All Questions
Tagged with passwords web-application
151 questions
2
votes
2
answers
2k
views
How to tie encryption key to login if there are multiple users
Scenario:
User A, B, C need to access an encrypted data from a web application. They all access the same data.
The encryption key must be tied to their login so that it's not stored in the server.
...
- 2,978
4
votes
2
answers
331
views
Is there any security threat due to returning password on form submitting failure (for example on a signup page)?
Let say that we have a registration page on a website, why shouldn't we return passwords like username, names or any other information on form submitting failure?
For example:
User goes to example....
- 867
2
votes
2
answers
588
views
Do these non-zero durations in btmp indicate someone is logging in?
I've set up a public-facing Debian server on a well-known web hosting provider and am trying to determine if hackers are breaking in. I know very little about securing web servers but I am trying to ...
- 119
236
votes
10
answers
38k
views
Is there any reason to disable paste password on login?
Today I logged in to pay my cellphone bill, and I found that the site has disabled paste functionality in password field.
I'm a webdev and I know how to fix this, but for regular user is REALLY ...
- 2,505
1
vote
2
answers
178
views
Security of picking unique passwords for users [duplicate]
I am learning more about security in web design so I can build more robust sites. As I see it password security is one of the main concerns, if a database is hacked then chances are passwords will be ...
- 131
0
votes
1
answer
201
views
Should all web applications implement a security feature that stores historical passwords? [duplicate]
In addition to Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?.
Facebook, and other companies, are storing historical passwords of ...
- 7,075
1
vote
1
answer
777
views
Challenge-Response Application in E-banking
Why is it important that Alice doesn't know K? What could happen if Alice knew K?
- 145
2
votes
3
answers
1k
views
Sending sensitive information via self destructing link in an email
I need to come up with a simple way for people within the company to send out arbitrary sensitive information to arbitrary recipients. There is an equal chance that the sender and recipient will be ...
- 224
6
votes
6
answers
2k
views
Why is using SQL injection to extract passwords or password hashes from a login database (that should never legitimately disclose them) even possible?
(Okay, so I'll confess upfront that while I'm trying to educate myself the current state of my knowledge on web applications security is still pretty shallow. So I appreciate your patience if the way ...
- 2,815
13
votes
1
answer
3k
views
Should I hash my passwords even if I am only allowed to generate limited traffic?
At this moment I'm busy working on an webapp with a friend of mine. The main problem we have is that we are only allowed to generate 50 GB a month in datatraffic.
My question is: Does hashing the ...
- 324
0
votes
2
answers
359
views
Obfuscate Identity for Password Reset Information
I am just wondering your opinions on why it would/would not be a good idea to mask or obfuscate email address data in a password reset web submission once the user has entered their username informing ...
user109721
13
votes
1
answer
2k
views
Handling "forgot password" functionality with encrypted data without security questions
As a sort of follow-up to this question on handling password-reset functionality when dealing with encrypted user data, is there any good method for resetting a user's password in an encrypted web ...
- 230
3
votes
2
answers
27k
views
How to securely transfer password from a registration page to the database [duplicate]
What steps must be followed to send password securely from the user registration page (i.e. client side) to the server over a non encrypted channel (http) when the user registers for the first time on ...
- 397
5
votes
0
answers
29
views
How to securely send your user and hashed password to a server? [duplicate]
I'm making a user system for an app I'm developing, and I have a client side (the mobile app itself) and a server side (where the database remains) for it. The app sends get and post petitions to the ...
- 151
5
votes
3
answers
402
views
Did I miss any vulns here?
I recently took a beating in a Security Engineer interview and I did not get any specific feedback on how I did. I'd like to re-ask the question to the community so I can polish up on these elements. ...
0
votes
0
answers
56
views
Is it appropriate to request a bounty for finding exploit on major site? [duplicate]
Long story short, I found an easily reproducible, very easy, and honestly embarrassing exploit on a major (yes, major) financial institution's online banking site today. It's not directly tied to ...
