The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

0
votes
1answer
27 views

Additiona security measures for getting Chrome Saved Passwords via password management Hacked or Exposed?

I've noticed that there are quite a few applications out in the open now to decrypt chrome's password management features. I've seen hacks where a hacker remotes into a computer and runs an app ...
0
votes
1answer
83 views

Things to remember while building a password manager [on hold]

I want to build a simple password manager for desktop whose sole purpose is to store the passwords that can be read by the user as and when required. I am not considering any fancy features such as ...
4
votes
4answers
197 views

Using a password manager vs manual

was wondering, who still uses the traditional method of storing passwords (in envelope) in an actual physical safebox vs modern methods like password managers? what are the pros and cons of each ...
0
votes
2answers
59 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
11
votes
4answers
5k views

SSH password vs. key authentication

I've usually been told that public key authentication is strongly preferred over password authentication for SSH. However our previous admin was against public keys and only issued passwords and took ...
3
votes
1answer
78 views

Security analysis of Dashlane

I've been asked by a user whether I would recommend using the Dashlane password manager. I'm aware that other password managers have had some significant security problems, including XSS and CSRF ...
6
votes
3answers
265 views

Decentralised password recovery

Are there good/established techniques for password/key recovery in situations without a centralised service? (Anything goes, but I'd prefer solutions that distribute the recovery information across ...
46
votes
12answers
8k views

What to do about websites that store plain text passwords

I recently received an email from a popular graduate job web site (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
0
votes
1answer
135 views

Can any App Store app access all of my passwords?

Whilst researching another question, I've noticed that on OS X 10.9.4 there are many instances of Library/Keychains/login.keychain from ~ within the Data folder of what looks like apps from Apple App ...
8
votes
3answers
3k views

Is LastPass' locally stored One-Time-Password recovery a security problem?

If you forget your LastPass master password then LastPass provides the possibility to recover access to your vault using a One-Time-Password (OTP) which is stored locally but is initially disabled. ...
0
votes
5answers
426 views

What if I develop my own hash algorithm to create strong passwords from easy ones?

I came up with this idea but I cant figure out if it's good or bad, maybe you can help. My goal is: I want to create extremely strong passwords for my main accounts (gmail, skype and so on). I want to ...
0
votes
1answer
34 views

LastPass Bootstrap on New Android Phone [closed]

I've been using LastPass to manage all my passwords, including the password for Google account. The thing is, on a new Android Phone, in order to sign in (for Gmail, Play store, etc), I need the ...
17
votes
4answers
5k views

Does the average user really need a password manager?

I'd describe myself as an average tech savvy computer user. I have many accounts in forums, shopping sites, etc where I recycle two moderately strong password with small variation. These are account ...
3
votes
2answers
252 views

Password on login idea

In addition to the standard best practices on password logins. Has anyone considered a captcha like system but instead of just typing out what is in the captcha, the captcha will be directions on what ...
5
votes
3answers
3k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
5
votes
4answers
198 views

Are there any disadvantages to encrypting the password hash?

Is encrypting the password hash in database more secure than storing only the hash? Suppose we store encrypted SHA-256 result with AES instead of hash directly. Is this a good protection from a ...
7
votes
3answers
306 views

Is Firefox Password Manager less secure than LastPass?

After installing the LastPass password manager, I am presented with a login dialog including the option to "Disable Insecure Firefox Password Manager". (This option appears as long as the Firefox ...
1
vote
2answers
35 views

Should a 2FA recovery key be stored along with a password?

Many websites give you a recovery key or a list of recovery codes that can be used in place of 2FA tokens if you lose your phone or can't access your token generator. What are the recommended ...
1
vote
0answers
26 views

Is there an extension/command line for OSX Chromium to save website passwords in LOCALSTORAGE instead of the system's keychain?

My situation: I want to use a portable-app implementation of Chromium running on a removable drive, so I never leave any passwords stored on the kaychain of any computer I use. Portable Chromium is ...
0
votes
1answer
94 views

How many passwords should I have? [closed]

So I am upgrading my personal security. Most passwords that I use are generated by and stored in a password manager. There are a few places where I cannot use a password manager -- here, I plan to ...
3
votes
4answers
3k views

Should I enable domain authentication in my DMZ

Traditionally at my place of work we have an internal subnet that is completely protected behind our firewall. No ports are allowed to be opened to direct connections from the public network. We also ...
0
votes
1answer
51 views

Which is the best way to secure login password and safeguard user data? (even DBAs couldn't connect data to users)

Lets say that I'm building an website and a app which saves the users' secrets. The user logs in and can save into the app his deepest secrets. I'm worried about two things: - Should I save the ...
2
votes
1answer
206 views

Is Google's password recovery by entering an old password a bad practice?

When you try and recover your password on Google, you will eventually stumble across this screen, and it made me wonder: Isn't this type of password recovery from Google essentially the same as ...
10
votes
3answers
4k views

What are the risks of storing passwords in a GPG encrypted file?

