The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

3
votes
1answer
98 views

API to change passwords?

After I learned last week that the login data of some of my accounts was leaked, I had to change my passwords for more than 30 sites. That was tedious! As luck would have it, some days later we ...
3
votes
1answer
44 views

How to minimize security risk when having to work with decrypted (plain text) passwords due to 3rd party API design

I'm developing an application (C#) for Microsoft SharePoint platform that uses SQL Server's (2008 R2) Remote BLOB Storage (RBS) technology. To accomplish certain client-side tasks, I must obtain ...
0
votes
1answer
179 views

The Problem with Changing All Passwords for HeartBleed [duplicate]

One thing that's been bugging me in relation to the discovery of the Heartbleed OpenSSL flaw is the recommendation that everyone should run to their computers in a panic and change all of their ...
3
votes
3answers
483 views

Encrypting passwords?

I am planning on creating a text file to store my passwords, so I only need to remember 1 password (at the moment, I have about 20 long/complex passwords in my mind, and am worried that I might forget ...
3
votes
1answer
92 views

Password Managers: encrypted database vs hashing strategy

I'm considering moving to a password-management strategy based on supergenpass or something similar. This is an alternative to other password managers where instead of having a database of passwords ...
3
votes
3answers
165 views

Is there a decentralized version of LastPass?

I am using LastPass for managing passwords on multiple computers. However, LastPass extension (at least the chrome version) is running some opaque binary code through Native Client, and I just feel ...
0
votes
1answer
110 views

are there serious weaknesses in this free password management system?

I want to protect my passwords for free and store them on a machine that might get stolen but have the passwords very securely backed-up in the cloud, again for free, and minimize the total lifetime ...
16
votes
2answers
531 views

Bank accepts different password to the one that I set

I'm not particularly well versed in IT security so please bear with me. I recently discovered that my bank's online system will accept passwords that consist of the correct password, and a string of ...
20
votes
6answers
15k views

How safe are password managers like LastPass?

I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long. How safe are password ...
-1
votes
0answers
17 views

User experience monitoring [closed]

Has anyone come across User experience monitoring software like Logfiller before? It appears to be a totally new category of security / log management, and wondered if there was actual value in it. ...
11
votes
5answers
4k views
+50

Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?

Justin Schuh defended Google's reasoning in the wake of this post detailing the "discovery" (sic) that passwords saved in the Chrome password manager can be viewed in plaintext. Let me just directly ...
0
votes
1answer
35 views

Is there an anti virus that protects processes from being injected code to?

As title says, is there an av that does that? And if not, is there any other program that protects processes like lsass in windows, apart from protected process utility in win8.1?
1
vote
0answers
26 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
244
votes
18answers
35k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
1
vote
3answers
169 views

Is it safe to back up passwords to the “cloud”

I have a small Truecrypt volume that contains just my password data (using Bruce Schneier's Password Safe application). I'd like an offsite, secure, backup of that Truecrypt volume. Currently, I am ...
0
votes
1answer
129 views

How do you secure service account password on enterprise windows enviroment?

I'm suppose to have a large environment ( 500+ servers ) all Windows based joined to Active Directory domain. Some domain accounts are used for application\middleware authentication that needs high ...
0
votes
1answer
41 views

Multiple user encryption-key store

Let's say I have an application that accesses an encrypted datastore, and I want the admins to be able to unlock the datastore upon application startup (and then the application will have access to ...
0
votes
0answers
50 views

Utilizing PBKDF2 With OpenSSL crypto library [migrated]

I want to utilize the PBKDF2 algorithm with SHA1 HMAC (based on this answer). How can I utilize this through the crypto library? I started by looking at man openssl, but the openssl passwd command ...
0
votes
1answer
43 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
0
votes
1answer
39 views

How does LM hash deal with passwords that are between 8 and 13 chars

If its 14 then it splits it to 7&7, but how about 13 characters? 7&6? How does it work?
4
votes
3answers
528 views

How often should I reset my salt?

I'm thinking of implementing a salt recycling scheme on my user credentials database. The motivation behind this decision is that even if the attacker manages to get his hands on the database and has ...
6
votes
1answer
996 views

Free/Libre software to handle TCG OPAL 2.0-compliant Self-Encrypting Drives (SEDs)?

I'm in search of a free/libre software that is able to handle OPAL (2.0)-compliant SEDs (i.e. manage the setting of Pre-Boot Authentification (PBA) environment, encryption keys...). It could be a ...
-1
votes
4answers
136 views

How do big companies and wealthy people secure their information? And how can I secure mine?

I've recently had some success and traffic increase with an online business I own and due to that someone has hacked my domain email and twitter accounts. My bank password is the same and I just ...
11
votes
7answers
6k views

Are services like “LastPass” less secure, as they have all my passwords protected by a single password?

If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security?
3
votes
1answer
58 views

Webpage sent me my password in clear text can it be secure? [duplicate]

I registered for a webpage years ago and have been using it without issues, today I made some changes to my account and they sent me an email containing my username and password in clear text. I ...
3
votes
1answer
72 views

Guidance for “image based” password reset challenge

Thycotic has a Password Reset Server that allows the user to select from several images. What general guidance is there for an image-based password reset challenge question? Examples may include ...
1
vote
2answers
85 views

Is checking against password lists a good way to enforce a secure password policy and possibly detect dictionary attacks on a web-based app?

