The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

2
votes
1answer
74 views

How to save passwords temporarily?

I work for a hosting company and are about to design a rest api for a 3rd party so they can create Active Directory user accounts. I also want this api to be async and robust enough to survice ...
2
votes
1answer
76 views

Keeping a password safe in program config

I have a Windows service which connects to a database to poll some value in order to monitor certain activity. Of course, to use this I need a database password. I need to keep this password safe, ...
2
votes
3answers
190 views

How does a hash which contains algorithm to choose can be secure?

I was thinking about creating my own hash+salt function, something like sha1(password + md5(login)), then I read here (part 4) that creating it's own hash+salt function is a bad idea, because if the ...
2
votes
1answer
105 views

Is drag-and-drop safer than using the clipboard when it comes to protecting sensitive data from keyloggers?

I noticed that multiple password-locker applications recommend that you use the drag-and-drop feature to transfer passwords to login forms instead of copying the passwords to the clipboard or having ...
2
votes
2answers
111 views

How significant is the risk in having someone email/IM an htpasswd hash?

I need to set users up for subversion access, and we're currently stuck using htpasswd for our credential storage. If a user sends me an htpasswd record via email (or GChat / off the record?), what's ...
2
votes
2answers
186 views

Secure copy-paste from phone to computer

Some computers on my university block the keepass application which I use as a password manager. I'm thinking of building a small web application + Android app which lets me securely copy a string ...
2
votes
3answers
216 views

Why is it not standard practice to run password-based KDF's client-side?

In most protocols I have encountered in which a passphrase is used for authentication it is stored not in plaintext, but a PBKDF digest of it instead. This is obviously good. However what does not ...
2
votes
2answers
3k views

Username and password stored under form data in Chrome Dev Tools

When I record the network tab in Chrome Developer Tools when logging in to my site I find that the username and password are stored in plaintext under form data. You can also find it in Safari, ...
2
votes
1answer
2k views

Android access tokens and access to all google services

My questions is based on the asnwer on that question: Can the Gmail password be recovered from the Android Gmail app? So, as I understand when we setup google account on Android devices, it stores ...
2
votes
1answer
751 views

What is more secure for voice and SMS OTP: A random number or generated similar to HOTP?

Many providers are creating OTP authentication for their sign in. However I noticed that all the voice and SMS OTPs I've come across are a series of 6 digits... similar to the HOTP RFC Standard ...
2
votes
2answers
275 views

Is the date that a password was last changed useful to an attacker?

Obviously I want my application's users to change their passwords on some semi-regular basis (in fact a few of our apps must be UL-approved, and they require a system to enforce changing passwords ...
2
votes
1answer
618 views

How can passwords be stolen from Yahoo?

I always understood that servers don't actually store user passwords. Instead, they store hashes of passwords and then they validate the user input by applying the hash function, then compare the ...
2
votes
1answer
63 views

Is it safe to signup multiple applications with facebook?

Putting all eggs in one basket.. Is it safe to sign-up on different applications with facebook or such similar platforms, linkedin, twitter etc?
2
votes
2answers
182 views

Randomness of hash token in password reset link [duplicate]

I want to know what are the points to be kept in mind while creating a hash token for my password reset links. In particular, how to make it un-predictable for an attacker?
2
votes
1answer
575 views

Is Google's password recovery by entering an old password a bad practice?

When you try and recover your password on Google, you will eventually stumble across this screen, and it made me wonder: Isn't this type of password recovery from Google essentially the same as ...
2
votes
1answer
106 views

Security of shared “super pin” code table at meineschufa.de

The german brank credit report service "Schufa" uses a so called "SuperPIN" to enable users to reset their password. This super pin is a permutation of 30 lower and upper case letters and digits and ...
2
votes
1answer
212 views

How can I design a password reset function, which does not reduce security for users who can remember their password?

