The functions performed by the person or processes responsible for security of passwords on a given system.
3
votes
5answers
332 views
Am I required to hash passwords
Is one required to hash passwords by law in the US or elsewhere? If not required by law, are there legal ramifications if unhashed passwords are stolen?
If not required in the US, but required in the ...
13
votes
3answers
13k views
How difficult to crack keepass master password?
How easily could someone crack my keepass .kdbx file if that person steals the file but never obtains the Master Password?
Is this a serious threat, or would a brute force attack require massive ...
3
votes
3answers
696 views
Best password storage scheme for high entropy, unique passwords which is failure resistant [closed]
What is the best, most secure, easiest way to:
store unique, strong passwords for every service which requires authentication
make the system resistant (total loss of security is avoided, breaches ...
17
votes
4answers
1k views
What should be used as a salt?
I always hear that it is best to use salts on top of stored passwords, which then somehow gets concatenated and hashed afterwards. But I don't know what to use as a the salt. What would be a good ...
5
votes
3answers
2k views
Creating username policies and best practices
I have found a tonne of information on password policy all over the Internet and several best practices checklists. However from a username point of view I could not find much. I thought it would be ...
15
votes
4answers
629 views
If a website allows another person to get a list of the site's users passwords, how likely is it that the passwords are stored in cleartext?
We had an incident where some of our managers were given passwords for the people they supervise using a particular company website. Ostensibly it was done so the managers could check in on the users ...
2
votes
0answers
324 views
Adding an alternative password change scheme to passwd using PAM modules [closed]
I am trying to set up a PAM module that lets one add a conditional password change scheme. The intended behavior is like this:
passwd
do you want to change authentication token for ...
12
votes
2answers
161 views
Would suggesting a random passphrase during sign-up hurt overall security?
I've been looking for ways to improve security and security awareness for both internal and external clients and I happened upon the idea of generating a one-time, random "password suggestion" on the ...
8
votes
2answers
476 views
Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email
Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance
MSFT even went to far as create ADMINSDUser rights to put ...
7
votes
4answers
1k views
Is forcing users to change passwords useful?
In many places, there's a policy that force the user changing it's password once a few months. The logic here is, that even if the password have leaked somehow, it'll be abused only for a relatively ...
32
votes
11answers
3k views
What to do about websites that store plain text passwords
I recently received an email from a popular graduate job web site (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
2
votes
2answers
217 views
Company sending Master passwords in unencrypted emails
If a company has terrible security policies like letting people email password in cleartext emails, what to do if they reject all fair minded advice?
17
votes
2answers
879 views
Sending temp password when users first registered - is that good for anything?
One of our clients has sent us a list of security requirements. One of them was that registration does not including setting a password - once complete, a temp password is sent to the user, and the ...
10
votes
4answers
243 views
Can apps be trusted when requesting your credentials?
I recently bought a newsreader app for my tablet that connects to Google Reader. To do so, it required my Google account password. Isn't this effectively the same as handling the password to the ...
3
votes
1answer
247 views
How can I manage multiple sets of passwords accessible by different users? [duplicate]
Possible Duplicate:
Sharing passwords and credentials between founders and employees
I use KeePass for my personal passwords.
I would want to use it for my business, too, but the only way ...
8
votes
4answers
939 views
Passwords - any statistics on user behavior?
I'm looking for analyses of how users choose and use passwords. I'm sure there are many resources out there that analyze user passwords. For instance, I've seen many people analyze dumps of password ...
21
votes
6answers
5k views
Sharing wifi at a business - Bad Policy?
Is it safe for a small business to let customers use their wifi while waiting?
My friend is starting up a small dentistry practice (1 dentist), and I'm setting up his computers/wifi as a favor. ...
9
votes
3answers
3k views
Security of passwords remembered by Windows
Does Windows XP or Windows 7 encrypt saved passwords?
I'm assuming that the user uses local password to logon.
The user then uses his own computer to connect to server in work and sets the "remember ...
7
votes
3answers
402 views
How is “anonymous” getting ahold of all these plain-text passwords
In the last several months there have been several publicized data breaches and public website defacements done by several different hacking groups (which the media loves to group under a single ...
33
votes
7answers
2k views
“Real” Salt and “Fake” Salt
During a Q&A period at DEFCON this year, one member of the audience mentioned that we're using "fake salt" when concatenating a random value and a password before hashing. He defined "real salt" ...
6
votes
4answers
1k views
Web browser password management security [duplicate]
Possible Duplicate:
How are browser saved passwords vulnerable?
How secure are the password managers that are built into modern web browsers?
Currently I use lastpass plugin as I believed ...
19
votes
3answers
811 views
Am I wrong to believe that passwords should never be recoverable (one way hash)?
I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
20
votes
1answer
2k views
Are there more modern password hashing methods than bcrypt and scrypt?
This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt.
What I'm wondering is if there are any ...
24
votes
6answers
1k views
Is it OK to tell or give your password to an admin?
I'm working in a small company (20 employees) as a senior software engineer.
