The functions performed by the person or processes responsible for security of passwords on a given system.

learn more… | top users | synonyms

7
votes
2answers
223 views

How to securely store and manage one-time backup codes for 2FA?

I am already using 31 services with 2nd factor authentication and the number is growing. In addition to having multiple authentication devices, I decided for or had to generate a separate set of ...
3
votes
1answer
74 views

Storing passwords in text files inside Ubuntu encrypted home directory

I'm interested in getting offlineimap working with my Gmail account so that I can read my emails while offline. My biggest concern with this is that it's a pretty big workaround to get the ...
0
votes
1answer
39 views

Storing and reading user's credentials on their machine

I am writing a (third-party) client for a game, and one feature that I would like this client to have is the ability to automatically log into the game using credentials previously entered. The ...
0
votes
1answer
51 views

Inadvertent clickjacking on page causes LastPass login dialog to appear.

I like the idea of password managers but have become leery of the way they interact with browsers (especially given the recent "LostPass" exploit). Today I found that viewing a certain page with ...
4
votes
0answers
71 views

What are the recommended scrypt cost factors for 2016?

I've been trying to look for the answer, but the latest one I found was outdated by three years. So what are the recommended scrypt cost factors for 2016?
3
votes
0answers
75 views

How to safely store the most recently used encryption password for subsequent reuse in an app?

Let's say I have a mobile app that can save photos inside password-protected AES-128 encrypted PDF files. For convenience, I want the user to be able to encrypt a file using the previously-used ...
1
vote
0answers
90 views

Pros and cons of this password reset scheme?

I handle the process of password resets at the institution where I work. Currently, we require users to make up questions and answers (three minimum and five maximum); the questions cannot repeat, nor ...
1
vote
0answers
31 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
1
vote
0answers
105 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
1
vote
0answers
229 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
1
vote
0answers
109 views

Store 2-legged one-time password's key securely

I have a system with a OTP authentication and I need a method to encrypt the main "secret algorithm". In my system each OTP has a pair named "solution" and it is also changing like the OTP. I need to ...
1
vote
0answers
66 views

Is there an extension/command line for OSX Chromium to save website passwords in LOCALSTORAGE instead of the system's keychain?

My situation: I want to use a portable-app implementation of Chromium running on a removable drive, so I never leave any passwords stored on the kaychain of any computer I use. Portable Chromium is ...
1
vote
0answers
32 views

Syncing service passwords during offline installations

Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of ...
1
vote
0answers
210 views

How to add user entries with password field in LDAP over HTTPS

I am new to this kind of stuff (HTTPS etc.) and pretty much confused on how to go ahead with this. An LDAP server (ApacheDS) at the back-end stores the user details. To add new users, the user ...
1
vote
0answers
300 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
0answers
182 views

How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)

Let's say the attacker got the username and the password's hash. How can he use it when authenticating to some service in its domain with NTLM , for example? How can he send the request as the ...
1
vote
0answers
269 views

How secure is a Python Pyro daemon for storing a password?

I am using the Pyro package to create a daemon which will, upon startup, prompt for a password, and then the daemon will store that password as long as it is running. Other scripts will then make a ...
0
votes
0answers
14 views

Scheduled tasks that need domain admin privileges

I have a Windows 10 box that runs a whole bunch of Powershell scripts, some of those contain cmdlets that need to be run against a DC, or mail server, for eg. Get-ADComputer, and ...
0
votes
0answers
37 views

Does an account with a !! /etc/shadow entry have to still expire?

Currently where I work, our password policy is set at 84 days. This is set in our login.defs on all of our Linux machines. We have policies that are set around PCI DSS 3.1 and the like, this goes for ...
0
votes
0answers
18 views

Concealing passwords — ODBC access with service accounts

On a UNIX system (with ssh access), a Jenkins instance is installed which is being used as a scheduler for some builds. As part of the process, the user which instanced the job is mapped to a service ...
0
votes
0answers
74 views

Web app crypto scheme

For learning purposes I am trying to build a web application (Symfony2, PHP) that allows users to post content and have their own password vault, everything encrypted. Since I want to users to be able ...
0
votes
0answers
103 views

Secure password transfer from stdout to another window

I am currently trying to build a little, secure password manager. As of now, I've implemented the encryption. Each website has its own file and each file has a number of fields (Most commonly username ...
0
votes
0answers
102 views

What do I do when a ISP stores passwords as plaintext

I am living in a student housing in UK. Today, I was suddenly asked to put in my log in credentials for the internet service and because I forgot the credentials, I went to find my password section. ...
-1
votes
0answers
57 views

Is it more secure to always download app/update iOS via iTunes in PC/Mac instead of in iPhone directly?

Is it more secure to always download ipa and then sync iPhone/download update by iTunes instead of downloading them in iPhone directly? Because I think it allows me to never enter my apple account ...