The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

6
votes
2answers
1k views

How do I block LinkedIn from extracting data from Microsoft Exchange Server?

LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click ...
5
votes
3answers
1k views

Is KeePass a good defense against keyloggers?

KeePass is a program in which you can store your password and copy and paste them into websites. Does anyone know if it is safe against key logging software? Does key logging software pick up what you ...
-1
votes
2answers
319 views

Looking for safe, simple way to store passwords with PHP 5.2.17 [duplicate]

I've found many posts on StackOverflow and other sites using Google, but since security is always changing, and what was safe a few months ago not me anymore... I felt the need to ask on here. ...
18
votes
6answers
1k views

How to avoid scripts with hardcoded password? [duplicate]

I have some scripts on Ubuntu Linux machine that logs in to a database server to run some maintenance daily. To login to the database, I need a password and right now it is hardcoded in the script. ...
2
votes
2answers
121 views

Shared vs unique credentials for remote support vendor accounts

I have a situation where my employer has a support contract with a vendor for an application we use. This application runs on a (Windows 2008 R2) server that does not store or have access to any ...
1
vote
1answer
74 views

Password Verification Server

I posted a question here... Protecting Password Hashes with Store Procedures? ...where I asked about denying a website's database user CRUD access to the tables that store password hashes except ...
24
votes
2answers
1k views

Does versioning an encrypted file make it less secure?

Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices. The kdb file in itself would be encrypted, but ...
4
votes
2answers
299 views

Protecting Password Hashes with Store Procedures?

I was thinking about the recent (seemingly weekly) security breaches we've seen where millions of password hashes have been leaked and I was wondering how one might secure their site against a ...
24
votes
10answers
5k views

Intel How Strong is Your Password page, good advice?

I came across this Intel How Strong is Your Password? page which estimates how strong your password is. It has some advice on choosing better passwords including that you should use multiple ...
1
vote
1answer
209 views

If a hacker gets into my PC can he get to my saved windows live mail passwords?

If a hacker gets into my PC can he steal my emails passwords? I use the windows live mail client to manage my email and I have saved my passwords when it asks me to save them. I run like 9 mail ...
8
votes
4answers
605 views

Do honeywords add any real security?

This paper proposes the concept of honeywords for detecting if a password database has been compromised. As far as I understand it works like this: You save n password hashes for each user, one that ...
-3
votes
3answers
922 views

How to effectively save database password inside desktop application?

Suppose we are in the field of desktop applications which need to store their data in a database. How do I store the password for this database avoiding the most obvious mistakes, which are: 1) hard ...
0
votes
3answers
381 views

Why one time passwords using nested hash chain are not used?

I am wondering, why web sites do not use one-time passwords generated by hash chain. By that I mean that a client chooses a secret and after being salted, he applies some secure hash function F() on ...
2
votes
1answer
303 views

Why are Lengthy Password Stronger Than Complex? [duplicate]

So all my life I've been listening to people tell me to make complex password: Upper / Lower / Numeric / Symbols. Recently though I've been reading / seeing that length above all seems to make for ...
4
votes
2answers
431 views

How to securely audit passwords using John the Ripper

When my clients create a password, they are shown a strength meter and I have set the requirements fairly high. However, the strength meter is essentially only useful if being attacked by a very dumb ...
140
votes
7answers
24k views

CTRL+ALT+DEL Login - Rationale behind it?

Maybe a rather noobish question: Why is CTRL+ALT+DEL required at login on Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a ...
16
votes
2answers
409 views

Mitigating the loss of a mobile phone used for second-factor login

Take the following scenario: John is using GMail for his primary email account and LastPass as his password management system. Both of these accounts are using the Google Authenticator mobile ...
11
votes
3answers
951 views

how secure is passwordcard.org?

How secure is passwordcard.org? Assuming user follows recommended precautions: Don't read along with your finger, or the smudge will tell a thief where your password is. Keep your PasswordCard on ...
3
votes
1answer
164 views

Why regenerating a password's hash?

I've read http://alias.io/2010/01/store-passwords-safely-with-php-and-mysql/ on how to store passwords using PHP and MySQL, the secure way. Elbert says: Use a cryptographically strong hashing ...
10
votes
3answers
3k views

SSH password vs. key authentication

I've usually been told that public key authentication is strongly preferred over password authentication for SSH. However our previous admin was against public keys and only issued passwords and took ...
4
votes
2answers
378 views

Where to draw the line with password managers? [duplicate]

I have just started using a password manager and was wondering what is the best practice regarding where to draw the line regarding what is stored in the software. Ideally I could store Windows/Unix ...
3
votes
1answer
188 views

Can a user's Apple Keychain be opened on a different computer?

Apple uses a nice keychain. This is used by, for example, Google's Chrome browser. Imagine a user copies all the keychain files. Would that user be able to unlock the keychain, if they knew the ...
3
votes
4answers
536 views

Temporary passwords e-mailed out as plain text

Is this a security issue? Many big ecommerce platform companies use this feature. Where if you forgot your password, they e-mail you a temp password. Could someone potentially figure out the ...
3
votes
3answers
746 views

How to evaluate a password manager?

How can we quantify the trade-off between password aggregation and convenience? Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce ...
5
votes
3answers
671 views

Setting a limit on password recovery attempts

in a setting where one has forgotten their password, I'd like to be able to limit the attempts of entering in email addresses to something like 10. My first thought was to use a cookie. $attempts = ...
3
votes
2answers
880 views

Is GPG suitable as part of a password manager and generator?

