The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

6
votes
3answers
724 views

How does KeePass master key derivation increase security?

I don't understand how KeePass key derivation increases the security of the password db at all. First I'll try to explain what I understood from the key derivation described here. I'll use some pseudo ...
6
votes
3answers
4k views

What are some good ways to verify user identity for password resets?

I'm wondering how others verify the identity of users they're resetting passwords for. We currently try to speak to a manager at work, but it frustrates end users and seems like we don't trust them. ...
6
votes
2answers
2k views

Best Practices for verifying a users identity for helpdesk

I had a conversation today and someone challenged me as to why you would need to verify the identity of a user calling a service desk with anything other than their company email. Granted I know these ...
6
votes
5answers
710 views

Is sending plain passwords over SSL as part of a password update process bad?

The Web application I'm working on is 100% SSL secured (or rather TLS as it is called today...). The application recently has been audited by a security company. I mostly agree with their results but ...
6
votes
3answers
3k views

Is there a decentralized version of LastPass?

I am using LastPass for managing passwords on multiple computers. However, LastPass extension (at least the chrome version) is running some opaque binary code through Native Client, and I just feel ...
6
votes
2answers
629 views

Best practice for storing credential in data center

I have a cache warming script I want to start in response to a certain server-side event. That script needs user credentials to perform its job (read-only account). So far I have avoided automating ...
6
votes
2answers
2k views

How do I block LinkedIn from extracting data from Microsoft Exchange Server?

LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click ...
6
votes
3answers
150 views

Is google saving clear text passwords? [closed]

On your GMail account you have the option to add other POP3 accounts to automatically fetch mail from them; Google Mail Fetcher. When enabled you have to specify your username and password, and the ...
5
votes
6answers
907 views

What is the use of password encryption?

Why do we encrypt passwords? Is it to protect the password from eavesdropping? to protect the password after saving it in database? both? or for some other reason?
5
votes
6answers
215 views

Is hashing a string a secure manner for generating passwords?

I have several servers that I'm using for an online business. I have passwords for MySQL, Wordpress, SSH, FTP, Domain Provider, Paypal, and many more. I wanted to have a different, very long password ...
5
votes
3answers
243 views

Could browsers improve security of stored passwords by using setuid?

On Unix-esque systems, Mozilla Firefox stores a users' preferences, web history and stored passwords in a set of files that are readible and writeable by that particular user. This makes sense: when ...
5
votes
3answers
657 views

Trying to understand password hashing

I am trying to get a grasp of password hashing. Back in the days it seemed so simple, just MD5(password + salt) and you are done. Then md5 was proven to have collisions so people started moving to ...
5
votes
4answers
2k views

Send new password by email is bad practice but what to do if user forgot his password?

According to http://plaintextoffenders.com/post/7006690494/whats-so-wrong-about-sending-a-new-password-in it's bad so what to do ? Just ask him to set a new one ?
5
votes
2answers
232 views

How should hospitals handle the use of sharing credentials to access sensitive information, especially in critical situations?

Most organizations today hold individuals accountable for their actions on systems and networks by unique user IDs and passwords. However, imagine working in a hospital environment where access to ...
5
votes
3answers
1k views

Is GPG suitable as part of a password manager and generator?

I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
5
votes
3answers
323 views

How secure is this method to remember security questions?

So I found an interesting method of remembering those pesky security questions. Basically, the guy takes a hash of the question (IE what is your mother's maiden name?) and then appends his own ...
5
votes
2answers
401 views

How to store passwords in database so that they can be retrieved?

I'm developing a password manager web app. It's just for fun: I'm not exposing anybody's passwords. My idea was to use hashing+salting, and that's what I did for the master password. But then I ...
5
votes
2answers
241 views

Why would Keepass2 decrease the password quality after adding another character?

In Keepass2 I was typing in a password and noticed the number of bits went down. Why would this be? I was using two words and mixed them up by replacing certain letters with numbers.
5
votes
1answer
134 views

Should I change the password of my password manager regurlarly?

A password manager stores many sensitive information like passwords, pins and so on . To access this data my should use a strong password/passphrase in order to protect our data. This password is more ...
5
votes
3answers
373 views

Bash command argument security

Suppose I want to call a program that takes in a username and password to start. What are the risks with calling the program like ./prog --user 'User' --password 'Password' other than the obvious leak ...
5
votes
3answers
417 views

Are there any regulations against financial companies storing passwords in plaintext?

A bank that I use stores my password in cleartext or perhaps using reverisible encryption, which is just as bad. I know this because when you click "Forgot your password?" (or similar) link, it ...
5
votes
3answers
391 views

Are there any disadvantages to encrypting the password hash?

Is encrypting the password hash in database more secure than storing only the hash? Suppose we store encrypted SHA-256 result with AES instead of hash directly. Is this a good protection from a ...
5
votes
3answers
690 views

Reset password - should I prevent abusing it?

My assumption is that resetting password is only a security issue if an attacker gained access to the user's email. But I was wondering, what if someone simply abuses it (e.g. sends a "reset ...
5
votes
2answers
1k views

What's the best way to send and receive lots of login credentials?

I'm currently a web developer for a company with lots of different remote clients. There are lots of usernames and passwords that I need to know so that I can do my job. When I first started, I was ...
5
votes
3answers
537 views

comparing password hashing algorithms - PoC ideas?

