Linked Questions

6 votes
2 answers

Why not send a plaintext recovery password? [duplicate]

It seems like sees sending a plaintext recovery password as wrong. Instead, a link to set a password is better. But what's the difference? If a user follows a link and sets a ...
ispiro's user avatar
  • 793
4 votes
2 answers

Is it ok to email someone their password from a newly created account? [duplicate]

I have a pretty standard registration form. One thing I've decided to do away with is the requirement to enter the password twice, for usability reasons. In order to mitigate the increased risk of ...
fredley's user avatar
  • 1,445
628 votes
7 answers

How to store salt?

If you expect to store user password securely, you need to do at least the following: $pwd=hash(hash($password) + salt) Then, you store $pwd in your system instead of the real password. I have seen ...
George's user avatar
  • 6,467
39 votes
9 answers

How to securely ask for passwords of customer as consultancy firm?

In my work as a developer, I need username/password combo's from the customer sometimes to make sure the settings on 3rd party services are correct to work with the website/application we are building....
Wim Deblauwe's user avatar
108 votes
1 answer

In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?

There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
jcaron's user avatar
  • 3,635
30 votes
4 answers

The registration confirmation email contains my password: do they keep it in plaintext?

I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
Alex's user avatar
  • 403
22 votes
4 answers

Is it a bad idea for an information holder to e-mail a user their password?

A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...
Steve Melnikoff's user avatar
20 votes
4 answers

What type of content better not to transfer by email?

Email is one of the main tools of business communication. On the other hand, it is not a secure way of communication. But to what extent it is not secure? I have always wondered how sensible it is ...
rem's user avatar
  • 2,127
7 votes
5 answers

How commonly are SSL/TLS or S/MIME used by e-mail providers?

I was reading through different posts here about email security. After reading these I still have some questions. I understand that S/MIME can be used to transfer email securely between servers. Is ...
user2315's user avatar
  • 473
16 votes
4 answers

Why are one time password reset links safer than one time passwords?

Recently I applied for a job at a company creating security-critical solutions for military, aerospace, ... After registering at their webpage, I received an email with my username and a ...
Martin Drozdik's user avatar
0 votes
2 answers

Keeping the password secret over regular http

I would like to at first be clear that this is for poor site owners who can't afford the SSL option but require logins to their site, potentially from a public kiosk, and need a secure method of ...
Mike S's user avatar
  • 404
3 votes
2 answers

How to give "Forgot password" option for a password encrypted file?

I have created a utility that encrypts a file (.txt, .dox, so on...). The utility asks for a password from user at the time of file encryption. Problem Suppose a user has created 1000 encrypted ...
Vikas Bansal's user avatar
3 votes
4 answers

Sending server-generated password by email

I'm implementing a system where our users need to enter a special (permanent) password to authorise a transaction. The password is separate to their login credentials, and they can only enter this ...
Stuart Kemp's user avatar
4 votes
2 answers

How risky is using e-mail to manage passwords?

No doubt there are better ways and more secure ways to manage passwords, but I'd like to make an informed decision to determine if this is just too risky. Briefly, when I receive a "welcome new user" ...
Michael J's user avatar
0 votes
1 answer

Idea for an algorithm to authenticate users with zero-knowledge-proof [need thoughts/review]

I have an idea for an algorithm. I don't know if I made any mistakes and need some extra thoughts/peer review on it. This would work as an (almost)zero knowledge proof for sending passwords that can ...
reggaemuffin's user avatar

15 30 50 per page