As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

Filter by
Sorted by
Tagged with
623 votes
23 answers

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
Bill the Lizard's user avatar
203 votes
10 answers

How safe are password managers like LastPass?

I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long. How safe are password ...
blended's user avatar
  • 2,851
54 votes
4 answers

Password manager vs remembering passwords

I have always thought that you are not supposed to use a password manager but to keep your passwords in your head, but lately I have thought about the pros and cons of having a password manager. Some ...
KilledKenny's user avatar
  • 1,672
58 votes
6 answers

How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?

In some environments, it is required that users change a certain number of characters every time they create a new password. This is of course to prevent passwords from being easily-guessable, ...
Iszi's user avatar
  • 27.1k
26 votes
1 answer

Password Managers: encrypted database vs hashing strategy

I'm considering moving to a password-management strategy based on supergenpass or something similar. This is an alternative to other password managers where instead of having a database of passwords ...
MikeFHay's user avatar
  • 522
87 votes
11 answers

What to do about websites that store plain text passwords

I recently received an email from a popular graduate job website ( that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
jamesj's user avatar
  • 1,093
48 votes
2 answers

Are there more modern password hashing methods than bcrypt and scrypt?

This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt. What I'm wondering is if there are any "...
Brendan Long's user avatar
  • 2,918
54 votes
11 answers

Is there a method of generating site-specific passwords which can be executed in my own head?

I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
Mnementh's user avatar
  • 803
99 votes
8 answers

Can anyone provide references for implementing web application self password reset mechanisms properly?

We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address). My problem is that I can'...
bdg's user avatar
  • 1,172
23 votes
5 answers

Is this idea for a password manager secure? If so, why doesn't anybody use it? [closed]

I've been thinking of a problem with usual password managers: although they do provide better security than manually using passwords, there's a central database that can get lost, get compromised, etc....
ithisa's user avatar
  • 566
30 votes
5 answers

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
KilledKenny's user avatar
  • 1,672
81 votes
9 answers

Is it OK to tell your password to your company's sysadmin?

I'm working in a small company (20 employees) as a senior software engineer. After having problems with my email, our newly employed IT administrator asked me to write my user password to someone in ...
BЈовић's user avatar
  • 1,219
75 votes
10 answers

Why Disallow Special Characters In a Password?

The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
Gary's user avatar
  • 851
111 votes
9 answers

Is it safe to send clear usernames/passwords on a https connection to authenticate users?

I'm setting up a home HTTP server which can send and receive JSON data to/from different clients (Android and iPhone apps). I'd like to allow access only to certain users and I'm considering using a ...
Emiliano's user avatar
  • 1,213
298 votes
7 answers

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, it'...
Count Zero's user avatar
  • 2,909
109 votes
7 answers

Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?

Justin Schuh defended Google's reasoning in the wake of this post detailing the "discovery" (sic) that passwords saved in the Chrome password manager can be viewed in plaintext. Let me just directly ...
brentonstrine's user avatar
89 votes
15 answers

How to store passwords written on a physical notebook?

Answers to the question "How safe are password managers like LastPass?" suggest that storing personal passwords on a physical notebook might be a reasonable option: I know someone who won't use ...
tmh's user avatar
  • 1,129
53 votes
7 answers

Do security questions subvert passwords?

Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
Thomas Eding's user avatar
46 votes
4 answers

What should be used as a salt?

I always hear that it is best to use salts on top of stored passwords, which then somehow gets concatenated and hashed afterwards. But I don't know what to use as a the salt. What would be a good salt?...
Sal Rahman's user avatar
20 votes
3 answers

Is it secure to store a two factor authentication seed in a password manager?

I wonder whether it is really secure to store the Two Factor Authentication seed code (e.g. the secret key for TOTP) within a password manager together with the user and password for the service. If ...
Programie's user avatar
  • 301
120 votes
2 answers

How difficult to crack keepass master password?

How easily could someone crack my keepass .kdbx file if that person steals the file but never obtains the Master Password? Is this a serious threat, or would a brute force attack require massive ...
steampowered's user avatar
  • 1,827
84 votes
4 answers

How to implement “forgot password” functionality?

For my project I need a "forgot password" functionality. I am not quite sure how to implement this kind of functionality yet so I was hoping to find some "best practice" on the internet but couldn't ...
Stefan Falk's user avatar
  • 1,057
63 votes
5 answers

Is it common practice to log rejected passwords?

While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
Drew Lex's user avatar
  • 2,013
56 votes
5 answers

Is using bcrypt on existing SHA1 hashes good enough when switching password implementation?

I'm working on improving a CMS where the current implementation of storing password is just sha1(password). I explained to my boss that doing it that way is incredibly insecure, and told him that we ...
Alex's user avatar
  • 709
28 votes
6 answers

Hash function change

I have user account passwords stored in a database using an unsafe (old) cryptographic hash function. What is the best/usual approach to changing password hash function? Only two ideas come to my ...
h9lpq0u's user avatar
  • 383
25 votes
3 answers

How can we accurately measure a password entropy range?

I've given myself the task of writing code that determines the strength of a password, and really want to break out of a lot of already established ways we do that, as they're often lacking, not ...
Incognito's user avatar
  • 5,264
19 votes
7 answers

Prevent denial of service attacks against slow hashing functions?

