The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

0
votes
1answer
82 views

How to manage all the unlock codes for thousands of mobile devices (iPads)?

I need to manage (assign, store, notify, etc.) the unlock code for thousands of mobile devices (iPads). How to manage optimally this unlock code? Maintenance users should be able to access the unlock ...
0
votes
2answers
121 views

Store password in Public Domain using files and md5sum

Whenever I check integrity of a file using md5sum, I get a string of alphanumeric characters to compare and verify if it was downloaded correctly. Couldn't the concatenation of several of those ...
0
votes
1answer
117 views

Why doesn't SSH use a better algorithm for encrypting keys?

According to the answers in this question, SSH still uses a very basic algorithm for encrypting keys with a passphrase, which can be attacked at a rate of billions tries per second using dedicated ...
0
votes
2answers
78 views

What is the solution for handling exceptions in password hashing schemes?

There is a technique called password hashing that describes creating unique passwords based on a unique master key and a static and arbitrary hash value. Using this technique, the user only has to ...
0
votes
1answer
176 views

Can any App Store app access all of my passwords?

Whilst researching another question, I've noticed that on OS X 10.9.4 there are many instances of Library/Keychains/login.keychain from ~ within the Data folder of what looks like apps from Apple App ...
0
votes
2answers
104 views

Enforcing password change

When a site gets hacked, or otherwise, the web site forces you to change your password. This is done by simply telling you to change your password, not enforcing it. Why do they do that? For ...
0
votes
1answer
210 views

The Problem with Changing All Passwords for HeartBleed [duplicate]

One thing that's been bugging me in relation to the discovery of the Heartbleed OpenSSL flaw is the recommendation that everyone should run to their computers in a panic and change all of their ...
0
votes
1answer
147 views

Should I log wrong passwords? [duplicate]

I have a public-facing web application where anyone can register an account. The passwords I store are salted and hashed. When someone tries to overtake the account of someone else through guessing ...
0
votes
2answers
386 views

Encryption method and other security concerns for a simple password manager [closed]

I thought I would learn a little bit of cryptography programming by making myself a simple password manager program that I can potentially even use to keep track of my passwords. The idea is that my ...
0
votes
1answer
25 views

SVN Password Requirements [closed]

Is there a general rule of thumb when it comes to administrating SVN user passwords, should it be necessary that they must meet complexity requirements?
0
votes
1answer
75 views

Can anyone help me build a combo file suitable for my problem? [closed]

I have a router model C1000A company: CenturyLink Actiontec I bought it through eBay, my problem is that I can not connect to the Settings page because I do not have the admin password (the password ...
0
votes
1answer
55 views

Securing HSM's Login Keys

I have an PKCS#11 enabled application which interacts with HSM to store TDES keys. The HSM is initialized with the Security Officer (SO) password provided by the user while the application was first ...
0
votes
1answer
62 views

Dealing with password vault recovery after a catastrophic failure as a home user

I had a dinner with some friends today, and I mentioned that I use 1Password combined with Dropbox to manage my password. One of them then remarked something which I actually hadn't considered: ...
0
votes
1answer
78 views

Practical benefit of using SqlCredential vs username/password in connection string

Currently I'm using SQL Server Authentication with the username/password as part of the connection string for my web application. As far as I know this standard procedure within the .NET world and ...
0
votes
2answers
186 views

Chrome/ Opera continue to save & autofill passwords after installing LastPass? Good or bad? Enable/ Disable?