- 101
1
vote
2
answers
525
views
Questions about user authentication over REST API
I'm now trying to implement user authentication on my android app. I, however, have a few questions.
I use a REST API. How do I safely request and send data to and from the phone? I'm assuming that I ...
- 11
15
votes
2
answers
11k
views
How to authenticate in a website with public/private keys?
I've been reading how the SSH public/private key works and realized how handy they are (taking the secure out of the equation). And started to wonder why websites do not implement the same thing?
...
3
votes
2
answers
834
views
Is encryption application credentials using certificate encryption good practice?
I'm working on a small web application. The web application needs access to a database, so the application needs access to a database username and password.
The application runs in an environment ...
- 173
0
votes
1
answer
574
views
Why enter again (or at the very least confirm) my email address when I click "Forgot password"?
In most, if not all, web forms for logging into a site, you have your forgot password link. When clicking the link, you get a new form (usually in a new page) either empty (!) or prefilled with the ...
- 181
26
votes
3
answers
46k
views
How secure are sha256 + salt hashes for password storage [duplicate]
I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 ...
- 371
4
votes
3
answers
1k
views
Is it safe to generate a password for a user during sign up in a web application?
I'm working on updating a web application. It currently creates a password for a user during sign up. Is asking the user to create the password themselves safer than relying on a generated password?
- 45
2
votes
3
answers
318
views
Trouble understand login vulnerabilities
I'm testing my own web page with the following vulnerabilities.
#1:
Form escapes ' to \'
So if a user tries to enter the following information:
username: 'or'1=1
password: m
username will ...
- 21
1
vote
1
answer
226
views
What is the safest way to encrypt a password that can be decrypted at a later time?
In a web app I'm building, I need to use Apple's AutoIngestion tool for iTunes Connect. In this tool it seems the only way to use it is to send a password in plain text.
What would be the best ...
- 111
0
votes
3
answers
920
views
When to set security questions for a web application?
For enhanced security, we can use security questions and use them as a means for users to reset forgotten passwords or as an additional means for authenticating.
When would we be the right time to ...
- 915
1
vote
1
answer
890
views
TLS/SSL and password transmission
I am still getting confused with security topics. At the moment the advantages and disadvantages of some of authentication methods are still not very clear. According to OWASP Authentication Cheat ...
- 63
4
votes
3
answers
15k
views
Where are the user credentials stored when remember password is selected?
Provided a user has chosen the remember me option while logged in last time into a web application,how does the web application server identifies the user next time when he logs in? The credentials ...
- 2,097
-2
votes
1
answer
145
views
Escape from <script> to cause a XSS (XSS when reflection is already under <script>) [duplicate]
I am trying my level best to solve this issue i am totally not able to create a XSS i still thinks it to be a vulnerability and i think it is exploitable. I am frustrated around it for 8 days . Please ...
- 115
5
votes
3
answers
2k
views
Two-factor verification without a mobile phone?
Currently, some services use a second layer of veficiation if logging in from a new device:
Gmail and Facebook send a text or call with a code
Facebook generates a code in the mobile application
...
- 271
3
votes
5
answers
8k
views
Why after a website password reset am I asked to login again?
I have noticed that every web site has the exact same behavior for their password reset pages. They send a link to your email using which you can reach the password reset page. On that page you enter ...
- 913
2
votes
2
answers
322
views
Database compromised and some passwords cracked
I run an MMORPG game and today while moving from one server to another, apache failed and listed some of the data on the server including a back-up of all the source code + database which a few people ...
- 21
55
votes
1
answer
44k
views
Why use an authentication token instead of the username/password per request?
The author of https://stackoverflow.com/a/477578/14731 recommends:
DO NOT STORE THE PERSISTENT LOGIN COOKIE (TOKEN) IN YOUR DATABASE, ONLY A HASH OF IT! [...] use strong salted hashing (bcrypt / ...
- 2,169
0
votes
1
answer
140
views
What is the point of hosting database externally?
Following the breach of avast:forum.avast.com
they decided to host the database [email protected].
My question is, what is the point of hosting the database externally since when you get remote ...
