The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

5
votes
2answers
357 views

Can a HSM be used to make password hashing stronger?

Say a database server has a HSM which is in use for encrypting (reversibly of course) credit card numbers. Is there any way a HSM could be used to add strength to a password hashing scheme? (Or are ...
5
votes
5answers
267 views

Is sending plain passwords over SSL as part of a password update process bad?

The Web application I'm working on is 100% SSL secured (or rather TLS as it is called today...). The application recently has been audited by a security company. I mostly agree with their results but ...
5
votes
3answers
323 views

Logging in a user after password reset via link

Lets say password reset functionality flow is the following: User submits email address used for his account. An email is sent to that email address with a link with a password reset hash. Upon ...
5
votes
2answers
915 views

Password History/Password policy

I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008). Where is password ...
5
votes
2answers
317 views

How can I detect users that have requested AD Administrators to reuse an expired password?

There is a trend among companies I've worked at where administrators (or helpdesk folks) give a user a courtesy extension of the old expired password... rather than forcing the user to change it. ...
5
votes
3answers
3k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
5
votes
1answer
108 views

Is it acceptable to generate salts with a hash of the username?

Salts are supposed to be unique and randomly generated for each user when storing passwords. Is there a reason why we can't generate these salts with a cryptographic hash function using the username ...
5
votes
1answer
1k views

Practices for storing username/password in Web applications

I have read the following question: Storing password in Java application but I don't find the answers useful for my case. So here is my question somehow related to that. I have a Java Web application ...
5
votes
0answers
168 views

Decentralised password recovery

Are there good/established techniques for password/key recovery in situations without a centralised service? (Anything goes, but I'd prefer solutions that distribute the recovery information across ...
4
votes
11answers
4k views

Definitely safest password storage scheme?

I already asked this on StackOverflow but I was suggested this would be a better suited place and I found no way to "move" the question so I have to copy it. Believe, I know, there are hundreds ...
4
votes
2answers
4k views

Salted hashes vs HMAC?

Most of discussions involving access credentials include references to "hashing salted passwords". Is this another way to referring to the HMAC algorithm or a totally different operation? Different or ...
4
votes
6answers
2k views

How can I best manage root passwords for many servers?

Lets say I have two racks with about 40 nix servers in them. I don't want to set all of the root user passwords all the same do I? If not how do you manage and keep up with all of the passwords? Is ...
4
votes
2answers
1k views

Is GPG suitable as part of a password manager and generator?

I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
4
votes
6answers
1k views

Password sent via email upon registration

I was wondering what the pros and cons are about sending an email with the password to a user registering on a website (like wordpress.org does). They use pretty good passwords (12 characters long ...
4
votes
3answers
708 views

Question about a simple strong password management system

I am designing a system which requires access control via a strong password and for that purpose will use a password generation algorithm A that produces a strong password of length L >= 32. The ...
4
votes
2answers
434 views

Is there a risk in sending the username in a password reset email?

We're using a CMS that has a password reset function that works according to best practices out of the box. Passwords are stored as salted hashes Forgot Password works like this: User enters ...
4
votes
3answers
861 views

How to evaluate a password manager?

How can we quantify the trade-off between password aggregation and convenience? Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce ...
4
votes
4answers
1k views

Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?

I'm beginning to think this is not as simple as it looks, and many "accepted" answers here and in SO have alternative answers that criticize them. Here is what I have gathered so far Most of what I ...
4
votes
2answers
2k views

Keepass client on Android (reliable one)

I need some advice to choose a Keepass client on Android phone which can synchronize using Dropbox. As i keep all my passwords in one place, I would like to keep it safe. Is KeepassDroid client safe ...
4
votes
2answers
806 views

What's the best way to send and receive lots of login credentials?

I'm currently a web developer for a company with lots of different remote clients. There are lots of usernames and passwords that I need to know so that I can do my job. When I first started, I was ...
4
votes
5answers
431 views

How to memorise multiple xkcd-style passwords for particular services?

I could use a password manager, but I don't like relying on another entity than myself to store my passwords, and it would screw me over if I find myself on the internet in a new location without the ...
4
votes
1answer
284 views

Saved passwords (use case)

I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together. Both the data and the password are encrypted ...
4
votes
3answers
403 views

Reset password - should I prevent abusing it?

My assumption is that resetting password is only a security issue if an attacker gained access to the user's email. But I was wondering, what if someone simply abuses it (e.g. sends a "reset ...
4
votes
2answers
65 views

Should password recommendations be different for devices, networks, and internet?

I started using a password manager last year and updated nearly all of my internet accounts to super-strong, unique passwords, and that isn't a problem, cause I only access them from web browsers or ...
4
votes
1answer
278 views

RSA vs PBKDF2 for password storage (theoretical)

I know this is not the right way to store passwords, but I'm asking this from a theoretical perspective: Suppose a web site's passwords were encrypted with RSA asymmetric encryption and the private ...
4
votes
2answers
524 views

How to securely audit passwords using John the Ripper

When my clients create a password, they are shown a strength meter and I have set the requirements fairly high. However, the strength meter is essentially only useful if being attacked by a very dumb ...
4
votes
1answer
257 views

Password Managers: encrypted database vs hashing strategy

I'm considering moving to a password-management strategy based on supergenpass or something similar. This is an alternative to other password managers where instead of having a database of passwords ...
4
votes
3answers
214 views

