The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

3
votes
5answers
462 views

Am I required to hash passwords

Is one required to hash passwords by law in the US or elsewhere? If not required by law, are there legal ramifications if unhashed passwords are stolen? If not required in the US, but required in the ...
48
votes
3answers
52k views

How difficult to crack keepass master password?

How easily could someone crack my keepass .kdbx file if that person steals the file but never obtains the Master Password? Is this a serious threat, or would a brute force attack require massive ...
3
votes
3answers
901 views

Best password storage scheme for high entropy, unique passwords which is failure resistant [closed]

What is the best, most secure, easiest way to: store unique, strong passwords for every service which requires authentication make the system resistant (total loss of security is avoided, breaches ...
25
votes
4answers
4k views

What should be used as a salt?

I always hear that it is best to use salts on top of stored passwords, which then somehow gets concatenated and hashed afterwards. But I don't know what to use as a the salt. What would be a good ...
5
votes
3answers
6k views

Creating username policies and best practices

I have found a tonne of information on password policy all over the Internet and several best practices checklists. However from a username point of view I could not find much. I thought it would be ...
15
votes
4answers
871 views

If a website allows another person to get a list of the site's users passwords, how likely is it that the passwords are stored in cleartext?

We had an incident where some of our managers were given passwords for the people they supervise using a particular company website. Ostensibly it was done so the managers could check in on the users ...
2
votes
0answers
663 views

Adding an alternative password change scheme to passwd using PAM modules [closed]

I am trying to set up a PAM module that lets one add a conditional password change scheme. The intended behavior is like this: passwd do you want to change authentication token for ...
13
votes
2answers
185 views

Would suggesting a random passphrase during sign-up hurt overall security?

I've been looking for ways to improve security and security awareness for both internal and external clients and I happened upon the idea of generating a one-time, random "password suggestion" on the ...
8
votes
2answers
2k views

Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email

Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance MSFT even went to far as create ADMINSDUser rights to put ...
8
votes
4answers
2k views

Is forcing users to change passwords useful?

In many places, there's a policy that force the user changing it's password once a few months. The logic here is, that even if the password have leaked somehow, it'll be abused only for a relatively ...
49
votes
12answers
9k views

What to do about websites that store plain text passwords

I recently received an email from a popular graduate job web site (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
2
votes
2answers
294 views

Company sending Master passwords in unencrypted emails

If a company has terrible security policies like letting people email password in cleartext emails, what to do if they reject all fair minded advice?
18
votes
2answers
2k views

Sending temp password when users first registered - is that good for anything?

One of our clients has sent us a list of security requirements. One of them was that registration does not including setting a password - once complete, a temp password is sent to the user, and the ...
13
votes
4answers
427 views

Can apps be trusted when requesting your credentials?

I recently bought a newsreader app for my tablet that connects to Google Reader. To do so, it required my Google account password. Isn't this effectively the same as handling the password to the ...
4
votes
1answer
474 views

How can I manage multiple sets of passwords accessible by different users? [duplicate]

Possible Duplicate: Sharing passwords and credentials between founders and employees I use KeePass for my personal passwords. I would want to use it for my business, too, but the only way ...
8
votes
4answers
2k views

Passwords - any statistics on user behavior?

I'm looking for analyses of how users choose and use passwords. I'm sure there are many resources out there that analyze user passwords. For instance, I've seen many people analyze dumps of password ...
25
votes
6answers
11k views

Sharing wifi at a business - Bad Policy?

Is it safe for a small business to let customers use their wifi while waiting? My friend is starting up a small dentistry practice (1 dentist), and I'm setting up his computers/wifi as a favor. ...
9
votes
3answers
8k views

Security of passwords remembered by Windows

Does Windows XP or Windows 7 encrypt saved passwords? I'm assuming that the user uses local password to logon. The user then uses his own computer to connect to server in work and sets the "remember ...
8
votes
3answers
547 views

How is “anonymous” getting ahold of all these plain-text passwords

In the last several months there have been several publicized data breaches and public website defacements done by several different hacking groups (which the media loves to group under a single ...
38
votes
7answers
3k views

“Real” Salt and “Fake” Salt

During a Q&A period at DEFCON this year, one member of the audience mentioned that we're using "fake salt" when concatenating a random value and a password before hashing. He defined "real salt" ...
7
votes
4answers
2k views

Web browser password management security [duplicate]

Possible Duplicate: How are browser saved passwords vulnerable? How secure are the password managers that are built into modern web browsers? Currently I use lastpass plugin as I believed ...
35
votes
3answers
2k views

Am I wrong to believe that passwords should never be recoverable (one way hash)?

I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
32
votes
1answer
5k views

Are there more modern password hashing methods than bcrypt and scrypt?

This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt. What I'm wondering is if there are any ...
50
votes
8answers
4k views

Is it OK to tell your password to your company's sysadmin?