After some email problems, our newly employed IT administrator asked me for the password to our hosting company to see why ...
14
votes
3answers
404 views
Is it OK to tell your password to an admin? [duplicate]
Possible Duplicate:
From a security point : Is it OK to tell your password to an admin?
I am working in a small company (20 employees) as a senior SW engineer.
After having some email ...
8
votes
3answers
968 views
Managing website passwords for small team
I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
10
votes
2answers
2k views
Security of LastPass + YubiKey
I'm looking at password manager solutions and came across LastPass. I see they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What are ...
6
votes
2answers
471 views
Is it better to hash n*x times in sha1 or n times in sha512 on the client side?
I already know I"m going to hash the user's password n times in either sha512 or n*x in sha1 before it is sent to the server. Once at the server, I'm going to use bcrypt set to use ~1/100th of a ...
2
votes
0answers
72 views
How to secure all my passwords with Kee Pass 2 or something else? [duplicate]
Possible Duplicate:
How to securely store my passwords?
I have a lot of passwords to lots of logins across websites, SSH logins, e-mails and what not.
Is there one program that can secure ...
3
votes
6answers
446 views
Sharing passwords and credentials between founders and employees
What's the best way to share passwords and credentials from the business's various accounts in a secure manner?
For example, email doesn't work because if someone gets into one of your employee's ...
198
votes
16answers
19k views
How does changing your password every 90 days increase security?
Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
13
votes
2answers
633 views
How can we accurately measure a password entropy range?
I've given myself the task of writing code that determines the strength of a password, and really want to break out of a lot of already established ways we do that, as they're often lacking, not ...
6
votes
1answer
252 views
How to prepare for protecting identity after death?
In the context of online accounts and identities, what are some best practices to prepare for the one certainty we all face: not a one of us will get out alive.
5
votes
4answers
2k views
How to implement a “Remember me” on a mobile app?
I would like to implement a "Remember Me" time-limited auto-login type feature on a mobile application (on Android). To start the app, the user must type in a username and password. For convenience,
...
35
votes
5answers
2k views
Do security questions subvert passwords?
Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
15
votes
3answers
2k views
Password manager vs remembering passwords
I have always thought that you are not supposed to use a password manager but to keep your passwords in your head, but lately I have thought about the pros and cons of having a password manager.
Some ...
7
votes
6answers
1k views
How to securely store my passwords?
Regarding this:
Are passwords in memory?
So does someone have a good idea on how to securely store my passwords?
The: "passwords.txt" -> ctrl+c; ctrl+v a passw is not very secure.
I have passwords ...
16
votes
3answers
1k views
Are passwords in memory?
I have an encrypted HDD (dm_crypt). That's why I store my passwords in a simple text file. I usually copy/paste the passwords from it. Ok!
Q: If I open this text file then it goes into the memory. So ...
7
votes
3answers
295 views
Should I obfuscate passwords before hashing? Should I pre-hash them on the client? What about salts?
For fun, and in my spare time I'm creating a simple CMS for my own purposes (with hopes to release for wider use... later), using PHP. I'm currently working on the login scheme now, and have a few ...
12
votes
3answers
1k views
Recommended policy on password complexity
Is there any research on how how a password complexity policy can increase or decrease the quality of passwords?
If you don't have any requirements on the password then probably 90% of users will use ...
5
votes
2answers
153 views
How can IA-5(1)(b) be enforced on non-Windows systems?
I have a question posted already for this issue in Windows systems, and thought that non-Windows systems should perhaps be covered separately.
In NIST SP 800-53 Rev. 3, IA-5 is the control addressing ...
17
votes
4answers
994 views
How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?
In some environments, it is required that users change a certain number of characters every time they create a new password. This is of course to prevent passwords from being easily-guessable, ...
7
votes
2answers
351 views
How can IA-5(1)(b) be enforced on Windows systems?
Note: I've also posted a question for this issue on non-Windows systems.
In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include ...
5
votes
2answers
624 views
Password History/Password policy
I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008).
Where is password ...
5
votes
2answers
246 views
How can I detect users that have requested AD Administrators to reuse an expired password?
There is a trend among companies I've worked at where administrators (or helpdesk folks) give a user a courtesy extension of the old expired password... rather than forcing the user to change it.
...
12
votes
2answers
6k views
FOSS Enterprise Password Management Solution
Can anyone recommend a F/OSS enterprise password management solution on/around the same level as something like Cyber-Ark?
Specifically, something along the lines of a standard password manager, ...
8
votes
6answers
330 views
How can I ensure that default passwords are no longer in use?
There are two situations in which 'default' passwords get used on a network:
A new user is registered. In her registration pack, along with her new username, e-mail address and so on is her initial ...
49
votes
8answers
5k views
Can anyone provide references for implementing web application self password reset mechanisms properly?
We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address).
My problem is that I ...
3
votes
1answer
112 views
Protect file in a web site
How would you protect a password file in a web site? Is hashing the individual passwords not enough? What other steps do I need to follow?
22
votes
7answers
1k views
Is there a method of generating site-specific passwords which can be executed in my own head?
I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
