Is checking against password lists a good way to enforce a secure password policy and possibly detect dictionary attacks on a web-based app?
I have written a script to check a given password against a ~65 million long list of passwords collated from various lists released after hacking attempts. I am thinking about incorporating it into ...
What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
I can't recall a website that after resetting my password I was automatically logged in, I had to type the password again - which seems quite silly. From a security perspective, why do websites do ...
I have the problem that I usually use 4 passwords that I use quite often. I use the first two strong passwords for very important services (e.g. Email, PayPal,..), and the other two not so strong for ...
I have a few private repositories set up on GitHub for some of the projects I am working on for my company. These applications connect to databases and I have database authentication credentials ...
There is a convention to always prompt for the old password on the same page as the one where the old password is being changed as shown below. Is it acceptable from a security perspective to allow a ...
In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
I have read the following question: Storing password in Java application but I don't find the answers useful for my case. So here is my question somehow related to that. I have a Java Web application ...
I know that if a web application needs to be PCI-DSS or HIPAA compliant the user personal identifiable information (e.g. user password, etc) needs to be kept confidential. Under what other situations ...
The guys who made the security for my country's state bank are completely nuts in all senses. Their internet banking password must be between 8 and 10 characters, and contain only letters and digits. ...
I've been looking for ways to improve security and security awareness for both internal and external clients and I happened upon the idea of generating a one-time, random "password suggestion" on the ...
I recently received an email from a popular graduate job web site (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
Can anyone provide references for implementing web application self password reset mechanisms properly?
We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address). My problem is that I ...