The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

3
votes
1answer
33 views

Password security when connecting to ldap with rails application

How do you store a username/password securely in a rails app when using it for many ldap searches? The connection in the app requires ldap_bind_authenticate(Net::LDAP.new, username, password) ...
2
votes
2answers
75 views

How significant is the risk in having someone email/IM an htpasswd hash?

I need to set users up for subversion access, and we're currently stuck using htpasswd for our credential storage. If a user sends me an htpasswd record via email (or GChat / off the record?), what's ...
1
vote
2answers
273 views

What impact do the frequency of password resets have on password reuse?

Wondering if there's any research behind the most common password reset cycle I've seen of 90-days, and if there's any research that gives any insight into how to optimize password resets to reduce ...
2
votes
1answer
57 views

Why do Facebook and Microsoft make you enter a code when reseting a password?

Typically when you reset a website password you receive an email. A lot of sites send you a link with a code on the end of it to click on which will take you to an 'enter new password' form. ...
23
votes
6answers
4k views

Source code as password

Passwords with a mixture of letters, numbers, and special characters are sometimes hard to remember. Is it secure to instead use a small amount of memorable source code as a 'passphrase'? As an ...
1
vote
2answers
112 views

Encrypting short data with RSA only?

I have a case where I need to create recovery accounts and I want to create them so that nobody knows the password to them until/unless necessary. Hence, I thought that I would do it using RSA - when ...
4
votes
3answers
345 views

Hashing vs “One-way Encryption”

When working on a website application, me and a friend asked a security expert (works at IBM) how to handle storing passwords. After hours of google searches (resulting in hours of ...
2
votes
1answer
166 views

How to find passwords in memory (password managers)

I’m trying to figure out if password managers such as last pass store passwords in plain text (or hash values that can then be decrypted with the master password) in memory after a user logs into the ...
4
votes
1answer
48 views

Countermeasures for a family-member attack on a password reset procedure

Given an account reset procedures, there are usually some recovery questions, and in better implementations a link will be sent to confirm the password change via email or SMS. Therefore, the attacker ...
1
vote
1answer
33 views

password storage and user authentication [duplicate]

I was going through (https://crackstation.net/hashing-security.htm) about doing password hashing / storage the right way. I understood most of it but i still have some questions and doubts which are ...
20
votes
5answers
10k views

Should I use FileZilla?

Recently, an increasing number of people have started advising moving away from FileZilla. However, the only reason I can see for this is that FileZilla stores the connection information in a ...
22
votes
10answers
4k views

Password Management within an Organisation

Within an organisation there are many passwords such as those for root accounts on servers, hosting accounts, router logins and other such things, that need to be kept track of. I know in some ...
15
votes
6answers
3k views

Managing website passwords for small team

I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
1
vote
1answer
47 views

If using a different password for every application is considered good practice, why is using a directory so widespread?

The title pretty much sums it all. We are always told that we should use a different password for every site and application, so that if one of those accounts is compromised, the others will still be ...
11
votes
7answers
2k views

Prevent denial of service attacks against slow hashing functions?

I've been thinking about bcrypt recently, and what I wonder is if there's a way to deal with the inherent (D)DoS problems with slow hashing functions. Namely, if I set up bcrypt so my machine takes ...
2
votes
1answer
54 views

Why use a password manager to protect browser logons when e-mail client is neglected?

Friends use password managers like lastpass or dashlane which have plugins for the browser, but not for the email clients (thunderbird or livemail). But surely the email password is the Achilles heel ...
1
vote
1answer
52 views

All UTF-8 characters for generated passwords

Why do a lot of password generators don't generate strong passwords including chinese, arabian...-characters? All generators I saw, also the included one in my password manager keepass, just output ...
3
votes
1answer
474 views

Security analysis of Dashlane

I've been asked by a user whether I would recommend using the Dashlane password manager. I'm aware that other password managers have had some significant security problems, including XSS and CSRF ...
0
votes
2answers
92 views

Why would Gmail ask for the last password I remember? [closed]

Yesterday I tried to recover the password for a Gmail account that I have created few months ago and during the process it asked me for the last password I remember. Why would it ask for that? I'm ...
-2
votes
1answer
42 views

designing secure telnet [closed]

i came across this question and have been thinking about it without a final solution. The question is to design a secure telnet. essentially to login using a username and password using telnet. I do ...
2
votes
1answer
49 views

Is it safe to signup multiple applications with facebook?

Putting all eggs in one basket.. Is it safe to sign-up on different applications with facebook or such similar platforms, linkedin, twitter etc?
1
vote
1answer
77 views

Designing a password auth/reg system

I'm designing a user reg/auth system for a website and came up with this design for password based authentication. I'd like to know if this is reasonable. (ignoring cookies for caching credentials, ...
0
votes
2answers
84 views

Need some docs that say we shouldn't upper the string when saving it as a password [closed]

I'm trying to find on the Internet some manual, guide or policy secure about applications should not convert lower string to upper string to store as password I mean, don't make ...
1
vote
1answer
74 views

How is password information stored and used on Android accounts?

