The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

0
votes
1answer
82 views

How to manage all the unlock codes for thousands of mobile devices (iPads)?

I need to manage (assign, store, notify, etc.) the unlock code for thousands of mobile devices (iPads). How to manage optimally this unlock code? Maintenance users should be able to access the unlock ...
3
votes
1answer
66 views

Sending a token with a request from one app to another

Say I have an application written in some language and framework (Python + flask, for instance), and have a great deal of the functionality requiring login, and authentication via JWT. Now I want to ...
9
votes
7answers
2k views

How to securely counter users from adding a single digit to their old password upon creating a new one? [duplicate]

Let's say that in the password policy the password history is defined to remember the last 10 passwords. I understand password history exists so that if a password is recovered from a compromised ...
5
votes
1answer
113 views

How to implement a password change policy when user's centralized password is in a lot of places?

I would like to implement password changing in an organization but they have the domain controller/LDAP passwords "all over the place". They have the passwords in a lot of places, for example, in ...
1
vote
0answers
30 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
0
votes
1answer
53 views

Securing HSM's Login Keys

I have an PKCS#11 enabled application which interacts with HSM to store TDES keys. The HSM is initialized with the Security Officer (SO) password provided by the user while the application was first ...
1
vote
1answer
90 views

Copy-and-pasting plaintext data from encrypted container

Suppose we have sensitive information stored in plaintext within a dm-crypt/VeraCrypt encrypted file and this information is copy-and-pasted by a user into a web browser after decrypting (this could ...
-1
votes
2answers
42 views

What could be a suitable solution to single factor authorization worksheet bank password circulation with no control?

Passwords for various banks are written in an excel sheet and this excel sheet is password protected. However, there is no control on circulation of this sheet, for many banks only single factor ...
3
votes
1answer
63 views

Should I use Google Accounts or my own hashed password system?

I have a relatively critical control-panel online. If someone with malicious intent were to log in, there would be a significant risk to property. I will be hosting said site on Google App Engine, ...
3
votes
2answers
165 views

How many characters should a password be? [duplicate]

I use the lastpass password manager. Lastpass can create a password from 10-100 characters. I would like to know what is the recommended value. I had a look a look at some questions like this and I ...
-2
votes
1answer
66 views

Password complexity policy and practicality [closed]

If you are a user and your company implements a password policy that says your password must have at least 8 characters, at least 1 number, at least one alphabet and at least 1 special character, ...
4
votes
2answers
80 views

Sending encrypted file and password by email

I know that a password for an encrypted file distributed by email should be sent out of band (i.e. not via email), and that there are better options for distributing information securely. But, let's ...
74
votes
14answers
7k views

How to store passwords written on a physical notebook?

Answers to the question "How safe are password managers like LastPass?" suggest that storing personal passwords on a physical notebook might be a reasonable option: I know someone who won't use ...
0
votes
1answer
90 views

LastPass website requests Master Password when creating the account

When I wanted to tryout out LastPass today, I was stunned that the webpage form for creating the account at LastPass actually requested the "Master Password", which is the same "Master Password" that ...
3
votes
1answer
74 views

Storing passwords in text files inside Ubuntu encrypted home directory

I'm interested in getting offlineimap working with my Gmail account so that I can read my emails while offline. My biggest concern with this is that it's a pretty big workaround to get the ...
5
votes
1answer
153 views

How does Nautilus store passwords on Ubuntu?

When I mount a LUKS volume, I get these options: Forget password immediately Remember password until you logout Remember forever I assume the first is the safest, and I can work on the files until ...
4
votes
3answers
900 views

Samsung SSD 850 EVO. Best way to protect personal data against thiefs

I'm wondering what is the best way to protect my personal data stored on Samsung SSD 850 EVO in Linux? I did some research and found this. To set an ATA password, simply access the BIOS, navigate ...
0
votes
2answers
111 views

Does the password manager store the passwords in memory if I lock my computer?

After I unlock my PC the password manager (any type) needs the password again to unlock it's DB containing passwords. Question: Does the password manager store the passwords/DB in memory when the PC ...
1
vote
1answer
16 views

Custom extensions to commonly used ciphers?

I wonder if there would be any value in creating a custom cipher for added security. So, I guess, for example, you have passwords stored as SHA256 hashes, if access is gained to the hashes it is ...
2
votes
2answers
136 views

Is logging a hashed password safe?

I'm creating a login module for Wildfly by extending org.jboss.security.auth.spi.DatabaseServerLoginModule and using log4j2 for debugging. I've gotten into the habit of using log4j2's Logger.entry() ...
2
votes
1answer
181 views

Does having multiple email addresses increase security?

With all the recent hacks and disclosures of email addresses that are happening recently, I was curious if its a reasonable idea to have distinct email address for every website which I have an ...
0
votes
1answer
62 views

Dealing with password vault recovery after a catastrophic failure as a home user

I had a dinner with some friends today, and I mentioned that I use 1Password combined with Dropbox to manage my password. One of them then remarked something which I actually hadn't considered: ...
27
votes
8answers
3k views

Best way to administer all my passwords

I am trying to figure out what the best solution is to store different types of passwords: Personal passwords (my personal email, my company's email, all the services I use to buy things like ...
0
votes
2answers
145 views

How can a weak root password be compromised?

I use ubuntu for personal computing. I've read an advice in many questions here to have a strong root password. I don't understand what's wrong with a weak root password. After all we have to type ...
0
votes
1answer
77 views

Practical benefit of using SqlCredential vs username/password in connection string

Currently I'm using SQL Server Authentication with the username/password as part of the connection string for my web application. As far as I know this standard procedure within the .NET world and ...
3
votes
2answers
171 views

Why is a bad idea to use a common password form?