I have written a script to check a given password against a ~65 million long list of passwords collated from various lists released after hacking attempts. I am thinking about incorporating it into ...
2
votes
3answers
102 views

Why is it not standard practice to run password-based KDF's client-side?

In most protocols I have encountered in which a passphrase is used for authentication it is stored not in plaintext, but a PBKDF digest of it instead. This is obviously good. However what does not ...
2
votes
5answers
213 views

Password Recovery - what if user can't complete 2nd step?

I'm thinking out my password recovery logic for an ecommerce system. Some backround: Passwords are stored using bcrypt, password recovery involves the standard reset link, which then can be used to ...
3
votes
3answers
102 views

Alternative to security questions for account recovery when email isn't an option

I'm working on a project whereby a certain level of anonymity is required for users. One of stipulations is that no email is used at all, as it makes the barrier to entry too high for people who want ...
2
votes
3answers
91 views

What is a good algorithm for memorizing a password in a few minutes?

Let's say I am following good security policy and picking passwords that are: Long Complex (passphrases where possible, otherwise random strings with special characters) Unique (completely ...
0
votes
2answers
58 views

Logging in after password reset email sent (but not acted on)

Should a user be allowed to request a password reset email and then log in (i.e. disregarding the reset email and using their existing password) or should the current account be locked until the ...
13
votes
3answers
2k views

Should I use FileZilla?

Recently, an increasing number of people have started advising moving away from FileZilla. However, the only reason I can see for this is that FileZilla stores the connection information in a ...
3
votes
2answers
143 views

How does my bank knows my second and forth chars of my password

I see that the new login mechanism used by some banks in UK and also used by visa debit authentication is to ask for three random characters from your password at login (for example second, ninth and ...
18
votes
6answers
1k views

How to avoid scripts with hardcoded password? [duplicate]

I have some scripts on Ubuntu Linux machine that logs in to a database server to run some maintenance daily. To login to the database, I need a password and right now it is hardcoded in the script. ...
7
votes
3answers
2k views

Is LastPass' locally stored One-Time-Password recovery a security problem?

If you forget your LastPass master password then LastPass provides the possibility to recover access to your vault using a One-Time-Password (OTP) which is stored locally but is initially disabled. ...
0
votes
1answer
149 views

Why don't we do dual password instead of forgot password?

You can see a link Forgot Password? nearby almost all login form. As I mentioned in question, Since passwords are completely protected from outside access unless owner reveal, I come up with this ...
27
votes
8answers
2k views

Is there a method of generating site-specific passwords which can be executed in my own head?

I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
1
vote
1answer
75 views

Is it a good idea to give users an additional password that they do not control?

It's a given that users will choose bad passwords. Why not help them out? Using a securely-random choice from a large dictionary, choose one or two words and tell the user to write them down. When ...
34
votes
9answers
2k views

Why do password strength requirements exist?

Password strength is now everything, and they force you to come up with passwords with digits, special characters, upper-case letters and whatnot. Apart from being a usability nightmare (even I as a ...
15
votes
5answers
1k views

Storing account credentials for spouse/loved one?

Just in case something ever "happens" to me... What are some best practices for sharing various account information (bank, email, etc.) with spouses/loved ones in a way that is safe but also not ...
0
votes
1answer
69 views

Should I log wrong passwords? [duplicate]

I have a public-facing web application where anyone can register an account. The passwords I store are salted and hashed. When someone tries to overtake the account of someone else through guessing ...
3
votes
6answers
390 views

Methods for remembering passwords around the web

What's the least painful way to manage passwords for user accounts that you have on various sites? I see only 3 options: Password manager. Passwords can be different and strong, but the downside is ...
2
votes
1answer
421 views

Where to keep key file used as composite key for Keepass 2

I used to use a master password and "Windows User Account" to get into my password datasbase with Keepass 2. Then I realized the "Windows User Account" option is garbage because if you ever want to ...
1
vote
0answers
58 views

How secure is a Python Pyro daemon for storing a password?

I am using the Pyro package to create a daemon which will, upon startup, prompt for a password, and then the daemon will store that password as long as it is running. Other scripts will then make a ...
1
vote
2answers
141 views

Username and password stored under form data in Chrome Dev Tools

When I record the network tab in Chrome Developer Tools when logging in to my site I find that the username and password are stored in plaintext under form data. You can also find it in Safari, ...
3
votes
1answer
68 views

What are industry-standard recommended practices to protect user information in an Android app?

I am developing an Android app that will potentially handle sensitive user data, and some of it may be even considered medical data (for example user height, weight, alergies, etc). What would be the ...
10
votes
3answers
2k views

SSH password vs. key authentication

I've usually been told that public key authentication is strongly preferred over password authentication for SSH. However our previous admin was against public keys and only issued passwords and took ...
3
votes
3answers
2k views

Should I enable domain authentication in my DMZ

Traditionally at my place of work we have an internal subnet that is completely protected behind our firewall. No ports are allowed to be opened to direct connections from the public network. We also ...
1
vote
3answers
182 views

Sharing passwords through email can be considered insecure?

I'm responsible to create new accounts for some services on my job. Some of these service do not allow password change by the user, so in the case the user wants to change its password, he would need ...