The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

30
votes
9answers
6k views

How to securely ask for passwords of customer as consultancy firm?

In my work as a developer, I need username/password combo's from the customer sometimes to make sure the settings on 3rd party services are correct to work with the website/application we are building....
-1
votes
1answer
32 views

Are Bruce Schneier's passwordsafe and passwordsafe.de related?

Is the (commercial) product at https://www.passwordsafe.de/ in any way related to Bruce Schneier's passwordsafe? Same algorithm? Compatible file-formats? Or do they only share the name? I did some ...
0
votes
2answers
62 views

Storing and reading user's credentials on their machine

I am writing a (third-party) client for a game, and one feature that I would like this client to have is the ability to automatically log into the game using credentials previously entered. The ...
36
votes
2answers
6k views

Are there more modern password hashing methods than bcrypt and scrypt?

This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt. What I'm wondering is if there are any "...
14
votes
3answers
6k views

What are the risks of storing passwords in a GPG encrypted file?

I currently store my passwords in a text file encrypted using GPG -e (specifying my own public key). When I want to lookup a password I'll do something like gpg -d passwords.gpg | grep <sitename&...
4
votes
2answers
559 views

Keepass Dictionary Attack Protection Strategy

Though pretty interested, I'm everything but an expert in Information Security, please redirect me to any helpful resources if my question is stupid or correct me if my assumptions are wrong. When ...
10
votes
4answers
9k views

How does a key file increase the security of a password manager?

Password managers like KeePass often have an option to use a key file in addition to a master password. I don't understand how this increases security. (Note: KeePass also allows using a key file ...
7
votes
3answers
1k views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as LastPass store passwords in plain text (or hash values that can then be decrypted with the master password) in memory after a user logs into the ...
4
votes
2answers
1k views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
18
votes
6answers
6k views

Managing website passwords for small team

I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
14
votes
8answers
8k views

Are services like “LastPass” less secure, as they have all my passwords protected by a single password?

If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security?
4
votes
1answer
120 views

Keepass - Needle in a stack of needles

I got the idea from someone saying the best way is to hide the needle in a stack of needles, not in a haystack. I am considering writing a little app to accompany my Keepass installation. The app ...
3
votes
3answers
796 views

I want to roll my personal cloud hosted Password Manager using pass. How secure/insecure would this be?

I've come to the conclusion that I need to up my security. I currently have a dozen memorized passwords I use for every device and website. I'm against KeePass/Lastpass due to having to trust they ...
9
votes
3answers
7k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
0
votes
1answer
44 views

Should all web applications implement a security feature that stores historical passwords? [duplicate]

In addition to Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?. Facebook, and other companies, are storing historical passwords of ...
1
vote
2answers
91 views

How secure is a password protected file?

I have a password-protected excel file that stores other personal passwords. Obviously there have been a number of ways to crack the password. community.spiceworks.com Where do you guys store ...
0
votes
2answers
92 views

How secure is the hashing/salting/stretching process as described in this diagram?

Question I was just brainstorming about the hashing, stretching, salting part of the user password in the authentication process and I want it to be as secure as possible (no matter how paranoid that ...
7
votes
1answer
117 views

What are the recommended scrypt cost factors for 2016?

I've been trying to look for the answer, but the latest one I found was outdated by three years. So what are the recommended scrypt cost factors for 2016?
3
votes
2answers
62 views

Multiple passwords, same account, different privileges

Many of our clients in the field often need to use untrusted computers to access their account on our website (no 4G/WiFi). We have had multiple cases of credentials being leaked leading to several ...
4
votes
0answers
50 views

Password manager that uses a mix of long and short key derivation functions [duplicate]

I was reading "A Convenient Method for Securely Managing Passwords, Halderman et al., 2005". In short, the authors say to do the following: cache = very_long_key_derivation_function(salt,...
4
votes
4answers
110 views

What are possible methods for calculating password entropy?

I noticed there are tons of questions and answers about password entropy on this forum, some even suggesting formulas for calculating it. None did answer my exact question. What are possible or ...
2
votes
1answer
60 views

How to force Firefox to remember passwords?

I use 32-character (128-bit) randomly generated passwords. It's a little bit hard to remember them all, so I use encrypted keyring built into firefox. In this way I have different passwords to ...
7
votes
2answers
160 views

Is there any recommended approach for “upgrading” MD5 hashes to something secure? [duplicate]

I'm currently dealing with a couple of user accounts containing MD5 hashed passwords. These accounts got migrated from an old system into our current system which uses PBKDF2 for password hashing. I ...
2
votes
1answer
48 views

Protecting against specialized Keepass attacks

If you look at the KeePass security information, it says: However in all the questions above we're assuming that there's a spyware program running on the system that's specialized on attacking ...
0
votes
0answers
39 views

Manually computable passphrases [duplicate]

I need to revamp my password scheme for my various logins on different sites. I had the idea to try and craft a method where I could, using just my brain, algorithmically recall a password so that ...
26
votes
3answers
6k views

Security of LastPass together with YubiKey

I'm looking at password manager solutions and came across LastPass. I see that they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What ...
0
votes
0answers
26 views

I want to deploy from GitLab to AWS - so where exactly do I store my private key?

