The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

7
votes
6answers
1k views

Storing password hashes without a correlation to the user account

I read an interesting article about an alternative way to store password hashes ans was rather intrigued. A better way to store password hashes? The primary concept is having a large table full of ...
7
votes
2answers
430 views

Does the secure attention key really increase security?

Are there any statistics on whether requiring the secure attention key to be pressed on login actually increases security ? I personally don't see the point of that : if you're after credentials, ...
7
votes
1answer
769 views

Password Managers: encrypted database vs hashing strategy

I'm considering moving to a password-management strategy based on supergenpass or something similar. This is an alternative to other password managers where instead of having a database of passwords ...
7
votes
5answers
671 views

Are we concentrating too much on password complexity?

As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
7
votes
1answer
4k views

Does NIST really recommend PBKDF2 for password hashing?

We hesitated between BCrypt and PBKDF2 for password hashing. In many forums and blogs people say something like "In their Special Publication SP 800-132 NIST basically recommends using PBKDF2 for ...
7
votes
1answer
640 views

Comparison between Firefox password manager and chrome password manager

As a follow up to Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?, I would like to know how firefox's password manager compares, if you have a master password and ...
7
votes
2answers
2k views

Best Practices for verifying a users identity for helpdesk

I had a conversation today and someone challenged me as to why you would need to verify the identity of a user calling a service desk with anything other than their company email. Granted I know these ...
7
votes
2answers
149 views

Do password managers leak information with swap memory?

The post How to find passwords in memory (password managers) concluded, that passwords are visible in plaintext if you login to a website. Password managers tend to store the passwords encrypted in ...
7
votes
2answers
942 views

How can IA-5(1)(b) be enforced on Windows systems?

Note: I've also posted a question for this issue on non-Windows systems. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include ...
7
votes
2answers
2k views

Keeping user data private in a cloud environment like Google App Engine

I am writing an open-source Java application for Google App Engine (GAE). The application will let users create content that is intended to be private. I want to provide reasonable assurances that ...
7
votes
4answers
2k views

Web browser password management security [duplicate]

Possible Duplicate: How are browser saved passwords vulnerable? How secure are the password managers that are built into modern web browsers? Currently I use lastpass plugin as I believed ...
7
votes
4answers
5k views

Is there a decentralized version of LastPass?

I am using LastPass for managing passwords on multiple computers. However, LastPass extension (at least the chrome version) is running some opaque binary code through Native Client, and I just feel ...
7
votes
4answers
488 views

Decentralised password recovery

Are there good/established techniques for password/key recovery in situations without a centralised service? (Anything goes, but I'd prefer solutions that distribute the recovery information across ...
6
votes
3answers
1k views

How often should I reset my salt?

I'm thinking of implementing a salt recycling scheme on my user credentials database. The motivation behind this decision is that even if the attacker manages to get his hands on the database and has ...
6
votes
2answers
1k views

Is it better to hash n*x times in sha1 or n times in sha512 on the client side?

I already know I"m going to hash the user's password n times in either sha512 or n*x in sha1 before it is sent to the server. Once at the server, I'm going to use bcrypt set to use ~1/100th of a ...
6
votes
2answers
277 views

How should hospitals handle the use of sharing credentials to access sensitive information, especially in critical situations?

Most organizations today hold individuals accountable for their actions on systems and networks by unique user IDs and passwords. However, imagine working in a hospital environment where access to ...
6
votes
4answers
2k views

Is GPG suitable as part of a password manager and generator?

I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
6
votes
3answers
8k views

Creating username policies and best practices

I have found a tonne of information on password policy all over the Internet and several best practices checklists. However from a username point of view I could not find much. I thought it would be ...
6
votes
3answers
604 views

How do I store a swipe pattern in a password manager?

Password managers are great for when I don't want to remember dozens of logins, keys, passwords and more. But what if I have a few mobile devices lying around? They unlock with a swipe pattern but ...
6
votes
7answers
4k views

How can I best manage root passwords for many servers?

Lets say I have two racks with about 40 nix servers in them. I don't want to set all of the root user passwords all the same do I? If not how do you manage and keep up with all of the passwords? Is ...
6
votes
2answers
184 views

Is KeePass's method for key derivation secure?

I'm familiar with how key derivation functions can be used to slow down brute force attacks against passwords by requiring significant computational and/or memory resources to compute the final key. ...
6
votes
4answers
418 views

Major industry password leaks using salted HMAC but without eg PBKDF2, scrypt

I'm trying to convince higher-ups on a project to use an iterative strengthening function to secure password-storage for a new system. The current proposal would store something like an HMAC of a ...
6
votes
2answers
2k views

Keepass client on Android (reliable one)

I need some advice to choose a Keepass client on Android phone which can synchronize using Dropbox. As i keep all my passwords in one place, I would like to keep it safe. Is KeepassDroid client safe ...
6
votes
3answers
6k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
6
votes
4answers
1k views

Does LastPass' multi-device functionality significantly compromise its security?

I think LastPass is a great consumer product because it allows users to conveniently utilize unique strong passwords for each site they use it with. It does encryption locally, but the fact that I can ...
6
votes
3answers
613 views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as last pass store passwords in plain text (or hash values that can then be decrypted with the master password) in memory after a user logs into the ...
6
votes
3answers
789 views

How does KeePass master key derivation increase security?