OK so I just started working for a security consulting firm and we recommend SHA 256 (with salt) for password hashing because MD5 is too weak. I have read some brilliant answers (the list is too ...
5
votes
3answers
5k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
5
votes
2answers
483 views

Can a HSM be used to make password hashing stronger?

Say a database server has a HSM which is in use for encrypting (reversibly of course) credit card numbers. Is there any way a HSM could be used to add strength to a password hashing scheme? (Or are ...
5
votes
3answers
166 views

How do I convince others of the importance of password management?

I just got married, and my wife and I are in the midst of combining finances, etc. We set up a joint bank account and the first thing I do during the account setup phase is generate a 16-character ...
5
votes
3answers
383 views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as last pass store passwords in plain text (or hash values that can then be decrypted with the master password) in memory after a user logs into the ...
5
votes
2answers
233 views

What are the weaknesses of my authentication scheme?

So, recently, after going through some infosec training (FutureLearn's Introduction to Cyber Security, which I heavily recommend as well-explained newbie material), I decided to take the plunge and ...
5
votes
1answer
425 views

Password Managers: encrypted database vs hashing strategy

I'm considering moving to a password-management strategy based on supergenpass or something similar. This is an alternative to other password managers where instead of having a database of passwords ...
5
votes
2answers
141 views

Share root access without sharing password

I am looking for a way to share admin privileges on some hosts without providing the admin password. From his link, I was thinking of using a primary host from which every user can sudo -u user to ...
5
votes
2answers
1k views

Password History/Password policy

I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008). Where is password ...
5
votes
3answers
409 views

How can I detect users that have requested AD Administrators to reuse an expired password?

There is a trend among companies I've worked at where administrators (or helpdesk folks) give a user a courtesy extension of the old expired password... rather than forcing the user to change it. ...
5
votes
1answer
195 views

Is Django's approach to password reset tokens secure?

I am implementing a password reset feature for a web application and am contemplating adopting an implementation similar to Django. In a nutshell, Django creates a token who is comprised of a ...
5
votes
1answer
136 views

How do people keep track of their employee's privileged accounts?

I am curious how the community here keeps track of a user's accounts. For instance, in the event of an employee transitioning from the company, how does security make sure that all user accounts the ...
5
votes
3answers
1k views

How to store passwords securely in my server?

Disclaimer: I know I should use bcrypt to securely store user's passwords. Please, keep reading. I want to store credentials for several email services for each user. So if I log in with my username ...
5
votes
1answer
111 views

Is it acceptable to generate salts with a hash of the username?

Salts are supposed to be unique and randomly generated for each user when storing passwords. Is there a reason why we can't generate these salts with a cryptographic hash function using the username ...
4
votes
11answers
4k views

Definitely safest password storage scheme?

I already asked this on StackOverflow but I was suggested this would be a better suited place and I found no way to "move" the question so I have to copy it. Believe, I know, there are hundreds ...
4
votes
3answers
727 views

Which passwords to exclude from a password manager?

The benefits of a password manager are clear. Still, it seems that there might be a case to keep at least some passwords out of it: Your primary e-mail, to minimize the "single point of attack" ...
4
votes
6answers
2k views

Password sent via email upon registration

I was wondering what the pros and cons are about sending an email with the password to a user registering on a website (like wordpress.org does). They use pretty good passwords (12 characters long ...
4
votes
4answers
300 views

Using a password manager vs manual

was wondering, who still uses the traditional method of storing passwords (in envelope) in an actual physical safebox vs modern methods like password managers? what are the pros and cons of each ...
4
votes
4answers
1k views

Temporary passwords e-mailed out as plain text

Is this a security issue? Many big ecommerce platform companies use this feature. Where if you forgot your password, they e-mail you a temp password. Could someone potentially figure out the ...
4
votes
3answers
785 views

Question about a simple strong password management system

I am designing a system which requires access control via a strong password and for that purpose will use a password generation algorithm A that produces a strong password of length L >= 32. The ...
4
votes
2answers
615 views

Is there a risk in sending the username in a password reset email?

We're using a CMS that has a password reset function that works according to best practices out of the box. Passwords are stored as salted hashes Forgot Password works like this: User enters ...
4
votes
2answers
2k views

Keepass client on Android (reliable one)

I need some advice to choose a Keepass client on Android phone which can synchronize using Dropbox. As i keep all my passwords in one place, I would like to keep it safe. Is KeepassDroid client safe ...
4
votes
5answers
488 views

Am I required to hash passwords

Is one required to hash passwords by law in the US or elsewhere? If not required by law, are there legal ramifications if unhashed passwords are stolen? If not required in the US, but required in the ...
4
votes
2answers
112 views

Should password recommendations be different for devices, networks, and internet?

I started using a password manager last year and updated nearly all of my internet accounts to super-strong, unique passwords, and that isn't a problem, cause I only access them from web browsers or ...
4
votes
4answers
314 views

What is a good algorithm for memorizing a password in a few minutes?

Let's say I am following good security policy and picking passwords that are: Long Complex (passphrases where possible, otherwise random strings with special characters) Unique (completely ...
4
votes
4answers
2k views

Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?

I'm beginning to think this is not as simple as it looks, and many "accepted" answers here and in SO have alternative answers that criticize them. Here is what I have gathered so far Most of what I ...