The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

3
votes
1answer
221 views

How should I store a password to allow people to enter single characters from it? [duplicate]

Possible Duplicate: How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext? Some banking applications ask for random letters ...
3
votes
0answers
78 views

How to safely store the most recently used encryption password for subsequent reuse in an app?

Let's say I have a mobile app that can save photos inside password-protected AES-128 encrypted PDF files. For convenience, I want the user to be able to encrypt a file using the previously-used ...
3
votes
1answer
155 views

Security implications of syncing with off-site keepass database

Is it a safe practice to sync with a Keepass database that is stored on an off-site server? Database is accessed primarily through my Android running 4.4.2. I access/sync my Keepass database by ...
3
votes
1answer
4k views

Where to keep key file used as composite key for Keepass 2

I used to use a master password and "Windows User Account" to get into my password datasbase with Keepass 2. Then I realized the "Windows User Account" option is garbage because if you ever want to ...
3
votes
1answer
78 views

Storing passwords in text files inside Ubuntu encrypted home directory

I'm interested in getting offlineimap working with my Gmail account so that I can read my emails while offline. My biggest concern with this is that it's a pretty big workaround to get the ...
2
votes
3answers
683 views

Storing passwords on a home computer

I remember all the passwords (and variations of passwords) that I use for various sites online. The problem is not that I forget a password, but that I forget which password goes with which site. And ...
2
votes
3answers
426 views

Is there any reason I shouldn't use SHA1 of salt + website name + master password for my password in websites?

I considered writing a program to do the above for websites I only intend to use for short-term use.
2
votes
4answers
394 views

Should we rethink our entire password strategy? [closed]

Passwords get discussed a lot on this site, and there's quite a lot for both users and sites to do, to stay in line with "best practice". Web sites need a password strength policy, account lockout ...
2
votes
3answers
567 views

Hashing speed with true random passwords

Just a theoretical question: If I had ideal users, who all provide fully random 128-bit passwords, And also, I invalidate every password shorter than 128 bits. Then would I still need a slow hash ...
2
votes
3answers
2k views

Why would you do a password audit

I was thinking last night after reading an article about pen testing and security audits, why would you get a list of all the passwords for the company you are auditing and put them through a piece of ...
2
votes
2answers
340 views

Is upgrading key-stretching algorithms and/or repetitions a thing?

Consider back in the 90s you're ahead of the curve, you hashed and salted your passwords with SHA, and you're a big site, millions of accounts, etc. Well the web evolves, and over time more advanced ...
2
votes
3answers
4k views

Microsoft password email reset link leads to different url?

...I am really annoyed and unsettled by the password reset email I just received from Microsoft. What should I think of this? My email client correctly told me that the underlying url is not the same ...
2
votes
3answers
1k views

Should I take care when entering incorrect passwords in untrustworthy websites?

I have the problem that I usually use 4 passwords that I use quite often. I use the first two strong passwords for very important services (e.g. Email, PayPal,..), and the other two not so strong for ...
2
votes
2answers
140 views

Is logging a hashed password safe?

I'm creating a login module for Wildfly by extending org.jboss.security.auth.spi.DatabaseServerLoginModule and using log4j2 for debugging. I've gotten into the habit of using log4j2's Logger.entry() ...
2
votes
5answers
2k views

Looking for password manager in company [duplicate]

I was looking for solution everywhere, but maybe because lack of specialized words I can't find it. I've got a problem in finding a program, but I don't know how to describe it in one word so I'll ...
2
votes
3answers
147 views

How to make an outbound request to users to update their passwords?

Clearly it works best if the request to update a password happens as a response to an inbound request to access a known system, but how do you make an outbound request to users to update their ...
2
votes
2answers
370 views

Storing lots of passwords that different levels of employees need access to

I am wondering what other people do for storing passwords. Our current model at my employer is fundamentally flawed in my opinion, so I am trying to see what other people do so I can select the best ...
2
votes
3answers
228 views

Should I implement my own local password hash?

Having a more-than-elementary knowledge of internet security, I've realized that some web applications and websites I use implement a less-than-ideal password policy. Some examples include: ...
2
votes
2answers
88 views

How do I respond to a spam server that invalidates my tokens? [duplicate]

Our web application sends a one-time use generated token, in the form of an URL, to clients who forget their passwords. This works except for the case where the client is sitting behind another server ...
2
votes
2answers
601 views

What impact do the frequency of password resets have on password reuse?

Wondering if there's any research behind the most common password reset cycle I've seen of 90-days, and if there's any research that gives any insight into how to optimize password resets to reduce ...
2
votes
4answers
2k views

Why do I need both root password and user password in Fedora Linux?

I am just now installing (for the first time) a shiny new Fedora 18. I set up a strong root password, installed the whole thing. Now it is asking me to create a user account and a password is ...
2
votes
3answers
117 views

Require Same Session ID Through All Password Reset Process Steps

Our password reset logic works as follows: user clicks "forgot my password" and enters the email address of the account email is sent with a cryptographically secure token, and the email address of ...
2
votes
1answer
2k views

Is it safe to keep passwords in an Evernote note?

I would like to keep a password matrix in an Evernote note. I would like to ask for feedback on the security of that storage.
2
votes
5answers
333 views

Password Recovery - what if user can't complete 2nd step?

I'm thinking out my password recovery logic for an ecommerce system. Some backround: Passwords are stored using bcrypt, password recovery involves the standard reset link, which then can be used to ...
2
votes
2answers
1k views

How can I create a service that automatically logs onto a third-party service without storing credentials in plain text?

