The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

0
votes
1answer
183 views

email on hosting company's site hacked?

I have a friend who's has a site hosted by a company in the states. They think that someone has gotten access to their email account because any requests for support submitted via their website ...
23
votes
6answers
10k views

Sharing wifi at a business - Bad Policy?

Is it safe for a small business to let customers use their wifi while waiting? My friend is starting up a small dentistry practice (1 dentist), and I'm setting up his computers/wifi as a favor. ...
18
votes
1answer
862 views

Does a maximum length of password mean non-hashed storage?

When a system requires a password between say 6 and 20 characters in length, does it mean the password is stored without using a hashing function, and that the mysql-field (or similar) is 20 ...
13
votes
5answers
1k views

Is there any reason to show the same message for invalid username as password?

I've seen a security question/requirement that a website login return the same error message for invalid password as for non-existent user. The idea being that this it makes it impossible to discover ...
1
vote
1answer
181 views

How does IIS persist identity credentials? Does it create any security issues?

We want to implement a feature similar to IIS in how it remembers user configured usernames and passwords. As I understand it, when you configure IIS to use a set of credentials for an app pool ...
4
votes
6answers
2k views

How can I best manage root passwords for many servers?

Lets say I have two racks with about 40 nix servers in them. I don't want to set all of the root user passwords all the same do I? If not how do you manage and keep up with all of the passwords? Is ...
1
vote
6answers
382 views

How to keep website passwords safe among employees? [duplicate]

We're a website developer agency, and most of our websites are made using in Wordpress, Joomla or Drupal as a CMS. I'm having trouble to decide how we should manage our passwords, and I'm open for ...
6
votes
1answer
446 views

Comparison between Firefox password manager and chrome password manager

As a follow up to Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?, I would like to know how firefox's password manager compares, if you have a master password and ...
3
votes
2answers
117 views

Reference for Insecure password by email

I have come across a site that on going through the password reset sends my old password to me via email. Now we know this is insecure I see here this question and here and no doubt others. However ...
2
votes
1answer
381 views

Inputting user ID's in URL?

I am currently working on functionality that will allow users to reset their passwords. My question pertains to the security in putting user ID's (a.k.a the auto increment ID's from database) in the ...
5
votes
4answers
2k views

Is 1Password more secure than an AES encrypted text file?

Are there extra measures taken by 1Password and KeePass, that make them more secure than an AES-256 encrypted text file? The database formats they use seem needlessly complex for my own purposes.
0
votes
3answers
641 views

Why do you need to login after you change a password?

I can't recall a website that after resetting my password I was automatically logged in, I had to type the password again - which seems quite silly. From a security perspective, why do websites do ...
53
votes
12answers
3k views

How do you log in from an unsecured computer?

Suppose that you are on a cybercafe, at a friend's home or at your work office, and you need to log in on a site, but you feel that the the computer can not be trusted (e.g. your friend isn't ...
2
votes
3answers
288 views

Is there any reason I shouldn't use SHA1 of salt + website name + master password for my password in websites?

I considered writing a program to do the above for websites I only intend to use for short-term use.
1
vote
3answers
931 views

Implementing 'Remember Me' for a mobile application

I am developing a mobile application wherein I need to implement the 'Remember Me' functionality. There are certain pages within the application which require you to login. What I need to do is, if ...
4
votes
2answers
369 views

Protecting Password Hashes with Store Procedures?

I was thinking about the recent (seemingly weekly) security breaches we've seen where millions of password hashes have been leaked and I was wondering how one might secure their site against a ...
2
votes
3answers
620 views

Should I take care when entering incorrect passwords in untrustworthy websites?

I have the problem that I usually use 4 passwords that I use quite often. I use the first two strong passwords for very important services (e.g. Email, PayPal,..), and the other two not so strong for ...
7
votes
2answers
403 views

Secure password management

I've recently begun using Keepass for my personal password management. I am setting it up to sync between my home PC, work PC and mobile device using dropbox. I'm going "all the way", and have ...
6
votes
2answers
992 views

Best Practices for verifying a users identity for helpdesk

I had a conversation today and someone challenged me as to why you would need to verify the identity of a user calling a service desk with anything other than their company email. Granted I know these ...
0
votes
2answers
191 views

Is my domain registrar storing my password in cleartext? [closed]

I called my domain registrar (unnamed here but not difficult to find out and a major provider) about a year ago to have them change some DNS settings. While on the phone, the customer service rep had ...
4
votes
2answers
833 views

What's the best way to send and receive lots of login credentials?

I'm currently a web developer for a company with lots of different remote clients. There are lots of usernames and passwords that I need to know so that I can do my job. When I first started, I was ...
5
votes
1answer
109 views

Is it acceptable to generate salts with a hash of the username?

Salts are supposed to be unique and randomly generated for each user when storing passwords. Is there a reason why we can't generate these salts with a cryptographic hash function using the username ...
-1
votes
2answers
473 views

Looking for safe, simple way to store passwords with PHP 5.2.17 [duplicate]

I've found many posts on StackOverflow and other sites using Google, but since security is always changing, and what was safe a few months ago not me anymore... I felt the need to ask on here. ...
10
votes
1answer
283 views

Is this cross-site password model secure?

I'm looking for a way of securely having passwords for different pages. Say I generate this password: ild23rfsfdfg%*#fArg34t34657%537@asd7oak2094^*q2k2k@Kk3j4tn453Q5# Then, for each site, I change ...
33
votes
3answers
2k views

Am I wrong to believe that passwords should never be recoverable (one way hash)?

