The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

4
votes
2answers
57 views

Should password recommendations be different for devices, networks, and internet?

I started using a password manager last year and updated nearly all of my internet accounts to super-strong, unique passwords, and that isn't a problem, cause I only access them from web browsers or ...
4
votes
1answer
231 views

RSA vs PBKDF2 for password storage (theoretical)

I know this is not the right way to store passwords, but I'm asking this from a theoretical perspective: Suppose a web site's passwords were encrypted with RSA asymmetric encryption and the private ...
4
votes
2answers
431 views

How to securely audit passwords using John the Ripper

When my clients create a password, they are shown a strength meter and I have set the requirements fairly high. However, the strength meter is essentially only useful if being attacked by a very dumb ...
4
votes
1answer
178 views

Password Managers: encrypted database vs hashing strategy

I'm considering moving to a password-management strategy based on supergenpass or something similar. This is an alternative to other password managers where instead of having a database of passwords ...
4
votes
2answers
2k views

Password management in Firefox, Chrome and Safari

I just read a couple of very interesting discussions on Chrome password security strategy. Chrome’s insane password security strategy Showing stored passwords - Tim Berners-Lee The following is how ...
4
votes
2answers
158 views

iPhone - logging out user when app goes into background

Our (financial/banking) mobile app requires user to enter username/password in order to get data via webservice calls. Once user is logged in, credentials are stored in global variable until user logs ...
4
votes
1answer
39 views

How to help users manage password portfolios based on risks of compromise?

A framework for modeling password management risks and costs, and the beginnings of a good strategy for users to help them manage passwords for their often large portfolios of accounts is outlined in ...
4
votes
3answers
121 views

What implementations are possible for dual control?

An organization requires employees to use 2 person authentication in some scenarios. That is, when accessing, say, a server, secret knowledge from 2 people should be used for authentication. No one ...
4
votes
2answers
299 views

Protecting Password Hashes with Store Procedures?

I was thinking about the recent (seemingly weekly) security breaches we've seen where millions of password hashes have been leaked and I was wondering how one might secure their site against a ...
4
votes
2answers
378 views

Where to draw the line with password managers? [duplicate]

I have just started using a password manager and was wondering what is the best practice regarding where to draw the line regarding what is stored in the software. Ideally I could store Windows/Unix ...
4
votes
2answers
121 views

Guidance for “image based” password reset challenge

Thycotic has a Password Reset Server that allows the user to select from several images. What general guidance is there for an image-based password reset challenge question? Examples may include ...
4
votes
2answers
2k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
4
votes
1answer
104 views

Is it acceptable to generate salts with a hash of the username?

Salts are supposed to be unique and randomly generated for each user when storing passwords. Is there a reason why we can't generate these salts with a cryptographic hash function using the username ...
4
votes
2answers
540 views

Would a massive blacklist of guessable passwords be useful? [duplicate]

Suggestions to make a good password all focus on creating a string that a computer (or more likely, a network of computers with multiple GPUs) can not guess. Putting a password meter for when users ...
4
votes
2answers
184 views

How can IA-5(1)(b) be enforced on non-Windows systems?

I have a question posted already for this issue in Windows systems, and thought that non-Windows systems should perhaps be covered separately. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing ...
4
votes
1answer
76 views

Does SSH authorized_keys violate the principle of “re-authenticate before password change”?

It is generally accepted that password change mechanisms should ask the user for their old password (e.g. OWASP) The reason being that an attacker who has temporary access to a user's session (be it ...
4
votes
1answer
144 views

API to change passwords?

After I learned last week that the login data of some of my accounts was leaked, I had to change my passwords for more than 30 sites. That was tedious! As luck would have it, some days later we ...
4
votes
1answer
2k views

Which cross-platform password managers support encryption using a hardware token?

I am looking for a really secure password manager and I really like the fact that Password Safe supports encryption/decryption using a Yubikey programmed in challenge-response mode. Read more here: ...
4
votes
1answer
533 views

Android for the Paranoid

In the case of a rooted phone, what are the various options to stay anonymous and keep your data secure? I've seen the guys at The Guardian Project work towards this: ...
4
votes
0answers
1k views

Hints for safe passwords that are easy to remember [duplicate]

Possible Duplicate: What is your way to create good passwords that can actually be remembered? What are good hints to create passwords that are both safe and comfortable? By comfortable I ...
3
votes
4answers
474 views

Is there any explanation (other than storing plaintext) for case-insensitive passwords?

I've come across a few organisations stating that passwords are case-insensitive. Obviously this is ridiculous, and a gigantic red flag from a security point of view. Is there any explanation for why ...
3
votes
11answers
4k views

Definitely safest password storage scheme?

I already asked this on StackOverflow but I was suggested this would be a better suited place and I found no way to "move" the question so I have to copy it. Believe, I know, there are hundreds ...
3
votes
6answers
828 views

Sharing passwords and credentials between founders and employees

What's the best way to share passwords and credentials from the business's various accounts in a secure manner? For example, email doesn't work because if someone gets into one of your employee's ...
3
votes
3answers
870 views

Best password storage scheme for high entropy, unique passwords which is failure resistant [closed]

What is the best, most secure, easiest way to: store unique, strong passwords for every service which requires authentication make the system resistant (total loss of security is avoided, breaches ...
3
votes
6answers
1k views

How can I best manage root passwords for many servers?

