Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
271
questions
623
votes
23
answers
152k
views
How does changing your password every 90 days increase security?
Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
- 6,781
203
votes
10
answers
125k
views
How safe are password managers like LastPass?
I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long.
How safe are password ...
- 2,851
54
votes
4
answers
13k
views
Password manager vs remembering passwords
I have always thought that you are not supposed to use a password manager but to keep your passwords in your head, but lately I have thought about the pros and cons of having a password manager.
Some ...
- 1,672
58
votes
6
answers
13k
views
How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?
In some environments, it is required that users change a certain number of characters every time they create a new password. This is of course to prevent passwords from being easily-guessable, ...
- 27.1k
26
votes
1
answer
3k
views
Password Managers: encrypted database vs hashing strategy
I'm considering moving to a password-management strategy based on supergenpass or something similar. This is an alternative to other password managers where instead of having a database of passwords ...
- 522
87
votes
11
answers
24k
views
What to do about websites that store plain text passwords
I recently received an email from a popular graduate job website (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
- 1,093
48
votes
2
answers
9k
views
Are there more modern password hashing methods than bcrypt and scrypt?
This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt.
What I'm wondering is if there are any "...
- 2,918
54
votes
11
answers
8k
views
Is there a method of generating site-specific passwords which can be executed in my own head?
I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
- 803
99
votes
8
answers
13k
views
Can anyone provide references for implementing web application self password reset mechanisms properly?
We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address).
My problem is that I can'...
- 1,172
23
votes
5
answers
6k
views
Is this idea for a password manager secure? If so, why doesn't anybody use it? [closed]
I've been thinking of a problem with usual password managers: although they do provide better security than manually using passwords, there's a central database that can get lost, get compromised, etc....
- 566
30
votes
5
answers
5k
views
Recommended policy on password complexity
Is there any research on how how a password complexity policy can increase or decrease the quality of passwords?
If you don't have any requirements on the password then probably 90% of users will use ...
- 1,672
81
votes
9
answers
26k
views
Is it OK to tell your password to your company's sysadmin?
I'm working in a small company (20 employees) as a senior software engineer.
After having problems with my email, our newly employed IT administrator asked me to write my user password to someone in ...
- 1,219
75
votes
10
answers
49k
views
Why Disallow Special Characters In a Password?
The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
- 851
111
votes
9
answers
61k
views
Is it safe to send clear usernames/passwords on a https connection to authenticate users?
I'm setting up a home HTTP server which can send and receive JSON data to/from different clients (Android and iPhone apps).
I'd like to allow access only to certain users and I'm considering using a ...
- 1,213
298
votes
7
answers
84k
views
What's the rationale behind Ctrl-Alt-Del for login
Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, it'...
- 2,909
109
votes
7
answers
149k
views
Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?
Justin Schuh defended Google's reasoning in the wake of this post detailing the "discovery" (sic) that passwords saved in the Chrome password manager can be viewed in plaintext. Let me just directly ...
- 1,259
89
votes
15
answers
32k
views
How to store passwords written on a physical notebook?
Answers to the question "How safe are password managers like LastPass?" suggest that storing personal passwords on a physical notebook might be a reasonable option:
I know someone who won't use ...
- 1,129
53
votes
7
answers
5k
views
Do security questions subvert passwords?
Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
- 685
46
votes
4
answers
22k
views
What should be used as a salt?
I always hear that it is best to use salts on top of stored passwords, which then somehow gets concatenated and hashed afterwards. But I don't know what to use as a the salt. What would be a good salt?...
- 631
20
votes
3
answers
9k
views
Is it secure to store a two factor authentication seed in a password manager?
I wonder whether it is really secure to store the Two Factor Authentication seed code (e.g. the secret key for TOTP) within a password manager together with the user and password for the service.
If ...
- 301
120
votes
2
answers
142k
views
How difficult to crack keepass master password?
How easily could someone crack my keepass .kdbx file if that person steals the file but never obtains the Master Password?
Is this a serious threat, or would a brute force attack require massive ...
- 1,827
84
votes
4
answers
45k
views
How to implement “forgot password” functionality?
For my project I need a "forgot password" functionality.
I am not quite sure how to implement this kind of functionality yet so I was hoping to find some "best practice" on the internet but couldn't ...
- 1,057
63
votes
5
answers
15k
views
Is it common practice to log rejected passwords?
While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
- 2,013
56
votes
5
answers
8k
views
Is using bcrypt on existing SHA1 hashes good enough when switching password implementation?
I'm working on improving a CMS where the current implementation of storing password is just sha1(password). I explained to my boss that doing it that way is incredibly insecure, and told him that we ...
- 709
28
votes
6
answers
5k
views
Hash function change
I have user account passwords stored in a database using an unsafe (old) cryptographic hash function.
What is the best/usual approach to changing password hash function? Only two ideas come to my ...
- 383
25
votes
3
answers
3k
views
How can we accurately measure a password entropy range?
I've given myself the task of writing code that determines the strength of a password, and really want to break out of a lot of already established ways we do that, as they're often lacking, not ...
