The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

0
votes
1answer
29 views

Inadvertent clickjacking on page causes LastPass login dialog to appear.

I like the idea of password managers but have become leery of the way they interact with browsers (especially given the recent "LostPass" exploit). Today I found that viewing a certain page with ...
1
vote
1answer
30 views

Password manager: should key file be stored on a different device than password db file (even if master pw used)?

Does it defeat the purpose of a key file to store it in the same location as the password database? What if a master password is needed also? For example I save my .kdbx to dropbox as a means to ...
5
votes
1answer
396 views

Regarding Windows password and Chrome's 'Remember password' Feature

Google Chrome browser helps in password management by prompting users to remember their passwords for the websites. These saved passwords can be accessed from the browsers "settings" menu, and to do ...
6
votes
3answers
191 views

How can I ensure safety when literal passwords are required

I have a case at my hands where my server needs to make automated API calls that require authentication. Hence the server will need to know the literal passwords to make those calls. What options do ...
5
votes
2answers
171 views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of ...
-3
votes
1answer
58 views

Making my password secure [closed]

I don't understand much about this topic and I am not highly involved with it in any way. I want to improve my password because I had my account stolen once (still a mystery has to how) but I was ...
3
votes
3answers
292 views

How do web email clients store my passwords from other providers?

The situation comes down to this: When I enter in hotmail, it retrieves my messages connecting to other providers: they could only do so by using my email and password. Since I had signed in a ...
0
votes
2answers
121 views

Hashed master password and generated encryption key in a password manager program

I'm writing a WPF password manager application to practice programming, so far this is the scheme I intend to use to store master password and individual site password: Master password: Generate a ...
76
votes
14answers
11k views

How can I protect myself from false accusations when our company practices password escrow?

During an internship for a small company, my boss created an account for me, so I generated a password and I used it. The next day, my boss told me to write down the password of my account on a piece ...
0
votes
5answers
276 views

What is the safest way to store passwords in a company for the case when the CISO leaves?

What is the best and safest way to store passwords in a company to ensure nothing is lost when the CISO leaves. I know this might be subjective and there isn't THE best way. But I'm curious about your ...
0
votes
0answers
15 views

Concealing passwords — ODBC access with service accounts

On a UNIX system (with ssh access), a Jenkins instance is installed which is being used as a scheduler for some builds. As part of the process, the user which instanced the job is mapped to a service ...
24
votes
10answers
7k views

Intel How Strong is Your Password page, good advice?

I came across this Intel How Strong is Your Password? page which estimates how strong your password is. It has some advice on choosing better passwords including that you should use multiple ...
96
votes
14answers
18k views

Why did customer services say using symbols in a password is insecure?

I am using an online service that I recently had to reset my password because I forgot it. When I went to change password I wanted to use one with a symbol !@£$%^&*(). When I clicked "confirm ...
1
vote
3answers
104 views

Trusted hardware password manager

I feel like I have a very common problem. I have too many passwords to remember, as well as PINs for credit/debit cards, access codes for doors at my workplace or combination locks. I don't seem to be ...
11
votes
3answers
2k views

how secure is passwordcard.org?

How secure is passwordcard.org? Assuming user follows recommended precautions: Don't read along with your finger, or the smudge will tell a thief where your password is. Keep your PasswordCard on ...
2
votes
2answers
82 views

staying not signed in: is it the safest procedure?

each time I do connect to a private or public network I log into websites by keeping the option "stay signed in" or "keep me signed in" unselected, so I have to re-type my username and passwod as ...
71
votes
10answers
12k views

If I enter a password on the wrong site, should I consider it compromised?

I have recently started to make use of a password manager and good password practices. I have a different password for each site that I use. If I accidentally use the password from another site when ...
3
votes
3answers
10k views

Sample challenge questions for use with self service password reset and validation

I'm building a secure password recovery feature similar to the one described here. During the final phase of the password recovery, the user is asked a recovery question to verify their identity. ...
4
votes
4answers
522 views

What to do when asked for a weak password

The guys who made the security for my country's state bank are completely nuts in all senses. Their internet banking password must be between 8 and 10 characters, and contain only letters and digits. ...
0
votes
1answer
40 views

Securing HSM's Login Keys

I have an PKCS#11 enabled application which interacts with HSM to store TDES keys. The HSM is initialized with the Security Officer (SO) password provided by the user while the application was first ...
6
votes
3answers
603 views

How do I store a swipe pattern in a password manager?

Password managers are great for when I don't want to remember dozens of logins, keys, passwords and more. But what if I have a few mobile devices lying around? They unlock with a swipe pattern but ...
-1
votes
1answer
60 views

What is the point in a password manager? [duplicate]

What is the point in a password manager? All someone has to do is crack the master password and then they have access to all the passwords than you have entered. I don't see how there is an added ...
1
vote
1answer
28 views

sharing a password for short term access to a shared resource

I sometimes need to delegate access to a single-user/shared user website for short term administration purposes (eg. with a junior administator for programmed maintenance). I have requested multiple ...
0
votes
1answer
67 views

Can anyone help me build a combo file suitable for my problem? [closed]

I have a router model C1000A company: CenturyLink Actiontec I bought it through eBay, my problem is that I can not connect to the Settings page because I do not have the admin password (the password ...
23
votes
5answers
3k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
0
votes
1answer
77 views

How to manage all the unlock codes for thousands of mobile devices (iPads)?

