The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

4
votes
1answer
108 views

A predictable password generator for offline clients

I know this sounds like pretty dumb question. Why would you use a password generator at all if it's predictable. But suppose you have a server and client - the server always requires a password and ...
2
votes
3answers
227 views

Alternative ways to manage lots of Passwords since Lastpass was hacked & now acquired

There is a lot of debate on Reddit and other sites about whether the hack was or was not bad based on lack of salt to uncover the password hashes. Also, LogMeIn seems to have poor reputation & ...
29
votes
4answers
8k views

Does the average user really need a password manager?

I'd describe myself as an average tech savvy computer user. I have many accounts in forums, shopping sites, etc where I recycle two moderately strong password with small variation. These are account ...
1
vote
1answer
103 views

Is it possible to disable `ypcat passwd`

We have an old NIS setup which, at geological speed, is being replaced by a Kerberos one. In the meantime, all the (non-root) users can simply type ypcat passwd and get the hashes of all the users' ...
7
votes
4answers
5k views

Is there a decentralized version of LastPass?

I am using LastPass for managing passwords on multiple computers. However, LastPass extension (at least the chrome version) is running some opaque binary code through Native Client, and I just feel ...
1
vote
1answer
222 views

If I have my neighbors wireless router password, can I access his data with a smartphone?

My neighbor gave me his wireless router password to use on my smartphone. Using this, can I access any of his accounts whether it's his bank account or Att/Direct TV account? I ask because I think ...
3
votes
3answers
262 views

Choosing a good password - again

There are many password-related questions in here, but I failed to find the answer to mine. I'm no expert so maybe I don't have the right keywords. Sorry for any duplicate for a possibly asked 100 ...
0
votes
2answers
102 views

password strength audits and mitigations

Reading this article about detecting bad passwords in the enterprise, made me want to ask if anyone here has attempted any audit like this. It would be an effective attack: There may be a good ...
1
vote
1answer
224 views

best practices for storing retrievable passwords

I am trying to build a NMS (network management system) and I am required to store passwords for 3rd party databases, devices and servers that are being managed (not user passwords). These passwords ...
2
votes
1answer
86 views

How to save passwords temporarily?

I work for a hosting company and are about to design a rest api for a 3rd party so they can create Active Directory user accounts. I also want this api to be async and robust enough to survice ...
3
votes
4answers
128 views

What are best practices for letting employees use a web app, but never actually know the password?

That is, is it possible with a Single-Sign-On tool to give employee "Joe Smith" access to app "SocialMedia App1" for him to do this job. But when Joe leaves the company, can I have complete confidence ...
2
votes
3answers
213 views

Prevention of user's passwords being stored as plain text in bash history

Say I want to find the password of a linux user sudoer account. Assume he uses a strong password. Assume I have physical access to the machine. I can get hold of his passwd and shadow file and brute-...
0
votes
2answers
249 views

Chrome/ Opera continue to save & autofill passwords after installing LastPass? Good or bad? Enable/ Disable?

I moved to lastpass a few months back and imported passwords from all Browsers. Apparently, Chrome & Opera {based on Chromium} still pop-up the option to save passwords and are probably ...
4
votes
1answer
108 views

Storing base passwords in Lastpass

After watching Mr Robot I finally motivated myself to setup two factor authenitication for Lastpass with Yubikey. Fastmail is the second service I've set up with my Yubikey. I changed my main ...
3
votes
1answer
129 views

How to safely reuse passwords in variation?

Remembering a lot of passwords is difficult. A lot of people use the same or a small set of passwords for everything. Of course, this is very unsafe. If such a password a password is stolen, the ...
7
votes
2answers
292 views

Is KeePass's method for key derivation secure?

I'm familiar with how key derivation functions can be used to slow down brute force attacks against passwords by requiring significant computational and/or memory resources to compute the final key. ...
6
votes
1answer
77 views

Should I inform a random person on the internet that their data may be compromised?

I've found a data leak in a fairly well known password manager. I'm currently in talks with the developers to get this corrected. However, in proving that this is a bug I stumbled on a users data ...
2
votes
1answer
82 views

Keeping a password safe in program config

I have a Windows service which connects to a database to poll some value in order to monitor certain activity. Of course, to use this I need a database password. I need to keep this password safe, ...
20
votes
8answers
9k views

On two-step login forms, why is it the login name and not the password that's asked first?

There are several login forms (e.g. Google's) on the internet where you first enter your login name and then, once that's submitted, you get to enter your password. One of the advantages of this is, ...
84
votes
8answers
17k views

If a provider sees the last 4 characters of my password, can they see it in full?

I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
1
vote
1answer
112 views

HMAC password reset link and replay attacks

I like the look of this technique for sending password reset links: https://neosmart.net/blog/2015/using-hmac-signatures-to-avoid-database-writes/ (TLDR: don't store token in database. Send password ...
32
votes
3answers
6k views

Is using the username encrypted with the password as key a good password storage scheme?

On web applications I build I don't hash the passwords. Instead I symmetrically encrypt the username using the user's password and store the result in the password field. I use RijndaelManaged on ...
4
votes
2answers
199 views

Does adding a random character to a pseudo-randomly generated password improve entropy significantly?

I'm asking a practical question. I was taught computers are bad at generating random data. Does this mean password generators, such as the one built into Keepass, suck? If yes, then would it help for ...
1
vote
1answer
141 views

What's the secure way to write clear text password into a file?

I'm trying to insert sensible data into a file. I'm trying to write a MySQL configuration file dynamically. The file contains this: [client] password: 87sfZEKEF,5 The script that I used is owned by ...
-2
votes
1answer
198 views

Online Password Storage: Is this safe and how can I implement this?