I know that storing log-in credentials in plain text is one of the cardinal no-nos of security, but I'm working on something where I can't think of any other solution. My service connects to a user's ...
2
votes
2answers
347 views

Company sending Master passwords in unencrypted emails

If a company has terrible security policies like letting people email password in cleartext emails, what to do if they reject all fair minded advice?
2
votes
1answer
122 views

How can Windows 10 not have the password in memory?

I have read that Windows 10 does not hold the password in memory from the creator of mimikatz: Starting with 8.x and 10, by default, there is no password in memory. Exceptions: When ...
2
votes
2answers
60 views

Is this use of PBKDF2 for generating passwords secure?

Reading Security Engineering by Ross Anderson, chapter 2.4.7.1 Password Manglers got an idea that finally seems to solve the issue I have with the existing 'I need to remember a strong* password for ...
2
votes
2answers
133 views

staying not signed in: is it the safest procedure?

each time I do connect to a private or public network I log into websites by keeping the option "stay signed in" or "keep me signed in" unselected, so I have to re-type my username and passwod as ...
2
votes
3answers
188 views

Prevention of user's passwords being stored as plain text in bash history

Say I want to find the password of a linux user sudoer account. Assume he uses a strong password. Assume I have physical access to the machine. I can get hold of his passwd and shadow file and ...
2
votes
2answers
145 views

Best practice for identity management methods with regards to confirming user existence

I'm working on a new site that uses asp.net identity to register users. I'm making use of email addresses as usernames and the email address has to be confirmed before the user can log in. I've been ...
2
votes
2answers
229 views

Encrypting short data with RSA only?

I have a case where I need to create recovery accounts and I want to create them so that nobody knows the password to them until/unless necessary. Hence, I thought that I would do it using RSA - when ...
2
votes
4answers
740 views

Password recovery flow - Send Password recovery to any email?

I am building a new MVC app. Considering this "forgot password" flow: 1)You enter an email. 2)You press "send recovery password". 3)An email awaits in the inbox, pressing the link in it brings you to ...
2
votes
2answers
295 views

Password reset system code system vs long hash

I'm building a password reset system at the moment and I've come across a dilema. Currently we have a system which creates a long md5 has (16 characters) and emails a link to a customer which they ...
2
votes
1answer
845 views

Inputting user ID's in URL?

I am currently working on functionality that will allow users to reset their passwords. My question pertains to the security in putting user ID's (a.k.a the auto increment ID's from database) in the ...
2
votes
2answers
261 views

Shared vs unique credentials for remote support vendor accounts

I have a situation where my employer has a support contract with a vendor for an application we use. This application runs on a (Windows 2008 R2) server that does not store or have access to any ...
2
votes
2answers
729 views

Using a tabula recta to store passwords

Reading an answer to another question ("Is there a method of generating site-specific passwords which can be executed in my own head?") I came across this link, describing a way to use a physical ...
2
votes
2answers
87 views

When is a group password for a closed circle of users acceptable?

I am developing a tool for a company, that takes some technical data and creates PDF reports. In the tool you have several text fields, which get filled by the database. If the user wants to, he can ...
2
votes
2answers
132 views

Log User In Automatically After Clicking Account Activation Email

Scenario: Forum account registrations, user must click an activation email after they sign up e.g. they create an account with username, email, password, and an email is sent to the email they select. ...
2
votes
3answers
2k views

Centralized local hosted web based password manager

In our company we have more than 100 employers and everyone use several online applications daily. To access all of this sites they need a password which was now stored very insecurely. so I'm ...
2
votes
1answer
95 views

Why do Facebook and Microsoft make you enter a code when reseting a password?

Typically when you reset a website password you receive an email. A lot of sites send you a link with a code on the end of it to click on which will take you to an 'enter new password' form. ...
2
votes
3answers
141 views

How could a shared password database be implemented?

In the traditional form, a password database is similar to any other database file, except the contents are encrypted using a key derived from a passphrase entered by the user. The user enters their ...
2
votes
1answer
111 views

Is it sensible to use application password bypassing two factor authentication? [duplicate]

I discovered that some applications (like Sylpheed) seems unable to support two factor authentication. Google has a feature called application passwords - a separate password that "grants complete ...
2
votes
2answers
93 views

Should security phrases be hashed?

I didn't think of this before but today I just realised that in soke sites, pw recovery is possible if you know the answers to security questions like What is your mother's maiden name? In this ...
2
votes
1answer
303 views

Is it secure to have two password managers?

For various reasons I use both Keepass 2 and Lastpass. They have 90% the same password database. Is it secure to be using and maintaining both of them? Is it secure if they both use the same password ...
2
votes
1answer
6k views

Where to store Java keystore password?

We are going to have a Java Key Store which will store certificates & public/private keys. This keystore will be protected with the password. However, access to the keystore is only from the ...
2
votes
3answers
6k views

Storing passwords online using Gmail documents

Following this discussion about "Online Passwords Managers" I wonder whether it is a good idea to store the passwords using a spreadsheet inside Gmail documents? I mean, it seems to me that these ...
2
votes
1answer
514 views

Best security algorith for storing passwords [duplicate]

Possible Duplicate: Which password hashing method should I use? I want the best cryptography algorithm for storing passwords in database, which one should I use and how can I implement ...
2
votes
1answer
80 views

Is storing passwords encrypted with GnuPGP on an anonymous FTP server safe?

I would like some advice on a method of storing passwords to a database on my anonymous FTP server. Basically I have login details for a few trusted users to a database server stored in a text file ...
2
votes
2answers
103 views

Are there any examples of huge damages done by password leaks, or bad password management policies? [closed]

Everybody knows that a strong password is very important. However, I can't find any citable public example of any kind where a user or users suffered a heavy loss from using bad passwords, or their ...