Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
1,291
questions
623
votes
23
answers
151k
views
How does changing your password every 90 days increase security?
Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
- 6,781
297
votes
7
answers
83k
views
What's the rationale behind Ctrl-Alt-Del for login
Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, it'...
- 2,899
234
votes
10
answers
36k
views
Is there any reason to disable paste password on login?
Today I logged in to pay my cellphone bill, and I found that the site has disabled paste functionality in password field.
I'm a webdev and I know how to fix this, but for regular user is REALLY ...
- 2,465
202
votes
10
answers
125k
views
How safe are password managers like LastPass?
I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long.
How safe are password ...
- 2,841
166
votes
5
answers
10k
views
Password management for kids - what's a good way to start?
Consider a young (primary-school age) child who is starting to collect passwords for online services. How can a parent (or equivalent) help them manage their passwords?
An example to make things ...
- 4,375
125
votes
10
answers
20k
views
Does an ISO27001 audit require users to reveal their passwords?
My company's system administrator is asking for our passwords for an ISO audit and my VP IT operations support says it's mandatory for ISMS (ISO27001).
Can someone confirm if this is true?
- 1,312
119
votes
2
answers
142k
views
How difficult to crack keepass master password?
How easily could someone crack my keepass .kdbx file if that person steals the file but never obtains the Master Password?
Is this a serious threat, or would a brute force attack require massive ...
- 1,817
111
votes
9
answers
61k
views
Is it safe to send clear usernames/passwords on a https connection to authenticate users?
I'm setting up a home HTTP server which can send and receive JSON data to/from different clients (Android and iPhone apps).
I'd like to allow access only to certain users and I'm considering using a ...
- 1,213
109
votes
7
answers
149k
views
Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?
Justin Schuh defended Google's reasoning in the wake of this post detailing the "discovery" (sic) that passwords saved in the Chrome password manager can be viewed in plaintext. Let me just directly ...
- 1,259
107
votes
15
answers
24k
views
Why did customer services say using symbols in a password is insecure?
I am using an online service that I recently had to reset my password because I forgot it. When I went to change password I wanted to use one with a symbol !@£$%^&*(). When I clicked "confirm ...
- 1,187
106
votes
7
answers
25k
views
School performs periodic password audits. Is my password compromised?
My university sent me an email informing me that, during a "periodic check", my password was found to be "easily discoverable and at risk of compromise". As I understand it, there ...
- 833
101
votes
3
answers
19k
views
Why is Sojdlg123aljg a common password?
I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
- 743
101
votes
5
answers
15k
views
How to address bad password security policy from a large company?
I just went to reset my Western Digital password and they emailed me my plaintext password, instead of providing online form to let me change it. This is really concerning to me as the site accepts/...
- 1,219
100
votes
12
answers
17k
views
How do very big companies manage their most important passwords / keys?
Third-party password managers such as 1password, etc. are useful for people, businesses, etc. to store passwords. But I bet Facebook, Google, Twitter and other super big tech companies don't use such ...
- 951
99
votes
8
answers
13k
views
Can anyone provide references for implementing web application self password reset mechanisms properly?
We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address).
My problem is that I can'...
- 1,172
98
votes
10
answers
32k
views
If a provider sees the last 4 characters of my password, can they see it in full?
I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
- 1,212
97
votes
6
answers
6k
views
Should passwords be automatically reset when the underlying method changes
I'm currently an engineer on a project in development phase. One 'module' on this project gives the ability for user authentication/authorization. However it's come to our concern that the password ...
- 1,527
89
votes
15
answers
31k
views
How to store passwords written on a physical notebook?
Answers to the question "How safe are password managers like LastPass?" suggest that storing personal passwords on a physical notebook might be a reasonable option:
I know someone who won't use ...
- 1,129
87
votes
11
answers
24k
views
What to do about websites that store plain text passwords
I recently received an email from a popular graduate job website (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
- 1,093
84
votes
14
answers
12k
views
How can I protect myself from false accusations when our company practices password escrow?
During an internship for a small company, my boss created an account for me, so I generated a password and I used it. The next day, my boss told me to write down the password of my account on a piece ...
- 854
83
votes
4
answers
45k
views
How to implement “forgot password” functionality?
For my project I need a "forgot password" functionality.
I am not quite sure how to implement this kind of functionality yet so I was hoping to find some "best practice" on the internet but couldn't ...
- 1,047
80
votes
3
answers
23k
views
How can I create a password that says "SALT ME!" when hashed?
How can I create a password, which when directly hashed (without any salt) with md5 will return a string containing the 8 characters "SALT ME!". The hope is that a naive developer browsing through his ...
- 1,069
80
votes
9
answers
26k
views
Is it OK to tell your password to your company's sysadmin?
I'm working in a small company (20 employees) as a senior software engineer.
After having problems with my email, our newly employed IT administrator asked me to write my user password to someone in ...
- 1,199
77
votes
10
answers
19k
views
If I enter a password on the wrong site, should I consider it compromised?
I have recently started to make use of a password manager and good password practices. I have a different password for each site that I use.
If I accidentally use the password from another site when ...
- 1,961
75
votes
10
answers
13k
views
What is worse for password strength, a poor password policy or no password policy at all?
Recently I saw the following screenshot on Twitter, describing a obviously terrible password policy:
I wonder what is worse for the password strength. Having no password policy at all or a poor ...
