Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

Filter by
Sorted by
Tagged with
571
votes
23answers
136k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
172
votes
10answers
115k views

How safe are password managers like LastPass?

I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long. How safe are password ...
51
votes
6answers
10k views

How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?

In some environments, it is required that users change a certain number of characters every time they create a new password. This is of course to prevent passwords from being easily-guessable, ...
49
votes
4answers
10k views

Password manager vs remembering passwords

I have always thought that you are not supposed to use a password manager but to keep your passwords in your head, but lately I have thought about the pros and cons of having a password manager. Some ...
51
votes
11answers
6k views

Is there a method of generating site-specific passwords which can be executed in my own head?

I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
23
votes
1answer
2k views

Password Managers: encrypted database vs hashing strategy

I'm considering moving to a password-management strategy based on supergenpass or something similar. This is an alternative to other password managers where instead of having a database of passwords ...
95
votes
8answers
13k views

Can anyone provide references for implementing web application self password reset mechanisms properly?

We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address). My problem is that I can'...
42
votes
2answers
8k views

Are there more modern password hashing methods than bcrypt and scrypt?

This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt. What I'm wondering is if there are any "...
22
votes
5answers
6k views

Is this idea for a password manager secure? If so, why doesn't anybody use it? [closed]

I've been thinking of a problem with usual password managers: although they do provide better security than manually using passwords, there's a central database that can get lost, get compromised, etc....
30
votes
5answers
5k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
84
votes
12answers
20k views

What to do about websites that store plain text passwords

I recently received an email from a popular graduate job website (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
78
votes
9answers
17k views

Is it OK to tell your password to your company's sysadmin?

I'm working in a small company (20 employees) as a senior software engineer. After having problems with my email, our newly employed IT administrator asked me to write my user password to someone in ...
100
votes
8answers
45k views

Is it safe to send clear usernames/passwords on a https connection to authenticate users?

I'm setting up a home HTTP server which can send and receive JSON data to/from different clients (Android and iPhone apps). I'd like to allow access only to certain users and I'm considering using a ...
91
votes
7answers
96k views

Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?

Justin Schuh defended Google's reasoning in the wake of this post detailing the "discovery" (sic) that passwords saved in the Chrome password manager can be viewed in plaintext. Let me just directly ...
42
votes
4answers
15k views

What should be used as a salt?

I always hear that it is best to use salts on top of stored passwords, which then somehow gets concatenated and hashed afterwards. But I don't know what to use as a the salt. What would be a good salt?...
89
votes
15answers
22k views

How to store passwords written on a physical notebook?

Answers to the question "How safe are password managers like LastPass?" suggest that storing personal passwords on a physical notebook might be a reasonable option: I know someone who won't use ...
53
votes
7answers
4k views

Do security questions subvert passwords?

Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
54
votes
4answers
6k views

Is using bcrypt on existing SHA1 hashes good enough when switching password implementation?

I'm working on improving a CMS where the current implementation of storing password is just sha1(password). I explained to my boss that doing it that way is incredibly insecure, and told him that we ...
285
votes
7answers
70k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, it'...
66
votes
4answers
26k views

How to implement “forgot password” functionality?

For my project I need a "change password" functionality. I am not quite sure how to implement this kind of functionality yet so I was hoping to find some "best practice" on the internet but couldn't ...
106
votes
2answers
126k views

How difficult to crack keepass master password?

How easily could someone crack my keepass .kdbx file if that person steals the file but never obtains the Master Password? Is this a serious threat, or would a brute force attack require massive ...
25
votes
3answers
2k views

How can we accurately measure a password entropy range?

I've given myself the task of writing code that determines the strength of a password, and really want to break out of a lot of already established ways we do that, as they're often lacking, not ...
63
votes
9answers
39k views

Why Disallow Special Characters In a Password?

The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
58
votes
5answers
12k views

Is it common practice to log rejected passwords?

While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
41
votes
3answers
3k views

Am I wrong to believe that passwords should never be recoverable (one way hash)?

I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
27
votes
4answers
8k views

The registration confirmation email contains my password: do they keep it in plaintext?

I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
35
votes
8answers
7k views

Why would salt not have prevented LinkedIn passwords from getting cracked?

In this interview posted on Krebs on Security, this question was asked and answered: BK: I’ve heard people say, you know this probably would not have happened if LinkedIn and others had salted ...
15
votes
7answers
5k views

Prevent denial of service attacks against slow hashing functions?

