The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

47
votes
4answers
3k views

How to implement “forgot password” functionality?

For my project I need a "change password" functionality. I am not quite sure how to implement this kind of functionality yet so I was hoping to find some "best practice" on the internet but couldn't ...
7
votes
3answers
1k views

Reset password - should I prevent abusing it?

My assumption is that resetting password is only a security issue if an attacker gained access to the user's email. But I was wondering, what if someone simply abuses it (e.g. sends a "reset ...
423
votes
22answers
89k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
6
votes
1answer
48 views

How to determine the good number of PBKDF2 iterations according to technology evolution?

I'm using PBKDF2 to derivate passwords but I never know what can be considered as a "sufficient" value for the iteration count. Technology evolves very fast and I would also like to know how often ...
-2
votes
2answers
63 views

Will hashing a password, and then splitting it into multiple db fields increase security? [duplicate]

I've been reading up on Password hashing, and it seems like there is a lot of opinions on "What's right." I'm curious about the possibility of storing a split of a Hashed password in multiple user ...
-2
votes
3answers
74 views

Is there something other than “if” and “else”

There are many ways for protecting a password like using strong algorithms like SHA-512, using salts, encrypting the database where the password is stored, packing the license file with UPX etc and ...
2
votes
1answer
35 views

Will the Credential Management API now available in Chrome 51 be widely adopted?

Google Chrome 51 stable includes support for the Credential Management API. This implementation is based on the W3C spec. Will other browsers support this technology (particularly Safari)? Will web ...
0
votes
1answer
44 views

Storing and reading user's credentials on their machine

I am writing a (third-party) client for a game, and one feature that I would like this client to have is the ability to automatically log into the game using credentials previously entered. The ...
5
votes
2answers
813 views

Is there a risk in sending the username in a password reset email?

We're using a CMS that has a password reset function that works according to best practices out of the box. Passwords are stored as salted hashes Forgot Password works like this: User enters ...
1
vote
1answer
35 views

Password manager login with compromised certificates

This morning I booted my work laptop as usual and logged in to Windows, then my password manager (Dashlane, if it makes a difference) as usual. Opening up Chrome and browsing to a site with HTTPS ...
2
votes
1answer
122 views

How can Windows 10 not have the password in memory?

I have read that Windows 10 does not hold the password in memory from the creator of mimikatz: Starting with 8.x and 10, by default, there is no password in memory. Exceptions: When ...
17
votes
2answers
2k views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
5
votes
1answer
480 views

Regarding Windows password and Chrome's 'Remember password' Feature

Google Chrome browser helps in password management by prompting users to remember their passwords for the websites. These saved passwords can be accessed from the browsers "settings" menu, and to do ...
-4
votes
1answer
84 views

If I am an admin of a WiFi router can I learn the password when it gets change by other admin? [closed]

I have a Huawei WS319 router. The admin password is known to me and my friend. Is there any way to learn WiFi password (through automatic notification) if it gets changed in the future, given that I ...
38
votes
10answers
8k views

How can I securely check if a username exists?

I'm working on the onboarding functionality of my web app and at some point I'm asking a new user to choose a username. When the user gets to this point, I have his/her email and a cellphone number ...
18
votes
6answers
3k views

Why do we ask for a user's existing password when changing their password?

In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
19
votes
5answers
4k views

How to tell if a webapp transmits my password in cleartext?

I am trying to see if a webapp transmit password in some form of cleartext. The problem is that the web app is NOT using https! This is why I wondering is my passwords is sent in clear text. I've ...
13
votes
1answer
3k views

Should I hash my passwords even if I am only allowed to generate limited traffic?

At this moment I'm busy working on an webapp with a friend of mine. The main problem we have is that we are only allowed to generate 50 GB a month in datatraffic. My question is: Does hashing the ...
7
votes
3answers
274 views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of ...
1
vote
3answers
135 views

Storing passwords in Confluence vs a password manager

My SysOP team is using a page in Confluence for sharing the passwords of common accounts. I suggested them to use a password manager, but now thinking... is there any benefit? The Confluence page is ...
-4
votes
0answers
39 views

How can secure passwords stored in password managers be entered on mobile apps?

People who know the most about computer security suggest using password managers to log into websites. This allows people to have a different secure password for every website they use. Most of these ...
-4
votes
1answer
71 views

maximum reasonable password length [duplicate]

I often register at different sites and I generate password for every one. What length should I use? What is the maximum reasonable password length? 10, 50, 100 characters?
1
vote
2answers
419 views

How to store the access token / password reset token in the database?

I have an access code that is sent to users so that they can access the site in one-click. From terms of access it's very similar to the password reset url, so I assume the same assumptions apply. ...
-1
votes
1answer
145 views

How can this encryption algorithm be improved?

I am currently developing an application to store my passwords safely. It will be a proof-of-concept at first, but I am planning to upgrade it later. Anyway, here is how the passwords are accessed: ...
1
vote
1answer
40 views

Is there a functional difference between `chage -M 99999`and `chage -M -1`on Linux?

My group just requested a security scan on some of our development systems and were informed that a number of system type accounts were insecure because the password did not have a maximum time limit. ...
0
votes
1answer
71 views

Inadvertent clickjacking on page causes LastPass login dialog to appear.

