The functions performed by the person or processes responsible for security of passwords on a given system.
202
votes
16answers
20k views
How does changing your password every 90 days increase security?
Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
117
votes
7answers
18k views
CTRL+ALT+DEL Login - Rationale behind it?
Maybe a rather noobish question: Why is CTRL+ALT+DEL required at login on Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a ...
50
votes
8answers
5k views
Can anyone provide references for implementing web application self password reset mechanisms properly?
We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address).
My problem is that I ...
48
votes
12answers
2k views
How do you log in from an unsecured computer?
Suppose that you are on a cybercafe, at a friend's home or at your work office, and you need to log in on a site, but you feel that the the computer can not be trusted (e.g. your friend isn't ...
35
votes
6answers
2k views
A client wants to tell me his home laptop's password. Must I push him towards a more-complex alternative?
I'm an IT consultant in Canada. One client has known me for a few years. He wants me to do some work on his kids' laptop again. I'll need to log into his kids' Windows user account. (I'm guessing that ...
35
votes
5answers
2k views
Do security questions subvert passwords?
Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
33
votes
7answers
2k views
“Real” Salt and “Fake” Salt
During a Q&A period at DEFCON this year, one member of the audience mentioned that we're using "fake salt" when concatenating a random value and a password before hashing. He defined "real salt" ...
32
votes
11answers
3k views
What to do about websites that store plain text passwords
I recently received an email from a popular graduate job web site (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
31
votes
6answers
1k views
Is it OK to tell or give your password to an admin?
I'm working in a small company (20 employees) as a senior software engineer.
After some email problems, our newly employed IT administrator asked me for the password to our hosting company to see why ...
30
votes
8answers
1k views
Why do password strength requirements exist?
Password strength is now everything, and they force you to come up with passwords with digits, special characters, upper-case letters and whatnot. Apart from being a usability nightmare (even I as a ...
25
votes
8answers
2k views
Why would salt not have prevented LinkedIn passwords from getting cracked?
In this interview posted on Krebs on Security, this question was asked and answered:
BK: I’ve heard people say, you know this probably would not have
happened if LinkedIn and others had salted ...
24
votes
10answers
3k views
Intel How Strong is Your Password page, good advice?
I came across this Intel How Strong is Your Password? page which estimates how strong your password is.
It has some advice on choosing better passwords including that you should use multiple ...
22
votes
7answers
1k views
Is there a method of generating site-specific passwords which can be executed in my own head?
I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
21
votes
6answers
5k views
Sharing wifi at a business - Bad Policy?
Is it safe for a small business to let customers use their wifi while waiting?
My friend is starting up a small dentistry practice (1 dentist), and I'm setting up his computers/wifi as a favor. ...
21
votes
3answers
1k views
Webmail host knows my password
I forgot the password to a webmail account and they didn't have an automated password recovery process. So I had to chat with their support and they asked a few verification questions then proceeded ...
21
votes
5answers
1k views
Do spaces in a passphrase really add any more security/entropy?
I often see passphrase suggestions written as a sentence, with spaces. In that format are they more susceptible to a dictionary attack because each word is on it's own as opposed to a large unbroken ...
21
votes
2answers
1k views
Does versioning an encrypted file make it less secure?
Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices.
The kdb file in itself would be encrypted, but ...
20
votes
5answers
1k views
Is it common practice to log rejected passwords?
While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
20
votes
1answer
2k views
Are there more modern password hashing methods than bcrypt and scrypt?
This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt.
What I'm wondering is if there are any ...
19
votes
5answers
1k views
How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?
In some environments, it is required that users change a certain number of characters every time they create a new password. This is of course to prevent passwords from being easily-guessable, ...
19
votes
3answers
831 views
Am I wrong to believe that passwords should never be recoverable (one way hash)?
I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
18
votes
5answers
1k views
What is the point of hashing passwords?
Even when following strict security protocols, and what the user typed is (in this hypothetical situation) completely impossible to derive, the key that the server needs to compare to is still there. ...
18
votes
4answers
1k views
What should be used as a salt?
I always hear that it is best to use salts on top of stored passwords, which then somehow gets concatenated and hashed afterwards. But I don't know what to use as a the salt. What would be a good ...
18
votes
6answers
735 views
How to avoid scripts with hardcoded password? [duplicate]
I have some scripts on Ubuntu Linux machine that logs in to a database server to run some maintenance daily. To login to the database, I need a password and right now it is hardcoded in the script.
...
18
votes
2answers
970 views
Sending temp password when users first registered - is that good for anything?
One of our clients has sent us a list of security requirements. One of them was that registration does not including setting a password - once complete, a temp password is sent to the user, and the ...
18
votes
5answers
766 views
Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?
I just wanted to know if you can increase the cost (iterations) of those two algorithms off-line.
I want to increase the cost every year of my users passwords.
One solution is to recalculate them ...
17
votes
7answers
2k views
Why don't people hash and salt usernames before storing them
Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext.
