The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

1
vote
3answers
375 views

For what do I hash user passwords with PDKDF2 when the user data is stored in the same database?

I'm hashing the passwors of my users with PDKDF2 right now. A user can gain access to his account with his password. When the user is logged in he can edit his personal information and do other stuff ...
1
vote
2answers
438 views

How to store the access token / password reset token in the database?

I have an access code that is sent to users so that they can access the site in one-click. From terms of access it's very similar to the password reset url, so I assume the same assumptions apply. E....
1
vote
3answers
521 views

Is Password Complexity required at all

For a web-site I'm using what I hope is the most secure password storage scheme I can find, which boils down to having a salt and hashed password stored in a database of contacts:- Byte[] ...
1
vote
2answers
432 views

Seeking advice on how to build a box to brute force hashes? [closed]

I work in a startup security firm, and I need to build a GPU-based to brute force password/hashes, which can be used to validate password strength and test hashing algorithms. I expect some high ...
1
vote
2answers
288 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
1
vote
3answers
404 views

Sharing passwords through email can be considered insecure?

I'm responsible to create new accounts for some services on my job. Some of these service do not allow password change by the user, so in the case the user wants to change its password, he would need ...
1
vote
1answer
234 views

If a hacker gets into my PC can he get to my saved windows live mail passwords?

If a hacker gets into my PC can he steal my emails passwords? I use the windows live mail client to manage my email and I have saved my passwords when it asks me to save them. I run like 9 mail ...
1
vote
2answers
5k views

Is there a way to find out how long it takes John the Ripper to crack a particular password?

I am looking to test/demonstrate things like: when the supplied wordlist contains "abc123" and pw="abc123" then John cracks the pw in 1/2 a second... but if word list does not contain "abc123" John ...
1
vote
3answers
192 views

Storing passwords in Confluence vs a password manager

My SysOP team is using a page in Confluence for sharing the passwords of common accounts. I suggested them to use a password manager, but now thinking... is there any benefit? The Confluence page is ...
1
vote
1answer
662 views

VeraCrypt: Is it possible to change the password after an encrypted container has been created?

I would like to know whether it is possible to change the password after an encrypted container has been created? The password I chose was a bit weak, and I would like to be able to modify it without ...
1
vote
2answers
174 views

Is there a way to securely store unsalted passwords?

So, obviously I'm not talking about username/password pairs here, I plan to store passwords with two salts and three hashes, but what occurred to me is that if I had a table where I kept pairs: ...
1
vote
2answers
76 views

Asking questions randomly from a set of questions instead of a password?

I was thinking about this for a while. Say we have an app for which there is an admin console, and we need to provide access to the admin console over the browser (yes, HTTPS). For authentication, ...
1
vote
2answers
396 views

Want to build a password manager using OpenPGP.js

I'm kind of tired of the password managers that are available around... I need one that's open source, that works on OSX, that lets me store .pem files and that I can trust. As I haven't found one, I ...
1
vote
2answers
425 views

Password database vs flat encrypted file [closed]

I am considering putting a forward a proposal to use a password database/manager instead of a flat (PGP) encrypted file for managed passwords for our team to access. I would like to hear some ...
1
vote
2answers
116 views

Logging in after password reset email sent (but not acted on)

Should a user be allowed to request a password reset email and then log in (i.e. disregarding the reset email and using their existing password) or should the current account be locked until the ...
1
vote
3answers
2k views

Implementing 'Remember Me' for a mobile application

I am developing a mobile application wherein I need to implement the 'Remember Me' functionality. There are certain pages within the application which require you to login. What I need to do is, if ...
1
vote
3answers
435 views

Logic for generating Strong Password?

I try to encrypt password using MD5 but there are decoders for MD5. So I'm worried about encryption of password for big website. Is there any logical suggestion or step function to generate strong ...
1
vote
1answer
548 views

If password is changed on Active Directory, can I ensure that PC must be restarted before logon with new password

Basically, if I have a Windows computer connected to a domain, how can I ensure that if the password is changed on Active Directory that the computer must be restarted before the new password takes ...
1
vote
3answers
193 views

Password reset question answer complexity

I need to implement a password reset feature for a system that will be controlled by a security question and answer pair. The problem is that I can't guarantee I'll have a valid e-mail address or cell ...
1
vote
1answer
222 views

If I have my neighbors wireless router password, can I access his data with a smartphone?

My neighbor gave me his wireless router password to use on my smartphone. Using this, can I access any of his accounts whether it's his bank account or Att/Direct TV account? I ask because I think ...
1
vote
1answer
211 views

Password management: how an administrator should reset password for a user?

I implement simple user management. How an administrator should reset password for a user? Just provide a new password for a user (as in Active Directory)? Is it secure enough? Added Is it secure ...
1
vote
2answers
569 views

Unregistering keyboard hooks by timeout expiration

I'm writing a password manager for Windows which I want to protect against keyloggers. There is a timeout of 5000 ms for keyboard hooks. The hook procedure should process a message in less time ...
1
vote
1answer
216 views

help identifying an IP address from email sent from my gmail account

Someone sent the following email from my gmail account. I believe it was hacked and if I can find the IP address I may be able to identify the person who did it. Here is the information. Please let me ...
1
vote
4answers
238 views

How to store passphrase in this situation?

How to store a passphrase with a Java application that periodically needs access to its plaintext form? It is a strange situation, but I am wedged in it. If providing a decent security mechanism is ...
1
vote
2answers
172 views

Mysql database password and webform password

I have a Mysql database where one table is meant to store user complaints/comments/suggestions. I am using Mysqli to connect to the database with a $con=mysqli_connect("myhost","myuser","...
1
vote
2answers
175 views

is it appropriate to set restrictions on a user's password? [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? Im developing a website and am curious as to the current trends in the nature of passwords. Is it good to ...
1
vote
1answer
102 views

Should the salt of a bcrypt hashed password be stored separately

I'm replacing a password storage system. The current implementation uses TripleDES with the key stored in plaintext in both the binaries and the config (in-case one of them is not available for some ...
1
vote
1answer
45 views

What is the drawback of allowing multiple accounts on a single email?

