The functions performed by the person or processes responsible for security of passwords on a given system.
49
votes
8answers
5k views
Can anyone provide references for implementing web application self password reset mechanisms properly?
We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address).
My problem is that I ...
198
votes
16answers
19k views
How does changing your password every 90 days increase security?
Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
20
votes
1answer
2k views
Are there more modern password hashing methods than bcrypt and scrypt?
This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt.
What I'm wondering is if there are any ...
17
votes
4answers
1k views
What should be used as a salt?
I always hear that it is best to use salts on top of stored passwords, which then somehow gets concatenated and hashed afterwards. But I don't know what to use as a the salt. What would be a good ...
22
votes
7answers
1k views
Is there a method of generating site-specific passwords which can be executed in my own head?
I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
35
votes
5answers
2k views
Do security questions subvert passwords?
Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
17
votes
4answers
999 views
How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?
In some environments, it is required that users change a certain number of characters every time they create a new password. This is of course to prevent passwords from being easily-guessable, ...
7
votes
4answers
1k views
What is a good practical (and sane) way to manage all your passwords for online sites?
I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords.
This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
25
votes
8answers
2k views
Why would salt not have prevented LinkedIn passwords from getting cracked?
In this interview posted on Krebs on Security, this question was asked and answered:
BK: I’ve heard people say, you know this probably would not have
happened if LinkedIn and others had salted ...
32
votes
11answers
3k views
What to do about websites that store plain text passwords
I recently received an email from a popular graduate job web site (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
24
votes
6answers
1k views
Is it OK to tell or give your password to an admin?
I'm working in a small company (20 employees) as a senior software engineer.
After some email problems, our newly employed IT administrator asked me for the password to our hosting company to see why ...
14
votes
9answers
2k views
Password Management within an Organisation
Within an organisation there are many passwords such as those for root accounts on servers, hosting accounts, router logins and other such things, that need to be kept track of.
I know in some ...
15
votes
3answers
2k views
Password manager vs remembering passwords
I have always thought that you are not supposed to use a password manager but to keep your passwords in your head, but lately I have thought about the pros and cons of having a password manager.
Some ...
12
votes
3answers
1k views
Recommended policy on password complexity
Is there any research on how how a password complexity policy can increase or decrease the quality of passwords?
If you don't have any requirements on the password then probably 90% of users will use ...
4
votes
11answers
3k views
Definitely safest password storage scheme?
I already asked this on StackOverflow but I was suggested this would be a better suited place and I found no way to "move" the question so I have to copy it.
Believe, I know, there are hundreds ...
9
votes
8answers
666 views
Password management/synchronization?
Is there a good enough service I could run on my own home (Linux) server that I could use for storing/accessing/synchronizing passwords so they could be available for me from multiple ...
18
votes
5answers
712 views
Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?
I just wanted to know if you can increase the cost (iterations) of those two algorithms off-line.
I want to increase the cost every year of my users passwords.
One solution is to recalculate them ...
8
votes
4answers
943 views
Passwords - any statistics on user behavior?
I'm looking for analyses of how users choose and use passwords. I'm sure there are many resources out there that analyze user passwords. For instance, I've seen many people analyze dumps of password ...
9
votes
1answer
238 views
Reversible, recoverable user data encryption scheme
From this earlier question, I have a general need to obfuscate a set of third-party credentials stored in a user account, which are then used in an internal Winforms software client. The scheme from ...
5
votes
1answer
1k views
Does NIST really recommend PBKDF2 for password hashing?
We hesitated between BCrypt and PBKDF2 for password hashing. In many forums and blogs people say something like "In their Special Publication SP 800-132 NIST basically recommends using PBKDF2 for ...
5
votes
6answers
810 views
Prevent denial of service attacks against slow hashing functions?
I've been thinking about bcrypt recently, and what I wonder is if there's a way to deal with the inherent (D)DoS problems with slow hashing functions. Namely, if I set up bcrypt so my machine takes ...
4
votes
3answers
242 views
How to evaluate a password manager?
How can we quantify the trade-off between password aggregation and convenience?
Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce ...
3
votes
6answers
447 views
Sharing passwords and credentials between founders and employees
What's the best way to share passwords and credentials from the business's various accounts in a secure manner?
For example, email doesn't work because if someone gets into one of your employee's ...
19
votes
3answers
811 views
Am I wrong to believe that passwords should never be recoverable (one way hash)?
I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
8
votes
2answers
479 views
Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email
Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance
MSFT even went to far as create ADMINSDUser rights to put ...
7
votes
6answers
1k views
How to securely store my passwords?
Regarding this:
Are passwords in memory?
So does someone have a good idea on how to securely store my passwords?
The: "passwords.txt" -> ctrl+c; ctrl+v a passw is not very secure.
I have passwords ...
7
votes
2answers
351 views
How can IA-5(1)(b) be enforced on Windows systems?
Note: I've also posted a question for this issue on non-Windows systems.