I'm working in a small company (20 employees) as a senior software engineer. After having problems with my email, our newly employed IT administrator asked me to write my user password to someone in ...
15
votes
3answers
542 views

Is it OK to tell your password to an admin? [duplicate]

Possible Duplicate: From a security point : Is it OK to tell your password to an admin? I am working in a small company (20 employees) as a senior SW engineer. After having some email ...
15
votes
6answers
3k views

Managing website passwords for small team

I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
20
votes
3answers
4k views

Security of LastPass + YubiKey

I'm looking at password manager solutions and came across LastPass. I see they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What are ...
6
votes
2answers
825 views

Is it better to hash n*x times in sha1 or n times in sha512 on the client side?

I already know I"m going to hash the user's password n times in either sha512 or n*x in sha1 before it is sent to the server. Once at the server, I'm going to use bcrypt set to use ~1/100th of a ...
2
votes
0answers
75 views

How to secure all my passwords with Kee Pass 2 or something else? [duplicate]

Possible Duplicate: How to securely store my passwords? I have a lot of passwords to lots of logins across websites, SSH logins, e-mails and what not. Is there one program that can secure ...
3
votes
7answers
1k views

Sharing passwords and credentials between founders and employees

What's the best way to share passwords and credentials from the business's various accounts in a secure manner? For example, email doesn't work because if someone gets into one of your employee's ...
333
votes
21answers
60k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
21
votes
2answers
1k views

How can we accurately measure a password entropy range?

I've given myself the task of writing code that determines the strength of a password, and really want to break out of a lot of already established ways we do that, as they're often lacking, not ...
9
votes
1answer
725 views

How to prepare for protecting identity after death?

In the context of online accounts and identities, what are some best practices to prepare for the one certainty we all face: not a one of us will get out alive.
7
votes
4answers
4k views

How to implement a “Remember me” on a mobile app?

I would like to implement a "Remember Me" time-limited auto-login type feature on a mobile application (on Android). To start the app, the user must type in a username and password. For convenience, ...
46
votes
5answers
3k views

Do security questions subvert passwords?

Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
20
votes
3answers
5k views

Password manager vs remembering passwords

I have always thought that you are not supposed to use a password manager but to keep your passwords in your head, but lately I have thought about the pros and cons of having a password manager. Some ...
8
votes
6answers
2k views

How to securely store my passwords?

Regarding this: Are passwords in memory? So does someone have a good idea on how to securely store my passwords? The: "passwords.txt" -> ctrl+c; ctrl+v a passw is not very secure. I have passwords ...
17
votes
3answers
2k views

Are passwords in memory?

I have an encrypted HDD (dm_crypt). That's why I store my passwords in a simple text file. I usually copy/paste the passwords from it. Ok! Q: If I open this text file then it goes into the memory. So ...
9
votes
4answers
616 views

Should I obfuscate passwords before hashing? Should I pre-hash them on the client? What about salts?

For fun, and in my spare time I'm creating a simple CMS for my own purposes (with hopes to release for wider use... later), using PHP. I'm currently working on the login scheme now, and have a few ...
20
votes
4answers
2k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
4
votes
2answers
195 views

How can IA-5(1)(b) be enforced on non-Windows systems?

I have a question posted already for this issue in Windows systems, and thought that non-Windows systems should perhaps be covered separately. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing ...
33
votes
6answers
3k views

How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?

In some environments, it is required that users change a certain number of characters every time they create a new password. This is of course to prevent passwords from being easily-guessable, ...
7
votes
2answers
741 views

How can IA-5(1)(b) be enforced on Windows systems?

Note: I've also posted a question for this issue on non-Windows systems. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include ...
5
votes
2answers
1k views

Password History/Password policy

I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008). Where is password ...
5
votes
2answers
332 views

How can I detect users that have requested AD Administrators to reuse an expired password?

There is a trend among companies I've worked at where administrators (or helpdesk folks) give a user a courtesy extension of the old expired password... rather than forcing the user to change it. ...
16
votes
2answers
10k views

FOSS Enterprise Password Management Solution [closed]

Can anyone recommend a F/OSS enterprise password management solution on/around the same level as something like Cyber-Ark? Specifically, something along the lines of a standard password manager, ...
9
votes
6answers
395 views

How can I ensure that default passwords are no longer in use?

There are two situations in which 'default' passwords get used on a network: A new user is registered. In her registration pack, along with her new username, e-mail address and so on is her initial ...
69
votes
8answers
8k views

Can anyone provide references for implementing web application self password reset mechanisms properly?

We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address). My problem is that I ...
3
votes
1answer
119 views

Protect file in a web site

How would you protect a password file in a web site? Is hashing the individual passwords not enough? What other steps do I need to follow?
34
votes
9answers
3k views

Is there a method of generating site-specific passwords which can be executed in my own head?

I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...