The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

1
vote
2answers
134 views

How do password suites store and encrypt their metadata and prevent attacks based on that knowledge?

If someone uses a password manager and tries to organize the credentials well, doesn't that make attacks easier? Let's assume an attacker has the encrypted credentials available for offline attacks, ...
1
vote
2answers
550 views

Using a tabula recta to store passwords

Reading an answer to another question ("Is there a method of generating site-specific passwords which can be executed in my own head?") I came across this link, describing a way to use a physical ...
1
vote
1answer
114 views

Password management: how an administrator should reset password for a user?

I implement simple user management. How an administrator should reset password for a user? Just provide a new password for a user (as in Active Directory)? Is it secure enough? Added Is it secure ...
1
vote
2answers
125 views

Encrypting short data with RSA only?

I have a case where I need to create recovery accounts and I want to create them so that nobody knows the password to them until/unless necessary. Hence, I thought that I would do it using RSA - when ...
1
vote
1answer
140 views

help identifying an IP address from email sent from my gmail account

Someone sent the following email from my gmail account. I believe it was hacked and if I can find the IP address I may be able to identify the person who did it. Here is the information. Please let me ...
1
vote
4answers
188 views

How to store passphrase in this situation?

How to store a passphrase with a Java application that periodically needs access to its plaintext form? It is a strange situation, but I am wedged in it. If providing a decent security mechanism is ...
1
vote
2answers
141 views

Mysql database password and webform password

I have a Mysql database where one table is meant to store user complaints/comments/suggestions. I am using Mysqli to connect to the database with a ...
1
vote
2answers
153 views

is it appropriate to set restrictions on a user's password? [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? Im developing a website and am curious as to the current trends in the nature of passwords. Is it good ...
1
vote
2answers
582 views

How can I create a service that automatically logs onto a third-party service without storing credentials in plain text?

I know that storing log-in credentials in plain text is one of the cardinal no-nos of security, but I'm working on something where I can't think of any other solution. My service connects to a user's ...
1
vote
1answer
87 views

If using a different password for every application is considered good practice, why is using a directory so widespread?

The title pretty much sums it all. We are always told that we should use a different password for every site and application, so that if one of those accounts is compromised, the others will still be ...
1
vote
1answer
70 views

All UTF-8 characters for generated passwords

Why do a lot of password generators don't generate strong passwords including chinese, arabian...-characters? All generators I saw, also the included one in my password manager keepass, just output ...
1
vote
1answer
80 views

Why should we focus on protecting root access on a home computer?

I understand why root access should be protected in general, especially in the context of a server environment. An unknown party can essentially control everything you do on a computer remotely ...
1
vote
1answer
104 views

Could Mental Cryptography(?) be useful to ordinary users?

I recently read about 'Mental cryptography' or 'Metal hash' process from this post: Mental cryptography and good passwords (via this message board ...
1
vote
2answers
118 views

How Empathy - a messaging program, is storing my passwords

I am connected to my chat accounts via Empathy, a messaging program, and it has my password stored in it. I am really curious to know how it is storing the passwords, and if there is any they can ...
1
vote
3answers
91 views

How to limit the need to type a long master passphrase to only once per login session?

I want to set up a password management system on a home machine running Debian, and for this I'm considering only non-proprietary, open source password-managers available through Debian1. I'd like to ...
1
vote
1answer
138 views

ISO and Password Security

I have to go through background check. The company providing the service to the client is called Verifications, Inc. Verifications, Inc claims to have a data security plan, ISO certification and US ...
1
vote
3answers
121 views

cleartext passphrase for keystore

How is passphrase for a keystore to be stored? we have all passwords encrypted and the key to encrypt is stored in keystore , so how is the passphrase for the keystore to be stored? in clear text? if ...
1
vote
1answer
76 views

How do you manage credentials to multiple remote systems?

We are a vendor that provides software to the healthcare industry, and our application is locally hosted on customer infrastructure. As such, we are provided with VPN access in order to be able to ...
1
vote
2answers
294 views

What are the security risks associated with storing passwords on the internet?

With products such as LastPass that store encrypted passwords on remote servers, what are the associated risks that aren't applicable to locally stored and encrypted passwords? If something is ...
1
vote
1answer
217 views

Security implications of setting the same password on private key and PKCS12/JKS?

Are there any negative security implications of setting the private key password (DSA in this case) as a PKCS12 (and then JKS) export password (instead of generating/inventing a new one)? My use case ...
1
vote
1answer
92 views

storing username/email and password with a hash of the hash of the email/password? [duplicate]

Quite the simple discussion this one (one would assume): If I'd hash the email and password, and then hash the hashes, whould this be considered safe enough or would this just be a waste considering ...
1
vote
1answer
248 views

How does IIS persist identity credentials? Does it create any security issues?

We want to implement a feature similar to IIS in how it remembers user configured usernames and passwords. As I understand it, when you configure IIS to use a set of credentials for an app pool ...
1
vote
6answers
481 views

How to keep website passwords safe among employees? [duplicate]

We're a website developer agency, and most of our websites are made using in Wordpress, Joomla or Drupal as a CMS. I'm having trouble to decide how we should manage our passwords, and I'm open for ...
1
vote
1answer
513 views

Securely tell the user his password in new WHM/Cpanel account creation?

I understand it's not safe to send passwords via email but when accounts are created via WHM/Cpanel, I have to let the user know what password I created for them. How can I relay the password safely?
1
vote
1answer
330 views

Should I mount my mac Truecrypt Volume elsewhere?

I've read in various places to not mount your truecrypt volume in the same place as your Dropbox or Sugarsync folder. I believe this only matter for Mac/Linux, but I need some verification. On a Mac, ...
1
vote
1answer
226 views

Can accounts still be logged onto if Password Caching is not enabled?