I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
4
votes
2answers
114 views

Write & “WHERE” Clause Only?

I've had an idea kicking around in my head for a while, and am wondering if there are problems with it or it just has no value. What if a Database server (such as Postgres) had a column that could ...
4
votes
2answers
644 views

Would a massive blacklist of guessable passwords be useful? [duplicate]

Suggestions to make a good password all focus on creating a string that a computer (or more likely, a network of computers with multiple GPUs) can not guess. Putting a password meter for when users ...
1
vote
1answer
213 views

If a hacker gets into my PC can he get to my saved windows live mail passwords?

If a hacker gets into my PC can he steal my emails passwords? I use the windows live mail client to manage my email and I have saved my passwords when it asks me to save them. I run like 9 mail ...
1
vote
2answers
120 views

Mysql database password and webform password

I have a Mysql database where one table is meant to store user complaints/comments/suggestions. I am using Mysqli to connect to the database with a ...
46
votes
7answers
3k views

Is it OK to tell your password to your company's sysadmin?

I'm working in a small company (20 employees) as a senior software engineer. After having problems with my email, our newly employed IT administrator asked me to write my user password to someone in ...
1
vote
2answers
580 views

Centralize Linux System Management

We currently maintain several linux servers and are looking to employ sub contractors. However, we wan't to keep tabs on who does what on each server. Other then creating sudo accounts on every ...
9
votes
4answers
889 views

How dangerous is it to store password in plain text on sites like GitHub?

I have a few private repositories set up on GitHub for some of the projects I am working on for my company. These applications connect to databases and I have database authentication credentials ...
5
votes
3answers
332 views

Logging in a user after password reset via link

Lets say password reset functionality flow is the following: User submits email address used for his account. An email is sent to that email address with a link with a password reset hash. Upon ...
6
votes
2answers
1k views

How do I block LinkedIn from extracting data from Microsoft Exchange Server?

LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click ...
2
votes
3answers
451 views

Storing passwords on a home computer

I remember all the passwords (and variations of passwords) that I use for various sites online. The problem is not that I forget a password, but that I forget which password goes with which site. And ...
-1
votes
2answers
46 views

Secure OS for Website managing [closed]

I'm starting a new website project where I have many passwords (root,sql,wordpress, etc). I have a USB stick encrypted with TrueCrypt with a file of all my passwords. But I also want to be safe if i ...
2
votes
1answer
296 views

How to manage passwords in a multi-tenant surrounding?

I am building a multi-tenant application in a shared database model. I would like to encrypt sensitive data so that only a particular tenant could have access to his data. What is the best mode to ...
7
votes
3answers
593 views

Can cloud based password managing services be trusted?

I'm a big time user of cloud based password managing services like LastPass. But in the light of recent revelations like various government backdoors in popular sites, programs like prism, etc. I'm ...
4
votes
1answer
288 views

RSA vs PBKDF2 for password storage (theoretical)

I know this is not the right way to store passwords, but I'm asking this from a theoretical perspective: Suppose a web site's passwords were encrypted with RSA asymmetric encryption and the private ...
31
votes
6answers
3k views

How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?

In some environments, it is required that users change a certain number of characters every time they create a new password. This is of course to prevent passwords from being easily-guessable, ...
18
votes
2answers
2k views

Sending temp password when users first registered - is that good for anything?

One of our clients has sent us a list of security requirements. One of them was that registration does not including setting a password - once complete, a temp password is sent to the user, and the ...
23
votes
10answers
6k views

Intel How Strong is Your Password page, good advice?

I came across this Intel How Strong is Your Password? page which estimates how strong your password is. It has some advice on choosing better passwords including that you should use multiple ...
2
votes
2answers
149 views

Shared vs unique credentials for remote support vendor accounts

I have a situation where my employer has a support contract with a vendor for an application we use. This application runs on a (Windows 2008 R2) server that does not store or have access to any ...
1
vote
1answer
79 views

Password Verification Server

I posted a question here... Protecting Password Hashes with Store Procedures? ...where I asked about denying a website's database user CRUD access to the tables that store password hashes except ...
25
votes
2answers
1k views

Does versioning an encrypted file make it less secure?

Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices. The kdb file in itself would be encrypted, but ...
11
votes
4answers
492 views

What is the best way to hand out passwords to a widely spread diverse employee base?

I have a problem I need to solve - specifically, how to hand out passwords to people in a variety of locations, and with a wide variety of access. I've thought of some options, but there are ...
0
votes
3answers
498 views

Why one time passwords using nested hash chain are not used?

I am wondering, why web sites do not use one-time passwords generated by hash chain. By that I mean that a client chooses a secret and after being salted, he applies some secure hash function F() on ...
10
votes
6answers
2k views

Prevent denial of service attacks against slow hashing functions?

I've been thinking about bcrypt recently, and what I wonder is if there's a way to deal with the inherent (D)DoS problems with slow hashing functions. Namely, if I set up bcrypt so my machine takes ...
23
votes
3answers
1k views

Webmail host knows my password

I forgot the password to a webmail account and they didn't have an automated password recovery process. So I had to chat with their support and they asked a few verification questions then proceeded ...
4
votes
2answers
537 views

How to securely audit passwords using John the Ripper

When my clients create a password, they are shown a strength meter and I have set the requirements fairly high. However, the strength meter is essentially only useful if being attacked by a very dumb ...