I don't understand how KeePass key derivation increases the security of the password db at all. First I'll try to explain what I understood from the key derivation described here. I'll use some pseudo ...
6
votes
3answers
5k views

What are some good ways to verify user identity for password resets?

I'm wondering how others verify the identity of users they're resetting passwords for. We currently try to speak to a manager at work, but it frustrates end users and seems like we don't trust them. ...
6
votes
5answers
914 views

Is sending plain passwords over SSL as part of a password update process bad?

The Web application I'm working on is 100% SSL secured (or rather TLS as it is called today...). The application recently has been audited by a security company. I mostly agree with their results but ...
6
votes
1answer
194 views

Why does OWASP recommend security questions?

I was reading the OWASP Forgot Password Cheat Sheet when I stumbled upon the recommendation to use security questions. There is even a dedicated page about what information to gather. Whenever I ...
6
votes
1answer
87 views

Best way to store a password for web app

I know how to store passwords for authentication of users (hash, salt, etc..), but in this case, I am developing a web app and I need to connect to other services and in order to this, I need to store ...
6
votes
1answer
341 views

Gmail lets me use my old password

My university's email works through Gmail and I can log on to it either through my uni's website or in Gmail. I recently changed my password and I use it to log in to the schools secure WiFi, school ...
6
votes
2answers
702 views

Best practice for storing credential in data center

I have a cache warming script I want to start in response to a certain server-side event. That script needs user credentials to perform its job (read-only account). So far I have avoided automating ...
6
votes
2answers
144 views

What is the best strategy to store and share pem files between team?

Our company's small tech team works with several different servers, to which we connect with pem files. What is a good way of storing the pem files so that it can be accessed by other team members if ...
6
votes
1answer
134 views

Attacks Against Password Managers

What threat models and currently known attacks against online and/or offline Password Managers exist, that do not base on CSRF, XSS or autofill behaviour? I have found two publications from ...
6
votes
1answer
161 views

Password security when connecting to ldap with rails application

How do you store a username/password securely in a rails app when using it for many ldap searches? The connection in the app requires ldap_bind_authenticate(Net::LDAP.new, username, password) ...
6
votes
2answers
2k views

How do I block LinkedIn from extracting data from Microsoft Exchange Server?

LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click ...
6
votes
1answer
76 views

Should I inform a random person on the internet that their data may be compromised?

I've found a data leak in a fairly well known password manager. I'm currently in talks with the developers to get this corrected. However, in proving that this is a bug I stumbled on a users data ...
6
votes
3answers
192 views

How can I ensure safety when literal passwords are required

I have a case at my hands where my server needs to make automated API calls that require authentication. Hence the server will need to know the literal passwords to make those calls. What options do ...
6
votes
3answers
180 views

Is google saving clear text passwords? [closed]

On your GMail account you have the option to add other POP3 accounts to automatically fetch mail from them; Google Mail Fetcher. When enabled you have to specify your username and password, and the ...
5
votes
6answers
1k views

What is the use of password encryption?

Why do we encrypt passwords? Is it to protect the password from eavesdropping? to protect the password after saving it in database? both? or for some other reason?
5
votes
6answers
242 views

Is hashing a string a secure manner for generating passwords?

I have several servers that I'm using for an online business. I have passwords for MySQL, Wordpress, SSH, FTP, Domain Provider, Paypal, and many more. I wanted to have a different, very long password ...
5
votes
3answers
250 views

Could browsers improve security of stored passwords by using setuid?

On Unix-esque systems, Mozilla Firefox stores a users' preferences, web history and stored passwords in a set of files that are readible and writeable by that particular user. This makes sense: when ...
5
votes
3answers
719 views

Trying to understand password hashing

I am trying to get a grasp of password hashing. Back in the days it seemed so simple, just MD5(password + salt) and you are done. Then md5 was proven to have collisions so people started moving to ...
5
votes
4answers
3k views

Send new password by email is bad practice but what to do if user forgot his password?

According to http://plaintextoffenders.com/post/7006690494/whats-so-wrong-about-sending-a-new-password-in it's bad so what to do ? Just ask him to set a new one ?
5
votes
3answers
370 views

How secure is this method to remember security questions?

So I found an interesting method of remembering those pesky security questions. Basically, the guy takes a hash of the question (IE what is your mother's maiden name?) and then appends his own ...
5
votes
4answers
2k views

Temporary passwords e-mailed out as plain text

Is this a security issue? Many big ecommerce platform companies use this feature. Where if you forgot your password, they e-mail you a temp password. Could someone potentially figure out the ...
5
votes
3answers
902 views

Reset password - should I prevent abusing it?

My assumption is that resetting password is only a security issue if an attacker gained access to the user's email. But I was wondering, what if someone simply abuses it (e.g. sends a "reset ...
5
votes
2answers
551 views

How to store passwords in database so that they can be retrieved?

I'm developing a password manager web app. It's just for fun: I'm not exposing anybody's passwords. My idea was to use hashing+salting, and that's what I did for the master password. But then I ...
5
votes
2answers
268 views

Why would Keepass2 decrease the password quality after adding another character?

In Keepass2 I was typing in a password and noticed the number of bits went down. Why would this be? I was using two words and mixed them up by replacing certain letters with numbers.