All Questions
Tagged with passwords web-application
151 questions
252
votes
2
answers
42k
views
Can ads on a page read my password?
Disclaimer: I have minimal web-dev/security knowledge so please answer as if talking to a "layman."
I've heard that web-advertisements need to be able to run their own JavaScript so that they can ...
- 1,045
236
votes
10
answers
38k
views
Is there any reason to disable paste password on login?
Today I logged in to pay my cellphone bill, and I found that the site has disabled paste functionality in password field.
I'm a webdev and I know how to fix this, but for regular user is REALLY ...
- 2,505
171
votes
13
answers
111k
views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
- 1,945
155
votes
3
answers
21k
views
If my password was able to be printed on a form sent home from my child's school, does it imply insecure password storage policies?
I have a user account for each of my children in our district website, which oversees registration, grades, identification, etc.
I was recently sent home a form from both of my children's classrooms ...
- 1,247
105
votes
2
answers
20k
views
Is a redirect showing the password in plain text a security vulnerability?
A couple of days ago, I attempted to log into the website of a well-known SaaS provider. I used a password manager on my browser (so user/pass were correct) and the NoScript plugin which had limited ...
- 1,021
101
votes
6
answers
39k
views
Are GUIDs safe for one-time tokens?
I see a lot of sites use GUIDs for password resets, unsubscribe requests and other forms of unique identification.
Presumably they are appealing because they are easy to generate, unique, non-...
- 1,112
88
votes
11
answers
25k
views
What to do about websites that store plain text passwords
I recently received an email from a popular graduate job website (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
- 1,103
67
votes
8
answers
60k
views
Why do people still use/recommend MD5 if it has been proven weak since 1996?
It's still a commonly recommended way of hashing passwords, even if its insecurity had been proven in 1996:
Therefore we suggest that in the future MD5 should no longer be implemented in applications ...
- 2,253
66
votes
10
answers
20k
views
Bad practice to have a "god" password?
Is it bad security practice to have a password that will allow you to access any user account on a website for support purposes? The password would be stored in a secure manner and would be super ...
- 8,185
61
votes
3
answers
9k
views
Website returning plaintext password [duplicate]
I have recently logged into a website. When I clicked on the "Update Profile" page, you are displayed with a list of text boxes for all the user fields, e.g. name, email, phone number etc.
There is ...
- 612
55
votes
1
answer
44k
views
Why use an authentication token instead of the username/password per request?
The author of https://stackoverflow.com/a/477578/14731 recommends:
DO NOT STORE THE PERSISTENT LOGIN COOKIE (TOKEN) IN YOUR DATABASE, ONLY A HASH OF IT! [...] use strong salted hashing (bcrypt / ...
- 2,169
45
votes
7
answers
33k
views
Is it okay for API secret to be stored in plain text or decrypt-able?
Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
- 2,978
41
votes
3
answers
19k
views
Is it safe to check password against the HIBP Pwned Passwords API during account registration?
User registers account on a web app. Passwords are salted and hashed.
But is it safe to check the password against the HIBP Pwned Passwords API, before salting and hashing it? Of course the app uses ...
- 533
40
votes
7
answers
16k
views
Why do we ask for a user's existing password when changing their password?
In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
- 749
34
votes
3
answers
5k
views
Is there a security reason for a site to limit the number of times a user can change their password?
Is there a security reason to disallow a user to change their password as frequently as they want? I have found this security policy in a site and I am not sure why it is enforcing it.
One reason I ...
- 2,789
33
votes
9
answers
25k
views
How to secure passwords over HTTP?
Say my password is abc. I want to send it to the server over HTTP.
I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
- 465
28
votes
3
answers
6k
views
Should I have a maximum password length?
I'm creating a webapp, and part of my authentication method is password length.
Should I put one in place? (say, 50 characters?) Or should I just put a minimum length (Currently at 6).
Are there ...
- 548
27
votes
2
answers
5k
views
How to avoid using System.String with Rfc2898DeriveBytes in C#
I am creating a .NET core webapp in C# that takes in a user password and hashes it to be stored on a server. I'm using Rfc2898DeriveBytes along with a randomly generated salt. I've read, however, that ...
- 373
26
votes
3
answers
46k
views
How secure are sha256 + salt hashes for password storage [duplicate]
I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 ...
- 371
25
votes
8
answers
32k
views
What chars should I not allow in passwords?
I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
- 5,233
25
votes
6
answers
3k
views
My credit union is reducing its maximum password length to 10 characters
I just received an email from my credit union saying they are redesigning their online banking service and that I will need to change my password by October 22 to conform to the new limit of 10 ...
- 351
22
votes
5
answers
4k
views
Why do some websites and programs restrict password characteristics?
There are some websites and even programs that I use that have ridiculous password restrictions. Lots of forums for instance restrict passwords to ~32 characters. Others enforce a restricted charset.
...
- 1,249
22
votes
3
answers
6k
views
Using SHA-256 to preprocess password before bcrypt?
I would like to allow users of my web application to have long passwords, if they so wish. Today I became aware of bcrypt's password length limitation (72 characters, the rest truncated).
Would it be ...
- 425
21
votes
8
answers
9k
views
Is PGP for user authentication a good idea?
I am building a web site that provides user login. For that, I am currently researching good strategies for dealing with authentication.
How I'm doing it right now
My current concept is modeled ...
- 329
20
votes
4
answers
1k
views
Should I be concerned when a "Forgot Password?" tool sends my password in plaintext?
Some sites I have been a member of in the past don't go through the normal "Forgot Password?" process. Instead of e-mailing me a unique password reset link or something of the like, I have received ...
- 353
19
votes
5
answers
3k
views
From a security standpoint should users be asked to confirm their password when registering?
