
HP ProtectSmart In A Domain?
All of our HP PCs come with this software pre-installed, I'm a bit inclined to outright remove it because:
Credential manager stores passwords by default (this has lead to user confusion, plus ...
3
votes
1answer
258 views
Android for the Paranoid
In the case of a rooted phone, what are the various options to stay anonymous and keep your data secure? I've seen the guys at The Guardian Project work towards this: ...
4
votes
1answer
252 views
Keeping user data private in a cloud environment like Google App Engine
I am writing an open-source Java application for Google App Engine (GAE). The application will let users create content that is intended to be private. I want to provide reasonable assurances that ...
10
votes
3answers
315 views
Is it possible to not store passwords locally, at all?
Earlier this year I was playing around on the schools computers and found out the administrative password to a computer in my classroom. I realized how XP stored their passwords, booted into Ubuntu, ...
2
votes
1answer
253 views
Should I enable domain authentication in my DMZ
Traditionally at my place of work we have an internal subnet that is completely protected behind our firewall. No ports are allowed to be opened to direct connections from the public network. We also ...
4
votes
2answers
614 views
Sudo password when authenticating via passwordless SSH
I've got a few boxes all networked together on Amazon EC2, each of which are in automated communication with each other via SSH (rsync, etc). As such, I've created SSH keys on each of these machines ...
5
votes
2answers
146 views
How should hospitals handle the use of sharing credentials to access sensitive information, especially in critical situations?
Most organizations today hold individuals accountable for their actions on systems and networks by unique user IDs and passwords. However, imagine working in a hospital environment where access to ...
12
votes
4answers
451 views
How should I respond to poor password security?
My son's school uses a 3rd party to handle tuition and fee payments. I have recently come to the realization that they completely fail in the area of password security.
Last month they sent a ...
2
votes
1answer
250 views
Saving connection parameters in an RDP file
For connecting to a remote Windows Server 2008 I use a standard Windows 7 RDP remote desktop connection. In an RDP dialog there is an option to save connection parameters to an RDP file to use it ...
6
votes
4answers
600 views
Is it possible to easily retrieve Thunderbird's passwords with access to HDD?
I know Firefox 8 stores it's passwords in a SQLite database, which can easily be stolen with access to the HDD!
What about Thunderbird 8? How does it store the passwords and how can one retieve them?
...
2
votes
2answers
189 views
Keepass client on Android (reliable one)
I need some advice to choose a Keepass client on Android phone which can synchronize using Dropbox.
As i keep all my passwords in one place, I would like to keep it safe. Is KeepassDroid client safe ...
3
votes
5answers
273 views
Am I required to hash passwords
Is one required to hash passwords by law in the US or elsewhere? If not required by law, are there legal ramifications if unhashed passwords are stolen?
If not required in the US, but required in the ...
3
votes
1answer
2k views
How difficult to crack keepass master password?
How easily could someone crack my keepass .kdbx if they steal the file but never obtains the Master Password?
Is this a serious threat, or would a brute force attack require massive computing time? ...
3
votes
3answers
529 views
Best password storage scheme for high entropy, unique passwords which is failure resistant [closed]
What is the best, most secure, easiest way to:
store unique, strong passwords for every service which requires authentication
make the system resistant (total loss of security is avoided, breaches ...
10
votes
4answers
538 views
What should be used as a salt?
I always hear that it is best to use salts on top of stored passwords, which then somehow gets concatenated and hashed afterwards. But I don't know what to use as a the salt. What would be a good ...
4
votes
3answers
438 views
Username policy / Best Practices
I have found a tonne of information on Password policy all over the internet and several best practices checklists. However from a username point of view I could not find much. I thought it would be ...
14
votes
4answers
553 views
If a website allows another person to get a list of the site's users passwords, how likely is it that the passwords are stored in cleartext?
We had an incident where some of our managers were given passwords for the people they supervise using a particular company website. Ostensibly it was done so the managers could check in on the users ...
1
vote
0answers
166 views
Adding an alternative password change scheme to passwd using PAM modules [closed]
I am trying to set up a PAM module that lets one add a conditional password change scheme. The intended behavior is like this:
passwd
do you want to change authentication token for ...
12
votes
2answers
134 views
Would suggesting a random passphrase during sign-up hurt overall security?
I've been looking for ways to improve security and security awareness for both internal and external clients and I happened upon the idea of generating a one-time, random "password suggestion" on the ...
6
votes
2answers
155 views
Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email
Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance
MSFT even went to far as create ADMINSDUser rights to put ...
4
votes
4answers
343 views
Is forcing users to change passwords useful?
In many places, there's a policy that force the user changing it's password once a few months. The logic here is, that even if the password have leaked somehow, it'll be abused only for a relatively ...
26
votes
11answers
1k views
What to do about websites that store plain text passwords
I recently received an email from a popular graduate job web site (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
2
votes
2answers
167 views
Company sending Master passwords in unencrypted emails
If a company has terrible security policies like letting people email password in cleartext emails, what to do if they reject all fair minded advice?
13
votes
2answers
334 views
Sending temp password when users first registered - is that good for anything?
One of our clients has sent us a list of security requirements. One of them was that registration does not including setting a password - once complete, a temp password is sent to the user, and the ...
9
votes
4answers
169 views
Can apps be trusted when requesting your credentials?
I recently bought a newsreader app for my tablet that connects to Google Reader. To do so, it required my Google account password. Isn't this effectively the same as handling the password to the ...
2
votes
1answer
153 views
How can I manage multiple sets of passwords accessible by different users? [closed]
Possible Duplicate:
Sharing passwords and credentials between founders and employees
I use KeePass for my personal passwords.
I would want to use it for my business, too, but the only way ...
5
votes
4answers
395 views
Passwords - any statistics on user behavior?
I'm looking for analyses of how users choose and use passwords. I'm sure there are many resources out there that analyze user passwords. For instance, I've seen many people analyze dumps of password ...
0
votes
0answers
280 views
Best algorithm to securely store passwords? [closed]
Possible Duplicate:
How to securely hash passwords?
Question:
When I store the passwords of my site, what's the most secure way of doing this:
1) Encrypt it with a PGP public key, and ...
19
votes
6answers
2k views
Sharing wifi at a business - Bad Policy?
Is it safe for a small business to let customers use their wifi while waiting?
My friend is starting up a small dentistry practice (1 dentist), and I'm setting up his computers/wifi as a favor. ...