Alternative to security questions for account recovery when email isn't an option

I'm working on a project whereby a certain level of anonymity is required for users. One of stipulations is that no email is used at all, as it makes the barrier to entry too high for people who want ...
4
votes
2answers
2k views

Password management in Firefox, Chrome and Safari

I just read a couple of very interesting discussions on Chrome password security strategy. Chrome’s insane password security strategy Showing stored passwords - Tim Berners-Lee The following is how ...
4
votes
2answers
176 views

iPhone - logging out user when app goes into background

Our (financial/banking) mobile app requires user to enter username/password in order to get data via webservice calls. Once user is logged in, credentials are stored in global variable until user logs ...
4
votes
1answer
71 views

How to help users manage password portfolios based on risks of compromise?

A framework for modeling password management risks and costs, and the beginnings of a good strategy for users to help them manage passwords for their often large portfolios of accounts is outlined in ...
4
votes
3answers
153 views

What implementations are possible for dual control?

An organization requires employees to use 2 person authentication in some scenarios. That is, when accessing, say, a server, secret knowledge from 2 people should be used for authentication. No one ...
4
votes
2answers
350 views

Protecting Password Hashes with Store Procedures?

I was thinking about the recent (seemingly weekly) security breaches we've seen where millions of password hashes have been leaked and I was wondering how one might secure their site against a ...
4
votes
2answers
394 views

Where to draw the line with password managers? [duplicate]

I have just started using a password manager and was wondering what is the best practice regarding where to draw the line regarding what is stored in the software. Ideally I could store Windows/Unix ...
4
votes
1answer
119 views

Does SSH authorized_keys violate the principle of “re-authenticate before password change”?

It is generally accepted that password change mechanisms should ask the user for their old password (e.g. OWASP) The reason being that an attacker who has temporary access to a user's session (be it ...
4
votes
1answer
183 views

API to change passwords?

After I learned last week that the login data of some of my accounts was leaked, I had to change my passwords for more than 30 sites. That was tedious! As luck would have it, some days later we ...
4
votes
2answers
137 views

Guidance for “image based” password reset challenge

Thycotic has a Password Reset Server that allows the user to select from several images. What general guidance is there for an image-based password reset challenge question? Examples may include ...
4
votes
2answers
113 views

Write & “WHERE” Clause Only?

I've had an idea kicking around in my head for a while, and am wondering if there are problems with it or it just has no value. What if a Database server (such as Postgres) had a column that could ...
4
votes
2answers
630 views

Would a massive blacklist of guessable passwords be useful? [duplicate]

Suggestions to make a good password all focus on creating a string that a computer (or more likely, a network of computers with multiple GPUs) can not guess. Putting a password meter for when users ...
4
votes
2answers
190 views

How can IA-5(1)(b) be enforced on non-Windows systems?

I have a question posted already for this issue in Windows systems, and thought that non-Windows systems should perhaps be covered separately. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing ...
4
votes
1answer
100 views

How to store a group password for multi-user server-client web-application?

In a web application, accessed by browser via https, users need to be able to access data stored on a server in a MySQL database. Data has to be encrypted for several groups of users, where one group ...
4
votes
1answer
2k views

Which cross-platform password managers support encryption using a hardware token?

I am looking for a really secure password manager and I really like the fact that Password Safe supports encryption/decryption using a Yubikey programmed in challenge-response mode. Read more here: ...
4
votes
1answer
554 views

Android for the Paranoid

In the case of a rooted phone, what are the various options to stay anonymous and keep your data secure? I've seen the guys at The Guardian Project work towards this: ...
4
votes
0answers
1k views

Hints for safe passwords that are easy to remember [duplicate]

Possible Duplicate: What is your way to create good passwords that can actually be remembered? What are good hints to create passwords that are both safe and comfortable? By comfortable I ...
3
votes
4answers
502 views

Is there any explanation (other than storing plaintext) for case-insensitive passwords?

I've come across a few organisations stating that passwords are case-insensitive. Obviously this is ridiculous, and a gigantic red flag from a security point of view. Is there any explanation for why ...
3
votes
7answers
1k views

Sharing passwords and credentials between founders and employees

What's the best way to share passwords and credentials from the business's various accounts in a secure manner? For example, email doesn't work because if someone gets into one of your employee's ...
3
votes
3answers
890 views

Best password storage scheme for high entropy, unique passwords which is failure resistant [closed]

What is the best, most secure, easiest way to: store unique, strong passwords for every service which requires authentication make the system resistant (total loss of security is avoided, breaches ...
3
votes
1answer
240 views

Perfectly Robust Hashing Scheme, or Completely Over-Engineered?

This is going to get long, so prepare. Basis of the question is, Do all these steps improve security, or am I completely overthinking the problem? Are my assumptions/thought process valid? We all ...
3
votes
3answers
670 views

Encrypting passwords?

I am planning on creating a text file to store my passwords, so I only need to remember 1 password (at the moment, I have about 20 long/complex passwords in my mind, and am worried that I might forget ...
3
votes
4answers
518 views

Should user's password strength be assessed at client or at server side?

Now most of big website like Google mail, Twitter, Facebook have a feature that assesses password strength (check number of digit, alphabet, special characters, or check the similarity over already ...