I currently store my passwords in a text file encrypted using GPG -e (specifying my own public key). When I want to lookup a password I'll do something like gpg -d passwords.gpg | grep ...
20
votes
10answers
4k views

Password Management within an Organisation

Within an organisation there are many passwords such as those for root accounts on servers, hosting accounts, router logins and other such things, that need to be kept track of. I know in some ...
8
votes
1answer
676 views

Browser password manager vs third party password manager

How usable and secure are 3rd-party password managers like Roboform, Lastpass, and 1password from the built-in Chrome and Mozilla password managers? What are the advantages of using 3rd-party password ...
3
votes
1answer
127 views

Regarding Windows password and Chromes Remember password Feature

Google Chrome browser helps in password management by prompting users to remember their passwords for the websites. These saved passwords can be accessed from the browsers "settings" menu, and to do ...
9
votes
2answers
1k views

How does Google not care about “spaces” in Application-specific passwords?

I have recently setup "2-step verification" for my Google account. One of the features is the ability to create "Application-specific passwords " for devices that do not support the 2 step process. ...
1
vote
1answer
84 views

help identifying an IP address from email sent from my gmail account

Someone sent the following email from my gmail account. I believe it was hacked and if I can find the IP address I may be able to identify the person who did it. Here is the information. Please let me ...
5
votes
2answers
153 views

What are the weaknesses of my authentication scheme?

So, recently, after going through some infosec training (FutureLearn's Introduction to Cyber Security, which I heavily recommend as well-explained newbie material), I decided to take the plunge and ...
1
vote
3answers
104 views

Site allows both Partial and Complete password authentication; do they have my password in plain text? [duplicate]

My bank provides online banking facility like most of the banks these days. On the web they have Partial Password Authentication. Although I don't really believe in PPA providing extra security but ...
0
votes
1answer
40 views

how to get mysql user password? [closed]

I have a problem. I am creating a mysql user, and mysql will store the hashed password in user table. The problem is I dont know how to get the password back. As it is hashed, we can't get it back. ...
8
votes
6answers
925 views

Is it useful to protect hashed password with encryption?

Imagine that I am hashing the users' passwords with a random, long enough, salt, using key stretching, and a secure hash. Would it be more secure to finally encrypt the hash with a symmetric key?
4
votes
3answers
718 views

Question about a simple strong password management system

I am designing a system which requires access control via a strong password and for that purpose will use a password generation algorithm A that produces a strong password of length L >= 32. The ...
3
votes
1answer
252 views

Perfectly Robust Hashing Scheme, or Completely Over-Engineered?

This is going to get long, so prepare. Basis of the question is, Do all these steps improve security, or am I completely overthinking the problem? Are my assumptions/thought process valid? We all ...
2
votes
5answers
816 views

Looking for password manager in company [duplicate]

I was looking for solution everywhere, but maybe because lack of specialized words I can't find it. I've got a problem in finding a program, but I don't know how to describe it in one word so I'll ...
9
votes
8answers
1k views

Sequential password updates

Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse. What's to stop the user from changing the ...
0
votes
2answers
55 views

What is the solution for handling exceptions in password hashing schemes?

There is a technique called password hashing that describes creating unique passwords based on a unique master key and a static and arbitrary hash value. Using this technique, the user only has to ...
0
votes
1answer
52 views

Using PGP to encrypt emailed password reset token

Even if I am careful not to lose/forget my password for some web account, other people are not and so most sites have a password reset mechanism, often being a reset token sent to the registered email ...
1
vote
0answers
174 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
5
votes
2answers
206 views

Why would Keepass2 decrease the password quality after adding another character?

In Keepass2 I was typing in a password and noticed the number of bits went down. Why would this be? I was using two words and mixed them up by replacing certain letters with numbers.
160
votes
7answers
27k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, ...
-4
votes
1answer
216 views

Is there any way to hack the password of my neighbour WPA-PSK and WEP connection [closed]

Is there any way to hack the password of my neighbour WPA-PSK and WEP connection of WI-FI without using a keylogger. I tried a lots of softwares and efforts but unsuccessful. Can any one suggest. I ...
-1
votes
2answers
108 views

Can I get past information of what I typed in my computer or laptop with my keyboard [closed]

Once I forget my ID's password. I recovered it and changed it about a month ago but I forget again. Is there any way to see the details stored in laptop what i typed in past to till now from my ...
5
votes
3answers
303 views

Bash command argument security

Suppose I want to call a program that takes in a username and password to start. What are the risks with calling the program like ./prog --user 'User' --password 'Password' other than the obvious leak ...
12
votes
6answers
2k views

What is the simplest safe way to convey a password to another person? [duplicate]

What is the easiest way for two people – neither of whom are computer specialists and cannot meet in person – to send a password for an encrypted file that is attached to an email? The two simplest ...
1
vote
4answers
103 views

Password recovery flow - Send Password recovery to any email?

I am building a new MVC app. Considering this "forgot password" flow: 1)You enter an email. 2)You press "send recovery password". 3)An email awaits in the inbox, pressing the link in it brings you to ...
3
votes
2answers
196 views

How do web email clients store my passwords from other providers?

The situation comes down to this: When I enter in hotmail, it retrieves my messages connecting to other providers: they could only do so by using my email and password. Since I had signed in a ...
4
votes
1answer
107 views

How to store a group password for multi-user server-client web-application?

In a web application, accessed by browser via https, users need to be able to access data stored on a server in a MySQL database. Data has to be encrypted for several groups of users, where one group ...
2
votes
1answer
66 views

Security of shared “super pin” code table at meineschufa.de

The german brank credit report service "Schufa" uses a so called "SuperPIN" to enable users to reset their password. This super pin is a permutation of 30 lower and upper case letters and digits and ...