I've been thinking about bcrypt recently, and what I wonder is if there's a way to deal with the inherent (D)DoS problems with slow hashing functions. Namely, if I set up bcrypt so my machine takes ...
27
votes
6answers
4k views

Hash function change

I have user account passwords stored in a database using an unsafe (old) cryptographic hash function. What is the best/usual approach to changing password hash function? Only two ideas come to my ...
23
votes
7answers
19k views

How can I avoid putting the database password in a perl script?

I have a cronned Perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
18
votes
6answers
7k views

Logging in a user after password reset via link

Lets say password reset functionality flow is the following: User submits email address used for his account. An email is sent to that email address with a link with a password reset hash. Upon ...
3
votes
2answers
947 views

Password generation based on hash of master password + suffix? [duplicate]

Is this [1] a secure and reasonable way to generate a unique password for login on various websites? echo -n my_strong_master_password#website.com | sha1sum Of course, if my system is compromised ...
2
votes
3answers
411 views

How to decide whether to password protect key files in addition to full disk encryption

It is customary to protect certain critical files with a password. For example: PGP keys, VPN keys, password managers, etc. The practice dates back to before full disk encryption being common. These ...
41
votes
5answers
11k views

Does the average user really need a password manager?

I'd describe myself as an average tech savvy computer user. I have many accounts in forums, shopping sites, etc where I recycle two moderately strong password with small variation. These are account ...
38
votes
9answers
19k views

Why don't people hash and salt usernames before storing them

Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext. What I ...
31
votes
4answers
6k views

Any reason to slow hash passwords generated randomly by our site?

The site which I maintain has been in production for 3 years. When you register, the site generates a large (20 digit) random hex password for you. It's stored MD5 hashed unsalted. When I told the ...
31
votes
5answers
4k views

Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?

I just wanted to know if you can increase the cost (iterations) of those two algorithms off-line. I want to increase the cost every year of my users passwords. One solution is to recalculate them ...
22
votes
6answers
9k views

Managing website passwords for small team

I'm part of a small group of people who manage a website and the server it runs on. We have many accounts with third-party websites or services that multiple people on the team need to access. What is ...
21
votes
4answers
19k views

Does adding two-factor authentication by OTP really make KeePass more secure

KeePass is an application that keeps all your passwords for you in a database. It is primarily protected by a master password and/or keyfile. If the database is properly encrypted with that password ...
15
votes
3answers
2k views

How to evaluate a password manager?

How can we quantify the trade-off between password aggregation and convenience? Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce security....
11
votes
6answers
3k views

How to securely store my passwords?

Regarding this: Are passwords in memory? So does someone have a good idea on how to securely store my passwords? The: "passwords.txt" -> ctrl+c; ctrl+v a passw is not very secure. I have passwords ...
9
votes
2answers
1k views

Is it acceptable to generate salts with a hash of the username?

Salts are supposed to be unique and randomly generated for each user when storing passwords. Is there a reason why we can't generate these salts with a cryptographic hash function using the username ...
52
votes
4answers
20k views

How can I be sure Lastpass really can't access my passwords?

The recent, widely publicized security incident where millions of Linkedin were exposed reminded me to tighten up my password practices. I'm looking at several password managers now and I'm especially ...
95
votes
6answers
5k views

Should passwords be automatically reset when the underlying method changes

I'm currently an engineer on a project in development phase. One 'module' on this project gives the ability for user authentication/authorization. However it's come to our concern that the password ...
44
votes
10answers
8k views

What type of pattern should I use for my passwords?

I have a lot of accounts and until some time ago I used an universal password for all of them. Right now I have a different password for every account depending on the website name that I am logging ...
30
votes
3answers
19k views

Is it safe to store the database password in a PHP file?

My connection.php file stores the credentials to connect to the database: <?php $objConnect = mysql_connect("localhost","username","password"); mysql_select_db("selectDB", $objConnect); ?...
50
votes
10answers
16k views

Confused about using a password that “would take centuries to break”

I am talking about this password - 23##24$$25%%26 and the similar ones consisting of special characters appearing in a pattern, which the users these days use a lot. At work (finance company), I was ...
26
votes
7answers
7k views

What is a good practical (and sane) way to manage all your passwords for online sites?

I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords. This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
17
votes
7answers
2k views

Aren't password managers still incredibly risky?

I understand the utility in having one application remember a bunch of long, randomized passwords, but all you'd need is one well-placed phishing scam or a keylogger and they get all the keys to the ...
13
votes
3answers
18k views

Security analysis of Dashlane

I've been asked by a user whether I would recommend using the Dashlane password manager. I'm aware that other password managers have had some significant security problems, including XSS and CSRF (...