The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

4
votes
2answers
162 views

Is the same decryption key used for data on the server as locally with Lastpass?

Lastpass stores the password databases encrypted on the server. Does it give a database to anyone who asks? If no, then what authentication (i.e. password) is used? I use Lastpass on multiple devices ...
5
votes
1answer
124 views

Is Django's approach to password reset tokens secure?

I am implementing a password reset feature for a web application and am contemplating adopting an implementation similar to Django. In a nutshell, Django creates a token who is comprised of a ...
12
votes
4answers
3k views

Is KeePass a good defense against keyloggers?

KeePass is a program in which you can store your password and copy and paste them into websites. Does anyone know if it is safe against key logging software? Does key logging software pick up what you ...
1
vote
2answers
150 views

Is there a way to securely store unsalted passwords?

So, obviously I'm not talking about username/password pairs here, I plan to store passwords with two salts and three hashes, but what occurred to me is that if I had a table where I kept pairs: ...
3
votes
1answer
73 views

Password security when connecting to ldap with rails application

How do you store a username/password securely in a rails app when using it for many ldap searches? The connection in the app requires ldap_bind_authenticate(Net::LDAP.new, username, password) ...
5
votes
1answer
108 views

Should I change the password of my password manager regurlarly?

A password manager stores many sensitive information like passwords, pins and so on . To access this data my should use a strong password/passphrase in order to protect our data. This password is more ...
4
votes
1answer
195 views

Protecting my high-value passwords against offline attacks

Summary I'm a LastPass user, but I have concerns about storing high-value passwords, like my bank password, online. I've read some posts on this topic but still have questions. How safe are ...
0
votes
1answer
143 views

Saving username and pasword inside SQL

I am currently managing a network of around 100 PCs. Many users have different mails/usernames and passwords for different services like login to PC, mail, local applications, ... When an application ...
196
votes
7answers
34k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, ...
1
vote
3answers
103 views

How YubiKey Challenge-Response works “locally”?

I have got a YubiKey NEO recently (and a bit disappointed that you can only have two activated second factor authentication methods out of all the listed). In password managers those support YubiKey, ...
3
votes
2answers
278 views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as last pass store passwords in plain text (or hash values that can then be decrypted with the master password) in memory after a user logs into the ...
37
votes
8answers
6k views

Is “different usernames” as good as “different passwords”

The answers to this question, and the associated xkcd got me wondering: if I use different account names in every service, then can I use the same hard-to-crack password in each? I'm thinking that ...
1
vote
2answers
196 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
35
votes
10answers
3k views

Is there a method of generating site-specific passwords which can be executed in my own head?

I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
0
votes
2answers
85 views

How can I ensure safety when literal passwords are required

I have a case at my hands where my server needs to make automated API calls that require authentication. Hence the server will need to know the literal passwords to make those calls. What options do ...
3
votes
1answer
907 views

Security analysis of Dashlane

I've been asked by a user whether I would recommend using the Dashlane password manager. I'm aware that other password managers have had some significant security problems, including XSS and CSRF ...
5
votes
3answers
367 views

How can I detect users that have requested AD Administrators to reuse an expired password?

There is a trend among companies I've worked at where administrators (or helpdesk folks) give a user a courtesy extension of the old expired password... rather than forcing the user to change it. ...
1
vote
1answer
83 views

Where to store hashes, salts, keys in Desktop Applications

I am trying to figure out where or how i should store application secrets and keys inside a desktop application. For example a facebook app key or dropbox key and secret. So I've read that i should ...
1
vote
1answer
50 views

Store/retrieve users passwords on server (using password managers ?)

I am working on a project in wich a school's server will need to use students' passwords periodically to connect to another website for them. I am aware that storing users' passwords in a server ...
0
votes
0answers
35 views

Hashed master password and generated encryption key in a password manager program

I'm writing a WPF password manager application to practice programming, so far this is the scheme I intend to use to store master password and individual site password: Master password: Generate a ...
46
votes
7answers
3k views

Do security questions subvert passwords?

Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
2
votes
3answers
3k views

Microsoft password email reset link leads to different url?

...I am really annoyed and unsettled by the password reset email I just received from Microsoft. What should I think of this? My email client correctly told me that the underlying url is not the same ...
20
votes
6answers
11k views

Should I use FileZilla?

Recently, an increasing number of people have started advising moving away from FileZilla. However, the only reason I can see for this is that FileZilla stores the connection information in a ...
1
vote
1answer
152 views

How is password information stored and used on Android accounts?

How difficult would it be for someone who stole your device to gain access to the username and password information stored under the Settings -> More -> Accounts section of an Android device? ...
16
votes
5answers
4k views

What is a good practical (and sane) way to manage all your passwords for online sites?

I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords. This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
1
vote
1answer
114 views

Password management: how an administrator should reset password for a user?

I implement simple user management. How an administrator should reset password for a user? Just provide a new password for a user (as in Active Directory)? Is it secure enough? Added Is it secure ...
1
vote
3answers
211 views

Why do banks still hack-up autocomplete=off functionality?