- 6,337
75
votes
10
answers
48k
views
Why Disallow Special Characters In a Password?
The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
- 851
72
votes
9
answers
17k
views
What's the safest way to inform a new user of their password on an invite-only website?
I'm developing a web site where people will have accounts. However, unlike most web sites, user do not register, rather they are invited by the site admins. The site admins will create a new user ...
- 715
71
votes
12
answers
29k
views
Storing passwords in access-restricted Google spreadsheets?
I saw someone's interesting practice to store sensitive information.
He is saving all his thousand logins (including banks and email) in a access-restricted Google spread sheet, stored on his Google ...
67
votes
17
answers
43k
views
Alternative to sending password over mail?
Recently I've started working as a contractor for a company, which requires me to often log in to different b2b services.
The way I receive the login data is usually over email in plain text. My gut ...
- 3,645
66
votes
7
answers
18k
views
Is it safe/wise to store a salt in the same field as the hashed password?
In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"):
$argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
- 771
63
votes
5
answers
15k
views
Is it common practice to log rejected passwords?
While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
- 2,013
59
votes
12
answers
4k
views
How do you log in from an unsecured computer?
Suppose that you are on a cybercafe, at a friend's home or at your work office, and you need to log in on a site, but you feel that the the computer can not be trusted (e.g. your friend isn't tech-...
- 699
58
votes
10
answers
15k
views
How can I convince my boss that storing third party passwords in plaintext is a bad idea?
Keeping things vague - I work at a company that handles compliance issues for our clients. Very often, this means we need to log onto their various accounts for various entities. We store their ...
- 715
58
votes
6
answers
13k
views
How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?
In some environments, it is required that users change a certain number of characters every time they create a new password. This is of course to prevent passwords from being easily-guessable, ...
- 27k
56
votes
5
answers
8k
views
Is using bcrypt on existing SHA1 hashes good enough when switching password implementation?
I'm working on improving a CMS where the current implementation of storing password is just sha1(password). I explained to my boss that doing it that way is incredibly insecure, and told him that we ...
- 709
55
votes
3
answers
11k
views
Secret salts; why do they slow down attacker more than they do me?
When studying Dan Boneh's slides for 'Session Management and
User Authentication' (2011) he mentions 'secret salts' on the slide 'Further defences' (slide 48 out of 58).
He suggest to store in the ...
- 603
54
votes
8
answers
6k
views
You're an IT consultant. Should you discourage a client from telling you their password?
I'm an IT consultant. One client has known me for a few years. He wants me to do some work on his kids' laptop again. I'll need to log into his kids' Windows user account. (I'm guessing that multiple ...
54
votes
11
answers
8k
views
Is there a method of generating site-specific passwords which can be executed in my own head?
I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
- 793
53
votes
4
answers
21k
views
How can I be sure Lastpass really can't access my passwords?
The recent, widely publicized security incident where millions of Linkedin were exposed reminded me to tighten up my password practices. I'm looking at several password managers now and I'm especially ...
- 531
53
votes
7
answers
5k
views
Do security questions subvert passwords?
Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
- 685
53
votes
4
answers
13k
views
Password manager vs remembering passwords
I have always thought that you are not supposed to use a password manager but to keep your passwords in your head, but lately I have thought about the pros and cons of having a password manager.
Some ...
- 1,662
52
votes
7
answers
14k
views
What are the cons of stateless password generators?
Does anybody have hands-on experience with stateless password generators (managers) like Getpass?
It seems like it does most of the work of cloud password managers, but leans more to the security ...
- 631
51
votes
13
answers
18k
views
Is there a good way to store credentials outside of a password manager?
A lot of the users in my company are using their agendas to write down their password and usernames, or Excel sheets with a protected password. I'm hesitant to install software for password management ...
- 599
51
votes
10
answers
17k
views
Confused about using a password that "would take centuries to break"
I am talking about this password - 23##24$$25%%26 and the similar ones consisting of special characters appearing in a pattern, which the users these days use a lot.
At work (finance company), I was ...
- 845
51
votes
5
answers
6k
views
Should a bank be able to shorten your password without your involvement?
The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore.
He called his advisor, who ...
- 611
51
votes
9
answers
11k
views
Can users make use of a password manager when banks tell them never to write passwords down?
Consider a user who wants to use a password manager for their banking passwords. Advice from banks usually says they should never write down their password. The user would be concerned about going ...
- 32.9k
50
votes
10
answers
18k
views
Is it OK that a sysadmin knows the password for a newcomer / act as a user (immediately after his/her recruiting)?
Somehow related to this other question. I am dealing with the following case: a medium-large company (with about 200 on-premises employees) is applying the following procedure for all the newly ...
- 601
48
votes
2
answers
9k
views
Are there more modern password hashing methods than bcrypt and scrypt?
This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt.
What I'm wondering is if there are any "...
- 2,898
47
votes
6
answers
5k
views
"Real" Salt and "Fake" Salt
During a Q&A period at DEFCON this year, one member of the audience mentioned that we're using "fake salt" when concatenating a random value and a password before hashing. He defined "real salt" ...
- 38.2k
47
votes
3
answers
16k
views
Should password reset tokens be hashed when stored in a database?
Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in.
If I can get a valid password reset token ...
- 1,167