Is it advisable to have users re-type their password to confirm it's correct? On User Experience the general consensus seems to be no but I'm wondering if this has security ramifications?
EDIT: my ...
- 10.2k
19
votes
6
answers
4k
views
Is this login security enough?
I'm coming up with my next login system for admins of an e-commerce website, which will have this:
login form is SSL secured
password is converted to SHA-256 before being transmitted (bcrypt is too ...
- 341
19
votes
3
answers
10k
views
Should security question answers be case-sensitive?
Question
In the case of security questions being used to reset an account password, what is considered best practice for handling case-sensitivity on the security question answers?
Scenario
An ...
- 345
18
votes
7
answers
602
views
Is a "security measure" that doesn't provide a security benefit actually harmful?
If a security measure is implemented that doesn't provide any additional security benefit, can it be considered harmful?
As an example, consider a login page where the user is asked to enter their ...
- 283
18
votes
3
answers
8k
views
Encrypting user data using password and forgot my password
I am planning to do a web application which stores a lot of personal stuff (info, photos...). And to give users a sense of protection, I want to encrypt the data before storing it to the database.
So,...
- 453
18
votes
2
answers
18k
views
Practices for storing username/password in Web applications
I have read the following question: Storing password in Java application but I don't find the answers useful for my case.
So here is my question somehow related to that. I have a Java Web application ...
- 183
17
votes
7
answers
21k
views
Facebook account keeps getting hacked, can't seem to figure out why or how?
One of my friends, she has a lot of friends on Facebook, and uses it for marketing.
Her account keeps getting broken into. Her password gets reset and/or gets locked for changing resetting password ...
- 279
15
votes
3
answers
3k
views
Are HTTP brute-force password-guessing attacks common nowadays?
Are brute-force attacks against online accounts (gmail, facebook, instagram) something that really happens? I don't mean something like cracking password hashes or DDoS, but real brute-force attacks (...
- 535
15
votes
2
answers
11k
views
How to authenticate in a website with public/private keys?
I've been reading how the SSH public/private key works and realized how handy they are (taking the secure out of the equation). And started to wonder why websites do not implement the same thing?
...
14
votes
4
answers
4k
views
PBKDF2 usage will slow REST API down?
When implementing password hashing using PBKDF2 for authenticating access to a REST api,when we say that PBKDF2 is slow does it mean that it's going to take a lot of time to hash the password and ...
- 2,483
14
votes
4
answers
4k
views
How dangerous is it to store password in plain text on sites like GitHub?
I have a few private repositories set up on GitHub for some of the projects I am working on for my company. These applications connect to databases and I have database authentication credentials ...
- 243
14
votes
2
answers
304
views
Would suggesting a random passphrase during sign-up hurt overall security?
I've been looking for ways to improve security and security awareness for both internal and external clients and I happened upon the idea of generating a one-time, random "password suggestion" on the ...
- 363
13
votes
5
answers
6k
views
Authenticating without a database
I've been inspired by a question over on Code Review, which boils down to: What is the proper way to authenticate a user without a database?
Would it be the exact same process if you stored ...
- 258
13
votes
1
answer
3k
views
Should I hash my passwords even if I am only allowed to generate limited traffic?
At this moment I'm busy working on an webapp with a friend of mine. The main problem we have is that we are only allowed to generate 50 GB a month in datatraffic.
My question is: Does hashing the ...
- 324
13
votes
3
answers
2k
views
How much information about the reason for an unsuccessful login should a web application give?
After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application give?...
- 511
13
votes
1
answer
2k
views
Handling "forgot password" functionality with encrypted data without security questions
As a sort of follow-up to this question on handling password-reset functionality when dealing with encrypted user data, is there any good method for resetting a user's password in an encrypted web ...
- 230
12
votes
2
answers
4k
views
Is it safe to expose bcrypt password hashes?
I'm building a web app that needs to support user-switching offline and am wondering if it is safe to expose bcrypt hashes to authenticate users.
The basic flow:
Primary users logs in while web app ...
- 221
12
votes
3
answers
2k
views
If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?
In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the key/password/...
- 2,237
11
votes
3
answers
2k
views
When changing a password using a WebPage, must the old password be entered on the same screen?
There is a convention to always prompt for the old password on the same page as the one where the old password is being changed as shown below.
Is it acceptable from a security perspective to allow a ...
- 51.1k
11
votes
3
answers
4k
views
Should the password field be cleared after an unsuccessful login attempt?
Let's assume following workflow for logging in
a) On a device with keyboard:
I type my username and password
Press enter
[realization] I made a typo
Password field is cleared: not a big deal, I can ...
- 575
11
votes
3
answers
15k
views
How to store passwords securely in my server?
Disclaimer: I know I should use bcrypt to securely store user's passwords. Please, keep reading.
I want to store credentials for several email services for each user. So if I log in with my username ...
10
votes
2
answers
1k
views
Should user be allowed to save password in browser?
The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
- 5,467
10
votes
5
answers
937
views
Is there any added security benefit to username complexity requirements?
I've come across several sites lately that have complexity requirements for usernames like "must be 8 characters long and contain at least 2 numbers". Is there any real added benefit to this from a ...
- 1,113
9
votes
5
answers
4k
views
Why don't we use HTML password inputfields for usernames and 2FA codes in the front-end of web applications?
When entering a username and password on a web application I have always wondered why the username often equals personal email address (which is often known or easy to guess or find). A random ...
- 7,055
9
votes
3
answers
3k
views
Accessing document using a 6 letter token
We are building a web app where users can insert 6 letters/digits (A_Z, 0-9) into a form to access a document. Every document has a randomly assigned access code like this: 1ABH5F.
When the user ...
- 201