With Bug #1025703 in the latest Firefox 38, Mozilla has finally decided to stand up for its users instead of catering to the banks that don't want the passwords remembered. However, I've noticed ...
2
votes
2answers
67 views

Best practice for identity management methods with regards to confirming user existence

I'm working on a new site that uses asp.net identity to register users. I'm making use of email addresses as usernames and the email address has to be confirmed before the user can log in. I've been ...
1
vote
2answers
89 views

Using PGP to encrypt emailed password reset token

Even if I am careful not to lose/forget my password for some web account, other people are not and so most sites have a password reset mechanism, often being a reset token sent to the registered email ...
5
votes
6answers
201 views

Is hashing a string a secure manner for generating passwords?

I have several servers that I'm using for an online business. I have passwords for MySQL, Wordpress, SSH, FTP, Domain Provider, Paypal, and many more. I wanted to have a different, very long password ...
13
votes
4answers
1k views

Why will Google no longer allow me to end or begin passwords with a space? [closed]

Why won't Google allow me to use a password ending in a space anymore? Backstory: I have memorized a cipher that allows me to generate a different and very strong password across many different ...
13
votes
8answers
8k views

Are services like “LastPass” less secure, as they have all my passwords protected by a single password?

If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security?
6
votes
4answers
1k views

Does LastPass' multi-device functionality significantly compromise its security?

I think LastPass is a great consumer product because it allows users to conveniently utilize unique strong passwords for each site they use it with. It does encryption locally, but the fact that I can ...
0
votes
1answer
37 views

Is secure tokens send by email secure? [duplicate]

I'm struggling with the reset password function of a web app, the way i'm inclined to do it is by sending a token based url to the email of the user and than the user can access and reset its ...
2
votes
1answer
59 views

Is drag-and-drop safer than using the clipboard when it comes to protecting sensitive data from keyloggers?

I noticed that multiple password-locker applications recommend that you use the drag-and-drop feature to transfer passwords to login forms instead of copying the passwords to the clipboard or having ...
4
votes
3answers
667 views

Which passwords to exclude from a password manager?

The benefits of a password manager are clear. Still, it seems that there might be a case to keep at least some passwords out of it: Your primary e-mail, to minimize the "single point of attack" ...
21
votes
6answers
2k views

Is there a use-case that renders the password manager obsolete?

Background Trevor posed a question about the nature and validity of using a password manager, given the current prevailing model of authentication on most web resources. Caveat: this is not the ...
13
votes
5answers
7k views

How can I avoid putting the database password in a perl script?

I have a cronned perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
21
votes
3answers
5k views

Security of LastPass + YubiKey

I'm looking at password manager solutions and came across LastPass. I see they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What are ...
16
votes
2answers
4k views

How big should salt be?

I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2). Having that in mind, how big salt should I use? Should it be ...
5
votes
3answers
144 views

How do I convince others of the importance of password management?

I just got married, and my wife and I are in the midst of combining finances, etc. We set up a joint bank account and the first thing I do during the account setup phase is generate a 16-character ...
21
votes
4answers
6k views

Does the average user really need a password manager?

I'd describe myself as an average tech savvy computer user. I have many accounts in forums, shopping sites, etc where I recycle two moderately strong password with small variation. These are account ...
11
votes
2answers
777 views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
2
votes
2answers
92 views

How significant is the risk in having someone email/IM an htpasswd hash?

I need to set users up for subversion access, and we're currently stuck using htpasswd for our credential storage. If a user sends me an htpasswd record via email (or GChat / off the record?), what's ...
1
vote
2answers
335 views

What impact do the frequency of password resets have on password reuse?

Wondering if there's any research behind the most common password reset cycle I've seen of 90-days, and if there's any research that gives any insight into how to optimize password resets to reduce ...
2
votes
1answer
69 views

Why do Facebook and Microsoft make you enter a code when reseting a password?

Typically when you reset a website password you receive an email. A lot of sites send you a link with a code on the end of it to click on which will take you to an 'enter new password' form. ...
23
votes
6answers
4k views

Source code as password

Passwords with a mixture of letters, numbers, and special characters are sometimes hard to remember. Is it secure to instead use a small amount of memorable source code as a 'passphrase'? As an ...
1
vote
2answers
123 views

Encrypting short data with RSA only?

I have a case where I need to create recovery accounts and I want to create them so that nobody knows the password to them until/unless necessary. Hence, I thought that I would do it using RSA - when ...
4
votes
3answers
744 views

Hashing vs “One-way Encryption”

When working on a website application, me and a friend asked a security expert (works at IBM) how to handle storing passwords. After hours of google searches (resulting in hours of ...
4
votes
1answer
56 views

Countermeasures for a family-member attack on a password reset procedure

Given an account reset procedures, there are usually some recovery questions, and in better implementations a link will be sent to confirm the password change via email or SMS. Therefore, the attacker ...