The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

5
votes
1answer
126 views

How to implement a password change policy when user's centralized password is in a lot of places?

I would like to implement password changing in an organization but they have the domain controller/LDAP passwords "all over the place". They have the passwords in a lot of places, for example, in ...
-2
votes
1answer
181 views

How does the “emergency access” feature of LastPass work?

How does the "emergency access" feature of LastPass work? I can't find detailed information about the used cryptographic methods. How can I be sure that LastPass is not keeping a copy of my master-...
1
vote
0answers
37 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
0
votes
1answer
62 views

Securing HSM's Login Keys

I have an PKCS#11 enabled application which interacts with HSM to store TDES keys. The HSM is initialized with the Security Officer (SO) password provided by the user while the application was first ...
1
vote
1answer
146 views

Copy-and-pasting plaintext data from encrypted container

Suppose we have sensitive information stored in plaintext within a dm-crypt/VeraCrypt encrypted file and this information is copy-and-pasted by a user into a web browser after decrypting (this could ...
-1
votes
2answers
57 views

What could be a suitable solution to single factor authorization worksheet bank password circulation with no control?

Passwords for various banks are written in an excel sheet and this excel sheet is password protected. However, there is no control on circulation of this sheet, for many banks only single factor ...
3
votes
1answer
80 views

Should I use Google Accounts or my own hashed password system?

I have a relatively critical control-panel online. If someone with malicious intent were to log in, there would be a significant risk to property. I will be hosting said site on Google App Engine, ...
3
votes
2answers
271 views

How many characters should a password be? [duplicate]

I use the lastpass password manager. Lastpass can create a password from 10-100 characters. I would like to know what is the recommended value. I had a look a look at some questions like this and I ...
-2
votes
1answer
76 views

Password complexity policy and practicality [closed]

If you are a user and your company implements a password policy that says your password must have at least 8 characters, at least 1 number, at least one alphabet and at least 1 special character, ...
4
votes
2answers
83 views

Sending encrypted file and password by email

I know that a password for an encrypted file distributed by email should be sent out of band (i.e. not via email), and that there are better options for distributing information securely. But, let's ...
76
votes
14answers
8k views

How to store passwords written on a physical notebook?

Answers to the question "How safe are password managers like LastPass?" suggest that storing personal passwords on a physical notebook might be a reasonable option: I know someone who won't use ...
0
votes
1answer
98 views

LastPass website requests Master Password when creating the account

When I wanted to tryout out LastPass today, I was stunned that the webpage form for creating the account at LastPass actually requested the "Master Password", which is the same "Master Password" that ...
3
votes
1answer
79 views

Storing passwords in text files inside Ubuntu encrypted home directory

I'm interested in getting offlineimap working with my Gmail account so that I can read my emails while offline. My biggest concern with this is that it's a pretty big workaround to get the ....
5
votes
1answer
263 views

How does Nautilus store passwords on Ubuntu?

When I mount a LUKS volume, I get these options: Forget password immediately Remember password until you logout Remember forever I assume the first is the safest, and I can work on the files until ...
4
votes
3answers
2k views

Samsung SSD 850 EVO. Best way to protect personal data against thiefs

I'm wondering what is the best way to protect my personal data stored on Samsung SSD 850 EVO in Linux? I did some research and found this. To set an ATA password, simply access the BIOS, navigate ...
0
votes
2answers
125 views

Does the password manager store the passwords in memory if I lock my computer?

After I unlock my PC the password manager (any type) needs the password again to unlock it's DB containing passwords. Question: Does the password manager store the passwords/DB in memory when the PC ...
1
vote
1answer
17 views

Custom extensions to commonly used ciphers?

I wonder if there would be any value in creating a custom cipher for added security. So, I guess, for example, you have passwords stored as SHA256 hashes, if access is gained to the hashes it is ...
2
votes
2answers
147 views

Is logging a hashed password safe?

I'm creating a login module for Wildfly by extending org.jboss.security.auth.spi.DatabaseServerLoginModule and using log4j2 for debugging. I've gotten into the habit of using log4j2's Logger.entry() ...
2
votes
1answer
303 views

Does having multiple email addresses increase security?

With all the recent hacks and disclosures of email addresses that are happening recently, I was curious if its a reasonable idea to have distinct email address for every website which I have an ...
0
votes
1answer
66 views

Dealing with password vault recovery after a catastrophic failure as a home user

I had a dinner with some friends today, and I mentioned that I use 1Password combined with Dropbox to manage my password. One of them then remarked something which I actually hadn't considered: ...
27
votes
8answers
3k views

Best way to administer all my passwords

I am trying to figure out what the best solution is to store different types of passwords: Personal passwords (my personal email, my company's email, all the services I use to buy things like ...
0
votes
2answers
159 views

How can a weak root password be compromised?

I use ubuntu for personal computing. I've read an advice in many questions here to have a strong root password. I don't understand what's wrong with a weak root password. After all we have to type ...
0
votes
1answer
110 views

Practical benefit of using SqlCredential vs username/password in connection string

Currently I'm using SQL Server Authentication with the username/password as part of the connection string for my web application. As far as I know this standard procedure within the .NET world and ...
3
votes
2answers
183 views

Why is a bad idea to use a common password form?

I've heard that its a bad idea to create passwords based on a common form such as random letters appended with the start of a websites domain name. So for example a password to gmail might be ...
2
votes
3answers
170 views

I have moved to OSX; what is the best way to self manage passwords?