In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include ...
5
votes
2answers
153 views
How can IA-5(1)(b) be enforced on non-Windows systems?
I have a question posted already for this issue in Windows systems, and thought that non-Windows systems should perhaps be covered separately.
In NIST SP 800-53 Rev. 3, IA-5 is the control addressing ...
4
votes
3answers
368 views
Does LastPass' multi-device functionality significantly compromise its security?
I think LastPass is a great consumer product because it allows users to conveniently utilize unique strong passwords for each site they use it with. It does encryption locally, but the fact that I can ...
33
votes
7answers
2k views
“Real” Salt and “Fake” Salt
During a Q&A period at DEFCON this year, one member of the audience mentioned that we're using "fake salt" when concatenating a random value and a password before hashing. He defined "real salt" ...
20
votes
5answers
1k views
Is it common practice to log rejected passwords?
While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
21
votes
6answers
5k views
Sharing wifi at a business - Bad Policy?
Is it safe for a small business to let customers use their wifi while waiting?
My friend is starting up a small dentistry practice (1 dentist), and I'm setting up his computers/wifi as a favor. ...
16
votes
3answers
1k views
Are passwords in memory?
I have an encrypted HDD (dm_crypt). That's why I store my passwords in a simple text file. I usually copy/paste the passwords from it. Ok!
Q: If I open this text file then it goes into the memory. So ...
13
votes
3answers
13k views
How difficult to crack keepass master password?
How easily could someone crack my keepass .kdbx file if that person steals the file but never obtains the Master Password?
Is this a serious threat, or would a brute force attack require massive ...
17
votes
8answers
3k views
Why Not Allow Special Characters In a Password?
The culprit in this case is a particular (and particularly large) bank. I know one that does not allow special characters (of any sort) in their passwords. Is their any valid reason for doing this? ...
14
votes
3answers
404 views
Is it OK to tell your password to an admin? [duplicate]
Possible Duplicate:
From a security point : Is it OK to tell your password to an admin?
I am working in a small company (20 employees) as a senior SW engineer.
After having some email ...
8
votes
2answers
1k views
How big salt should be?
I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2).
Having that in mind, how big salt should I use?
Should it be ...
7
votes
3answers
155 views
If multi factor authentication is enabled, how should that affect self-service password reset?
Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required)
...
3
votes
3answers
697 views
Best password storage scheme for high entropy, unique passwords which is failure resistant [closed]
What is the best, most secure, easiest way to:
store unique, strong passwords for every service which requires authentication
make the system resistant (total loss of security is avoided, breaches ...
1
vote
3answers
194 views
Logic for generating Strong Password?
I try to encrypt password using MD5 but there are decoders for MD5. So I'm worried about encryption of password for big website.
Is there any logical suggestion or step function to generate strong ...
11
votes
3answers
391 views
Is it possible to not store passwords locally, at all?
Earlier this year I was playing around on the schools computers and found out the administrative password to a computer in my classroom. I realized how XP stored their passwords, booted into Ubuntu, ...
8
votes
3answers
903 views
Password in file .php
My connection.php file stores the credentials to connect to the database.
<?php
$objConnect = mysql_connect("localhost","username","password");
mysql_select_db("selectDB", $objConnect);
...
6
votes
1answer
232 views
Reversible password storage obfuscation method for third-party login credentials
I have an internal business application, that as part of its functionality connects to a third-party app using login credentials specific to the user of my own app. These passwords are stored in a ...
3
votes
2answers
925 views
Storing password in Java application
What is best secure way to store passwords in Java web application?
I am not talking about password to the DB, so it must be stored in de-cryptable way. It’s cloud environment and I need to protect ...
3
votes
6answers
608 views
Password sent via email upon registration
I was wondering what the pros and cons are about sending an email with the password to a user registering on a website (like wordpress.org does).
They use pretty good passwords (12 characters long ...
1
vote
2answers
188 views
How can I create a service that automatically logs onto a third-party service without storing credentials in plain text?
I know that storing log-in credentials in plain text is one of the cardinal no-nos of security, but I'm working on something where I can't think of any other solution.
My service connects to a user's ...
15
votes
4answers
630 views
If a website allows another person to get a list of the site's users passwords, how likely is it that the passwords are stored in cleartext?
We had an incident where some of our managers were given passwords for the people they supervise using a particular company website. Ostensibly it was done so the managers could check in on the users ...
8
votes
4answers
485 views
Is there any reason to show the same message for invalid username as password?
I've seen a security question/requirement that a website login return the same error message for invalid password as for non-existent user. The idea being that this it makes it impossible to discover ...
8
votes
3answers
988 views
Managing website passwords for small team
I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
7
votes
2answers
543 views
How does Google not care about “spaces” in Application-specific passwords?
I have recently setup "2-step verification" for my Google account.
One of the features is the ability to create "Application-specific passwords
" for devices that do not support the 2 step process. ...