This is kind of an extension of my other question.. If you were not storing any of the passwords locally (caching disabled), would a user some how still be able to circumvent around this security ...
1
vote
1answer
82 views

Designing a password auth/reg system

I'm designing a user reg/auth system for a website and came up with this design for password based authentication. I'd like to know if this is reasonable. (ignoring cookies for caching credentials, ...
1
vote
1answer
153 views

How is password information stored and used on Android accounts?

How difficult would it be for someone who stole your device to gain access to the username and password information stored under the Settings -> More -> Accounts section of an Android device? ...
1
vote
1answer
73 views

Password sharing with spouse or mate (bulk-change shared passwords (via cloud service))? [closed]

I've read on New Scientist magazine that in 80% of all cases when people in a relationship share a place where they live one of the spouses knows the other's password, thus making the question I am ...
1
vote
1answer
104 views

Secure copy-paste from phone to computer

Some computers on my university block the keepass application which I use as a password manager. I'm thinking of building a small web application + Android app which lets me securely copy a string ...
1
vote
1answer
96 views

Are there best practices concerning application account credentials?

I am looking for best practices concerning application account credentials. For example, suppose I got a corporate application which uses an Active Directory application user account to communicate ...
1
vote
1answer
101 views

Easy to use, simple, secure password storage method? [closed]

I wish to reduce the barrier of entry to a more secure method of generating/storing passwords. The main stumbling block for anyone I have spoken to, or tried to convince to switch to a password ...
1
vote
3answers
203 views

Site allows both Partial and Complete password authentication; do they have my password in plain text? [duplicate]

My bank provides online banking facility like most of the banks these days. On the web they have Partial Password Authentication. Although I don't really believe in PPA providing extra security but ...
1
vote
1answer
233 views

Implementing password-reset in a web application by authtoken over email

I think I have a basic understanding of security concerns, but I feel like if I don't know everything, I'm going to implement lousy solutions. Below is my current strategy; Have I overlooked obvious ...
1
vote
1answer
124 views

How do I migrate users with shared email addresses to an email-based forgotten password process?

I'm migrating users from custom application-level authentication security (built into the app, using username as the unique identifier) to security as a service (using ThinkTecture's Identity Server ...
1
vote
2answers
78 views

Automatic vs Manual

When it comes to technologies that directly affect information security, how do you determine when it is better to use an automatic option instead of a manual option, and vice versa? I already feel ...
1
vote
1answer
245 views

how to use hash passwords to retrieve keys from keystore or access database

How do I hash the password for a keystore? How do I then use the hash to retrieve something from keystore? Similarly, how do I use a hashed password for accessing the database? I have encrypted the ...
1
vote
3answers
221 views

Is it safe to back up passwords to the “cloud”

I have a small Truecrypt volume that contains just my password data (using Bruce Schneier's Password Safe application). I'd like an offsite, secure, backup of that Truecrypt volume. Currently, I am ...
1
vote
2answers
119 views

Is checking against password lists a good way to enforce a secure password policy and possibly detect dictionary attacks on a web-based app?

I have written a script to check a given password against a ~65 million long list of passwords collated from various lists released after hacking attempts. I am thinking about incorporating it into ...
1
vote
1answer
174 views

Is it a good idea to give users an additional password that they do not control?

It's a given that users will choose bad passwords. Why not help them out? Using a securely-random choice from a large dictionary, choose one or two words and tell the user to write them down. When ...
1
vote
1answer
198 views

Which is best DPAPI or HSM?

Can you please explain what's is the main difference between for this both DPAPI and HSM? As far as I understand both protecting the data, the way of protection is difference HSM is physical device ...
1
vote
1answer
82 views

Password Verification Server

I posted a question here... Protecting Password Hashes with Store Procedures? ...where I asked about denying a website's database user CRUD access to the tables that store password hashes except ...
1
vote
2answers
163 views

passwords database - access control and/or synchronization

so, we've got a ton of passwords that several different administrators need to have access to, each with their unique password/key/user/whatever... it needs to be either centralized, or the passwords ...
1
vote
1answer
155 views

Is the date that a password was last changed useful to an attacker?

Obviously I want my application's users to change their passwords on some semi-regular basis (in fact a few of our apps must be UL-approved, and they require a system to enforce changing passwords ...
1
vote
1answer
59 views

Store/retrieve users passwords on server (using password managers ?)

I am working on a project in wich a school's server will need to use students' passwords periodically to connect to another website for them. I am aware that storing users' passwords in a server ...
1
vote
1answer
40 views

password storage and user authentication [duplicate]

I was going through (https://crackstation.net/hashing-security.htm) about doing password hashing / storage the right way. I understood most of it but i still have some questions and doubts which are ...
1
vote
0answers
104 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
1
vote
2answers
72 views

Should a password ever be presented in plain text to a user (On a website)? Is this illegal under UK Data protections act? [closed]

There is a website I use at work, external to our own. They have just presented with every employee with their plain text password and username via our internal website which requires our own logins. ...
1
vote
0answers
79 views

Store 2-legged one-time password's key securely

I have a system with a OTP authentication and I need a method to encrypt the main "secret algorithm". In my system each OTP has a pair named "solution" and it is also changing like the OTP. I need to ...
1
vote
0answers
48 views

Is there an extension/command line for OSX Chromium to save website passwords in LOCALSTORAGE instead of the system's keychain?

My situation: I want to use a portable-app implementation of Chromium running on a removable drive, so I never leave any passwords stored on the kaychain of any computer I use. Portable Chromium is ...