The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

-1
votes
1answer
21 views

Is there any way to hack the password of my neighbour WPA-PSK and WEP connection

Is there any way to hack the password of my neighbour WPA-PSK and WEP connection of WI-FI without using a keylogger. I tried a lots of softwares and efforts but unsuccessful. Can any one suggest. I ...
-1
votes
2answers
64 views

Can I get past information of what I typed in my computer or laptop with my keyboard [closed]

Once I forget my ID's password. I recovered it and changed it about a month ago but I forget again. Is there any way to see the details stored in laptop what i typed in past to till now from my ...
5
votes
3answers
248 views

Bash command argument security

Suppose I want to call a program that takes in a username and password to start. What are the risks with calling the program like ./prog --user 'User' --password 'Password' other than the obvious leak ...
11
votes
6answers
2k views

What is the simplest safe way to convey a password to another person? [duplicate]

What is the easiest way for two people – neither of whom are computer specialists and cannot meet in person – to send a password for an encrypted file that is attached to an email? The two simplest ...
1
vote
4answers
74 views

Password recovery flow - Send Password recovery to any email?

I am building a new MVC app. Considering this "forgot password" flow: 1)You enter an email. 2)You press "send recovery password". 3)An email awaits in the inbox, pressing the link in it brings you to ...
3
votes
2answers
165 views

How do web email clients store my passwords from other providers?

The situation comes down to this: When I enter in hotmail, it retrieves my messages connecting to other providers: they could only do so by using my email and password. Since I had signed in a ...
4
votes
1answer
86 views

How to store a group password for multi-user server-client web-application?

In a web application, accessed by browser via https, users need to be able to access data stored on a server in a MySQL database. Data has to be encrypted for several groups of users, where one group ...
-1
votes
0answers
42 views

Use of Password manager [duplicate]

Is it safe to use Password Managers to save different passwords? If so please suggest good password manager.
2
votes
1answer
58 views

Security of shared “super pin” code table at meineschufa.de

The german brank credit report service "Schufa" uses a so called "SuperPIN" to enable users to reset their password. This super pin is a permutation of 30 lower and upper case letters and digits and ...
282
votes
20answers
47k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
2
votes
1answer
186 views

Is there more risk in changing administrator password locally vs from a centralized location?

I'm working on a mechanism to better handle group policy passwords in response to MS14-025. We formerly used this mechanism for setting the local admin account passwords on our workstations (primarily ...
0
votes
1answer
92 views

Can any App Store app access all of my passwords?

Whilst researching another question, I've noticed that on OS X 10.9.4 there are many instances of Library/Keychains/login.keychain from ~ within the Data folder of what looks like apps from Apple App ...
2
votes
1answer
156 views

Storing a user's password in a retrievable manner

I currently store my users passwords as PBKDF2 hashes, for the authentication part of my web application. Each user also has their own private key and public key (also stored in their user profile in ...
3
votes
2answers
68 views

How do I respond to a spam server that invalidates my tokens? [duplicate]

Our web application sends a one-time use generated token, in the form of an URL, to clients who forget their passwords. This works except for the case where the client is sitting behind another server ...
12
votes
5answers
3k views

What is a good practical (and sane) way to manage all your passwords for online sites?

I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords. This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
3
votes
3answers
183 views

Is it ok for software to store passwords locally in plain-text?

There are already plenty of questions about what to do when websites store plain-text passwords. But this one is a little different. I use a piece of open-source (see below) software for playing ...
1
vote
0answers
41 views

Decentralised password recovery

Are there good/established techniques for password/key recovery in situations without a centralised service? For example: I can imagine a system where a recovery key is generated, split using secret ...
-3
votes
2answers
365 views

How to secure a login.php file? [closed]

I have a hand built website, and am triying to build a cms/admin-panel, and my username and password, are not stored in a database, but, in a two setup file like seen below. index.php <?php ...
1
vote
1answer
72 views

Could Mental Cryptography(?) be useful to ordinary users?

I recently read about 'Mental cryptography' or 'Metal hash' process from this post: Mental cryptography and good passwords (via this message board ...
1
vote
1answer
155 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
7
votes
6answers
955 views

Storing password hashes without a correlation to the user account

I read an interesting article about an alternative way to store password hashes ans was rather intrigued. A better way to store password hashes? The primary concept is having a large table full of ...
0
votes
2answers
42 views

How to decide whether to password protect key files in addition to full disk encryption

It is customary to protect certain critical files with a password. For example: PGP keys, VPN keys, password managers, etc. The practice dates back to before full disk encryption being common. These ...
16
votes
4answers
16k views

Is it possible to easily retrieve Thunderbird's passwords with access to HDD?

I know Firefox 8 stores it's passwords in a SQLite database, which can easily be stolen with access to the HDD! What about Thunderbird 8? How does it store the passwords and how can one retieve them? ...
3
votes
1answer
88 views

Hard Coded Credentials in Equipment Serviced by Many People

According to National Public Radio, Ruben Santamarta has reported that gear aboard airliners and accessible through on-board WiFi or in-flight entertainment equipment uses hard-coded login ...
-4
votes
1answer
60 views

what if an operating system can change your password [closed]

Everyone want security for their pc/laptops... NO DOUBT... So we protect them by some password. 'Longer password, more security' this is the tag line. But what if our computer can change our ...
23
votes
2answers
1k views

Juggling bus factor & separation of duties on a small team?

