The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

9
votes
4answers
653 views

Should I obfuscate passwords before hashing? Should I pre-hash them on the client? What about salts?

For fun, and in my spare time I'm creating a simple CMS for my own purposes (with hopes to release for wider use... later), using PHP. I'm currently working on the login scheme now, and have a few ...
20
votes
4answers
2k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
4
votes
2answers
196 views

How can IA-5(1)(b) be enforced on non-Windows systems?

I have a question posted already for this issue in Windows systems, and thought that non-Windows systems should perhaps be covered separately. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing ...
33
votes
6answers
3k views

How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?

In some environments, it is required that users change a certain number of characters every time they create a new password. This is of course to prevent passwords from being easily-guessable, ...
7
votes
2answers
757 views

How can IA-5(1)(b) be enforced on Windows systems?

Note: I've also posted a question for this issue on non-Windows systems. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include ...
5
votes
2answers
1k views

Password History/Password policy

I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008). Where is password ...
5
votes
2answers
338 views

How can I detect users that have requested AD Administrators to reuse an expired password?

There is a trend among companies I've worked at where administrators (or helpdesk folks) give a user a courtesy extension of the old expired password... rather than forcing the user to change it. ...
16
votes
2answers
10k views

FOSS Enterprise Password Management Solution [closed]

Can anyone recommend a F/OSS enterprise password management solution on/around the same level as something like Cyber-Ark? Specifically, something along the lines of a standard password manager, ...
9
votes
6answers
398 views

How can I ensure that default passwords are no longer in use?

There are two situations in which 'default' passwords get used on a network: A new user is registered. In her registration pack, along with her new username, e-mail address and so on is her initial ...
72
votes
8answers
8k views

Can anyone provide references for implementing web application self password reset mechanisms properly?

We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address). My problem is that I ...
3
votes
1answer
119 views

Protect file in a web site

How would you protect a password file in a web site? Is hashing the individual passwords not enough? What other steps do I need to follow?
34
votes
9answers
3k views

Is there a method of generating site-specific passwords which can be executed in my own head?

I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
23
votes
10answers
4k views

Password Management within an Organisation

Within an organisation there are many passwords such as those for root accounts on servers, hosting accounts, router logins and other such things, that need to be kept track of. I know in some ...
4
votes
0answers
1k views

Hints for safe passwords that are easy to remember [duplicate]

Possible Duplicate: What is your way to create good passwords that can actually be remembered? What are good hints to create passwords that are both safe and comfortable? By comfortable I ...
15
votes
8answers
1k views

Password management/synchronization?

Is there a good enough service I could run on my own home (Linux) server that I could use for storing/accessing/synchronizing passwords so they could be available for me from multiple ...