The functions performed by the person or processes responsible for security of passwords on a given system.
2
votes
2answers
92 views
Keepass Dictionary Attack Protection Strategy
Though pretty interested, I'm everything but an expert in Information Security, please redirect me to any helpful resources if my question is stupid or correct me if my assumptions are wrong.
When ...
2
votes
1answer
60 views
Is it secure to have two password managers?
For various reasons I use both Keepass 2 and Lastpass. They have 90% the same password database. Is it secure to be using and maintaining both of them? Is it secure if they both use the same password ...
0
votes
2answers
71 views
How do password suites store and encrypt their metadata and prevent attacks based on that knowledge?
If someone uses a password manager and tries to organize the credentials well, doesn't that make attacks easier?
Let's assume an attacker has the encrypted credentials available for offline attacks,
...
3
votes
1answer
50 views
How to minimize security risk when having to work with decrypted (plain text) passwords due to 3rd party API design
I'm developing an application (C#) for Microsoft SharePoint platform that uses SQL Server's (2008 R2) Remote BLOB Storage (RBS) technology. To accomplish certain client-side tasks, I must obtain ...
3
votes
3answers
502 views
Encrypting passwords?
I am planning on creating a text file to store my passwords, so I only need to remember 1 password (at the moment, I have about 20 long/complex passwords in my mind, and am worried that I might forget ...
3
votes
1answer
100 views
Password Managers: encrypted database vs hashing strategy
I'm considering moving to a password-management strategy based on supergenpass or something similar. This is an alternative to other password managers where instead of having a database of passwords ...
0
votes
1answer
119 views
are there serious weaknesses in this free password management system?
I want to protect my passwords for free and store them on a machine that might get stolen but have the passwords very securely backed-up in the cloud, again for free, and minimize the total lifetime ...
3
votes
1answer
110 views
API to change passwords?
After I learned last week that the login data of some of my accounts was leaked, I had to change my passwords for more than 30 sites. That was tedious! As luck would have it, some days later we ...
0
votes
1answer
185 views
The Problem with Changing All Passwords for HeartBleed [duplicate]
One thing that's been bugging me in relation to the discovery of the Heartbleed OpenSSL flaw is the recommendation that everyone should run to their computers in a panic and change all of their ...
0
votes
1answer
36 views
Is there an anti virus that protects processes from being injected code to?
As title says, is there an av that does that?
And if not, is there any other program that protects processes like lsass in windows, apart from protected process utility in win8.1?
1
vote
0answers
26 views
Digital signature based authentication schema using two passwords
I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
3answers
172 views
Is it safe to back up passwords to the “cloud”
I have a small Truecrypt volume that contains just my password data (using Bruce Schneier's Password Safe application).
I'd like an offsite, secure, backup of that Truecrypt volume. Currently, I am ...
0
votes
1answer
43 views
Multiple user encryption-key store
Let's say I have an application that accesses an encrypted datastore, and I want the admins to be able to unlock the datastore upon application startup (and then the application will have access to ...
0
votes
0answers
50 views
Utilizing PBKDF2 With OpenSSL crypto library [migrated]
I want to utilize the PBKDF2 algorithm with SHA1 HMAC (based on this answer).
How can I utilize this through the crypto library?
I started by looking at man openssl, but the openssl passwd command ...
0
votes
1answer
44 views
How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)
Let's say the attacker got the username and the password's hash.
How can he use it when authenticating to some service in its domain with NTLM , for example?
How can he send the request as the ...
0
votes
1answer
39 views
How does LM hash deal with passwords that are between 8 and 13 chars
If its 14 then it splits it to 7&7, but how about 13 characters? 7&6?
How does it work?
-1
votes
4answers
137 views
How do big companies and wealthy people secure their information? And how can I secure mine?
I've recently had some success and traffic increase with an online business I own and due to that someone has hacked my domain email and twitter accounts. My bank password is the same and I just ...
3
votes
1answer
59 views
Webpage sent me my password in clear text can it be secure? [duplicate]
I registered for a webpage years ago and have been using it without issues, today I made some changes to my account and they sent me an email containing my username and password in clear text.
I ...
3
votes
3answers
173 views
Is there a decentralized version of LastPass?
I am using LastPass for managing passwords on multiple computers.
However, LastPass extension (at least the chrome version) is running some opaque binary code through Native Client, and I just feel ...
1
vote
2answers
85 views
Is checking against password lists a good way to enforce a secure password policy and possibly detect dictionary attacks on a web-based app?
I have written a script to check a given password against a ~65 million long list of passwords collated from various lists released after hacking attempts.
I am thinking about incorporating it into ...
2
votes
3answers
103 views
Why is it not standard practice to run password-based KDF's client-side?
In most protocols I have encountered in which a passphrase is used for authentication it is stored not in plaintext, but a PBKDF digest of it instead. This is obviously good.
However what does not ...
3
votes
3answers
105 views
Alternative to security questions for account recovery when email isn't an option
I'm working on a project whereby a certain level of anonymity is required for users. One of stipulations is that no email is used at all, as it makes the barrier to entry too high for people who want ...
2
votes
3answers
95 views
What is a good algorithm for memorizing a password in a few minutes?
Let's say I am following good security policy and picking passwords that are:
Long
Complex (passphrases where possible, otherwise random strings with special characters)
Unique (completely ...
0
votes
2answers
58 views
Logging in after password reset email sent (but not acted on)
Should a user be allowed to request a password reset email and then log in (i.e. disregarding the reset email and using their existing password) or should the current account be locked until the ...
3
votes
2answers
143 views
How does my bank knows my second and forth chars of my password
I see that the new login mechanism used by some banks in UK and also used by visa debit authentication is to ask for three random characters from your password at login (for example second, ninth and ...
