The functions performed by the person or processes responsible for security of passwords on a given system.
1
vote
2answers
59 views
How does my bank knows my second and forth chars of my password
I see that the new login mechanism used by some banks in UK and also used by visa debit authentication is to ask for three random characters from your password at login (for example second, ninth and ...
0
votes
1answer
129 views
Why don't we do dual password instead of forgot password?
You can see a link Forgot Password? nearby almost all login form.
As I mentioned in question, Since passwords are completely protected from outside access unless owner reveal, I come up with this ...
1
vote
1answer
70 views
Is it a good idea to give users an additional password that they do not control?
It's a given that users will choose bad passwords. Why not help them out? Using a securely-random choice from a large dictionary, choose one or two words and tell the user to write them down. When ...
0
votes
1answer
63 views
Should I log wrong passwords? [duplicate]
I have a public-facing web application where anyone can register an account. The passwords I store are salted and hashed.
When someone tries to overtake the account of someone else through guessing ...
0
votes
0answers
38 views
How secure is a Python Pyro daemon for storing a password?
I am using the Pyro package to create a daemon which will, upon startup, prompt for a password, and then the daemon will store that password as long as it is running. Other scripts will then make a ...
1
vote
2answers
91 views
Username and password stored under form data in Chrome Dev Tools
When I record the network tab in Chrome Developer Tools when logging in to my site I find that the username and password are stored in plaintext under form data.
You can also find it in Safari, ...
3
votes
1answer
56 views
What are industry-standard recommended practices to protect user information in an Android app?
I am developing an Android app that will potentially handle sensitive user data, and some of it may be even considered medical data (for example user height, weight, alergies, etc).
What would be the ...
1
vote
3answers
171 views
Sharing passwords through email can be considered insecure?
I'm responsible to create new accounts for some services on my job. Some of these service do not allow password change by the user, so in the case the user wants to change its password, he would need ...
1
vote
4answers
170 views
Password Recovery - what if user can't complete 2nd step?
I'm thinking out my password recovery logic for an ecommerce system. Some backround: Passwords are stored using bcrypt, password recovery involves the standard reset link, which then can be used to ...
1
vote
2answers
126 views
What are the security risks associated with storing passwords on the internet?
With products such as LastPass that store encrypted passwords on remote servers, what are the associated risks that aren't applicable to locally stored and encrypted passwords? If something is ...
13
votes
2answers
417 views
Bank accepts different password to the one that I set
I'm not particularly well versed in IT security so please bear with me.
I recently discovered that my bank's online system will accept passwords that consist of the correct password, and a string of ...
2
votes
1answer
161 views
Where to keep key file used as composite key for Keepass 2
I used to use a master password and "Windows User Account" to get into my password datasbase with Keepass 2. Then I realized the "Windows User Account" option is garbage because if you ever want to ...
14
votes
3answers
1k views
Why check to see if a password is already used by another user?
This is coming from a joke originally in French:
Enter your password.
carrot
Sorry, your password must be more than 8 characters.
carottegéante
(giant carrot)
Sorry, your ...
1
vote
1answer
70 views
Which is best DPAPI or HSM?
Can you please explain what's is the main difference between for this both DPAPI and
HSM? As far as I understand both protecting the data, the way of protection is difference HSM is physical device ...
9
votes
4answers
733 views
Forgetting passwords typed in too frequently
It has happened to me several times that I've become so used to typing in a password I can't consciously remember it and it's purely muscle memory. This is particularly true with complex passwords ...
1
vote
4answers
137 views
How to store passphrase in this situation?
How to store a passphrase with a Java application that periodically needs access to its plaintext form? It is a strange situation, but I am wedged in it. If providing a decent security mechanism is ...
0
votes
1answer
43 views
Security implications of setting the same password on private key and PKCS12/JKS?
Are there any negative security implications of setting the private key password (DSA in this case) as a PKCS12 (and then JKS) export password (instead of generating/inventing a new one)? My use case ...
2
votes
2answers
193 views
What are the pros and cons of using a password safe instead of writing passwords on paper?
Many companies have policy again writing passwords and paper and I wonder if there reasoning is sound. Is it always better to use a software password safe than writing passwords on paper? Here are ...
1
vote
2answers
135 views
How can I store a password history to prevent reuse?
I have an application with a user database. The database stores the password using a bcrypt hash with a randomized salt.
How can I implement a password history set (to prevent password reuse) in a ...
9
votes
4answers
413 views
Password security
I was requested at the login page of a website to first change my password. After typing in a new password, the web page told me the new password did not differ enough from the previous one.
Does this ...
1
vote
1answer
73 views
storing username/email and password with a hash of the hash of the email/password? [duplicate]
Quite the simple discussion this one (one would assume):
If I'd hash the email and password, and then hash the hashes, whould this be considered safe enough or would this just be a waste considering ...
0
votes
2answers
87 views
Password management [duplicate]
I am work in small company. I am Java Developer and Sysadmin of remote servers. I have problem with store password from several servers. How to best way to manage passwords in company?
0
votes
2answers
114 views
Encryption method and other security concerns for a simple password manager [closed]
I thought I would learn a little bit of cryptography programming by making myself a simple password manager program that I can potentially even use to keep track of my passwords. The idea is that my ...
0
votes
2answers
375 views
Security of cloud-based password manager (Dashlane, LastPass) vs. federated login (OpenID, Google, Yahoo, Microsoft, Facebook)
Many websites offer the option to log in with your existing Google or Facebook account (among others). For a long time I've resisted doing this because I use a password manager and I figured it was ...
2
votes
2answers
321 views
Managing and deploying web app passwords
What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
2
votes
4answers
210 views
Should user's password strength be assessed at client or at server side?
