The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

5
votes
3answers
917 views

How often should I reset my salt?

I'm thinking of implementing a salt recycling scheme on my user credentials database. The motivation behind this decision is that even if the attacker manages to get his hands on the database and has ...
-1
votes
4answers
254 views

How do big companies and wealthy people secure their information? And how can I secure mine?

I've recently had some success and traffic increase with an online business I own and due to that someone has hacked my domain email and twitter accounts. My bank password is the same and I just ...
11
votes
6answers
7k views

Are services like “LastPass” less secure, as they have all my passwords protected by a single password?

If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security?
3
votes
1answer
170 views

Webpage sent me my password in clear text can it be secure? [duplicate]

I registered for a webpage years ago and have been using it without issues, today I made some changes to my account and they sent me an email containing my username and password in clear text. I ...
1
vote
2answers
116 views

Is checking against password lists a good way to enforce a secure password policy and possibly detect dictionary attacks on a web-based app?

I have written a script to check a given password against a ~65 million long list of passwords collated from various lists released after hacking attempts. I am thinking about incorporating it into ...
2
votes
3answers
160 views

Why is it not standard practice to run password-based KDF's client-side?

In most protocols I have encountered in which a passphrase is used for authentication it is stored not in plaintext, but a PBKDF digest of it instead. This is obviously good. However what does not ...
2
votes
5answers
291 views

Password Recovery - what if user can't complete 2nd step?

I'm thinking out my password recovery logic for an ecommerce system. Some backround: Passwords are stored using bcrypt, password recovery involves the standard reset link, which then can be used to ...
4
votes
3answers
245 views

Alternative to security questions for account recovery when email isn't an option

I'm working on a project whereby a certain level of anonymity is required for users. One of stipulations is that no email is used at all, as it makes the barrier to entry too high for people who want ...
0
votes
2answers
94 views

Logging in after password reset email sent (but not acted on)

Should a user be allowed to request a password reset email and then log in (i.e. disregarding the reset email and using their existing password) or should the current account be locked until the ...
3
votes
2answers
194 views

How does my bank knows my second and forth chars of my password [duplicate]

I see that the new login mechanism used by some banks in UK and also used by visa debit authentication is to ask for three random characters from your password at login (for example second, ninth and ...
18
votes
6answers
2k views

How to avoid scripts with hardcoded password? [duplicate]

I have some scripts on Ubuntu Linux machine that logs in to a database server to run some maintenance daily. To login to the database, I need a password and right now it is hardcoded in the script. ...
-3
votes
1answer
298 views

Why don't we do dual password instead of forgot password?

You can see a link Forgot Password? nearby almost all login form. As I mentioned in question, Since passwords are completely protected from outside access unless owner reveal, I come up with this ...
1
vote
1answer
146 views

Is it a good idea to give users an additional password that they do not control?

It's a given that users will choose bad passwords. Why not help them out? Using a securely-random choice from a large dictionary, choose one or two words and tell the user to write them down. When ...
16
votes
5answers
1k views

Storing account credentials for spouse/loved one?

Just in case something ever "happens" to me... What are some best practices for sharing various account information (bank, email, etc.) with spouses/loved ones in a way that is safe but also not ...
0
votes
1answer
111 views

Should I log wrong passwords? [duplicate]

I have a public-facing web application where anyone can register an account. The passwords I store are salted and hashed. When someone tries to overtake the account of someone else through guessing ...
3
votes
6answers
508 views

Methods for remembering passwords around the web

What's the least painful way to manage passwords for user accounts that you have on various sites? I see only 3 options: Password manager. Passwords can be different and strong, but the downside is ...
3
votes
1answer
3k views

Where to keep key file used as composite key for Keepass 2

I used to use a master password and "Windows User Account" to get into my password datasbase with Keepass 2. Then I realized the "Windows User Account" option is garbage because if you ever want to ...
1
vote
0answers
141 views

How secure is a Python Pyro daemon for storing a password?

I am using the Pyro package to create a daemon which will, upon startup, prompt for a password, and then the daemon will store that password as long as it is running. Other scripts will then make a ...
2
votes
2answers
1k views

Username and password stored under form data in Chrome Dev Tools

When I record the network tab in Chrome Developer Tools when logging in to my site I find that the username and password are stored in plaintext under form data. You can also find it in Safari, ...
3
votes
1answer
191 views

What are industry-standard recommended practices to protect user information in an Android app?

I am developing an Android app that will potentially handle sensitive user data, and some of it may be even considered medical data (for example user height, weight, alergies, etc). What would be the ...
1
vote
3answers
270 views

Sharing passwords through email can be considered insecure?

I'm responsible to create new accounts for some services on my job. Some of these service do not allow password change by the user, so in the case the user wants to change its password, he would need ...
1
vote
2answers
258 views

What are the security risks associated with storing passwords on the internet?

With products such as LastPass that store encrypted passwords on remote servers, what are the associated risks that aren't applicable to locally stored and encrypted passwords? If something is ...
15
votes
3answers
2k views

Why check to see if a password is already used by another user?

This is coming from a joke originally in French: Enter your password. carrot Sorry, your password must be more than 8 characters. carottegéante (giant carrot) Sorry, your ...
1
vote
1answer
169 views

Which is best DPAPI or HSM?

Can you please explain what's is the main difference between for this both DPAPI and HSM? As far as I understand both protecting the data, the way of protection is difference HSM is physical device ...
10
votes
4answers
880 views

Forgetting passwords typed in too frequently

It has happened to me several times that I've become so used to typing in a password I can't consciously remember it and it's purely muscle memory. This is particularly true with complex passwords ...
1
vote
4answers
173 views

How to store passphrase in this situation?