I need to manage (assign, store, notify, etc.) the unlock code for thousands of mobile devices (iPads). How to manage optimally this unlock code? Maintenance users should be able to access the unlock ...
4
votes
1answer
168 views

TrueCrypt LUKS keyfile and password

I understand that a TrueCrypt volume may be encrypted with a password AND a keyfile. As far as I can tell, A LUKS volume may use EITHER a password OR a keyfile, but not both simultaneously for ...
2
votes
0answers
57 views

Can I see the contents of SAM file with a plain text-editor? [migrated]

I have exported the SAM and SYSTEM as Registry Hive Files and I was wondering if it is possible to look inside those files to see what they contain? I opened them with Notepad but I didn't ...
3
votes
1answer
42 views

Sending a token with a request from one app to another

Say I have an application written in some language and framework (Python + flask, for instance), and have a great deal of the functionality requiring login, and authentication via JWT. Now I want to ...
22
votes
3answers
1k views

How can we accurately measure a password entropy range?

I've given myself the task of writing code that determines the strength of a password, and really want to break out of a lot of already established ways we do that, as they're often lacking, not ...
9
votes
7answers
2k views

How to securely counter users from adding a single digit to their old password upon creating a new one? [duplicate]

Let's say that in the password policy the password history is defined to remember the last 10 passwords. I understand password history exists so that if a password is recovered from a compromised ...
19
votes
5answers
5k views

What is a good practical (and sane) way to manage all your passwords for online sites?

I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords. This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
5
votes
1answer
88 views

How to implement a password change policy when user's centralized password is in a lot of places?

I would like to implement password changing in an organization but they have the domain controller/LDAP passwords "all over the place". They have the passwords in a lot of places, for example, in ...
0
votes
2answers
96 views

Does the password manager store the passwords in memory if I lock my computer?

After I unlock my PC the password manager (any type) needs the password again to unlock it's DB containing passwords. Question: Does the password manager store the passwords/DB in memory when the PC ...
1
vote
0answers
26 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
1
vote
1answer
71 views

Copy-and-pasting plaintext data from encrypted container

Suppose we have sensitive information stored in plaintext within a dm-crypt/VeraCrypt encrypted file and this information is copy-and-pasted by a user into a web browser after decrypting (this could ...
11
votes
2answers
3k views

Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email

Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance MSFT even went to far as create ADMINSDUser rights to put ...
-2
votes
1answer
62 views

Password complexity policy and practicality [closed]

If you are a user and your company implements a password policy that says your password must have at least 8 characters, at least 1 number, at least one alphabet and at least 1 special character, ...
-1
votes
2answers
33 views

What could be a suitable solution to single factor authorization worksheet bank password circulation with no control?

Passwords for various banks are written in an excel sheet and this excel sheet is password protected. However, there is no control on circulation of this sheet, for many banks only single factor ...
3
votes
2answers
89 views

How many characters should a password be? [duplicate]

I use the lastpass password manager. Lastpass can create a password from 10-100 characters. I would like to know what is the recommended value. I had a look a look at some questions like this and I ...
3
votes
1answer
48 views

Should I use Google Accounts or my own hashed password system?

I have a relatively critical control-panel online. If someone with malicious intent were to log in, there would be a significant risk to property. I will be hosting said site on Google App Engine, ...
73
votes
14answers
7k views

How to store passwords written on a physical notebook?

Answers to the question "How safe are password managers like LastPass?" suggest that storing personal passwords on a physical notebook might be a reasonable option: I know someone who won't use ...
4
votes
2answers
70 views

Sending encrypted file and password by email

I know that a password for an encrypted file distributed by email should be sent out of band (i.e. not via email), and that there are better options for distributing information securely. But, let's ...
27
votes
9answers
3k views

Best way to administer all my passwords

I am trying to figure out what the best solution is to store different types of passwords: Personal passwords (my personal email, my company's email, all the services I use to buy things like ...
24
votes
6answers
16k views

Should I use FileZilla?

Recently, an increasing number of people have started advising moving away from FileZilla. However, the only reason I can see for this is that FileZilla stores the connection information in a ...
6
votes
1answer
160 views

Password security when connecting to ldap with rails application

How do you store a username/password securely in a rails app when using it for many ldap searches? The connection in the app requires ldap_bind_authenticate(Net::LDAP.new, username, password) ...
0
votes
1answer
89 views

LastPass website requests Master Password when creating the account

When I wanted to tryout out LastPass today, I was stunned that the webpage form for creating the account at LastPass actually requested the "Master Password", which is the same "Master Password" that ...
5
votes
1answer
81 views

How does Nautilus store passwords on Ubuntu?

When I mount a LUKS volume, I get these options: Forget password immediately Remember password until you logout Remember forever I assume the first is the safest, and I can work on the files until ...
3
votes
1answer
60 views

Storing passwords in text files inside Ubuntu encrypted home directory

I'm interested in getting offlineimap working with my Gmail account so that I can read my emails while offline. My biggest concern with this is that it's a pretty big workaround to get the ...
7
votes
3answers
3k views

Hashing vs “One-way Encryption”

When working on a website application, me and a friend asked a security expert (works at IBM) how to handle storing passwords. After hours of google searches (resulting in hours of ...