Lets say I have two racks with about 40 nix servers in them. I don't want to set all of the root user passwords all the same do I? If not how do you manage and keep up with all of the passwords? Is ...
3
votes
2answers
3k views

Salted hashes vs HMAC?

Most of discussions involving access credentials include references to "hashing salted passwords". Is this another way to referring to the HMAC algorithm or a totally different operation? Different or ...
3
votes
3answers
623 views

Encrypting passwords?

I am planning on creating a text file to store my passwords, so I only need to remember 1 password (at the moment, I have about 20 long/complex passwords in my mind, and am worried that I might forget ...
3
votes
6answers
1k views

Password sent via email upon registration

I was wondering what the pros and cons are about sending an email with the password to a user registering on a website (like wordpress.org does). They use pretty good passwords (12 characters long ...
3
votes
2answers
880 views

Is GPG suitable as part of a password manager and generator?

I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
3
votes
2answers
264 views

How can I store a password history to prevent reuse?

I have an application with a user database. The database stores the password using a bcrypt hash with a randomized salt. How can I implement a password history set (to prevent password reuse) in a ...
3
votes
4answers
536 views

Temporary passwords e-mailed out as plain text

Is this a security issue? Many big ecommerce platform companies use this feature. Where if you forgot your password, they e-mail you a temp password. Could someone potentially figure out the ...
3
votes
3answers
746 views

How to evaluate a password manager?

How can we quantify the trade-off between password aggregation and convenience? Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce ...
3
votes
2answers
1k views

Keepass client on Android (reliable one)

I need some advice to choose a Keepass client on Android phone which can synchronize using Dropbox. As i keep all my passwords in one place, I would like to keep it safe. Is KeepassDroid client safe ...
3
votes
5answers
424 views

Am I required to hash passwords

Is one required to hash passwords by law in the US or elsewhere? If not required by law, are there legal ramifications if unhashed passwords are stolen? If not required in the US, but required in the ...
3
votes
4answers
2k views

How does a key file increase the security of a password manager?

Password managers like KeePass often have an option to use a key file in addition to a master password. I don't understand how this increases security. (Note: KeePass also allows using a key file ...
3
votes
1answer
164 views

Why regenerating a password's hash?

I've read http://alias.io/2010/01/store-passwords-safely-with-php-and-mysql/ on how to store passwords using PHP and MySQL, the secure way. Elbert says: Use a cryptographically strong hashing ...
3
votes
3answers
121 views

Arguments that proof a hashing scheme is sufficient

We're currently working on a new server application that is going to communicate with client applications on many different systems. For this we wanted to implement a new password hashing scheme. ...
3
votes
3answers
139 views

What is a good algorithm for memorizing a password in a few minutes?

Let's say I am following good security policy and picking passwords that are: Long Complex (passphrases where possible, otherwise random strings with special characters) Unique (completely ...
3
votes
2answers
929 views

LastPass One Time Recovery Passwords--How?

The LastPass password manager stores One Time Recovery Passwords locally in each browser you use the plugin with: http://helpdesk.lastpass.com/account-recovery/ My question is, how can you have more ...
3
votes
3answers
335 views

What to do when asked for a weak password

The guys who made the security for my country's state bank are completely nuts in all senses. Their internet banking password must be between 8 and 10 characters, and contain only letters and digits. ...
3
votes
1answer
144 views

S/Key as an alternative to UNIX passwords

There is this password system called S/Key I saw on the Internet. Can someone give me a brief description about S/Key and how it works? Can S/Key be an alternative solution to the UNIX password ...
3
votes
3answers
3k views

Should I enable domain authentication in my DMZ

Traditionally at my place of work we have an internal subnet that is completely protected behind our firewall. No ports are allowed to be opened to direct connections from the public network. We also ...
3
votes
1answer
118 views

Protect file in a web site

How would you protect a password file in a web site? Is hashing the individual passwords not enough? What other steps do I need to follow?
3
votes
3answers
305 views

Is there a decentralized version of LastPass?

I am using LastPass for managing passwords on multiple computers. However, LastPass extension (at least the chrome version) is running some opaque binary code through Native Client, and I just feel ...
3
votes
2answers
159 views

How does my bank knows my second and forth chars of my password

I see that the new login mechanism used by some banks in UK and also used by visa debit authentication is to ask for three random characters from your password at login (for example second, ninth and ...
3
votes
2answers
105 views

Reference for Insecure password by email

I have come across a site that on going through the password reset sends my old password to me via email. Now we know this is insecure I see here this question and here and no doubt others. However ...
3
votes
2answers
687 views

SASL Authentication Protocol with No Cleartext passwords

As you know, LDAP supports three authentication mechanisms: anonymous, simple and SASL. The first one is only suitable for particular cases, and therefore I'm not going to talk about that. The ...
3
votes
3answers
153 views

Alternative to security questions for account recovery when email isn't an option

I'm working on a project whereby a certain level of anonymity is required for users. One of stipulations is that no email is used at all, as it makes the barrier to entry too high for people who want ...
3
votes
1answer
113 views

What are industry-standard recommended practices to protect user information in an Android app?

I am developing an Android app that will potentially handle sensitive user data, and some of it may be even considered medical data (for example user height, weight, alergies, etc). What would be the ...
3
votes
1answer
619 views

Why do some large companies still store passwords in plain text/decrypt-able format? [closed]

In the last couple of weeks I've come across two fairly large companies who seem to not have stringent password security: Tesco - they store passwords in an "encrypted" format, yet they can decrypt ...