I've heard that its a bad idea to create passwords based on a common form such as random letters appended with the start of a websites domain name. So for example a password to gmail might be ...
2
votes
3answers
161 views

I have moved to OSX; what is the best way to self manage passwords?

I am going to go ahead and say that I have to trust at some level, therefore I choosing to trust first parties (Apple/Microsoft/etc) for the sake of this question. I used to use KeePass (database ...
6
votes
1answer
235 views

Why does OWASP recommend security questions?

I was reading the OWASP Forgot Password Cheat Sheet when I stumbled upon the recommendation to use security questions. There is even a dedicated page about what information to gather. Whenever I ...
5
votes
1answer
124 views

Can a FIDO U2F device be used for symmetric encryption?

As I understand, U2F is mainly used for authentication. It uses challenge-response scheme to check if the device used for logging in is the same device which was used during registration based on ...
-1
votes
2answers
117 views

Using a password hash…as the password? [duplicate]

Ok, this is probably a really stupid idea, but I can't really see why it would be a bad idea. Maybe someone can enlighten me. Why couldn't you enter a password good hashing algorithm like bcrypt, ...
2
votes
3answers
102 views

Require Same Session ID Through All Password Reset Process Steps

Our password reset logic works as follows: user clicks "forgot my password" and enters the email address of the account email is sent with a cryptographically secure token, and the email address of ...
4
votes
2answers
129 views

Password manager's hash choices (scrypt + sha256)

Background information: Master password is a stateless password manager. It (deterministically) generates a password using a hash function, depending on your master password and the site name (also ...
13
votes
2answers
324 views

Why is OpenID considered secure when password reuse is not?

OpenID allows you to use your e.g. Google/Facebook/Microsoft account to log into a third party website. It can be used to log into Stack Exchange. Why is this considered an acceptable practice, ...
72
votes
10answers
12k views

If I enter a password on the wrong site, should I consider it compromised?

I have recently started to make use of a password manager and good password practices. I have a different password for each site that I use. If I accidentally use the password from another site when ...
3
votes
2answers
161 views

What is a Rainbow table? How many hash codes must be generated in the following scenario?

One of the technical access controls used by a company consists of entering a 5-digit PIN. When entered, the PIN number is hashed and the hash code is compared to the stored value of the hash code in ...
2
votes
2answers
107 views

Log User In Automatically After Clicking Account Activation Email

Scenario: Forum account registrations, user must click an activation email after they sign up e.g. they create an account with username, email, password, and an email is sent to the email they select. ...
6
votes
2answers
240 views

What is the best strategy to store and share pem files between team?

Our company's small tech team works with several different servers, to which we connect with pem files. What is a good way of storing the pem files so that it can be accessed by other team members if ...
5
votes
1answer
267 views

YubiKey or Google authenticator?

I'm using lastpass and I would like to implement a 2FA in my account, but I don't know which one is the most secure, a software authenticator such as google authenticator or an USB device as Yubikey. ...
2
votes
0answers
37 views

Is it a good idea to use password safes such as KeePass? [duplicate]

I'm starting to use KeePass as a password manager but I was wondering if such password safes are a good way to store passwords. Could a malware dump my RAM when the safe is open and retrieve all the ...
1
vote
0answers
105 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
2
votes
2answers
71 views

Password generation based on hash of master password + suffix?

Is this [1] a secure and reasonable way to generate a unique password for login on various websites? echo -n my_strong_master_password#website.com | sha1sum Of course, if my system is compromised ...
41
votes
10answers
7k views

What type of pattern should I use for my passwords?

I have a lot of accounts and until some time ago I used an universal password for all of them. Right now I have a different password for every account depending on the website name that I am logging ...
22
votes
4answers
2k views

Is a file shredder/secure erase necessary when you have full disk encryption turned on?

The password manager that I use has instructions to migrate to a new file format: Export existing passwords to a temporary text file Change password manager to new format Import passwords from ...
6
votes
1answer
107 views

Random Oracle in Javascript for password generation and recall

I use a lot of different sites, and my number one security issue is to never reuse a password. As it seems that every company out there like TalkTalk is as leaky as a sieve, I figure that's the right ...
1
vote
1answer
430 views

VeraCrypt: Is it possible to change the password after an encrypted container has been created?

I would like to know whether it is possible to change the password after an encrypted container has been created? The password I chose was a bit weak, and I would like to be able to modify it without ...
7
votes
2answers
223 views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of ...
42
votes
4answers
3k views

Is using bcrypt on existing SHA1 hashes good enough when switching password implementation?

I'm working on improving a CMS where the current implementation of storing password is just sha1(password). I explained to my boss that doing it that way is incredibly insecure, and told him that we ...
7
votes
1answer
693 views

Password manager in not own device

I believe that password managers have a lot of advantages rather than remembering the passwords. So: its time to use them! But I don't want to lose the capability of using my passwords in devices I ...
6
votes
1answer
96 views

Best way to store a password for web app

I know how to store passwords for authentication of users (hash, salt, etc..), but in this case, I am developing a web app and I need to connect to other services and in order to this, I need to store ...
4
votes
1answer
102 views

A predictable password generator for offline clients

I know this sounds like pretty dumb question. Why would you use a password generator at all if it's predictable. But suppose you have a server and client - the server always requires a password and ...