I've been thinking about bcrypt recently, and what I wonder is if there's a way to deal with the inherent (D)DoS problems with slow hashing functions. Namely, if I set up bcrypt so my machine takes ...
Brendan Long's user avatar
  • 2,918
42 votes
3 answers

Am I wrong to believe that passwords should never be recoverable (one way hash)?

I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
user avatar
30 votes
4 answers

The registration confirmation email contains my password: do they keep it in plaintext?

I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
Alex's user avatar
  • 403
35 votes
8 answers

Why would salt not have prevented LinkedIn passwords from getting cracked?

In this interview posted on Krebs on Security, this question was asked and answered: BK: I’ve heard people say, you know this probably would not have happened if LinkedIn and others had salted ...
pepsi's user avatar
  • 485
24 votes
7 answers

How can I avoid putting the database password in a perl script?

I have a cronned Perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
Luke Sheppard's user avatar
24 votes
7 answers

Logging in a user after password reset via link

Lets say password reset functionality flow is the following: User submits email address used for his account. An email is sent to that email address with a link with a password reset hash. Upon ...
Dmitry Efimenko's user avatar
17 votes
3 answers

How to evaluate a password manager?

How can we quantify the trade-off between password aggregation and convenience? Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce security....
nitrl's user avatar
  • 3,003
4 votes
2 answers

Password generation based on hash of master password + suffix? [duplicate]

Is this [1] a secure and reasonable way to generate a unique password for login on various websites? echo -n | sha1sum Of course, if my system is compromised ...
Simon's user avatar
  • 163
3 votes
3 answers

How to decide whether to password protect key files in addition to full disk encryption

It is customary to protect certain critical files with a password. For example: PGP keys, VPN keys, password managers, etc. The practice dates back to before full disk encryption being common. These ...
paj28's user avatar
  • 33k
97 votes
6 answers

Should passwords be automatically reset when the underlying method changes

I'm currently an engineer on a project in development phase. One 'module' on this project gives the ability for user authentication/authorization. However it's come to our concern that the password ...
Crazy Dino's user avatar
  • 1,527
52 votes
7 answers

What are the cons of stateless password generators?

Does anybody have hands-on experience with stateless password generators (managers) like Getpass? It seems like it does most of the work of cloud password managers, but leans more to the security ...
Cookiecutter's user avatar
43 votes
10 answers

What type of pattern should I use for my passwords?

I have a lot of accounts and until some time ago I used an universal password for all of them. Right now I have a different password for every account depending on the website name that I am logging ...
Chris's user avatar
  • 591
42 votes
5 answers

Does the average user really need a password manager?

I'd describe myself as an average tech savvy computer user. I have many accounts in forums, shopping sites, etc where I recycle two moderately strong password with small variation. These are account ...
Vladimir's user avatar
  • 613
42 votes
9 answers

Why don't people hash and salt usernames before storing them

Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext. What I ...
Grezzo's user avatar
  • 652
39 votes
4 answers

Is it safe to store the database password in a PHP file?

My connection.php file stores the credentials to connect to the database: <?php $objConnect = mysql_connect("localhost","username","password"); mysql_select_db("selectDB", $objConnect); ?...
OammieR's user avatar
  • 493
34 votes
5 answers

Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?

I just wanted to know if you can increase the cost (iterations) of those two algorithms off-line. I want to increase the cost every year of my users passwords. One solution is to recalculate them when ...
skantos's user avatar
  • 441
31 votes
4 answers

Any reason to slow hash passwords generated randomly by our site?

The site which I maintain has been in production for 3 years. When you register, the site generates a large (20 digit) random hex password for you. It's stored MD5 hashed unsalted. When I told the ...
bad security's user avatar
22 votes
6 answers

Managing website passwords for small team

I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
jrdioko's user avatar
  • 13.1k
21 votes
4 answers

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
Jeff's user avatar
  • 3,609
19 votes
7 answers

Aren't password managers still incredibly risky?

I understand the utility in having one application remember a bunch of long, randomized passwords, but all you'd need is one well-placed phishing scam or a keylogger and they get all the keys to the ...
user49637's user avatar
  • 723
12 votes
6 answers

How to securely store my passwords?

Regarding this: Are passwords in memory? So does someone have a good idea on how to securely store my passwords? The: "passwords.txt" -> ctrl+c; ctrl+v a passw is not very secure. I have passwords ...
LanceBaynes's user avatar
  • 6,219
11 votes
8 answers

Sequential password updates

Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse. What's to stop the user from changing the ...
Michael's user avatar
  • 2,482
9 votes
2 answers

Is it acceptable to generate salts with a hash of the username?

Salts are supposed to be unique and randomly generated for each user when storing passwords. Is there a reason why we can't generate these salts with a cryptographic hash function using the username ...
gbooooooo's user avatar
235 votes
10 answers

Is there any reason to disable paste password on login?

Today I logged in to pay my cellphone bill, and I found that the site has disabled paste functionality in password field. I'm a webdev and I know how to fix this, but for regular user is REALLY ...
IAmJulianAcosta's user avatar

2 3 4 5 6