3
votes
3answers
494 views

Encrypting passwords?

I am planning on creating a text file to store my passwords, so I only need to remember 1 password (at the moment, I have about 20 long/complex passwords in my mind, and am worried that I might forget ...
3
votes
1answer
98 views

Password Managers: encrypted database vs hashing strategy

I'm considering moving to a password-management strategy based on supergenpass or something similar. This is an alternative to other password managers where instead of having a database of passwords ...
3
votes
1answer
110 views

API to change passwords?

After I learned last week that the login data of some of my accounts was leaked, I had to change my passwords for more than 30 sites. That was tedious! As luck would have it, some days later we ...
0
votes
1answer
182 views

The Problem with Changing All Passwords for HeartBleed [duplicate]

One thing that's been bugging me in relation to the discovery of the Heartbleed OpenSSL flaw is the recommendation that everyone should run to their computers in a panic and change all of their ...
0
votes
1answer
35 views

Is there an anti virus that protects processes from being injected code to?

As title says, is there an av that does that? And if not, is there any other program that protects processes like lsass in windows, apart from protected process utility in win8.1?
1
vote
0answers
26 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
0
votes
1answer
43 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
0
votes
1answer
39 views

How does LM hash deal with passwords that are between 8 and 13 chars

If its 14 then it splits it to 7&7, but how about 13 characters? 7&6? How does it work?
-1
votes
4answers
136 views

How do big companies and wealthy people secure their information? And how can I secure mine?

I've recently had some success and traffic increase with an online business I own and due to that someone has hacked my domain email and twitter accounts. My bank password is the same and I just ...
3
votes
1answer
58 views

Webpage sent me my password in clear text can it be secure? [duplicate]

I registered for a webpage years ago and have been using it without issues, today I made some changes to my account and they sent me an email containing my username and password in clear text. I ...
0
votes
2answers
58 views

Logging in after password reset email sent (but not acted on)

Should a user be allowed to request a password reset email and then log in (i.e. disregarding the reset email and using their existing password) or should the current account be locked until the ...
3
votes
2answers
143 views

How does my bank knows my second and forth chars of my password

I see that the new login mechanism used by some banks in UK and also used by visa debit authentication is to ask for three random characters from your password at login (for example second, ninth and ...
0
votes
1answer
149 views

Why don't we do dual password instead of forgot password?

You can see a link Forgot Password? nearby almost all login form. As I mentioned in question, Since passwords are completely protected from outside access unless owner reveal, I come up with this ...
1
vote
1answer
75 views

Is it a good idea to give users an additional password that they do not control?

It's a given that users will choose bad passwords. Why not help them out? Using a securely-random choice from a large dictionary, choose one or two words and tell the user to write them down. When ...
1
vote
0answers
58 views

How secure is a Python Pyro daemon for storing a password?

I am using the Pyro package to create a daemon which will, upon startup, prompt for a password, and then the daemon will store that password as long as it is running. Other scripts will then make a ...
1
vote
2answers
142 views

Username and password stored under form data in Chrome Dev Tools

When I record the network tab in Chrome Developer Tools when logging in to my site I find that the username and password are stored in plaintext under form data. You can also find it in Safari, ...
1
vote
3answers
182 views

Sharing passwords through email can be considered insecure?

I'm responsible to create new accounts for some services on my job. Some of these service do not allow password change by the user, so in the case the user wants to change its password, he would need ...
2
votes
5answers
213 views

Password Recovery - what if user can't complete 2nd step?

I'm thinking out my password recovery logic for an ecommerce system. Some backround: Passwords are stored using bcrypt, password recovery involves the standard reset link, which then can be used to ...
16
votes
2answers
533 views

Bank accepts different password to the one that I set

I'm not particularly well versed in IT security so please bear with me. I recently discovered that my bank's online system will accept passwords that consist of the correct password, and a string of ...
10
votes
4answers
758 views

Forgetting passwords typed in too frequently

It has happened to me several times that I've become so used to typing in a password I can't consciously remember it and it's purely muscle memory. This is particularly true with complex passwords ...
1
vote
4answers
144 views

How to store passphrase in this situation?

How to store a passphrase with a Java application that periodically needs access to its plaintext form? It is a strange situation, but I am wedged in it. If providing a decent security mechanism is ...
1
vote
1answer
67 views

Security implications of setting the same password on private key and PKCS12/JKS?

Are there any negative security implications of setting the private key password (DSA in this case) as a PKCS12 (and then JKS) export password (instead of generating/inventing a new one)? My use case ...
9
votes
4answers
440 views

Password security

I was requested at the login page of a website to first change my password. After typing in a new password, the web page told me the new password did not differ enough from the previous one. Does this ...
1
vote
1answer
78 views

storing username/email and password with a hash of the hash of the email/password? [duplicate]

Quite the simple discussion this one (one would assume): If I'd hash the email and password, and then hash the hashes, whould this be considered safe enough or would this just be a waste considering ...
0
votes
2answers
112 views

Password management [duplicate]

I am work in small company. I am Java Developer and Sysadmin of remote servers. I have problem with store password from several servers. How to best way to manage passwords in company?
0
votes
2answers
140 views

Encryption method and other security concerns for a simple password manager [closed]

I thought I would learn a little bit of cryptography programming by making myself a simple password manager program that I can potentially even use to keep track of my passwords. The idea is that my ...
2
votes
2answers
347 views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
2
votes
4answers
263 views

Should user's password strength be assessed at client or at server side?

