The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

3
votes
1answer
631 views

Saving connection parameters in an RDP file

For connecting to a remote Windows Server 2008 I use a standard Windows 7 RDP remote desktop connection. In an RDP dialog there is an option to save connection parameters to an RDP file to use it ...
3
votes
5answers
281 views

Any security risks for the login authentication and change password on the same page?

I want to ask if there are any security risks for the login authentication and change password on the same page? Normally the user needs to authenticate first in order to see the password change form....
3
votes
2answers
228 views

TrueCrypt LUKS keyfile and password

I understand that a TrueCrypt volume may be encrypted with a password AND a keyfile. As far as I can tell, A LUKS volume may use EITHER a password OR a keyfile, but not both simultaneously for ...
3
votes
1answer
231 views

How to store a group password for multi-user server-client web-application?

In a web application, accessed by browser via https, users need to be able to access data stored on a server in a MySQL database. Data has to be encrypted for several groups of users, where one group ...
3
votes
3answers
829 views

I want to roll my personal cloud hosted Password Manager using pass. How secure/insecure would this be?

I've come to the conclusion that I need to up my security. I currently have a dozen memorized passwords I use for every device and website. I'm against KeePass/Lastpass due to having to trust they ...
3
votes
1answer
351 views

How to minimize security risk when having to work with decrypted (plain text) passwords due to 3rd party API design

I'm developing an application (C#) for Microsoft SharePoint platform that uses SQL Server's (2008 R2) Remote BLOB Storage (RBS) technology. To accomplish certain client-side tasks, I must obtain ...
3
votes
1answer
413 views

Webpage sent me my password in clear text can it be secure? [duplicate]

I registered for a webpage years ago and have been using it without issues, today I made some changes to my account and they sent me an email containing my username and password in clear text. I ...
3
votes
1answer
522 views

Can a user's Apple Keychain be opened on a different computer?

Apple uses a nice keychain. This is used by, for example, Google's Chrome browser. Imagine a user copies all the keychain files. Would that user be able to unlock the keychain, if they knew the ...
3
votes
6answers
673 views

Methods for remembering passwords around the web

What's the least painful way to manage passwords for user accounts that you have on various sites? I see only 3 options: Password manager. Passwords can be different and strong, but the downside is ...
3
votes
1answer
221 views

How should I store a password to allow people to enter single characters from it? [duplicate]

Possible Duplicate: How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext? Some banking applications ask for random letters ...
3
votes
0answers
80 views

How to safely store the most recently used encryption password for subsequent reuse in an app?

Let's say I have a mobile app that can save photos inside password-protected AES-128 encrypted PDF files. For convenience, I want the user to be able to encrypt a file using the previously-used ...
3
votes
1answer
163 views

Security implications of syncing with off-site keepass database

Is it a safe practice to sync with a Keepass database that is stored on an off-site server? Database is accessed primarily through my Android running 4.4.2. I access/sync my Keepass database by ...
3
votes
1answer
4k views

Where to keep key file used as composite key for Keepass 2

I used to use a master password and "Windows User Account" to get into my password datasbase with Keepass 2. Then I realized the "Windows User Account" option is garbage because if you ever want to ...
3
votes
1answer
79 views

Storing passwords in text files inside Ubuntu encrypted home directory

I'm interested in getting offlineimap working with my Gmail account so that I can read my emails while offline. My biggest concern with this is that it's a pretty big workaround to get the ....
2
votes
3answers
692 views

Storing passwords on a home computer

I remember all the passwords (and variations of passwords) that I use for various sites online. The problem is not that I forget a password, but that I forget which password goes with which site. And ...
2
votes
3answers
430 views

Is there any reason I shouldn't use SHA1 of salt + website name + master password for my password in websites?

I considered writing a program to do the above for websites I only intend to use for short-term use.
2
votes
4answers
399 views

Should we rethink our entire password strategy? [closed]

Passwords get discussed a lot on this site, and there's quite a lot for both users and sites to do, to stay in line with "best practice". Web sites need a password strength policy, account lockout ...
2
votes
3answers
568 views

Hashing speed with true random passwords

Just a theoretical question: If I had ideal users, who all provide fully random 128-bit passwords, And also, I invalidate every password shorter than 128 bits. Then would I still need a slow hash ...
2
votes
3answers
2k views

Why would you do a password audit

I was thinking last night after reading an article about pen testing and security audits, why would you get a list of all the passwords for the company you are auditing and put them through a piece of ...
2
votes
2answers
342 views

Is upgrading key-stretching algorithms and/or repetitions a thing?

Consider back in the 90s you're ahead of the curve, you hashed and salted your passwords with SHA, and you're a big site, millions of accounts, etc. Well the web evolves, and over time more advanced ...
2
votes
3answers
4k views

Microsoft password email reset link leads to different url?

...I am really annoyed and unsettled by the password reset email I just received from Microsoft. What should I think of this? My email client correctly told me that the underlying url is not the same ...
2
votes
3answers
1k views

Should I take care when entering incorrect passwords in untrustworthy websites?

I have the problem that I usually use 4 passwords that I use quite often. I use the first two strong passwords for very important services (e.g. Email, PayPal,..), and the other two not so strong for ...
2
votes
2answers
147 views

Is logging a hashed password safe?

I'm creating a login module for Wildfly by extending org.jboss.security.auth.spi.DatabaseServerLoginModule and using log4j2 for debugging. I've gotten into the habit of using log4j2's Logger.entry() ...
2
votes
5answers
2k views

Looking for password manager in company [duplicate]

I was looking for solution everywhere, but maybe because lack of specialized words I can't find it. I've got a problem in finding a program, but I don't know how to describe it in one word so I'll ...
2
votes
3answers
147 views

How to make an outbound request to users to update their passwords?