How difficult would it be for someone who stole your device to gain access to the username and password information stored under the Settings -> More -> Accounts section of an Android device? ...
0
votes
0answers
56 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
20
votes
4answers
2k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
5
votes
3answers
1k views

Is GPG suitable as part of a password manager and generator?

I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
7
votes
4answers
435 views

Decentralised password recovery

Are there good/established techniques for password/key recovery in situations without a centralised service? (Anything goes, but I'd prefer solutions that distribute the recovery information across ...
1
vote
1answer
63 views

Password sharing with spouse or mate (bulk-change shared passwords (via cloud service))? [closed]

I've read on New Scientist magazine that in 80% of all cases when people in a relationship share a place where they live one of the spouses knows the other's password, thus making the question I am ...
22
votes
4answers
11k views

How can I be sure Lastpass really can't access my passwords?

The recent, widely publicized security incident where millions of Linkedin were exposed reminded me to tighten up my password practices. I'm looking at several password managers now and I'm especially ...
11
votes
5answers
6k views

SSH password vs. key authentication

I've usually been told that public key authentication is strongly preferred over password authentication for SSH. However our previous admin was against public keys and only issued passwords and took ...
45
votes
9answers
13k views

Why Disallow Special Characters In a Password?

The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
1
vote
1answer
76 views

Why should we focus on protecting root access on a home computer?

I understand why root access should be protected in general, especially in the context of a server environment. An unknown party can essentially control everything you do on a computer remotely ...
2
votes
0answers
27 views

sample/starter code to test for TRUSTe password requirements [closed]

Considering its a requirement for Truste certification I figure that the code to test for a password meeting Truste's password strength requirements has been written more than a few times. I was ...
2
votes
3answers
3k views

Microsoft password email reset link leads to different url?

...I am really annoyed and unsettled by the password reset email I just received from Microsoft. What should I think of this? My email client correctly told me that the underlying url is not the same ...
-2
votes
4answers
113 views

Getting password cracking time and byte storage from bruteforce?

I am stuck with this question, you can see it in the picture I have included below. PARTS (a and b) I know a-z will be 26^8, A-Z will be 26^8 guesses, and 0-9 will be 10^8 guesses. But I can't relate ...
6
votes
2answers
389 views

Does the secure attention key really increase security?

Are there any statistics on whether requiring the secure attention key to be pressed on login actually increases security ? I personally don't see the point of that : if you're after credentials, ...
0
votes
0answers
55 views

Web app crypto scheme

For learning purposes I am trying to build a web application (Symfony2, PHP) that allows users to post content and have their own password vault, everything encrypted. Since I want to users to be able ...
1
vote
3answers
82 views

Password reset question answer complexity

I need to implement a password reset feature for a system that will be controlled by a security question and answer pair. The problem is that I can't guarantee I'll have a valid e-mail address or cell ...
0
votes
1answer
76 views

Different password for each login - based on some variable

This might sound a silly question, but I was thinking this as and extra option(which is not required) mainly for advanced users, who want to protect their accounts even more. Lets consider that other ...
5
votes
1answer
73 views

How do people keep track of their employee's privileged accounts?

I am curious how the community here keeps track of a user's accounts. For instance, in the event of an employee transitioning from the company, how does security make sure that all user accounts the ...
5
votes
2answers
107 views

Share root access without sharing password

I am looking for a way to share admin privileges on some hosts without providing the admin password. From his link, I was thinking of using a primary host from which every user can sudo -u user to ...
0
votes
1answer
44 views

MD5 before PBKDF2 on legacy software

I am mantaining a legacy software that uses MD5 in the following way: The client asks for a 16 byte salt when authenticating an account. The server generates a 16 byte salt, links it to the account ...
1
vote
3answers
101 views

cleartext passphrase for keystore

How is passphrase for a keystore to be stored? we have all passwords encrypted and the key to encrypt is stored in keystore , so how is the passphrase for the keystore to be stored? in clear text? if ...
2
votes
1answer
352 views

Is Google's password recovery by entering an old password a bad practice?

When you try and recover your password on Google, you will eventually stumble across this screen, and it made me wonder: Isn't this type of password recovery from Google essentially the same as ...
1
vote
2answers
43 views

Asking questions randomly from a set of questions instead of a password?

I was thinking about this for a while. Say we have an app for which there is an admin console, and we need to provide access to the admin console over the browser (yes, HTTPS). For authentication, ...
1
vote
2answers
53 views

Should a password ever be presented in plain text to a user (On a website)? Is this illegal under UK Data protections act? [closed]

There is a website I use at work, external to our own. They have just presented with every employee with their plain text password and username via our internal website which requires our own logins. ...
22
votes
7answers
6k views

Why don't people hash and salt usernames before storing them

Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext. What I ...
54
votes
6answers
7k views

Is it safe to send clear usernames/passwords on a https connection to authenticate users?

I'm setting up a home HTTP server which can send and receive JSON data to/from different clients (Android and iPhone apps). I'd like to allow access only to certain users and I'm considering using a ...
4
votes
1answer
147 views

Protecting my high-value passwords against offline attacks

Summary I'm a LastPass user, but I have concerns about storing high-value passwords, like my bank password, online. I've read some posts on this topic but still have questions. How safe are ...