We have a web app for which some users want to have a password reset function. I don't want to enforce a particular level of security for the users. So if a user picks a strong password which she is ...
2
votes
3answers
310 views

How do web email clients store my passwords from other providers?

The situation comes down to this: When I enter in hotmail, it retrieves my messages connecting to other providers: they could only do so by using my email and password. Since I had signed in a ...
2
votes
1answer
394 views

Implementing password-reset in a web application by authtoken over email

I think I have a basic understanding of security concerns, but I feel like if I don't know everything, I'm going to implement lousy solutions. Below is my current strategy; Have I overlooked obvious ...
2
votes
1answer
176 views

encfs and passwords

I notice that encfs fails to mount a filesystem when a wrong password is entered. However, this capability of detecting whether a password is right or wrong can allow brute-force attacks to be ...
2
votes
1answer
586 views

How to manage passwords in a multi-tenant surrounding?

I am building a multi-tenant application in a shared database model. I would like to encrypt sensitive data so that only a particular tenant could have access to his data. What is the best mode to ...
2
votes
0answers
37 views

Is it a good idea to use password safes such as KeePass? [duplicate]

I'm starting to use KeePass as a password manager but I was wondering if such password safes are a good way to store passwords. Could a malware dump my RAM when the safe is open and retrieve all the ...
2
votes
3answers
202 views

Alternative ways to manage lots of Passwords since Lastpass was hacked & now acquired

There is a lot of debate on Reddit and other sites about whether the hack was or was not bad based on lack of salt to uncover the password hashes. Also, LogMeIn seems to have poor reputation & ...
2
votes
1answer
414 views

Is there more risk in changing administrator password locally vs from a centralized location?

I'm working on a mechanism to better handle group policy passwords in response to MS14-025. We formerly used this mechanism for setting the local admin account passwords on our workstations (primarily ...
2
votes
0answers
821 views

Adding an alternative password change scheme to passwd using PAM modules [closed]

I am trying to set up a PAM module that lets one add a conditional password change scheme. The intended behavior is like this: passwd do you want to change authentication token for ...
2
votes
0answers
76 views

How to secure all my passwords with Kee Pass 2 or something else? [duplicate]

Possible Duplicate: How to securely store my passwords? I have a lot of passwords to lots of logins across websites, SSH logins, e-mails and what not. Is there one program that can secure ...
2
votes
1answer
43 views

How do I securely store passwords in my database? [duplicate]

Creating a database for a small question and answer platform and need a way to attribute or create a password protection scenario for the user table.
1
vote
1answer
261 views

uninstall and reinstall after hacking [closed]

My computer has been hacked. If I uninstall and reinstall do I loose my files? The facebook tech tried to sell me a number of pkgs ranged $149-$299 and told me that my account was hacked as was my ...
1
vote
2answers
742 views

What is the safest way to store a password in a single file?

I've been reading about it. This article helped me a lot. But the more I read the more complicated it seems. For example: Is it better to use bcrypt, or PBKDF2, sha2 or something else for the salt? ...
1
vote
3answers
630 views

Should I use a Firefox master password or NTFS encrypt my profile?

As a follow-up to another question, is the encryption via Firefox' master password more secure than simply NTFS encrypting the profile folder? I.e. is there a convincing reason to add the ...
1
vote
4answers
105 views

For all the hassle it brings, why isn't password management handled by the database?

Right now, we might do something like password varchar(72), when defining a password column, with for example BCrypt. But there's a lot of folks that don't do this very effectively. Maybe they just ...
1
vote
3answers
346 views

How safe is it to provide my administrator account password for a 3rd party software: EasyUS Todo Backup?

I've been recently searching for a backup solution for my Windows desktop. That's when I came across this free software called EasyUS Todo Backup. (I know it's a mouthful but English doesn't seem to ...
1
vote
3answers
951 views

Why one time passwords using nested hash chain are not used?