I like the idea of password managers but have become leery of the way they interact with browsers (especially given the recent "LostPass" exploit). Today I found that viewing a certain page with ...
5
votes
2answers
4k views

Password management in Firefox, Chrome and Safari

I just read a couple of very interesting discussions on Chrome password security strategy. Chrome’s insane password security strategy Showing stored passwords - Tim Berners-Lee The following is how ...
6
votes
1answer
685 views

Gmail lets me use my old password

My university's email works through Gmail and I can log on to it either through my uni's website or in Gmail. I recently changed my password and I use it to log in to the schools secure WiFi, school ...
3
votes
1answer
687 views

Why are lengthy passwords stronger than complex ones? [duplicate]

So all my life I've been listening to people tell me to make my password complex: upper case / lower case / numeric / symbols. Recently though I've been reading / seeing that length above all seems to ...
10
votes
3answers
1k views

An authoritative source for why you should NEVER give your password to anyone?

I know this might be a bit subjective, but it's based on this popular question here. Hopefully this is acceptable. The problem with that question and answer is that I can't send it to my boss and ...
2
votes
2answers
200 views

Secure copy-paste from phone to computer

Some computers on my university block the keepass application which I use as a password manager. I'm thinking of building a small web application + Android app which lets me securely copy a string ...
0
votes
0answers
22 views

Scheduled tasks that need domain admin privileges

I have a Windows 10 box that runs a whole bunch of Powershell scripts, some of those contain cmdlets that need to be run against a DC, or mail server, for eg. Get-ADComputer, and ...
0
votes
2answers
47 views

How to properly hash a key? big vs small digest

We have to roll (decommission) database access keys often, but it's important to know which key each system is using in order to avoid removing a key in use thus creating unavailability. We want each ...
0
votes
2answers
54 views

Replacing files with infected files on anonymous ftp server

I am creating a new question as i now have another question which was raised from a previous answered question post. What im trying to figure out is would this scenario be possible. I have an ...
2
votes
1answer
80 views

Is storing passwords encrypted with GnuPGP on an anonymous FTP server safe?

I would like some advice on a method of storing passwords to a database on my anonymous FTP server. Basically I have login details for a few trusted users to a database server stored in a text file ...
0
votes
3answers
39 views

How secure is it to use passwords consisting of one common part and one site specific prefix? [duplicate]

One of the greatest problems with passwords is having to remember different passwords for different sites. Some people use password managers, others use the password reset link every time they want to ...
4
votes
0answers
87 views

What are the recommended scrypt cost factors for 2016?

I've been trying to look for the answer, but the latest one I found was outdated by three years. So what are the recommended scrypt cost factors for 2016?
2
votes
3answers
2k views

Centralized local hosted web based password manager

In our company we have more than 100 employers and everyone use several online applications daily. To access all of this sites they need a password which was now stored very insecurely. so I'm ...
0
votes
0answers
44 views

Does an account with a !! /etc/shadow entry have to still expire?

Currently where I work, our password policy is set at 84 days. This is set in our login.defs on all of our Linux machines. We have policies that are set around PCI DSS 3.1 and the like, this goes for ...
1
vote
1answer
89 views

Should VPN passwords be stored in plaintext?

I know nothing about setting up a VPN, but it happens that I use a VPN add-on for Firefox, and that the VPN provider stores the user password in plaintext. Last week I installed a VPN add-on for ...
1
vote
1answer
54 views

Powershell and cached credentials

In my environment we have powershell remoting off- I get around this using 2 hop scripts, packages(exe -no creds are stored in code- local privs only), and iwmi. I never pass creds to the endpoint, ...
36
votes
4answers
4k views

Avast AV could read Firefox saved passwords

My friend uses Firefox's built-in password manager feature to save passwords for sites. Later, after installing Avast Free Antivirus there was a feature called Passwords on the Avast UI. When accessed ...
62
votes
8answers
7k views

Is it OK to tell your password to your company's sysadmin?

I'm working in a small company (20 employees) as a senior software engineer. After having problems with my email, our newly employed IT administrator asked me to write my user password to someone in ...
-4
votes
1answer
483 views

Why don't we do dual password instead of forgot password?

You can see the link "Forgot Password?" nearby almost all login form. Since passwords are completely protected from outside access, I come up with this question. I accept that the forgot password ...
4
votes
4answers
121 views

Sending server-generated password by email

I'm implementing a system where our users need to enter a special (permanent) password to authorise a transaction. The password is separate to their login credentials, and they can only enter this ...
10
votes
2answers
949 views

Is there more to password hashing?

You have a plain text password and salt. The plain text password is assumed to be securely random and only known by the user and the salt is no secret and not necessarily unique but stored alongside ...
1
vote
4answers
98 views

How can I mitigate the risk of my wifi key being shared with strangers through apps?

Sometimes a guest asks for my wifi password, and I gladly give it to them. Sometimes that guest has a wifi sharing app, and said app shares the key with totally random strangers (I know there is some ...
6
votes
1answer
218 views

Should I change the password of my password manager regularly?

A password manager can store lots of sensitive information like passwords, pins and so on. To access this data, we should use a strong password/passphrase in order to protect our data. This password ...
24
votes
7answers
17k views

Should I use FileZilla?

Recently, an increasing number of people have started advising moving away from FileZilla. However, the only reason I can see for this is that FileZilla stores the connection information in a ...
-8
votes
4answers
146 views

Why shouldn't I store passwords in plaintext? [closed]

Why is it so important not to save passwords in plaintext? I think it is the same issue like authorizing a user on a RESTful webservice, where most developers claim: "Don't send your security token ...