I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
3
votes
2answers
929 views

LastPass One Time Recovery Passwords--How?

The LastPass password manager stores One Time Recovery Passwords locally in each browser you use the plugin with: http://helpdesk.lastpass.com/account-recovery/ My question is, how can you have more ...
1
vote
2answers
481 views

What is the safest way to store a password in a single file?

I've been reading about it. This article helped me a lot. But the more I read the more complicated it seems. For example: Is it better to use bcrypt, or PBKDF2, sha2 or something else for the salt? ...
1
vote
1answer
308 views

What is more secure for voice and SMS OTP: A random number or generated similar to HOTP?

Many providers are creating OTP authentication for their sign in. However I noticed that all the voice and SMS OTPs I've come across are a series of 6 digits... similar to the HOTP RFC Standard ...
3
votes
3answers
121 views

Arguments that proof a hashing scheme is sufficient

We're currently working on a new server application that is going to communicate with client applications on many different systems. For this we wanted to implement a new password hashing scheme. ...
5
votes
3answers
246 views

Logging in a user after password reset via link

Lets say password reset functionality flow is the following: User submits email address used for his account. An email is sent to that email address with a link with a password reset hash. Upon ...
2
votes
1answer
2k views

Where to store Java keystore password?

We are going to have a Java Key Store which will store certificates & public/private keys. This keystore will be protected with the password. However, access to the keystore is only from the ...
20
votes
5answers
1k views

What is the point of hashing passwords?

Even when following strict security protocols, and what the user typed is (in this hypothetical situation) completely impossible to derive, the key that the server needs to compare to is still there. ...
1
vote
4answers
1k views

Why do I need both root password and user password in Fedora Linux?

I am just now installing (for the first time) a shiny new Fedora 18. I set up a strong root password, installed the whole thing. Now it is asking me to create a user account and a password is ...
4
votes
1answer
252 views

Saved passwords (use case)

I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together. Both the data and the password are encrypted ...
-4
votes
1answer
391 views

Secure Web application Password vault/manager [duplicate]

I would like to build an open source online password vault which allows users to securely store their passwords, like Keepass or roboform, but where a user can access their passwords through a ...
1
vote
2answers
2k views

Is there a way to find out how long it takes John the Ripper to crack a particular password?

I am looking to test/demonstrate things like: when the supplied wordlist contains "abc123" and pw="abc123" then John cracks the pw in 1/2 a second... but if word list does not contain "abc123" John ...
10
votes
3answers
304 views

If multi factor authentication is enabled, how should that affect self-service password reset?

Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required) ...
9
votes
4answers
308 views

When changing a password using a WebPage, must the old password be entered on the same screen?

There is a convention to always prompt for the old password on the same page as the one where the old password is being changed as shown below. Is it acceptable from a security perspective to allow a ...
3
votes
2answers
3k views

Salted hashes vs HMAC?

Most of discussions involving access credentials include references to "hashing salted passwords". Is this another way to referring to the HMAC algorithm or a totally different operation? Different or ...
11
votes
7answers
7k views

Are services like “LastPass” less secure, as they have all my passwords protected by a single password?

If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security?
0
votes
2answers
1k views

Can my ISP know my passwords

If I am using some proxy service, proxy service provider can know my passwords to my online accounts. In which case my ISP can filter my requests and get my passwords to my online accounts? And how ...
6
votes
2answers
398 views

Best practice for storing credential in data center

I have a cache warming script I want to start in response to a certain server-side event. That script needs user credentials to perform its job (read-only account). So far I have avoided automating ...
3
votes
6answers
419 views

Methods for remembering passwords around the web

What's the least painful way to manage passwords for user accounts that you have on various sites? I see only 3 options: Password manager. Passwords can be different and strong, but the downside is ...
-1
votes
1answer
164 views

Idea feedback wanted - easy and secure web notes manager (javascript) [closed]

I have an idea for a web app that I'd like to discuss. I like it a lot but chances are that I missed some evident security hole. Or, maybe it just sucks. The idea is a web-based secure text notes ...
1
vote
2answers
150 views

passwords database - access control and/or synchronization

so, we've got a ton of passwords that several different administrators need to have access to, each with their unique password/key/user/whatever... it needs to be either centralized, or the passwords ...
2
votes
4answers
656 views

Looking for password manager in company

I was looking for solution everywhere, but maybe because lack of specialized words I can't find it. I've got a problem in finding a program, but I don't know how to describe it in one word so I'll ...
1
vote
2answers
1k views

Portable KeePass and TrueCrypt

I ran some advice on the nets: Don't reuse your passwords. Make sure all the passwords you use are different. Use a password manager. An example is "Keepass". Set the master password to something ...
0
votes
2answers
501 views

What are RealVNC 5.0 Authentication Protocol Security Limitations?

In the old version of RealVNC, the password length was limited to 8 characters which was easier to be cracked. They have now increased the password length by 255 characters, will this make Realvnc ...
1
vote
1answer
145 views

Is the date that a password was last changed useful to an attacker?

Obviously I want my application's users to change their passwords on some semi-regular basis (in fact a few of our apps must be UL-approved, and they require a system to enforce changing passwords ...