Tagged Questions
-2
votes
2answers
34 views
Looking for safe, simple way to store passwords with PHP 5.2.17 [duplicate]
I've found many posts on StackOverflow and other sites using Google, but since security is always changing, and what was safe a few months ago not me anymore... I felt the need to ask on here.
...
20
votes
2answers
1k views
Does versioning an encrypted file make it less secure?
Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices.
The kdb file in itself would be encrypted, but ...
3
votes
2answers
97 views
Protecting Password Hashes with Store Procedures?
I was thinking about the recent (seemingly weekly) security breaches we've seen where millions of password hashes have been leaked and I was wondering how one might secure their site against a ...
24
votes
10answers
2k views
Intel How Strong is Your Password page, good advice?
I came across this Intel How Strong is Your Password? page which estimates how strong your password is.
It has some advice on choosing better passwords including that you should use multiple ...
-3
votes
0answers
72 views
My Evaluation on the Recent Honeywords Paper [closed]
I just read the paper "Honeywords: Making Password-Cracking Detectable" and have some thoughts about the reality and viability - as well as weaknesses of this approach.
My initial take is that this ...
5
votes
4answers
247 views
Do honeywords add any real security?
This paper proposes the concept of honeywords for detecting if a password database has been compromised.
As far as I understand it works like this:
You save n password hashes for each user, one that ...
0
votes
3answers
102 views
Why one time passwords using nested hash chain are not used?
I am wondering, why web sites do not use one-time passwords generated by hash chain. By that I mean that a client chooses a secret and after being salted, he applies some secure hash function F() on ...
2
votes
1answer
107 views
Why are Lengthy Password Stronger Than Complex? [duplicate]
So all my life I've been listening to people tell me to make complex password: Upper / Lower / Numeric / Symbols. Recently though I've been reading / seeing that length above all seems to make for ...
3
votes
1answer
105 views
Why regenerating a password's hash?
I've read http://alias.io/2010/01/store-passwords-safely-with-php-and-mysql/ on how to store passwords using PHP and MySQL, the secure way. Elbert says:
Use a cryptographically strong hashing ...
3
votes
1answer
91 views
Can a user's Apple Keychain be opened on a different computer?
Apple uses a nice keychain. This is used by, for example, Google's Chrome browser.
Imagine a user copies all the keychain files.
Would that user be able to unlock the keychain, if they knew the ...
3
votes
4answers
159 views
Temporary passwords e-mailed out as plain text
Is this a security issue? Many big ecommerce platform companies use this feature. Where if you forgot your password, they e-mail you a temp password.
Could someone potentially figure out the ...
3
votes
2answers
206 views
Is GPG suitable as part of a password manager and generator?
I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
3
votes
2answers
190 views
LastPass One Time Recovery Passwords--How?
The LastPass password manager stores One Time Recovery Passwords locally in each browser you use the plugin with:
http://helpdesk.lastpass.com/account-recovery/
My question is, how can you have more ...
1
vote
2answers
271 views
What is the safest way to store a password in a single file?
I've been reading about it. This article helped me a lot. But the more I read the more complicated it seems. For example:
Is it better to use bcrypt, or PBKDF2, sha2 or something else for the salt?
...
4
votes
1answer
147 views
Saved passwords (use case)
I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together.
Both the data and the password are encrypted ...
-4
votes
1answer
139 views
Secure Web application Password vault/manager [duplicate]
I would like to build an open source online password vault which allows users to securely store their passwords, like Keepass or roboform, but where a user can access their passwords through a ...
0
votes
2answers
275 views
Is there a way to find out how long it takes John the Ripper to crack a particular password?
I am looking to test/demonstrate things like: when the supplied wordlist contains "abc123" and pw="abc123" then John cracks the pw in 1/2 a second... but if word list does not contain "abc123" John ...
7
votes
3answers
151 views
If multi factor authentication is enabled, how should that affect self-service password reset?
Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required)
...
7
votes
4answers
188 views
When changing a password using a WebPage, must the old password be entered on the same screen?
There is a convention to always prompt for the old password on the same page as the one where the old password is being changed as shown below.
Is it acceptable from a security perspective to allow a ...
2
votes
2answers
334 views
Salted hashes vs HMAC?
Most of discussions involving access credentials include references to "hashing salted passwords". Is this another way to referring to the HMAC algorithm or a totally different operation? Different or ...
6
votes
4answers
983 views
Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security?
0
votes
2answers
293 views
Can my ISP know my passwords
If I am using some proxy service, proxy service provider can know my passwords to my online accounts. In which case my ISP can filter my requests and get my passwords to my online accounts? And how ...
3
votes
3answers
151 views
Methods for remembering passwords around the web
What's the least painful way to manage passwords for user accounts that you have on various sites?
I see only 3 options:
Password manager. Passwords can be different and strong, but the downside is ...
2
votes
4answers
376 views
Looking for password manager in company
I was looking for solution everywhere, but maybe because lack of specialized words I can't find it.
I've got a problem in finding a program, but I don't know how to describe it in one word so I'll ...
7
votes
5answers
371 views
Are we concentrating too much on password complexity?
As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
17
votes
7answers
2k views
Why don't people hash and salt usernames before storing them
Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext.
What I ...