0
votes
1answer
150 views
Why don't we do dual password instead of forgot password?
You can see a link Forgot Password? nearby almost all login form.
As I mentioned in question, Since passwords are completely protected from outside access unless owner reveal, I come up with this ...
1
vote
1answer
75 views
Is it a good idea to give users an additional password that they do not control?
It's a given that users will choose bad passwords. Why not help them out? Using a securely-random choice from a large dictionary, choose one or two words and tell the user to write them down. When ...
0
votes
1answer
69 views
Should I log wrong passwords? [duplicate]
I have a public-facing web application where anyone can register an account. The passwords I store are salted and hashed.
When someone tries to overtake the account of someone else through guessing ...
1
vote
0answers
60 views
How secure is a Python Pyro daemon for storing a password?
I am using the Pyro package to create a daemon which will, upon startup, prompt for a password, and then the daemon will store that password as long as it is running. Other scripts will then make a ...
1
vote
2answers
144 views
Username and password stored under form data in Chrome Dev Tools
When I record the network tab in Chrome Developer Tools when logging in to my site I find that the username and password are stored in plaintext under form data.
You can also find it in Safari, ...
3
votes
1answer
70 views
What are industry-standard recommended practices to protect user information in an Android app?
I am developing an Android app that will potentially handle sensitive user data, and some of it may be even considered medical data (for example user height, weight, alergies, etc).
What would be the ...
1
vote
3answers
182 views
Sharing passwords through email can be considered insecure?
I'm responsible to create new accounts for some services on my job. Some of these service do not allow password change by the user, so in the case the user wants to change its password, he would need ...
2
votes
5answers
214 views
Password Recovery - what if user can't complete 2nd step?
I'm thinking out my password recovery logic for an ecommerce system. Some backround: Passwords are stored using bcrypt, password recovery involves the standard reset link, which then can be used to ...
1
vote
2answers
158 views
What are the security risks associated with storing passwords on the internet?
With products such as LastPass that store encrypted passwords on remote servers, what are the associated risks that aren't applicable to locally stored and encrypted passwords? If something is ...
16
votes
2answers
537 views
Bank accepts different password to the one that I set
I'm not particularly well versed in IT security so please bear with me.
I recently discovered that my bank's online system will accept passwords that consist of the correct password, and a string of ...
2
votes
1answer
479 views
Where to keep key file used as composite key for Keepass 2
I used to use a master password and "Windows User Account" to get into my password datasbase with Keepass 2. Then I realized the "Windows User Account" option is garbage because if you ever want to ...
15
votes
3answers
1k views
Why check to see if a password is already used by another user?
This is coming from a joke originally in French:
Enter your password.
carrot
Sorry, your password must be more than 8 characters.
carottegéante
(giant carrot)
Sorry, your ...
1
vote
1answer
86 views
Which is best DPAPI or HSM?
Can you please explain what's is the main difference between for this both DPAPI and
HSM? As far as I understand both protecting the data, the way of protection is difference HSM is physical device ...
10
votes
4answers
759 views
Forgetting passwords typed in too frequently
It has happened to me several times that I've become so used to typing in a password I can't consciously remember it and it's purely muscle memory. This is particularly true with complex passwords ...
1
vote
4answers
144 views
How to store passphrase in this situation?
How to store a passphrase with a Java application that periodically needs access to its plaintext form? It is a strange situation, but I am wedged in it. If providing a decent security mechanism is ...
1
vote
1answer
67 views
Security implications of setting the same password on private key and PKCS12/JKS?
Are there any negative security implications of setting the private key password (DSA in this case) as a PKCS12 (and then JKS) export password (instead of generating/inventing a new one)? My use case ...
2
votes
2answers
293 views
What are the pros and cons of using a password safe instead of writing passwords on paper?
Many companies have policy again writing passwords and paper and I wonder if there reasoning is sound. Is it always better to use a software password safe than writing passwords on paper? Here are ...
2
votes
2answers
165 views
How can I store a password history to prevent reuse?
I have an application with a user database. The database stores the password using a bcrypt hash with a randomized salt.
How can I implement a password history set (to prevent password reuse) in a ...
9
votes
4answers
440 views
Password security
I was requested at the login page of a website to first change my password. After typing in a new password, the web page told me the new password did not differ enough from the previous one.
Does this ...
1
vote
1answer
78 views
storing username/email and password with a hash of the hash of the email/password? [duplicate]
Quite the simple discussion this one (one would assume):
If I'd hash the email and password, and then hash the hashes, whould this be considered safe enough or would this just be a waste considering ...
0
votes
2answers
112 views
Password management [duplicate]
I am work in small company. I am Java Developer and Sysadmin of remote servers. I have problem with store password from several servers. How to best way to manage passwords in company?
0
votes
2answers
140 views
Encryption method and other security concerns for a simple password manager [closed]
I thought I would learn a little bit of cryptography programming by making myself a simple password manager program that I can potentially even use to keep track of my passwords. The idea is that my ...
0
votes
2answers
449 views
Security of cloud-based password manager (Dashlane, LastPass) vs. federated login (OpenID, Google, Yahoo, Microsoft, Facebook)
Many websites offer the option to log in with your existing Google or Facebook account (among others). For a long time I've resisted doing this because I use a password manager and I figured it was ...
2
votes
2answers
348 views
Managing and deploying web app passwords
What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
2
votes
4answers
265 views
Should user's password strength be assessed at client or at server side?
Now most of big website like Google mail, Twitter, Facebook have a feature that assesses password strength (check number of digit, alphabet, special characters, or check the similarity over already ...