- 5,264
19
votes
7
answers
6k
views
Prevent denial of service attacks against slow hashing functions?
I've been thinking about bcrypt recently, and what I wonder is if there's a way to deal with the inherent (D)DoS problems with slow hashing functions. Namely, if I set up bcrypt so my machine takes ...
- 2,918
42
votes
3
answers
3k
views
Am I wrong to believe that passwords should never be recoverable (one way hash)?
I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
user3127
30
votes
4
answers
10k
views
The registration confirmation email contains my password: do they keep it in plaintext?
I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
- 403
35
votes
8
answers
8k
views
Why would salt not have prevented LinkedIn passwords from getting cracked?
In this interview posted on Krebs on Security, this question was asked and answered:
BK: I’ve heard people say, you know this probably would not have
happened if LinkedIn and others had salted ...
- 485
24
votes
7
answers
22k
views
How can I avoid putting the database password in a perl script?
I have a cronned Perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
- 2,237
24
votes
7
answers
10k
views
Logging in a user after password reset via link
Lets say password reset functionality flow is the following:
User submits email address used for his account.
An email is sent to that email address with a link with a password reset hash.
Upon ...
- 343
17
votes
3
answers
2k
views
How to evaluate a password manager?
How can we quantify the trade-off between password aggregation and convenience?
Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce security....
- 3,003
4
votes
2
answers
1k
views
Password generation based on hash of master password + suffix? [duplicate]
Is this [1] a secure and reasonable way to generate a unique password for login on various websites?
echo -n my_strong_master_password#website.com | sha1sum
Of course, if my system is compromised ...
- 163
3
votes
3
answers
524
views
How to decide whether to password protect key files in addition to full disk encryption
It is customary to protect certain critical files with a password. For example: PGP keys, VPN keys, password managers, etc. The practice dates back to before full disk encryption being common.
These ...
- 33k
97
votes
6
answers
6k
views
Should passwords be automatically reset when the underlying method changes
I'm currently an engineer on a project in development phase. One 'module' on this project gives the ability for user authentication/authorization. However it's come to our concern that the password ...
- 1,527
52
votes
7
answers
14k
views
What are the cons of stateless password generators?
Does anybody have hands-on experience with stateless password generators (managers) like Getpass?
It seems like it does most of the work of cloud password managers, but leans more to the security ...
- 631
43
votes
10
answers
8k
views
What type of pattern should I use for my passwords?
I have a lot of accounts and until some time ago I used an universal password for all of them. Right now I have a different password for every account depending on the website name that I am logging ...
- 591
42
votes
5
answers
13k
views
Does the average user really need a password manager?
I'd describe myself as an average tech savvy computer user. I have many accounts in forums, shopping sites, etc where I recycle two moderately strong password with small variation. These are account ...
- 613
42
votes
9
answers
26k
views
Why don't people hash and salt usernames before storing them
Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext.
What I ...
- 652
39
votes
4
answers
35k
views
Is it safe to store the database password in a PHP file?
My connection.php file stores the credentials to connect to the database:
<?php
$objConnect = mysql_connect("localhost","username","password");
mysql_select_db("selectDB", $objConnect);
?...
- 493
34
votes
5
answers
5k
views
Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?
I just wanted to know if you can increase the cost (iterations) of those two algorithms off-line.
I want to increase the cost every year of my users passwords.
One solution is to recalculate them when ...
- 441
31
votes
4
answers
6k
views
Any reason to slow hash passwords generated randomly by our site?
The site which I maintain has been in production for 3 years. When you register, the site generates a large (20 digit) random hex password for you. It's stored MD5 hashed unsalted.
When I told the ...
- 301
22
votes
6
answers
9k
views
Managing website passwords for small team
I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
- 13.1k
21
votes
4
answers
26k
views
Does adding two-factor authentication by OTP really make KeePass more secure
KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
- 3,609
19
votes
7
answers
2k
views
Aren't password managers still incredibly risky?
I understand the utility in having one application remember a bunch of long, randomized passwords, but all you'd need is one well-placed phishing scam or a keylogger and they get all the keys to the ...
- 723
12
votes
6
answers
3k
views
How to securely store my passwords?
Regarding this:
Are passwords in memory?
So does someone have a good idea on how to securely store my passwords?
The: "passwords.txt" -> ctrl+c; ctrl+v a passw is not very secure.
I have passwords ...
- 6,219
11
votes
8
answers
6k
views
Sequential password updates
Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse.
What's to stop the user from changing the ...
- 2,482
9
votes
2
answers
2k
views
Is it acceptable to generate salts with a hash of the username?
Salts are supposed to be unique and randomly generated for each user when storing passwords. Is there a reason why we can't generate these salts with a cryptographic hash function using the username ...
- 93
235
votes
10
answers
36k
views
Is there any reason to disable paste password on login?
Today I logged in to pay my cellphone bill, and I found that the site has disabled paste functionality in password field.
I'm a webdev and I know how to fix this, but for regular user is REALLY ...
- 2,475