I am wondering, why web sites do not use one-time passwords generated by hash chain. By that I mean that a client chooses a secret and after being salted, he applies some secure hash function F() on ...
1
vote
2answers
2k views

Portable KeePass and TrueCrypt

I ran some advice on the nets: Don't reuse your passwords. Make sure all the passwords you use are different. Use a password manager. An example is "Keepass". Set the master password to something ...
1
vote
3answers
359 views

For what do I hash user passwords with PDKDF2 when the user data is stored in the same database?

I'm hashing the passwors of my users with PDKDF2 right now. A user can gain access to his account with his password. When the user is logged in he can edit his personal information and do other stuff ...
1
vote
3answers
507 views

Is Password Complexity required at all

For a web-site I'm using what I hope is the most secure password storage scheme I can find, which boils down to having a salt and hashed password stored in a database of contacts:- Byte[] ...
1
vote
2answers
430 views

Seeking advice on how to build a box to brute force hashes? [closed]

I work in a startup security firm, and I need to build a GPU-based to brute force password/hashes, which can be used to validate password strength and test hashing algorithms. I expect some high ...
1
vote
2answers
281 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
1
vote
3answers
389 views

Sharing passwords through email can be considered insecure?

I'm responsible to create new accounts for some services on my job. Some of these service do not allow password change by the user, so in the case the user wants to change its password, he would need ...
1
vote
1answer
234 views

If a hacker gets into my PC can he get to my saved windows live mail passwords?

If a hacker gets into my PC can he steal my emails passwords? I use the windows live mail client to manage my email and I have saved my passwords when it asks me to save them. I run like 9 mail ...
1
vote
2answers
4k views

Is there a way to find out how long it takes John the Ripper to crack a particular password?

I am looking to test/demonstrate things like: when the supplied wordlist contains "abc123" and pw="abc123" then John cracks the pw in 1/2 a second... but if word list does not contain "abc123" John ...
1
vote
1answer
459 views

VeraCrypt: Is it possible to change the password after an encrypted container has been created?

I would like to know whether it is possible to change the password after an encrypted container has been created? The password I chose was a bit weak, and I would like to be able to modify it without ...
1
vote
2answers
173 views

Is there a way to securely store unsalted passwords?

So, obviously I'm not talking about username/password pairs here, I plan to store passwords with two salts and three hashes, but what occurred to me is that if I had a table where I kept pairs: ...
1
vote
2answers
71 views

Asking questions randomly from a set of questions instead of a password?

I was thinking about this for a while. Say we have an app for which there is an admin console, and we need to provide access to the admin console over the browser (yes, HTTPS). For authentication, ...
1
vote
2answers
375 views

Want to build a password manager using OpenPGP.js

I'm kind of tired of the password managers that are available around... I need one that's open source, that works on OSX, that lets me store .pem files and that I can trust. As I haven't found one, I ...
1
vote
2answers
396 views

Password database vs flat encrypted file [closed]

I am considering putting a forward a proposal to use a password database/manager instead of a flat (PGP) encrypted file for managed passwords for our team to access. I would like to hear some ...
1
vote
2answers
116 views

Logging in after password reset email sent (but not acted on)

Should a user be allowed to request a password reset email and then log in (i.e. disregarding the reset email and using their existing password) or should the current account be locked until the ...
1
vote
3answers
2k views

Implementing 'Remember Me' for a mobile application

I am developing a mobile application wherein I need to implement the 'Remember Me' functionality. There are certain pages within the application which require you to login. What I need to do is, if ...
1
vote
3answers
428 views

Logic for generating Strong Password?

I try to encrypt password using MD5 but there are decoders for MD5. So I'm worried about encryption of password for big website. Is there any logical suggestion or step function to generate strong ...
1
vote
1answer
539 views

If password is changed on Active Directory, can I ensure that PC must be restarted before logon with new password

Basically, if I have a Windows computer connected to a domain, how can I ensure that if the password is changed on Active Directory that the computer must be restarted before the new password takes ...