The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

1
vote
4answers
103 views

How can I mitigate the risk of my wifi key being shared with strangers through apps?

Sometimes a guest asks for my wifi password, and I gladly give it to them. Sometimes that guest has a wifi sharing app, and said app shares the key with totally random strangers (I know there is some ...
1
vote
1answer
30 views

Passing a hash of a secret to a server instead of the plain text

Instead of passing an authentication token or api key in an http header to a server in the plain text, what if I calculated its hash and passed the hash? This way even if a adversary intercepts the ...
1
vote
1answer
57 views

Password manager: should key file be stored on a different device than password db file (even if master pw used)?

Does it defeat the purpose of a key file to store it in the same location as the password database? What if a master password is needed also? For example I save my .kdbx to dropbox as a means to ...
1
vote
1answer
123 views

Copy-and-pasting plaintext data from encrypted container

Suppose we have sensitive information stored in plaintext within a dm-crypt/VeraCrypt encrypted file and this information is copy-and-pasted by a user into a web browser after decrypting (this could ...
1
vote
1answer
16 views

Custom extensions to commonly used ciphers?

I wonder if there would be any value in creating a custom cipher for added security. So, I guess, for example, you have passwords stored as SHA256 hashes, if access is gained to the hashes it is ...
1
vote
1answer
272 views

How to prevent chromeipass from auto-filling credentials?

ChromeIPass (addon for Keepass on Chrome) wants to unlock the database every time it detects credential fields, even if I don't even have an account on that site. This is the default setting (october ...
1
vote
1answer
103 views

Is it possible to disable `ypcat passwd`

We have an old NIS setup which, at geological speed, is being replaced by a Kerberos one. In the meantime, all the (non-root) users can simply type ypcat passwd and get the hashes of all the users' ...
1
vote
1answer
222 views

best practices for storing retrievable passwords

I am trying to build a NMS (network management system) and I am required to store passwords for 3rd party databases, devices and servers that are being managed (not user passwords). These passwords ...
1
vote
1answer
112 views

HMAC password reset link and replay attacks

I like the look of this technique for sending password reset links: https://neosmart.net/blog/2015/using-hmac-signatures-to-avoid-database-writes/ (TLDR: don't store token in database. Send password ...
1
vote
1answer
140 views

What's the secure way to write clear text password into a file?

I'm trying to insert sensible data into a file. I'm trying to write a MySQL configuration file dynamically. The file contains this: [client] password: 87sfZEKEF,5 The script that I used is owned by ...
1
vote
2answers
1k views

Do cloud-based password managers invalidate even the most secure architecture?

Can an online password vault, like Lastpass, be defended through a security assessment that demonstrates the value they provide outweigh the risks of being a high value target? A valid answer would: ...
1
vote
2answers
182 views

Hashed master password and generated encryption key in a password manager program

I'm writing a WPF password manager application to practice programming, so far this is the scheme I intend to use to store master password and individual site password: Master password: Generate a ...
1
vote
1answer
116 views

Designing a password auth/reg system

I'm designing a user reg/auth system for a website and came up with this design for password based authentication. I'd like to know if this is reasonable. (ignoring cookies for caching credentials, ...
1
vote
1answer
408 views

How is password information stored and used on Android accounts?

How difficult would it be for someone who stole your device to gain access to the username and password information stored under the Settings -> More -> Accounts section of an Android device? ...
1
vote
1answer
107 views

Password sharing with spouse or mate (bulk-change shared passwords (via cloud service))? [closed]

I've read on New Scientist magazine that in 80% of all cases when people in a relationship share a place where they live one of the spouses knows the other's password, thus making the question I am ...
1
vote
2answers
202 views

Different password for each login - based on some variable

This might sound a silly question, but I was thinking this as and extra option(which is not required) mainly for advanced users, who want to protect their accounts even more. Lets consider that other ...
1
vote
1answer
196 views

Easy to use, simple, secure password storage method? [closed]

I wish to reduce the barrier of entry to a more secure method of generating/storing passwords. The main stumbling block for anyone I have spoken to, or tried to convince to switch to a password ...
1
vote
1answer
389 views

How many passwords should I have? [closed]

So I am upgrading my personal security. Most passwords that I use are generated by and stored in a password manager. There are a few places where I cannot use a password manager -- here, I plan to ...
1
vote
1answer
214 views

How do I migrate users with shared email addresses to an email-based forgotten password process?

I'm migrating users from custom application-level authentication security (built into the app, using username as the unique identifier) to security as a service (using ThinkTecture's Identity Server ...
1
vote
2answers
93 views

Automatic vs Manual

When it comes to technologies that directly affect information security, how do you determine when it is better to use an automatic option instead of a manual option, and vice versa? I already feel ...
1
vote
1answer
353 views

how to use hash passwords to retrieve keys from keystore or access database

How do I hash the password for a keystore? How do I then use the hash to retrieve something from keystore? Similarly, how do I use a hashed password for accessing the database? I have encrypted the ...
1
vote
3answers
237 views

Is it safe to back up passwords to the “cloud”

I have a small Truecrypt volume that contains just my password data (using Bruce Schneier's Password Safe application). I'd like an offsite, secure, backup of that Truecrypt volume. Currently, I am ...
1
vote
2answers
149 views

Is checking against password lists a good way to enforce a secure password policy and possibly detect dictionary attacks on a web-based app?