What I ...
17
votes
6answers
1k views
Why do we ask for a user's existing password when changing their password?
In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
17
votes
8answers
3k views
Why Not Allow Special Characters In a Password?
The culprit in this case is a particular (and particularly large) bank. I know one that does not allow special characters (of any sort) in their passwords. Is their any valid reason for doing this? ...
16
votes
3answers
1k views
Are passwords in memory?
I have an encrypted HDD (dm_crypt). That's why I store my passwords in a simple text file. I usually copy/paste the passwords from it. Ok!
Q: If I open this text file then it goes into the memory. So ...
15
votes
7answers
395 views
To salt, or not to salt? [duplicate]
Possible Duplicate:
Why is using salt more secure?
Why would salt not have prevented LinkedIn passwords from getting cracked?
Recently I decided that I wanted to learn more about web ...
15
votes
4answers
631 views
If a website allows another person to get a list of the site's users passwords, how likely is it that the passwords are stored in cleartext?
We had an incident where some of our managers were given passwords for the people they supervise using a particular company website. Ostensibly it was done so the managers could check in on the users ...
15
votes
6answers
785 views
Hash function change
I have user account passwords stored in a database using an unsafe (old) cryptographic hash function.
What is the best/usual approach to changing password hash function? Only two ideas come to my ...
15
votes
3answers
2k views
Password manager vs remembering passwords
I have always thought that you are not supposed to use a password manager but to keep your passwords in your head, but lately I have thought about the pros and cons of having a password manager.
Some ...
15
votes
9answers
2k views
Password Management within an Organisation
Within an organisation there are many passwords such as those for root accounts on servers, hosting accounts, router logins and other such things, that need to be kept track of.
I know in some ...
14
votes
3answers
423 views
Is it OK to tell your password to an admin? [duplicate]
Possible Duplicate:
From a security point : Is it OK to tell your password to an admin?
I am working in a small company (20 employees) as a senior SW engineer.
After having some email ...
14
votes
3answers
14k views
How difficult to crack keepass master password?
How easily could someone crack my keepass .kdbx file if that person steals the file but never obtains the Master Password?
Is this a serious threat, or would a brute force attack require massive ...
14
votes
2answers
252 views
Mitigating the loss of a mobile phone used for second-factor login
Take the following scenario: John is using GMail for his primary email account and LastPass as his password management system. Both of these accounts are using the Google Authenticator mobile ...
14
votes
2answers
654 views
How can we accurately measure a password entropy range?
I've given myself the task of writing code that determines the strength of a password, and really want to break out of a lot of already established ways we do that, as they're often lacking, not ...
13
votes
4answers
530 views
How should I respond to poor password security?
My son's school uses a 3rd party to handle tuition and fee payments. I have recently come to the realization that they completely fail in the area of password security.
Last month they sent a ...
13
votes
6answers
3k views
Is TrueCrypt safe enough to store clear-text-passwords?
The reason: I want to be able to use a portable USB drive to access my passwords on any machine and OS. TrueCrypt seems to be the only program that has sufficient support on all major platforms. So I ...
13
votes
2answers
6k views
FOSS Enterprise Password Management Solution
Can anyone recommend a F/OSS enterprise password management solution on/around the same level as something like Cyber-Ark?
Specifically, something along the lines of a standard password manager, ...
12
votes
11answers
2k views
Best practice for password distribution
I am about to set up a new account on my Linux server for a user that lives in another state in the U.S.
I can't think of a good way to get them this user their password. There must be a standard ...
12
votes
2answers
162 views
Would suggesting a random passphrase during sign-up hurt overall security?
I've been looking for ways to improve security and security awareness for both internal and external clients and I happened upon the idea of generating a one-time, random "password suggestion" on the ...
12
votes
3answers
1k views
Recommended policy on password complexity
Is there any research on how how a password complexity policy can increase or decrease the quality of passwords?
If you don't have any requirements on the password then probably 90% of users will use ...
11
votes
3answers
477 views
Does the salt need to be unique or not predictable?
I always thought that salts is simply used to prevent rainbow tables to be used. Other have suggest they should be unique on a per account basis. Currently i have been using a config file to use as ...
11
votes
3answers
397 views
Is it possible to not store passwords locally, at all?
Earlier this year I was playing around on the schools computers and found out the administrative password to a computer in my classroom. I realized how XP stored their passwords, booted into Ubuntu, ...
10
votes
8answers
684 views
Password management/synchronization?
Is there a good enough service I could run on my own home (Linux) server that I could use for storing/accessing/synchronizing passwords so they could be available for me from multiple ...
10
votes
3answers
296 views
how secure is passwordcard.org?
How secure is passwordcard.org? Assuming user follows recommended precautions:
Don't read along with your finger, or the smudge will tell a thief where your password is.
Keep your PasswordCard on ...
10
votes
2answers
2k views
Security of LastPass + YubiKey
I'm looking at password manager solutions and came across LastPass. I see they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What are ...