I am lead dev on a team of five people. Only three are coders. And only the coders are really technical enough to do a roll-out of our application to a production server. Our app is pretty ...
2
votes
1answer
166 views

Correct way to perform secure two way encryption on a web site

I'm currently working a project that requires me to store sensitive information (mainly passwords and other information) on a web server via a standard python/flask website. This information is to be ...
5
votes
3answers
153 views

How secure is this method to remember security questions?

So I found an interesting method of remembering those pesky security questions. Basically, the guy takes a hash of the question (IE what is your mother's maiden name?) and then appends his own ...
16
votes
8answers
6k views

Is TrueCrypt safe enough to store clear-text-passwords?

The reason: I want to be able to use a portable USB drive to access my passwords on any machine and OS. TrueCrypt seems to be the only program that has sufficient support on all major platforms. So I ...
19
votes
4answers
5k views

Should I use FileZilla?

Recently, an increasing number of people have started advising moving away from FileZilla. However, the only reason I can see for this is that FileZilla stores the connection information in a ...
155
votes
7answers
26k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, ...
19
votes
4answers
3k views

The registration confirmation email contains my password: do they keep it in plaintext?

I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
2
votes
1answer
93 views

How can I design a password reset function, which does not reduce security for users who can remember their password?

We have a web app for which some users want to have a password reset function. I don't want to enforce a particular level of security for the users. So if a user picks a strong password which she is ...
-1
votes
3answers
79 views

What does one call the strategy of using “pre-password transforms” as passwords?

Suppose that instead of using, say, Google, let me in! as my Google password, I used some consistent transform of this string, say ZWE1NjMyNm? What search keywords would be helpful to search for ...
2
votes
2answers
73 views

Should security phrases be hashed?

I didn't think of this before but today I just realised that in soke sites, pw recovery is possible if you know the answers to security questions like What is your mother's maiden name? In this ...
-4
votes
3answers
129 views

Is MS Windows more secure than Linux on this aspect?

The administrator account can be renamed which means the hacker needs to figure out two pieces of information : the user name and the password while there is always one root account in Linux named ...
0
votes
0answers
54 views

What do I do when a ISP stores passwords as plaintext

I am living in a student housing in UK. Today, I was suddenly asked to put in my log in credentials for the internet service and because I forgot the credentials, I went to find my password section. ...
2
votes
3answers
194 views

Should I implement my own local password hash?

Having a more-than-elementary knowledge of internet security, I've realized that some web applications and websites I use implement a less-than-ideal password policy. Some examples include: ...
49
votes
6answers
7k views

Is it safe to send clear usernames/passwords on a https connection to authenticate users?

I'm setting up a home HTTP server which can send and receive JSON data to/from different clients (Android and iPhone apps). I'd like to allow access only to certain users and I'm considering using a ...
3
votes
7answers
971 views

Sharing passwords and credentials between founders and employees

What's the best way to share passwords and credentials from the business's various accounts in a secure manner? For example, email doesn't work because if someone gets into one of your employee's ...
0
votes
0answers
24 views

Syncing service passwords during offline installations

Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of ...
0
votes
2answers
138 views

Does cPanel store my login password as plaintext

On attempt to change my cPanel password I was warned that: Your password could not be changed because the new password failed with the following reason : (is too similar to the old one), please try ...
0
votes
1answer
65 views

I store my passwordstore.org data in the cloud. Are my passwords safe?

I use pass to manage my passwords and sync this manually to a private git repo in the cloud. I believe this is safe because the repo is not public and, more importantly, the data is GPG encrypted. ...
0
votes
2answers
113 views

Want to build a password manager using OpenPGP.js

I'm kind of tired of the password managers that are available around... I need one that's open source, that works on OSX, that lets me store .pem files and that I can trust. As I haven't found one, I ...
4
votes
1answer
59 views

How to help users manage password portfolios based on risks of compromise?

A framework for modeling password management risks and costs, and the beginnings of a good strategy for users to help them manage passwords for their often large portfolios of accounts is outlined in ...
1
vote
2answers
63 views

How Empathy - a messaging program, is storing my passwords

I am connected to my chat accounts via Empathy, a messaging program, and it has my password stored in it. I am really curious to know how it is storing the passwords, and if there is any they can ...
4
votes
5answers
418 views

How to memorise multiple xkcd-style passwords for particular services?

I could use a password manager, but I don't like relying on another entity than myself to store my passwords, and it would screw me over if I find myself on the internet in a new location without the ...
35
votes
9answers
3k views

Why do password strength requirements exist?

Password strength is now everything, and they force you to come up with passwords with digits, special characters, upper-case letters and whatnot. Apart from being a usability nightmare (even I as a ...
2
votes
3answers
172 views

How secure could the LastPass Android application be with a four-digit PIN?

I use LastPass for Android with the PIN option. After having entered my full Lastpass password the first time that I used the app, now when opening the application I have access to all my passwords ...
4
votes
3answers
143 views

What implementations are possible for dual control?

An organization requires employees to use 2 person authentication in some scenarios. That is, when accessing, say, a server, secret knowledge from 2 people should be used for authentication. No one ...