The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

4
votes
1answer
102 views

A predictable password generator for offline clients

I know this sounds like pretty dumb question. Why would you use a password generator at all if it's predictable. But suppose you have a server and client - the server always requires a password and ...
1
vote
1answer
178 views

How to prevent chromeipass from auto-filling credentials?

ChromeIPass (addon for Keepass on Chrome) wants to unlock the database every time it detects credential fields, even if I don't even have an account on that site. This is the default setting (october ...
6
votes
1answer
149 views

Attacks Against Password Managers

What threat models and currently known attacks against online and/or offline Password Managers exist, that do not base on CSRF, XSS or autofill behaviour? I have found two publications from ...
5
votes
5answers
422 views

Secure way to save password in configuration file

I'm developing a desktop application and it required connecting to a remote MySQL database server, currently I save all information (server IP, TCP port, username, password, database name) needed for ...
6
votes
1answer
586 views

Gmail lets me use my old password

My university's email works through Gmail and I can log on to it either through my uni's website or in Gmail. I recently changed my password and I use it to log in to the schools secure WiFi, school ...
2
votes
3answers
202 views

Alternative ways to manage lots of Passwords since Lastpass was hacked & now acquired

There is a lot of debate on Reddit and other sites about whether the hack was or was not bad based on lack of salt to uncover the password hashes. Also, LogMeIn seems to have poor reputation & ...
1
vote
1answer
92 views

Is it possible to disable `ypcat passwd`

We have an old NIS setup which, at geological speed, is being replaced by a Kerberos one. In the meantime, all the (non-root) users can simply type ypcat passwd and get the hashes of all the users' ...
7
votes
4answers
426 views

Major industry password leaks using salted HMAC but without eg PBKDF2, scrypt

I'm trying to convince higher-ups on a project to use an iterative strengthening function to secure password-storage for a new system. The current proposal would store something like an HMAC of a ...
1
vote
1answer
218 views

If I have my neighbors wireless router password, can I access his data with a smartphone?

My neighbor gave me his wireless router password to use on my smartphone. Using this, can I access any of his accounts whether it's his bank account or Att/Direct TV account? I ask because I think ...
3
votes
3answers
257 views

Choosing a good password - again

There are many password-related questions in here, but I failed to find the answer to mine. I'm no expert so maybe I don't have the right keywords. Sorry for any duplicate for a possibly asked 100 ...
1
vote
1answer
160 views

best practices for storing retrievable passwords

I am trying to build a NMS (network management system) and I am required to store passwords for 3rd party databases, devices and servers that are being managed (not user passwords). These passwords ...
0
votes
2answers
89 views

password strength audits and mitigations

Reading this article about detecting bad passwords in the enterprise, made me want to ask if anyone here has attempted any audit like this. It would be an effective attack: There may be a good ...
2
votes
1answer
74 views

How to save passwords temporarily?

I work for a hosting company and are about to design a rest api for a 3rd party so they can create Active Directory user accounts. I also want this api to be async and robust enough to survice ...
3
votes
4answers
127 views

What are best practices for letting employees use a web app, but never actually know the password?

That is, is it possible with a Single-Sign-On tool to give employee "Joe Smith" access to app "SocialMedia App1" for him to do this job. But when Joe leaves the company, can I have complete confidence ...
2
votes
3answers
171 views

Prevention of user's passwords being stored as plain text in bash history

Say I want to find the password of a linux user sudoer account. Assume he uses a strong password. Assume I have physical access to the machine. I can get hold of his passwd and shadow file and ...
3
votes
1answer
98 views

Storing base passwords in Lastpass

After watching Mr Robot I finally motivated myself to setup two factor authenitication for Lastpass with Yubikey. Fastmail is the second service I've set up with my Yubikey. I changed my main ...
3
votes
1answer
125 views

How to safely reuse passwords in variation?

Remembering a lot of passwords is difficult. A lot of people use the same or a small set of passwords for everything. Of course, this is very unsafe. If such a password a password is stolen, the ...
0
votes
2answers
182 views

Chrome/ Opera continue to save & autofill passwords after installing LastPass? Good or bad? Enable/ Disable?

I moved to lastpass a few months back and imported passwords from all Browsers. Apparently, Chrome & Opera {based on Chromium} still pop-up the option to save passwords and are probably ...
7
votes
2answers
237 views

Is KeePass's method for key derivation secure?

I'm familiar with how key derivation functions can be used to slow down brute force attacks against passwords by requiring significant computational and/or memory resources to compute the final key. ...
6
votes
1answer
77 views

Should I inform a random person on the internet that their data may be compromised?

I've found a data leak in a fairly well known password manager. I'm currently in talks with the developers to get this corrected. However, in proving that this is a bug I stumbled on a users data ...
2
votes
1answer
76 views

Keeping a password safe in program config

I have a Windows service which connects to a database to poll some value in order to monitor certain activity. Of course, to use this I need a database password. I need to keep this password safe, ...
1
vote
1answer
98 views

HMAC password reset link and replay attacks

I like the look of this technique for sending password reset links: https://neosmart.net/blog/2015/using-hmac-signatures-to-avoid-database-writes/ (TLDR: don't store token in database. Send password ...
4
votes
2answers
186 views

Does adding a random character to a pseudo-randomly generated password improve entropy significantly?

I'm asking a practical question. I was taught computers are bad at generating random data. Does this mean password generators, such as the one built into Keepass, suck? If yes, then would it help for ...
32
votes
3answers
6k views

Is using the username encrypted with the password as key a good password storage scheme?

On web applications I build I don't hash the passwords. Instead I symmetrically encrypt the username using the user's password and store the result in the password field. I use RijndaelManaged on ...
1
vote
1answer
124 views

What's the secure way to write clear text password into a file?