I am going to go ahead and say that I have to trust at some level, therefore I choosing to trust first parties (Apple/Microsoft/etc) for the sake of this question. I used to use KeePass (database ...
7
votes
1answer
285 views

Why does OWASP recommend security questions?

I was reading the OWASP Forgot Password Cheat Sheet when I stumbled upon the recommendation to use security questions. There is even a dedicated page about what information to gather. Whenever I ...
5
votes
1answer
162 views

Can a FIDO U2F device be used for symmetric encryption?

As I understand, U2F is mainly used for authentication. It uses challenge-response scheme to check if the device used for logging in is the same device which was used during registration based on ...
-1
votes
2answers
185 views

Using a password hash…as the password? [duplicate]

Ok, this is probably a really stupid idea, but I can't really see why it would be a bad idea. Maybe someone can enlighten me. Why couldn't you enter a password good hashing algorithm like bcrypt, ...
2
votes
3answers
138 views

Require Same Session ID Through All Password Reset Process Steps

Our password reset logic works as follows: user clicks "forgot my password" and enters the email address of the account email is sent with a cryptographically secure token, and the email address of ...
4
votes
2answers
139 views

Password manager's hash choices (scrypt + sha256)

Background information: Master password is a stateless password manager. It (deterministically) generates a password using a hash function, depending on your master password and the site name (also ...
13
votes
2answers
364 views

Why is OpenID considered secure when password reuse is not?

OpenID allows you to use your e.g. Google/Facebook/Microsoft account to log into a third party website. It can be used to log into Stack Exchange. Why is this considered an acceptable practice, ...
72
votes
10answers
12k views

If I enter a password on the wrong site, should I consider it compromised?

I have recently started to make use of a password manager and good password practices. I have a different password for each site that I use. If I accidentally use the password from another site when ...
3
votes
2answers
166 views

What is a Rainbow table? How many hash codes must be generated in the following scenario?

One of the technical access controls used by a company consists of entering a 5-digit PIN. When entered, the PIN number is hashed and the hash code is compared to the stored value of the hash code in ...
2
votes
2answers
177 views

Log User In Automatically After Clicking Account Activation Email

Scenario: Forum account registrations, user must click an activation email after they sign up e.g. they create an account with username, email, password, and an email is sent to the email they select. ...
6
votes
2answers
366 views

What is the best strategy to store and share pem files between team?

Our company's small tech team works with several different servers, to which we connect with pem files. What is a good way of storing the pem files so that it can be accessed by other team members if ...
5
votes
1answer
567 views

YubiKey or Google authenticator?

I'm using lastpass and I would like to implement a 2FA in my account, but I don't know which one is the most secure, a software authenticator such as google authenticator or an USB device as Yubikey. ...
2
votes
0answers
39 views

Is it a good idea to use password safes such as KeePass? [duplicate]

I'm starting to use KeePass as a password manager but I was wondering if such password safes are a good way to store passwords. Could a malware dump my RAM when the safe is open and retrieve all the ...
2
votes
0answers
109 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
2
votes
2answers
91 views

Password generation based on hash of master password + suffix?

Is this [1] a secure and reasonable way to generate a unique password for login on various websites? echo -n my_strong_master_password#website.com | sha1sum Of course, if my system is compromised ...
41
votes
10answers
7k views

What type of pattern should I use for my passwords?

I have a lot of accounts and until some time ago I used an universal password for all of them. Right now I have a different password for every account depending on the website name that I am logging ...
22
votes
4answers
2k views

Is a file shredder/secure erase necessary when you have full disk encryption turned on?

The password manager that I use has instructions to migrate to a new file format: Export existing passwords to a temporary text file Change password manager to new format Import passwords from ...
6
votes
1answer
137 views

Random Oracle in Javascript for password generation and recall

I use a lot of different sites, and my number one security issue is to never reuse a password. As it seems that every company out there like TalkTalk is as leaky as a sieve, I figure that's the right ...
1
vote
1answer
762 views

VeraCrypt: Is it possible to change the password after an encrypted container has been created?

I would like to know whether it is possible to change the password after an encrypted container has been created? The password I chose was a bit weak, and I would like to be able to modify it without ...
8
votes
3answers
324 views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of one-...
43
votes
4answers
3k views

Is using bcrypt on existing SHA1 hashes good enough when switching password implementation?

I'm working on improving a CMS where the current implementation of storing password is just sha1(password). I explained to my boss that doing it that way is incredibly insecure, and told him that we ...
7
votes
1answer
711 views

Password manager in not own device

I believe that password managers have a lot of advantages rather than remembering the passwords. So: its time to use them! But I don't want to lose the capability of using my passwords in devices I ...
6
votes
1answer
114 views

Best way to store a password for web app

I know how to store passwords for authentication of users (hash, salt, etc..), but in this case, I am developing a web app and I need to connect to other services and in order to this, I need to store ...
4
votes
1answer
108 views

A predictable password generator for offline clients

I know this sounds like pretty dumb question. Why would you use a password generator at all if it's predictable. But suppose you have a server and client - the server always requires a password and ...
1
vote
1answer
311 views

How to prevent chromeipass from auto-filling credentials?

ChromeIPass (addon for Keepass on Chrome) wants to unlock the database every time it detects credential fields, even if I don't even have an account on that site. This is the default setting (october ...
6
votes
1answer
158 views

Attacks Against Password Managers

What threat models and currently known attacks against online and/or offline Password Managers exist, that do not base on CSRF, XSS or autofill behaviour? I have found two publications from usenix....