I run a website where users authenticate using email and password. Some users would like to have two or three accounts using the same email address. I see the use case in their situation, and am ...
1
vote
2answers
171 views

Several hashing routines support client side work. Doesn't the hash just become a password equivalent?

Isnt Secure Remote Password Protocol (SRP) pretty much client side hashing? Argon2 the winner of the PHC also allows for client side hashing. How do these systems avoid the plaintext equivalence ...
1
vote
1answer
102 views

All UTF-8 characters for generated passwords

Why do a lot of password generators don't generate strong passwords including chinese, arabian...-characters? All generators I saw, also the included one in my password manager keepass, just output ...
1
vote
1answer
89 views

Why should we focus on protecting root access on a home computer?

I understand why root access should be protected in general, especially in the context of a server environment. An unknown party can essentially control everything you do on a computer remotely ...
1
vote
2answers
419 views

Additional security measures for getting Chrome Saved Passwords via password management Hacked or Exposed?

I've noticed that there are quite a few applications out in the open now to decrypt chrome's password management features. I've seen hacks where a hacker remotes into a computer and runs an app ...
1
vote
3answers
378 views

Site allows both Partial and Complete password authentication; do they have my password in plain text? [duplicate]

My bank provides online banking facility like most of the banks these days. On the web they have Partial Password Authentication. Although I don't really believe in PPA providing extra security but ...
1
vote
2answers
155 views

How Empathy - a messaging program, is storing my passwords

I am connected to my chat accounts via Empathy, a messaging program, and it has my password stored in it. I am really curious to know how it is storing the passwords, and if there is any they can ...
1
vote
3answers
132 views

How to limit the need to type a long master passphrase to only once per login session?

I want to set up a password management system on a home machine running Debian, and for this I'm considering only non-proprietary, open source password-managers available through Debian1. I'd like to ...
1
vote
1answer
243 views

ISO and Password Security

I have to go through background check. The company providing the service to the client is called Verifications, Inc. Verifications, Inc claims to have a data security plan, ISO certification and US ...
1
vote
3answers
293 views

cleartext passphrase for keystore

How is passphrase for a keystore to be stored? we have all passwords encrypted and the key to encrypt is stored in keystore , so how is the passphrase for the keystore to be stored? in clear text? if ...
1
vote
1answer
94 views

How do you manage credentials to multiple remote systems?

We are a vendor that provides software to the healthcare industry, and our application is locally hosted on customer infrastructure. As such, we are provided with VPN access in order to be able to ...
1
vote
2answers
388 views

What are the security risks associated with storing passwords on the internet?

With products such as LastPass that store encrypted passwords on remote servers, what are the associated risks that aren't applicable to locally stored and encrypted passwords? If something is ...
1
vote
1answer
281 views

Security implications of setting the same password on private key and PKCS12/JKS?

Are there any negative security implications of setting the private key password (DSA in this case) as a PKCS12 (and then JKS) export password (instead of generating/inventing a new one)? My use case ...
1
vote
1answer
101 views

storing username/email and password with a hash of the hash of the email/password? [duplicate]

Quite the simple discussion this one (one would assume): If I'd hash the email and password, and then hash the hashes, whould this be considered safe enough or would this just be a waste considering ...
1
vote
2answers
398 views

Encryption method and other security concerns for a simple password manager [closed]

I thought I would learn a little bit of cryptography programming by making myself a simple password manager program that I can potentially even use to keep track of my passwords. The idea is that my ...
1
vote
1answer
358 views

How does IIS persist identity credentials? Does it create any security issues?

We want to implement a feature similar to IIS in how it remembers user configured usernames and passwords. As I understand it, when you configure IIS to use a set of credentials for an app pool ...
1
vote
6answers
620 views

How to keep website passwords safe among employees? [duplicate]

We're a website developer agency, and most of our websites are made using in Wordpress, Joomla or Drupal as a CMS. I'm having trouble to decide how we should manage our passwords, and I'm open for ...
1
vote
1answer
627 views

Securely tell the user his password in new WHM/Cpanel account creation?

I understand it's not safe to send passwords via email but when accounts are created via WHM/Cpanel, I have to let the user know what password I created for them. How can I relay the password safely?
1
vote
1answer
331 views

Should I mount my mac Truecrypt Volume elsewhere?

I've read in various places to not mount your truecrypt volume in the same place as your Dropbox or Sugarsync folder. I believe this only matter for Mac/Linux, but I need some verification. On a Mac, ...
1
vote
1answer
260 views

Can accounts still be logged onto if Password Caching is not enabled?

This is kind of an extension of my other question.. If you were not storing any of the passwords locally (caching disabled), would a user some how still be able to circumvent around this security ...
1
vote
2answers
91 views

How secure is a password protected file?

I have a password-protected excel file that stores other personal passwords. Obviously there have been a number of ways to crack the password. community.spiceworks.com Where do you guys store ...
1
vote
1answer
43 views

Is there a functional difference between `chage -M 99999`and `chage -M -1`on Linux?

My group just requested a security scan on some of our development systems and were informed that a number of system type accounts were insecure because the password did not have a maximum time limit. ...
1
vote
1answer
98 views

Should VPN passwords be stored in plaintext?

I know nothing about setting up a VPN, but it happens that I use a VPN add-on for Firefox, and that the VPN provider stores the user password in plaintext. Last week I installed a VPN add-on for ...