Hello there for an online Tool which offers the feature of storing passwords online I want to implement the following process: A user is generating a secure secret random key with Javascript This ...
5
votes
1answer
236 views

Are there any passwords managers that use a second hidden encryption drive to hide passwords?

I've heard that encryption program, Truecrypt can create a hidden encrypted drive within an encrypted drive; and even if an attacker accesses the first encrypted drive he/she cannot prove the hidden ...
3
votes
1answer
2k views

Correct way to generate password salts in PHP 5.3 on Linux given my constraints?

In examining our database storage of hashed passwords with salts, I note a high rate of salt collisions, i.e., there are far too many cases where two table rows have the same salt stored. One ...
2
votes
2answers
279 views

Is the date that a password was last changed useful to an attacker?

Obviously I want my application's users to change their passwords on some semi-regular basis (in fact a few of our apps must be UL-approved, and they require a system to enforce changing passwords ...
12
votes
3answers
10k views

Free/Libre software to handle TCG OPAL 2.0-compliant Self-Encrypting Drives (SEDs)?

I'm in search of a free/libre software that is able to handle OPAL (2.0)-compliant SEDs (i.e. manage the setting of Pre-Boot Authentification (PBA) environment, encryption keys...). It could be a ...
1
vote
2answers
1k views

Do cloud-based password managers invalidate even the most secure architecture?

Can an online password vault, like Lastpass, be defended through a security assessment that demonstrates the value they provide outweigh the risks of being a high value target? A valid answer would: ...
6
votes
4answers
2k views

Is GPG suitable as part of a password manager and generator?

I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
0
votes
2answers
124 views

Store password in Public Domain using files and md5sum

Whenever I check integrity of a file using md5sum, I get a string of alphanumeric characters to compare and verify if it was downloaded correctly. Couldn't the concatenation of several of those ...
8
votes
3answers
478 views

Forgot password and revealing whether account exists

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...
0
votes
1answer
46 views

Is there any problem using empty salts with PBDKF for this purpose?

The aim is to generate a secure key for symmetric encryption. I have a master password, from which I want to generate the key for symmetric encryption, in order to encrypt other passwords. The idea ...
1
vote
2answers
202 views

Different password for each login - based on some variable

This might sound a silly question, but I was thinking this as and extra option(which is not required) mainly for advanced users, who want to protect their accounts even more. Lets consider that other ...
6
votes
7answers
5k views

How can I best manage root passwords for many servers?

Lets say I have two racks with about 40 nix servers in them. I don't want to set all of the root user passwords all the same do I? If not how do you manage and keep up with all of the passwords? Is ...
-2
votes
2answers
76 views

When should a password be hashed? [duplicate]

I develop a Smartphone App and have a little question: When should I hash the user passwords, on the device or upload them in plain text and hash them on the server before stored in the database?
7
votes
2answers
166 views

Do password managers leak information with swap memory?

The post How to find passwords in memory (password managers) concluded, that passwords are visible in plaintext if you login to a website. Password managers tend to store the passwords encrypted in ...
8
votes
2answers
5k views

Practices for storing username/password in Web applications

I have read the following question: Storing password in Java application but I don't find the answers useful for my case. So here is my question somehow related to that. I have a Java Web application ...
1
vote
2answers
171 views

Several hashing routines support client side work. Doesn't the hash just become a password equivalent?

Isnt Secure Remote Password Protocol (SRP) pretty much client side hashing? Argon2 the winner of the PHC also allows for client side hashing. How do these systems avoid the plaintext equivalence ...
0
votes
1answer
201 views

How secure are the passwords stored at Google Passwords? [closed]

It seems Google activated central place for storing app/website passwords which is accessible at https://passwords.google.com/ and all the remembered Chrome passwords are synched there. In what ...
6
votes
2answers
628 views

How to store passwords in database so that they can be retrieved?

I'm developing a password manager web app. It's just for fun: I'm not exposing anybody's passwords. My idea was to use hashing+salting, and that's what I did for the master password. But then I ...
64
votes
12answers
14k views

What to do about websites that store plain text passwords

I recently received an email from a popular graduate job web site (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
2
votes
3answers
197 views

How does a hash which contains algorithm to choose can be secure?

I was thinking about creating my own hash+salt function, something like sha1(password + md5(login)), then I read here (part 4) that creating it's own hash+salt function is a bad idea, because if the ...
3
votes
1answer
157 views

Security implications of syncing with off-site keepass database

Is it a safe practice to sync with a Keepass database that is stored on an off-site server? Database is accessed primarily through my Android running 4.4.2. I access/sync my Keepass database by ...
0
votes
0answers
11 views

Secure Distribution of Admin-Defined Credentials to End-Users [duplicate]

Situation: I need to safely send database credentials created by the admin to users in a secure fashion. Currently, creds have been sent to users via plain text email (which is a huge security ...
3
votes
5answers
264 views

Any security risks for the login authentication and change password on the same page?

I want to ask if there are any security risks for the login authentication and change password on the same page? Normally the user needs to authenticate first in order to see the password change form....
6
votes
3answers
203 views

Is google saving clear text passwords? [closed]

On your GMail account you have the option to add other POP3 accounts to automatically fetch mail from them; Google Mail Fetcher. When enabled you have to specify your username and password, and the ...
6
votes
1answer
5k views

Security analysis of Dashlane

I've been asked by a user whether I would recommend using the Dashlane password manager. I'm aware that other password managers have had some significant security problems, including XSS and CSRF (...
24
votes
4answers
26k views

Is it possible to easily retrieve Thunderbird's passwords with access to HDD?

I know Firefox 8 stores it's passwords in a SQLite database, which can easily be stolen with access to the HDD! What about Thunderbird 8? How does it store the passwords and how can one retieve them? ...