How to store a passphrase with a Java application that periodically needs access to its plaintext form? It is a strange situation, but I am wedged in it. If providing a decent security mechanism is ...
3
votes
2answers
1k views

What are the pros and cons of using a password safe instead of writing passwords on paper?

Many companies have policy again writing passwords and paper and I wonder if there reasoning is sound. Is it always better to use a software password safe than writing passwords on paper? Here are ...
1
vote
1answer
196 views

Security implications of setting the same password on private key and PKCS12/JKS?

Are there any negative security implications of setting the private key password (DSA in this case) as a PKCS12 (and then JKS) export password (instead of generating/inventing a new one)? My use case ...
20
votes
3answers
4k views

Security of LastPass + YubiKey

I'm looking at password manager solutions and came across LastPass. I see they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What are ...
9
votes
4answers
594 views

Password security

I was requested at the login page of a website to first change my password. After typing in a new password, the web page told me the new password did not differ enough from the previous one. Does this ...
3
votes
2answers
460 views

How can I store a password history to prevent reuse?

I have an application with a user database. The database stores the password using a bcrypt hash with a randomized salt. How can I implement a password history set (to prevent password reuse) in a ...
33
votes
10answers
5k views

Is there any point in using 'strong' passwords?

Let's say I'm setting up a new account on a website. Should I bother using a strong password? My reasoning is this: Password strength is a rough measure of how long it would take to brute-force my ...
1
vote
1answer
84 views

storing username/email and password with a hash of the hash of the email/password? [duplicate]

Quite the simple discussion this one (one would assume): If I'd hash the email and password, and then hash the hashes, whould this be considered safe enough or would this just be a waste considering ...
0
votes
2answers
160 views

Password management [duplicate]

I am work in small company. I am Java Developer and Sysadmin of remote servers. I have problem with store password from several servers. How to best way to manage passwords in company?
46
votes
3answers
51k views

How difficult to crack keepass master password?

How easily could someone crack my keepass .kdbx file if that person steals the file but never obtains the Master Password? Is this a serious threat, or would a brute force attack require massive ...
0
votes
2answers
250 views

Encryption method and other security concerns for a simple password manager [closed]

I thought I would learn a little bit of cryptography programming by making myself a simple password manager program that I can potentially even use to keep track of my passwords. The idea is that my ...
0
votes
2answers
647 views

Security of cloud-based password manager (Dashlane, LastPass) vs. federated login (OpenID, Google, Yahoo, Microsoft, Facebook)

Many websites offer the option to log in with your existing Google or Facebook account (among others). For a long time I've resisted doing this because I use a password manager and I figured it was ...
-2
votes
3answers
2k views

How to effectively save database password inside desktop application?

Suppose we are in the field of desktop applications which need to store their data in a database. How do I store the password for this database avoiding the most obvious mistakes, which are: 1) hard ...
4
votes
2answers
502 views

Is there a risk in sending the username in a password reset email?

We're using a CMS that has a password reset function that works according to best practices out of the box. Passwords are stored as salted hashes Forgot Password works like this: User enters ...
2
votes
2answers
631 views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
47
votes
8answers
3k views

I'm an IT consultant. Should I discourage a client from telling me his password?

I'm an IT consultant. One client has known me for a few years. He wants me to do some work on his kids' laptop again. I'll need to log into his kids' Windows user account. (I'm guessing that multiple ...
3
votes
4answers
632 views

Should user's password strength be assessed at client or at server side?

Now most of big website like Google mail, Twitter, Facebook have a feature that assesses password strength (check number of digit, alphabet, special characters, or check the similarity over already ...
0
votes
3answers
4k views

Storing passwords online using Gmail documents

Following this discussion about "Online Passwords Managers" I wonder whether it is a good idea to store the passwords using a spreadsheet inside Gmail documents? I mean, it seems to me that these ...
2
votes
1answer
1k views

Android access tokens and access to all google services

My questions is based on the asnwer on that question: Can the Gmail password be recovered from the Android Gmail app? So, as I understand when we setup google account on Android devices, it stores ...
4
votes
2answers
3k views

Password management in Firefox, Chrome and Safari

I just read a couple of very interesting discussions on Chrome password security strategy. Chrome’s insane password security strategy Showing stored passwords - Tim Berners-Lee The following is how ...
1
vote
3answers
269 views

How safe is it to provide my administrator account password for a 3rd party software: EasyUS Todo Backup?

I've been recently searching for a backup solution for my Windows desktop. That's when I came across this free software called EasyUS Todo Backup. (I know it's a mouthful but English doesn't seem to ...
5
votes
4answers
4k views

How does a key file increase the security of a password manager?

Password managers like KeePass often have an option to use a key file in addition to a master password. I don't understand how this increases security. (Note: KeePass also allows using a key file ...
3
votes
1answer
159 views

S/Key as an alternative to UNIX passwords

There is this password system called S/Key I saw on the Internet. Can someone give me a brief description about S/Key and how it works? Can S/Key be an alternative solution to the UNIX password ...
9
votes
1answer
52k views

Can the Gmail password be recovered from the Android Gmail app?

I have an Android device with the Gmail app installed. This app can access the mailbox so there must be some kind of authentication data stored on the device (possibly an application specific ...
1
vote
3answers
394 views

Is Password Complexity required at all

For a web-site I'm using what I hope is the most secure password storage scheme I can find, which boils down to having a salt and hashed password stored in a database of contacts:- Byte[] ...