I moved to lastpass a few months back and imported passwords from all Browsers. Apparently, Chrome & Opera {based on Chromium} still pop-up the option to save passwords and are probably ...
0
votes
2answers
174 views

Hashed master password and generated encryption key in a password manager program

I'm writing a WPF password manager application to practice programming, so far this is the scheme I intend to use to store master password and individual site password: Master password: Generate a ...
0
votes
1answer
78 views

Is secure tokens send by email secure? [duplicate]

I'm struggling with the reset password function of a web app, the way i'm inclined to do it is by sending a token based url to the email of the user and than the user can access and reset its ...
0
votes
1answer
65 views

MD5 before PBKDF2 on legacy software

I am mantaining a legacy software that uses MD5 in the following way: The client asks for a 16 byte salt when authenticating an account. The server generates a 16 byte salt, links it to the account ...
0
votes
2answers
75 views

Using bcrypt in chrome extension [closed]

I am developing a chrome extension for this non profit. Im also working on the server side component as well. Im not a full time developer so most of my knowledge has simply come from years of ...
0
votes
1answer
181 views

Easy to use, simple, secure password storage method? [closed]

I wish to reduce the barrier of entry to a more secure method of generating/storing passwords. The main stumbling block for anyone I have spoken to, or tried to convince to switch to a password ...
0
votes
1answer
148 views

LastPass Bootstrap on New Android Phone [closed]

I've been using LastPass to manage all my passwords, including the password for Google account. The thing is, on a new Android Phone, in order to sign in (for Gmail, Play store, etc), I need the ...
0
votes
1answer
356 views

How many passwords should I have? [closed]

So I am upgrading my personal security. Most passwords that I use are generated by and stored in a password manager. There are a few places where I cannot use a password manager -- here, I plan to ...
0
votes
1answer
92 views

Which is the best way to secure login password and safeguard user data? (even DBAs couldn't connect data to users)

Lets say that I'm building an website and a app which saves the users' secrets. The user logs in and can save into the app his deepest secrets. I'm worried about two things: - Should I save the ...
0
votes
1answer
133 views

Could Mental Cryptography(?) be useful to ordinary users?

I recently read about 'Mental cryptography' or 'Metal hash' process from this post: Mental cryptography and good passwords (via this message board ...
0
votes
2answers
161 views

How to decide whether to password protect key files in addition to full disk encryption

It is customary to protect certain critical files with a password. For example: PGP keys, VPN keys, password managers, etc. The practice dates back to before full disk encryption being common. These ...
0
votes
2answers
217 views

Asymmetric Data Storage+ No-Hash Password Storage?

Edit: removed a part of the original question; I'll break it down in a different post. I am following @Polynomial's answer to store information in a database. Here are my requirements: Only the ...
0
votes
1answer
329 views

are there serious weaknesses in this free password management system?

I want to protect my passwords for free and store them on a machine that might get stolen but have the passwords very securely backed-up in the cloud, again for free, and minimize the total lifetime ...
0
votes
1answer
155 views

Multiple user encryption-key store

Let's say I have an application that accesses an encrypted datastore, and I want the admins to be able to unlock the datastore upon application startup (and then the application will have access to ...
0
votes
2answers
819 views

Security of cloud-based password manager (Dashlane, LastPass) vs. federated login (OpenID, Google, Yahoo, Microsoft, Facebook)

Many websites offer the option to log in with your existing Google or Facebook account (among others). For a long time I've resisted doing this because I use a password manager and I figured it was ...
0
votes
1answer
387 views

How do you secure service account password on enterprise windows enviroment?

I'm suppose to have a large environment ( 500+ servers ) all Windows based joined to Active Directory domain. Some domain accounts are used for application\middleware authentication that needs high ...
0
votes
1answer
208 views

email on hosting company's site hacked?

I have a friend who's has a site hosted by a company in the states. They think that someone has gotten access to their email account because any requests for support submitted via their website ...
0
votes
0answers
15 views

Scheduled tasks that need domain admin privileges

I have a Windows 10 box that runs a whole bunch of Powershell scripts, some of those contain cmdlets that need to be run against a DC, or mail server, for eg. Get-ADComputer, and ...
0
votes
0answers
37 views

Does an account with a !! /etc/shadow entry have to still expire?