This seems like an odd and simple question, but I'm trying to get my head around the principle of "never check a private key into version control". I'm trying to build a startup of sorts, where ...
2
votes
1answer
74 views

What encryption is used by 1password?

I use a password storage application on my Mac called 1password. I was wondering if it encrypts the data it stores on my computer and decrypts it using a key made from my "one password" or if it has ...
8
votes
3answers
302 views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of one-...
3
votes
1answer
60 views

Where and how to create secret on embedded Linux system?

I'm using OpenSSL on an embedded Intel Edison (Atom Platform) running an Yocto Linux. I want to store passwords with OpenSSL on the device, but I don't know after which rules I should create the ...
0
votes
1answer
79 views

Inadvertent clickjacking on page causes LastPass login dialog to appear.

I like the idea of password managers but have become leery of the way they interact with browsers (especially given the recent "LostPass" exploit). Today I found that viewing a certain page with "...
0
votes
0answers
13 views

Password Managers — Generating Passwords On The Fly a Safe Approach? [duplicate]

Most password managers store user credentials for individual services encrypted on their own back-end databases, so that your passwords are available on multiple devices. So, a DB compromise on these ...
0
votes
1answer
32 views

Attacking encrypted storage vs attacking memory [duplicate]

I want to create a generative password manager. Generative password managers generate passwords based on seeds such as the master password and the website's URL. In contrast, most password managers ...
17
votes
5answers
3k views

Is this idea for a password manager secure? If so, why doesn't anybody use it? [closed]

I've been thinking of a problem with usual password managers: although they do provide better security than manually using passwords, there's a central database that can get lost, get compromised, etc....
1
vote
3answers
192 views

Storing passwords in Confluence vs a password manager

My SysOP team is using a page in Confluence for sharing the passwords of common accounts. I suggested them to use a password manager, but now thinking... is there any benefit? The Confluence page is ...
-1
votes
2answers
104 views

Secure password generation for different websites [duplicate]

I came up with the idea to generate passwords for internet sites by the following shema: $masterpassword $hostname $TLD hashfunction($TDL.$masterpassword.$hostname) So the actual password is a ...
0
votes
1answer
33 views

Securely stored secondary password

I'm currently writing a portal site for Microsoft Dynamic CRM, the portal works like this: Each user has his own account to login to my portal. Each user is assigned a seperate CRM credential by ...
2
votes
3answers
127 views

Require Same Session ID Through All Password Reset Process Steps

Our password reset logic works as follows: user clicks "forgot my password" and enters the email address of the account email is sent with a cryptographically secure token, and the email address of ...
49
votes
4answers
3k views

How to implement “forgot password” functionality?

For my project I need a "change password" functionality. I am not quite sure how to implement this kind of functionality yet so I was hoping to find some "best practice" on the internet but couldn't ...
8
votes
3answers
1k views

Reset password - should I prevent abusing it?

My assumption is that resetting password is only a security issue if an attacker gained access to the user's email. But I was wondering, what if someone simply abuses it (e.g. sends a "reset ...
433
votes
22answers
91k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
6
votes
1answer
52 views

How to determine the good number of PBKDF2 iterations according to technology evolution?

I'm using PBKDF2 to derivate passwords but I never know what can be considered as a "sufficient" value for the iteration count. Technology evolves very fast and I would also like to know how often ...
-3
votes
2answers
94 views

Will hashing a password, and then splitting it into multiple db fields increase security? [duplicate]

I've been reading up on Password hashing, and it seems like there is a lot of opinions on "What's right." I'm curious about the possibility of storing a split of a Hashed password in multiple user ...
-2
votes
3answers
83 views

Is there something other than “if” and “else”

There are many ways for protecting a password like using strong algorithms like SHA-512, using salts, encrypting the database where the password is stored, packing the license file with UPX etc and ...
2
votes
1answer
53 views

Will the Credential Management API now available in Chrome 51 be widely adopted?

Google Chrome 51 stable includes support for the Credential Management API. This implementation is based on the W3C spec. Will other browsers support this technology (particularly Safari)? Will web ...
5
votes
2answers
832 views

Is there a risk in sending the username in a password reset email?

We're using a CMS that has a password reset function that works according to best practices out of the box. Passwords are stored as salted hashes Forgot Password works like this: User enters ...
1
vote
1answer
44 views

Password manager login with compromised certificates

This morning I booted my work laptop as usual and logged in to Windows, then my password manager (Dashlane, if it makes a difference) as usual. Opening up Chrome and browsing to a site with HTTPS ...
2
votes
1answer
145 views

How can Windows 10 not have the password in memory?

I have read that Windows 10 does not hold the password in memory from the creator of mimikatz: Starting with 8.x and 10, by default, there is no password in memory. Exceptions: When ...
19
votes
2answers
2k views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
5
votes
1answer
496 views

Regarding Windows password and Chrome's 'Remember password' Feature

Google Chrome browser helps in password management by prompting users to remember their passwords for the websites. These saved passwords can be accessed from the browsers "settings" menu, and to do ...