Clearly it works best if the request to update a password happens as a response to an inbound request to access a known system, but how do you make an outbound request to users to update their ...
2
votes
2answers
384 views

Storing lots of passwords that different levels of employees need access to

I am wondering what other people do for storing passwords. Our current model at my employer is fundamentally flawed in my opinion, so I am trying to see what other people do so I can select the best ...
2
votes
3answers
230 views

Should I implement my own local password hash?

Having a more-than-elementary knowledge of internet security, I've realized that some web applications and websites I use implement a less-than-ideal password policy. Some examples include: ...
2
votes
2answers
90 views

How do I respond to a spam server that invalidates my tokens? [duplicate]

Our web application sends a one-time use generated token, in the form of an URL, to clients who forget their passwords. This works except for the case where the client is sitting behind another server ...
2
votes
2answers
636 views

What impact do the frequency of password resets have on password reuse?

Wondering if there's any research behind the most common password reset cycle I've seen of 90-days, and if there's any research that gives any insight into how to optimize password resets to reduce ...
2
votes
4answers
3k views

Why do I need both root password and user password in Fedora Linux?

I am just now installing (for the first time) a shiny new Fedora 18. I set up a strong root password, installed the whole thing. Now it is asking me to create a user account and a password is ...
2
votes
1answer
79 views

What encryption is used by 1password?

I use a password storage application on my Mac called 1password. I was wondering if it encrypts the data it stores on my computer and decrypts it using a key made from my "one password" or if it has ...
2
votes
1answer
180 views

How can Windows 10 not have the password in memory?

I have read that Windows 10 does not hold the password in memory from the creator of mimikatz: Starting with 8.x and 10, by default, there is no password in memory. Exceptions: When ...
2
votes
2answers
78 views

Is this use of PBKDF2 for generating passwords secure?

Reading Security Engineering by Ross Anderson, chapter 2.4.7.1 Password Manglers got an idea that finally seems to solve the issue I have with the existing 'I need to remember a strong* password for ...
2
votes
3answers
138 views

Require Same Session ID Through All Password Reset Process Steps

Our password reset logic works as follows: user clicks "forgot my password" and enters the email address of the account email is sent with a cryptographically secure token, and the email address of ...
2
votes
1answer
2k views

Is it safe to keep passwords in an Evernote note?

I would like to keep a password matrix in an Evernote note. I would like to ask for feedback on the security of that storage.
2
votes
5answers
335 views

Password Recovery - what if user can't complete 2nd step?

I'm thinking out my password recovery logic for an ecommerce system. Some backround: Passwords are stored using bcrypt, password recovery involves the standard reset link, which then can be used to ...
2
votes
2answers
350 views

Company sending Master passwords in unencrypted emails

If a company has terrible security policies like letting people email password in cleartext emails, what to do if they reject all fair minded advice?
2
votes
2answers
165 views

staying not signed in: is it the safest procedure?

each time I do connect to a private or public network I log into websites by keeping the option "stay signed in" or "keep me signed in" unselected, so I have to re-type my username and passwod as ...
2
votes
3answers
233 views

Prevention of user's passwords being stored as plain text in bash history

Say I want to find the password of a linux user sudoer account. Assume he uses a strong password. Assume I have physical access to the machine. I can get hold of his passwd and shadow file and brute-...
2
votes
1answer
221 views

Password management: how an administrator should reset password for a user?

I implement simple user management. How an administrator should reset password for a user? Just provide a new password for a user (as in Active Directory)? Is it secure enough? Added Is it secure ...
2
votes
2answers
148 views

Best practice for identity management methods with regards to confirming user existence

I'm working on a new site that uses asp.net identity to register users. I'm making use of email addresses as usernames and the email address has to be confirmed before the user can log in. I've been ...
2
votes
2answers
241 views

Encrypting short data with RSA only?

I have a case where I need to create recovery accounts and I want to create them so that nobody knows the password to them until/unless necessary. Hence, I thought that I would do it using RSA - when ...
2
votes
4answers
839 views

Password recovery flow - Send Password recovery to any email?

I am building a new MVC app. Considering this "forgot password" flow: 1)You enter an email. 2)You press "send recovery password". 3)An email awaits in the inbox, pressing the link in it brings you to ...
2
votes
2answers
302 views

Password reset system code system vs long hash

I'm building a password reset system at the moment and I've come across a dilema. Currently we have a system which creates a long md5 has (16 characters) and emails a link to a customer which they ...
2
votes
2answers
163 views

How do password suites store and encrypt their metadata and prevent attacks based on that knowledge?

If someone uses a password manager and tries to organize the credentials well, doesn't that make attacks easier? Let's assume an attacker has the encrypted credentials available for offline attacks, ...
2
votes
1answer
902 views

Inputting user ID's in URL?

I am currently working on functionality that will allow users to reset their passwords. My question pertains to the security in putting user ID's (a.k.a the auto increment ID's from database) in the ...
2
votes
2answers
272 views

Shared vs unique credentials for remote support vendor accounts

I have a situation where my employer has a support contract with a vendor for an application we use. This application runs on a (Windows 2008 R2) server that does not store or have access to any ...
2
votes
2answers
739 views

Using a tabula recta to store passwords

Reading an answer to another question ("Is there a method of generating site-specific passwords which can be executed in my own head?") I came across this link, describing a way to use a physical ...
2
votes
5answers
193 views

How secure is a password protected file?

I have a password-protected excel file that stores other personal passwords. Obviously there have been a number of ways to crack the password. community.spiceworks.com Where do you guys store ...
2
votes
2answers
98 views

When is a group password for a closed circle of users acceptable?

I am developing a tool for a company, that takes some technical data and creates PDF reports. In the tool you have several text fields, which get filled by the database. If the user wants to, he can ...