Currently where I work, our password policy is set at 84 days. This is set in our login.defs on all of our Linux machines. We have policies that are set around PCI DSS 3.1 and the like, this goes for ...
0
votes
1answer
39 views

Storing and reading user's credentials on their machine

I am writing a (third-party) client for a game, and one feature that I would like this client to have is the ability to automatically log into the game using credentials previously entered. The ...
0
votes
1answer
52 views

Inadvertent clickjacking on page causes LastPass login dialog to appear.

I like the idea of password managers but have become leery of the way they interact with browsers (especially given the recent "LostPass" exploit). Today I found that viewing a certain page with ...
0
votes
0answers
18 views

Concealing passwords — ODBC access with service accounts

On a UNIX system (with ssh access), a Jenkins instance is installed which is being used as a scheduler for some builds. As part of the process, the user which instanced the job is mapped to a service ...
0
votes
1answer
176 views

How secure are the passwords stored at Google Passwords? [closed]

It seems Google activated central place for storing app/website passwords which is accessible at https://passwords.google.com/ and all the remembered Chrome passwords are synched there. In what ...
0
votes
0answers
11 views

Secure Distribution of Admin-Defined Credentials to End-Users [duplicate]

Situation: I need to safely send database credentials created by the admin to users in a secure fashion. Currently, creds have been sent to users via plain text email (which is a huge security ...
0
votes
0answers
74 views

Web app crypto scheme

For learning purposes I am trying to build a web application (Symfony2, PHP) that allows users to post content and have their own password vault, everything encrypted. Since I want to users to be able ...
0
votes
1answer
63 views

Does Linux and Mac OSX have built-in Credential/Password Managers with API access? [closed]

Does Linux and Mac OSX have built-in Credential/Password Managers with API access like Windows has with its CredMan (CredWrite, etc). It would be preferrable if they could be used without the need to ...
0
votes
1answer
166 views

Are there best practices concerning application account credentials?

I am looking for best practices concerning application account credentials. For example, suppose I got a corporate application which uses an Active Directory application user account to communicate ...
0
votes
0answers
103 views

Secure password transfer from stdout to another window

I am currently trying to build a little, secure password manager. As of now, I've implemented the encryption. Each website has its own file and each file has a number of fields (Most commonly username ...
0
votes
0answers
102 views

What do I do when a ISP stores passwords as plaintext

I am living in a student housing in UK. Today, I was suddenly asked to put in my log in credentials for the internet service and because I forgot the credentials, I went to find my password section. ...
0
votes
2answers
364 views

Automated software hackers use to try passwords

Because of the eBay hacking, I had to go and look for other accounts that I have used the same password to change the passwords on those site as well. (I know that it's very bad to have same passwords ...
0
votes
2answers
197 views

Password management [duplicate]

I am work in small company. I am Java Developer and Sysadmin of remote servers. I have problem with store password from several servers. How to best way to manage passwords in company?
0
votes
0answers
765 views

Why do you need to login after you change a password? [duplicate]

I can't recall a website that after resetting my password I was automatically logged in, I had to type the password again - which seems quite silly. From a security perspective, why do websites do ...
0
votes
0answers
242 views

What is the most secure way to recover password online? [duplicate]

Possible Duplicate: Can anyone provide references for implementing web application self password reset mechanisms properly? I have website which sends generated password to any person who ...
0
votes
1answer
1k views

What's the idea behind requiring users to change password periodically? [duplicate]

Possible Duplicate: How does changing your password every 90 days increase security? Some sites require users to change their password every x days. For example, at least 3 online banking ...
0
votes
2answers
111 views

Does the password manager store the passwords in memory if I lock my computer?

After I unlock my PC the password manager (any type) needs the password again to unlock it's DB containing passwords. Question: Does the password manager store the passwords/DB in memory when the PC ...
-1
votes
4answers
356 views

How do big companies and wealthy people secure their information? And how can I secure mine?

I've recently had some success and traffic increase with an online business I own and due to that someone has hacked my domain email and twitter accounts. My bank password is the same and I just ...