Now most of big website like Google mail, Twitter, Facebook have a feature that assesses password strength (check number of digit, alphabet, special characters, or check the similarity over already ...
5
votes
6answers
703 views

Is it useful to protect hashed password with encryption?

Imagine that I am hashing the users' passwords with a random, long enough, salt, using key stretching, and a secure hash. Would it be more secure to finally encrypt the hash with a symmetric key?
20
votes
6answers
16k views

How safe are password managers like LastPass?

I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long. How safe are password ...
-3
votes
2answers
315 views

How to secure a login.php file? [closed]

I have a hand built website, and am triying to build a cms/admin-panel, and my username and password, are not stored in a database, but, in a two setup file like seen below. index.php <?php ...
1
vote
3answers
209 views

How safe is it to provide my administrator account password for a 3rd party software: EasyUS Todo Backup?

I've been recently searching for a backup solution for my Windows desktop. That's when I came across this free software called EasyUS Todo Backup. (I know it's a mouthful but English doesn't seem to ...
3
votes
1answer
140 views

S/Key as an alternative to UNIX passwords

There is this password system called S/Key I saw on the Internet. Can someone give me a brief description about S/Key and how it works? Can S/Key be an alternative solution to the UNIX password ...
3
votes
2answers
270 views

comparing password hashing algorithms - PoC ideas?

OK so I just started working for a security consulting firm and we recommend SHA 256 (with salt) for password hashing because MD5 is too weak. I have read some brilliant answers (the list is too ...
1
vote
3answers
295 views

Is Password Complexity required at all

For a web-site I'm using what I hope is the most secure password storage scheme I can find, which boils down to having a salt and hashed password stored in a database of contacts:- Byte[] ...
32
votes
10answers
4k views

Is there any point in using 'strong' passwords?

Let's say I'm setting up a new account on a website. Should I bother using a strong password? My reasoning is this: Password strength is a rough measure of how long it would take to brute-force my ...
0
votes
0answers
27 views

What'some best practice maintaining multiple accounts and password and making sure it's secure? [duplicate]

What'some best practice maintaining multiple accounts and password and making sure it's secure? Having around 20-30 critical accounts is a challenging process. I read some articles to make it really ...
17
votes
1answer
754 views

Does a maximum length of password mean non-hashed storage?

When a system requires a password between say 6 and 20 characters in length, does it mean the password is stored without using a hashing function, and that the mysql-field (or similar) is 20 ...
1
vote
6answers
233 views

How to keep website passwords safe among employees? [duplicate]

We're a website developer agency, and most of our websites are made using in Wordpress, Joomla or Drupal as a CMS. I'm having trouble to decide how we should manage our passwords, and I'm open for ...
3
votes
6answers
866 views

How can I best manage root passwords for many servers?

Lets say I have two racks with about 40 nix servers in them. I don't want to set all of the root user passwords all the same do I? If not how do you manage and keep up with all of the passwords? Is ...
4
votes
4answers
1k views

Is 1Password more secure than an AES encrypted text file?

Are there extra measures taken by 1Password and KeePass, that make them more secure than an AES-256 encrypted text file? The database formats they use seem needlessly complex for my own purposes.
12
votes
5answers
4k views

Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?

Justin Schuh defended Google's reasoning in the wake of this post detailing the "discovery" (sic) that passwords saved in the Chrome password manager can be viewed in plaintext. Let me just directly ...
0
votes
3answers
349 views

Why do you need to login after you change a password?

I can't recall a website that after resetting my password I was automatically logged in, I had to type the password again - which seems quite silly. From a security perspective, why do websites do ...
2
votes
3answers
200 views

Is there any reason I shouldn't use SHA1 of salt + website name + master password for my password in websites?

I considered writing a program to do the above for websites I only intend to use for short-term use.
2
votes
3answers
1k views

Microsoft password email reset link leads to different url?

...I am really annoyed and unsettled by the password reset email I just received from Microsoft. What should I think of this? My email client correctly told me that the underlying url is not the same ...
4
votes
3answers
529 views

How often should I reset my salt?

I'm thinking of implementing a salt recycling scheme on my user credentials database. The motivation behind this decision is that even if the attacker manages to get his hands on the database and has ...
6
votes
2answers
320 views

Secure password management

I've recently begun using Keepass for my personal password management. I am setting it up to sync between my home PC, work PC and mobile device using dropbox. I'm going "all the way", and have ...
0
votes
2answers
154 views

Is my domain registrar storing my password in cleartext? [closed]

I called my domain registrar (unnamed here but not difficult to find out and a major provider) about a year ago to have them change some DNS settings. While on the phone, the customer service rep had ...
4
votes
2answers
480 views

What's the best way to send and receive lots of login credentials?

I'm currently a web developer for a company with lots of different remote clients. There are lots of usernames and passwords that I need to know so that I can do my job. When I first started, I was ...
3
votes
1answer
100 views

Is it acceptable to generate salts with a hash of the username?

Salts are supposed to be unique and randomly generated for each user when storing passwords. Is there a reason why we can't generate these salts with a cryptographic hash function using the username ...