If a security measure is implemented that doesn't provide any additional security benefit, can it be considered harmful? As an example, consider a login page where the user is asked to enter their ...
I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
Can online password managers be used for storing and managing passwords? I mean from the security point of view. I understand that those systems can be different and some deserves more trust than the ...
If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?
In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the ...
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the ...
The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
Is there a good enough service I could run on my own home (Linux) server that I could use for storing/accessing/synchronizing passwords so they could be available for me from multiple ...
Which way of additionally feeding /dev/random entropy pool would you suggest for producing random passwords? Or, is there maybe a better way to locally create fully random passwords?
On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
I read somewhere that adding a salt at the beginning of a password before hashing it is a bad idea. Instead, the article claimed it is much more secure to insert it somewhere in the middle of the ...