0
votes
0answers
31 views
Password recovery protocol for user account [duplicate]
Possible Duplicate:
Can anyone provide references for implementing web application self password reset mechanisms properly?
I need to create a password recovery mechanism for a user account ...
17
votes
6answers
1k views
Why do we ask for a user's existing password when changing their password?
In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
48
votes
12answers
2k views
How do you log in from an unsecured computer?
Suppose that you are on a cybercafe, at a friend's home or at your work office, and you need to log in on a site, but you feel that the the computer can not be trusted (e.g. your friend isn't ...
5
votes
1answer
318 views
Practices for storing username/password in Web applications
I have read the following question: Storing password in Java application but I don't find the answers useful for my case.
So here is my question somehow related to that. I have a Java Web application ...
6
votes
1answer
231 views
Reversible password storage obfuscation method for third-party login credentials
I have an internal business application, that as part of its functionality connects to a third-party app using login credentials specific to the user of my own app. These passwords are stored in a ...
5
votes
5answers
1k views
How can I avoid putting the database password in a perl script?
I have a cronned perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
5
votes
3answers
326 views
How does KeePass master key derivation increase security?
I don't understand how KeePass key derivation increases the security of the password db at all.
First I'll try to explain what I understood from the key derivation described here. I'll use some pseudo ...
5
votes
2answers
336 views
Requiring regular password change but storing previous paswords?
My bank requires me to change my password regularly but then they can detect if my password was used before. They probably store the old password (possibly hashed) in order to detect it. I think this ...
0
votes
0answers
124 views
How to create a portable password storage [closed]
I want to have a portable way to store my passwords and key pairs. While I know that this already exists e.g. as Apps for iOS or Android and counterparts for OS X or Windows which can sync and ...
14
votes
6answers
742 views
Hash function change
I have user account passwords stored in a database using an unsafe (old) cryptographic hash function.
What is the best/usual approach to changing password hash function? Only two ideas come to my ...
2
votes
3answers
101 views
How to make an outbound request to users to update their passwords?
Clearly it works best if the request to update a password happens as a response to an inbound request to access a known system, but how do you make an outbound request to users to update their ...
3
votes
1answer
278 views
Why do some large companies still store passwords in plain text/decrypt-able format? [closed]
In the last couple of weeks I've come across two fairly large companies who seem to not have stringent password security:
Tesco - they store passwords in an "encrypted" format, yet they can decrypt ...
1
vote
3answers
171 views
For what do I hash user passwords with PDKDF2 when the user data is stored in the same database?
I'm hashing the passwors of my users with PDKDF2 right now. A user can gain access to his account with his password. When the user is logged in he can edit his personal information and do other stuff ...
2
votes
2answers
1k views
Sample challenge questions for use with self service password reset and validation
I'm building a secure password recovery feature similar to the one described here.
During the final phase of the password recovery, the user is asked a recovery question to verify their identity.
...
1
vote
1answer
179 views
Securely tell the user his password in new WHM/Cpanel account creation?
I understand it's not safe to send passwords via email but when accounts are created via WHM/Cpanel, I have to let the user know what password I created for them. How can I relay the password safely?
7
votes
2answers
385 views
Is there more to password hashing?
You have a plain text password and salt. The plain text password is assumed to be securely random and only known by the user and the salt is no secret and not necessarily unique but stored alongside ...
2
votes
1answer
194 views
How can passwords be stolen from Yahoo?
I always understood that servers don't actually store user passwords. Instead, they store hashes of passwords and then they validate the user input by applying the hash function, then compare the ...
4
votes
3answers
238 views
Are there any regulations against financial companies storing passwords in plaintext?
A bank that I use stores my password in cleartext or perhaps using reverisible encryption, which is just as bad.
I know this because when you click "Forgot your password?" (or similar) link, it ...
1
vote
3answers
193 views
Logic for generating Strong Password?
I try to encrypt password using MD5 but there are decoders for MD5. So I'm worried about encryption of password for big website.
Is there any logical suggestion or step function to generate strong ...
5
votes
2answers
139 views
Can a HSM be used to make password hashing stronger?
Say a database server has a HSM which is in use for encrypting (reversibly of course) credit card numbers. Is there any way a HSM could be used to add strength to a password hashing scheme? (Or are ...
3
votes
4answers
405 views
Is there any explanation (other than storing plaintext) for case-insensitive passwords?
I've come across a few organisations stating that passwords are case-insensitive. Obviously this is ridiculous, and a gigantic red flag from a security point of view.
Is there any explanation for why ...
2
votes
2answers
243 views
Seeking advice on how to build a box to brute force hashes? [closed]
I work in a startup security firm, and I need to build a GPU-based to brute force password/hashes, which can be used to validate password strength and test hashing algorithms. I expect some high ...
1
vote
2answers
83 views
is it appropriate to set restrictions on a user's password? [duplicate]
Possible Duplicate:
XKCD #936: Short complex password, or long dictionary passphrase?
Im developing a website and am curious as to the current trends in the nature of passwords. Is it good ...
4
votes
3answers
359 views
Trying to understand password hashing
I am trying to get a grasp of password hashing. Back in the days it seemed so simple, just MD5(password + salt) and you are done. Then md5 was proven to have collisions so people started moving to ...