- 1
13
votes
5
answers
6k
views
Authenticating without a database
I've been inspired by a question over on Code Review, which boils down to: What is the proper way to authenticate a user without a database?
Would it be the exact same process if you stored ...
- 258
11
votes
3
answers
15k
views
How to store passwords securely in my server?
Disclaimer: I know I should use bcrypt to securely store user's passwords. Please, keep reading.
I want to store credentials for several email services for each user. So if I log in with my username ...
1
vote
1
answer
330
views
Theoretical home grown password options, or what is it that SCrypt, BCrypt, PBKDF2 does that is so special?
I'm developing a personal web framework, nothing internetty, and probably not even anything that will ever go on my personal LAN. And looking for password advice people seem to only recommend those ...
- 620
1
vote
2
answers
252
views
In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?
I asked this question first on Stack Overflow but it was suggested that Information Security would be a better place for it (pretty obvious in hindsight).
https://stackoverflow.com/questions/24304756/...
- 113
4
votes
4
answers
1k
views
Ethical brute force demo on a web login when knowing the password complexity requirements
We are currently having accounts compromised at a substantially high rate. Some in the organization believe that our password complexity requirements is enough to thwart brute force attacks.
I wanted ...
- 203
1
vote
2
answers
651
views
Any reason I shouldn't be salting and hashing before putting through bCrypt?
I've been reading up on password storage and such, and have come to the conclusion that I need to be using bCrypt.
I've got an implementation working correctly, but I'm wondering the best way to move ...
- 111
4
votes
0
answers
1k
views
A Google owned IP address accessed my outlook account [closed]
Today I got a warning from Microsoft saying that there was unusual activity on my account. Diving deeper I saw that there was a successful sign in from a Google owned IP address (according to ARIN). ...
- 367
-3
votes
3
answers
1k
views
Hashing credentials. Is hash(email+password) secure enough?
I am working on a client server application where to identify each user I was thinking of storing a single database entry:
hash(email + password)
In my opinion, this is enough to stop some known ...
- 31
1
vote
1
answer
179
views
Amazon Turk - How secure is it? Strange behavior
I just had this really strange experience with Amazon Turk, where suddenly I was logged into someone else's account. I was logged into the company's Turk account, left my computer for a while, ...
- 203
0
votes
1
answer
300
views
Handling passwords in wicket
I have a form which contains a password field.
In swing the getPassword() method returns a character array. After the password has been processed by my web application the array can be wiped to ...
- 691
8
votes
5
answers
3k
views
What are the benefits to a two-page login system for a webapp?
I have noticed many website going to a two-page (not two-factor) login system - where you enter your username on page 1 and click submit, and then enter your password on page two and click submit.
...
- 698
66
votes
10
answers
20k
views
Bad practice to have a "god" password?
Is it bad security practice to have a password that will allow you to access any user account on a website for support purposes? The password would be stored in a secure manner and would be super ...
- 8,185
4
votes
2
answers
2k
views
Hashing Passphrase in Client-Side JavaScript Rather than Server-Side -- Is it Viable?
The oft-mentioned approach for website password-handling is to use a server-side language to employ a suitable hashing algorithm (stretched or otherwise designed to overly-consume computing resources),...
- 473
2
votes
3
answers
269
views
Limit attempt of user login against PBKDF2
I have been tasked been tasked by my boss to change the encryption system of our web application from MD5 to PBKDF2 as MD5/SHA1 has been shown to be breakable in recent years .
I argued against it ...
- 2,431
4
votes
1
answer
3k
views
Salt usage for Spring security?
I use the Spring security for Java web applications and I have written an authentication provider which is working without salt and now I want to either add salt or alternatively use the built-in ...
0
votes
2
answers
2k
views
How to retrieve the admin's password of a webapp?
I'm doing a pentesting example on a web app and I have dumped all the database.
I have a table with the users in plaintext and the passwords hashed.
I have to find the admin's password (I know that ...
- 85
4
votes
2
answers
2k
views
Managing and deploying web app passwords
What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
- 339