I'm trying to insert sensible data into a file. I'm trying to write a MySQL configuration file dynamically. The file contains this: [client] password: 87sfZEKEF,5 The script that I used is owned by ...
3
votes
1answer
2k views

Correct way to generate password salts in PHP 5.3 on Linux given my constraints?

In examining our database storage of hashed passwords with salts, I note a high rate of salt collisions, i.e., there are far too many cases where two table rows have the same salt stored. One ...
84
votes
8answers
16k views

If a provider sees the last 4 characters of my password, can they see it in full?

I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
-2
votes
1answer
182 views

Online Password Storage: Is this safe and how can I implement this?

Hello there for an online Tool which offers the feature of storing passwords online I want to implement the following process: A user is generating a secure secret random key with Javascript This ...
1
vote
2answers
1k views

Do cloud-based password managers invalidate even the most secure architecture?

Can an online password vault, like Lastpass, be defended through a security assessment that demonstrates the value they provide outweigh the risks of being a high value target? A valid answer would: ...
20
votes
8answers
9k views

On two-step login forms, why is it the login name and not the password that's asked first?

There are several login forms (e.g. Google's) on the internet where you first enter your login name and then, once that's submitted, you get to enter your password. One of the advantages of this is, ...
0
votes
2answers
121 views

Store password in Public Domain using files and md5sum

Whenever I check integrity of a file using md5sum, I get a string of alphanumeric characters to compare and verify if it was downloaded correctly. Couldn't the concatenation of several of those ...
7
votes
3answers
348 views

Forgot password and revealing whether account exists

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...
0
votes
1answer
43 views

Is there any problem using empty salts with PBDKF for this purpose?

The aim is to generate a secure key for symmetric encryption. I have a master password, from which I want to generate the key for symmetric encryption, in order to encrypt other passwords. The idea ...
-2
votes
2answers
76 views

When should a password be hashed? [duplicate]

I develop a Smartphone App and have a little question: When should I hash the user passwords, on the device or upload them in plain text and hash them on the server before stored in the database?
7
votes
2answers
160 views

Do password managers leak information with swap memory?

The post How to find passwords in memory (password managers) concluded, that passwords are visible in plaintext if you login to a website. Password managers tend to store the passwords encrypted in ...
1
vote
2answers
155 views

Several hashing routines support client side work. Doesn't the hash just become a password equivalent?

Isnt Secure Remote Password Protocol (SRP) pretty much client side hashing? Argon2 the winner of the PHC also allows for client side hashing. How do these systems avoid the plaintext equivalence ...
0
votes
1answer
175 views

How secure are the passwords stored at Google Passwords? [closed]

It seems Google activated central place for storing app/website passwords which is accessible at https://passwords.google.com/ and all the remembered Chrome passwords are synched there. In what ...
4
votes
1answer
109 views

Keypass - Needle in a stack of needles

I got the idea from someone saying the best way is to hide the needle in a stack of needles, not in a haystack. I am considering writing a little app to accompany my Keepass installation. The app ...
6
votes
2answers
586 views

How to store passwords in database so that they can be retrieved?

I'm developing a password manager web app. It's just for fun: I'm not exposing anybody's passwords. My idea was to use hashing+salting, and that's what I did for the master password. But then I ...
2
votes
3answers
2k views

Centralized local hosted web based password manager

In our company we have more than 100 employers and everyone use several online applications daily. To access all of this sites they need a password which was now stored very insecurely. so I'm ...
2
votes
3answers
190 views

How does a hash which contains algorithm to choose can be secure?

I was thinking about creating my own hash+salt function, something like sha1(password + md5(login)), then I read here (part 4) that creating it's own hash+salt function is a bad idea, because if the ...
0
votes
0answers
11 views

Secure Distribution of Admin-Defined Credentials to End-Users [duplicate]

Situation: I need to safely send database credentials created by the admin to users in a secure fashion. Currently, creds have been sent to users via plain text email (which is a huge security ...
3
votes
1answer
145 views

Security implications of syncing with off-site keepass database

Is it a safe practice to sync with a Keepass database that is stored on an off-site server? Database is accessed primarily through my Android running 4.4.2. I access/sync my Keepass database by ...
5
votes
1answer
236 views

Are there any passwords managers that use a second hidden encryption drive to hide passwords?

I've heard that encryption program, Truecrypt can create a hidden encrypted drive within an encrypted drive; and even if an attacker accesses the first encrypted drive he/she cannot prove the hidden ...
13
votes
5answers
3k views

Is this idea for a password manager secure? If so, why doesn't anybody use it? [closed]

I've been thinking of a problem with usual password managers: although they do provide better security than manually using passwords, there's a central database that can get lost, get compromised, ...
3
votes
5answers
217 views

Any security risks for the login authentication and change password on the same page?

I want to ask if there are any security risks for the login authentication and change password on the same page? Normally the user needs to authenticate first in order to see the password change ...
6
votes
3answers
192 views

Is google saving clear text passwords? [closed]

On your GMail account you have the option to add other POP3 accounts to automatically fetch mail from them; Google Mail Fetcher. When enabled you have to specify your username and password, and the ...
5
votes
1answer
661 views

Is Django's approach to password reset tokens secure?

I am implementing a password reset feature for a web application and am contemplating adopting an implementation similar to Django. In a nutshell, Django creates a token who is comprised of a ...
1
vote
2answers
173 views

Is there a way to securely store unsalted passwords?

So, obviously I'm not talking about username/password pairs here, I plan to store passwords with two salts and three hashes, but what occurred to me is that if I had a table where I kept pairs: ...
6
votes
1answer
213 views

Should I change the password of my password manager regularly?

A password manager can store lots of sensitive information like passwords, pins and so on. To access this data, we should use a strong password/passphrase in order to protect our data. This password ...