I have written a script to check a given password against a ~65 million long list of passwords collated from various lists released after hacking attempts. I am thinking about incorporating it into ...
1
vote
1answer
218 views

Is it a good idea to give users an additional password that they do not control?

It's a given that users will choose bad passwords. Why not help them out? Using a securely-random choice from a large dictionary, choose one or two words and tell the user to write them down. When ...
1
vote
1answer
277 views

Which is best DPAPI or HSM?

Can you please explain what's is the main difference between for this both DPAPI and HSM? As far as I understand both protecting the data, the way of protection is difference HSM is physical device ...
1
vote
1answer
86 views

Password Verification Server

I posted a question here... Protecting Password Hashes with Store Procedures? ...where I asked about denying a website's database user CRUD access to the tables that store password hashes except ...
1
vote
2answers
179 views

passwords database - access control and/or synchronization

so, we've got a ton of passwords that several different administrators need to have access to, each with their unique password/key/user/whatever... it needs to be either centralized, or the passwords ...
1
vote
1answer
44 views

Password manager login with compromised certificates

This morning I booted my work laptop as usual and logged in to Windows, then my password manager (Dashlane, if it makes a difference) as usual. Opening up Chrome and browsing to a site with HTTPS ...
1
vote
1answer
65 views

Powershell and cached credentials

In my environment we have powershell remoting off- I get around this using 2 hop scripts, packages(exe -no creds are stored in code- local privs only), and iwmi. I never pass creds to the endpoint, ...
1
vote
0answers
97 views

Pros and cons of this password reset scheme?

I handle the process of password resets at the institution where I work. Currently, we require users to make up questions and answers (three minimum and five maximum); the questions cannot repeat, nor ...
1
vote
1answer
35 views

sharing a password for short term access to a shared resource

I sometimes need to delegate access to a single-user/shared user website for short term administration purposes (eg. with a junior administator for programmed maintenance). I have requested multiple ...
1
vote
0answers
37 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
1
vote
0answers
108 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
1
vote
1answer
95 views

Store/retrieve users passwords on server (using password managers ?) [closed]

I am working on a project in wich a school's server will need to use students' passwords periodically to connect to another website for them. I am aware that storing users' passwords in a server ...
1
vote
1answer
53 views

password storage and user authentication [duplicate]

I was going through (https://crackstation.net/hashing-security.htm) about doing password hashing / storage the right way. I understood most of it but i still have some questions and doubts which are ...
1
vote
0answers
245 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
1
vote
0answers
77 views

sample/starter code to test for TRUSTe password requirements [closed]

Considering its a requirement for Truste certification I figure that the code to test for a password meeting Truste's password strength requirements has been written more than a few times. I was ...
1
vote
2answers
134 views

Should a password ever be presented in plain text to a user (On a website)? Is this illegal under UK Data protections act? [closed]

There is a website I use at work, external to our own. They have just presented with every employee with their plain text password and username via our internal website which requires our own logins. ...
1
vote
0answers
110 views

Store 2-legged one-time password's key securely

I have a system with a OTP authentication and I need a method to encrypt the main "secret algorithm". In my system each OTP has a pair named "solution" and it is also changing like the OTP. I need to ...
1
vote
0answers
69 views

Is there an extension/command line for OSX Chromium to save website passwords in LOCALSTORAGE instead of the system's keychain?

My situation: I want to use a portable-app implementation of Chromium running on a removable drive, so I never leave any passwords stored on the kaychain of any computer I use. Portable Chromium is ...
1
vote
0answers
32 views

Syncing service passwords during offline installations

Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of ...
1
vote
0answers
217 views

How to add user entries with password field in LDAP over HTTPS

I am new to this kind of stuff (HTTPS etc.) and pretty much confused on how to go ahead with this. An LDAP server (ApacheDS) at the back-end stores the user details. To add new users, the user ...
1
vote
2answers
162 views

Is storing passwords associated with system processes and binaries in an encoded format acceptable?

When a system must go from a powered down state to a fully operational state without any human intervention it therefore needs access to usable authentication credentials unattended. The system must ...
1
vote
0answers
307 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
0answers
182 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
1
vote
0answers
291 views

How secure is a Python Pyro daemon for storing a password?

I am using the Pyro package to create a daemon which will, upon startup, prompt for a password, and then the daemon will store that password as long as it is running. Other scripts will then make a ...
1
vote
2answers
920 views

What are RealVNC 5.0 Authentication Protocol Security Limitations?

In the old version of RealVNC, the password length was limited to 8 characters which was easier to be cracked. They have now increased the password length by 255 characters, will this make Realvnc ...
1
vote
2answers
129 views

Using PGP to encrypt emailed password reset token

Even if I am careful not to lose/forget my password for some web account, other people are not and so most sites have a password reset mechanism, often being a reset token sent to the registered email ...
1
vote
2answers
922 views

Centralize Linux System Management

We currently maintain several linux servers and are looking to employ sub contractors. However, we wan't to keep tabs on who does what on each server. Other then creating sudo accounts on every server,...
0
votes
5answers
1k views

What if I develop my own hash algorithm to create strong passwords from easy ones?

I came up with this idea but I cant figure out if it's good or bad, maybe you can help. My goal is: I want to create extremely strong passwords for my main accounts (gmail, skype and so on). I want to ...