Now most of big website like Google mail, Twitter, Facebook have a feature that assesses password strength (check number of digit, alphabet, special characters, or check the similarity over already ...
3
votes
0answers
719 views
Free/Libre software to handle TCG OPAL 2.0-compliant Self-Encrypting Drives (SEDs)?
I'm in search of a free/libre software that is able to handle OPAL (2.0)-compliant SEDs (i.e. manage the setting of Pre-Boot Authentification (PBA) environment, encryption keys...).
It could be a ...
2
votes
1answer
65 views
Guidance for “image based” password reset challenge
Thycotic has a Password Reset Server that allows the user to select from several images.
What general guidance is there for an image-based password reset challenge question?
Examples may include
...
0
votes
1answer
109 views
How do you secure service account password on enterprise windows enviroment?
I'm suppose to have a large environment ( 500+ servers ) all Windows based joined to Active Directory domain.
Some domain accounts are used for application\middleware authentication that needs high ...
5
votes
6answers
675 views
Is it useful to protect hashed password with encryption?
Imagine that I am hashing the users' passwords with a random, long enough, salt, using key stretching, and a secure hash. Would it be more secure to finally encrypt the hash with a symmetric key?
9
votes
5answers
7k views
How safe are password managers like LastPass?
I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long.
How safe are password ...
8
votes
1answer
942 views
Does the average user really need a password manager?
I'd describe myself as an average tech savvy computer user. I have many accounts in forums, shopping sites, etc where I recycle two moderately strong password with small variation. These are account ...
-3
votes
2answers
299 views
How to secure a login.php file? [closed]
I have a hand built website, and am triying to build a cms/admin-panel, and my username and password, are not stored in a database, but, in a two setup file like seen below.
index.php
<?php
...
2
votes
1answer
317 views
Android access tokens and access to all google services
My questions is based on the asnwer on that question:
Can the Gmail password be recovered from the Android Gmail app?
So, as I understand when we setup google account on Android devices, it stores ...
1
vote
3answers
195 views
How safe is it to provide my administrator account password for a 3rd party software: EasyUS Todo Backup?
I've been recently searching for a backup solution for my Windows desktop. That's when I came across this free software called EasyUS Todo Backup. (I know it's a mouthful but English doesn't seem to ...
3
votes
4answers
429 views
How does a key file increase the security of a password manager?
Password managers like KeePass often have an option to use a key file in addition to a master password.
I don't understand how this increases security.
(Note: KeePass also allows using a key file ...
3
votes
1answer
136 views
S/Key as an alternative to UNIX passwords
There is this password system called S/Key I saw on the Internet. Can someone give me a brief description about S/Key and how it works? Can S/Key be an alternative solution to the UNIX password ...
3
votes
2answers
251 views
comparing password hashing algorithms - PoC ideas?
OK so I just started working for a security consulting firm and we recommend SHA 256 (with salt) for password hashing because MD5 is too weak. I have read some brilliant answers (the list is too ...
1
vote
3answers
285 views
Is Password Complexity required at all
For a web-site I'm using what I hope is the most secure password storage scheme I can find, which boils down to having a salt and hashed password stored in a database of contacts:-
Byte[] ...
4
votes
2answers
1k views
Does adding two-factor authentication by OTP really make KeePass more secure
KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
31
votes
10answers
4k views
Is there any point in using 'strong' passwords?
Let's say I'm setting up a new account on a website. Should I bother using a strong password? My reasoning is this:
Password strength is a rough measure of how long it would take to brute-force my ...
0
votes
0answers
27 views
What'some best practice maintaining multiple accounts and password and making sure it's secure? [duplicate]
What'some best practice maintaining multiple accounts and password and making sure it's secure?
Having around 20-30 critical accounts is a challenging process. I read some articles to make it really ...
17
votes
1answer
747 views
Does a maximum length of password mean non-hashed storage?
When a system requires a password between say 6 and 20 characters in length, does it mean the password is stored without using a hashing function, and that the mysql-field (or similar) is 20 ...
1
vote
1answer
119 views
How does IIS persist identity credentials? Does it create any security issues?
We want to implement a feature similar to IIS in how it remembers user configured usernames and passwords. As I understand it, when you configure IIS to use a set of credentials for an app pool ...
1
vote
6answers
208 views
How to keep website passwords safe among employees? [duplicate]
We're a website developer agency, and most of our websites are made using in Wordpress, Joomla or Drupal as a CMS.
I'm having trouble to decide how we should manage our passwords, and I'm open for ...
3
votes
6answers
673 views
How can I best manage root passwords for many servers?
Lets say I have two racks with about 40 nix servers in them. I don't want to set all of the root user passwords all the same do I? If not how do you manage and keep up with all of the passwords?
Is ...
3
votes
2answers
1k views
Password management in Firefox, Chrome and Safari
I just read a couple of very interesting discussions on Chrome password security strategy.
Chrome’s insane password security strategy
Showing stored passwords - Tim Berners-Lee
The following is how ...
1
vote
1answer
207 views
Inputting user ID's in URL?
I am currently working on functionality that will allow users to reset their passwords. My question pertains to the security in putting user ID's (a.k.a the auto increment ID's from database) in the ...
3
votes
2answers
99 views
Reference for Insecure password by email
I have come across a site that on going through the password reset sends my old password to me via email.
Now we know this is insecure I see here this question and here and no doubt others.
However ...
4
votes
4answers
1k views
Is 1Password more secure than an AES encrypted text file?
Are there extra measures taken by 1Password and KeePass, that make them more secure than an AES-256 encrypted text file? The database formats they use seem needlessly complex for my own purposes.
