All Questions
19 questions
0
votes
0
answers
220
views
Optimal way to securely store password on client with server invalidation but not knowledge
A number of similar questions have been asked about this general topic before (e.g. How to store user credentials in browser securely?), but I wanted to seek some clarification on a specific scenario.
...
- 121
0
votes
1
answer
156
views
Password hashing for local servers
I'm running a local web server on my Raspberry Pi and want to have a login screen. My plan is to hash the password and store the result in a text file ( This is where I'm storing settings for the ...
1
vote
3
answers
508
views
Why keep track of user password changes in web application?
For some reason, it has become a common security* practice for websites to keep track of password changes. Sites like Google can even tell you how long ago you changed your password. Aside from just ...
- 111
1
vote
1
answer
470
views
Alternative to storing passwords when dealing with integrations that only allow username/password authentication? [duplicate]
I'm working on an integration with an external service that requires per-user authentication, like Facebook for example, but unlike Facebook only allows username+password for this authentication. My ...
12
votes
2
answers
4k
views
Is it safe to expose bcrypt password hashes?
I'm building a web app that needs to support user-switching offline and am wondering if it is safe to expose bcrypt hashes to authenticate users.
The basic flow:
Primary users logs in while web app ...
- 221
236
votes
10
answers
38k
views
Is there any reason to disable paste password on login?
Today I logged in to pay my cellphone bill, and I found that the site has disabled paste functionality in password field.
I'm a webdev and I know how to fix this, but for regular user is REALLY ...
- 2,505
1
vote
2
answers
178
views
Security of picking unique passwords for users [duplicate]
I am learning more about security in web design so I can build more robust sites. As I see it password security is one of the main concerns, if a database is hacked then chances are passwords will be ...
- 131
0
votes
1
answer
201
views
Should all web applications implement a security feature that stores historical passwords? [duplicate]
In addition to Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?.
Facebook, and other companies, are storing historical passwords of ...
- 7,056
13
votes
1
answer
3k
views
Should I hash my passwords even if I am only allowed to generate limited traffic?
At this moment I'm busy working on an webapp with a friend of mine. The main problem we have is that we are only allowed to generate 50 GB a month in datatraffic.
My question is: Does hashing the ...
- 324
11
votes
3
answers
15k
views
How to store passwords securely in my server?
Disclaimer: I know I should use bcrypt to securely store user's passwords. Please, keep reading.
I want to store credentials for several email services for each user. So if I log in with my username ...
4
votes
2
answers
2k
views
Managing and deploying web app passwords
What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
- 339
0
votes
0
answers
802
views
Why do you need to login after you change a password? [duplicate]
I can't recall a website that after resetting my password I was automatically logged in, I had to type the password again - which seems quite silly.
From a security perspective, why do websites do ...
- 163
2
votes
3
answers
2k
views
Should I take care when entering incorrect passwords in untrustworthy websites?
I have the problem that I usually use 4 passwords that I use quite often. I use the first two strong passwords for very important services (e.g. Email, PayPal,..), and the other two not so strong for ...
- 155
14
votes
4
answers
4k
views
How dangerous is it to store password in plain text on sites like GitHub?
I have a few private repositories set up on GitHub for some of the projects I am working on for my company. These applications connect to databases and I have database authentication credentials ...
- 243
11
votes
3
answers
2k
views
When changing a password using a WebPage, must the old password be entered on the same screen?
There is a convention to always prompt for the old password on the same page as the one where the old password is being changed as shown below.
Is it acceptable from a security perspective to allow a ...
- 51.1k
40
votes
7
answers
16k
views
Why do we ask for a user's existing password when changing their password?
In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
- 749
18
votes
2
answers
18k
views
Practices for storing username/password in Web applications
I have read the following question: Storing password in Java application but I don't find the answers useful for my case.
So here is my question somehow related to that. I have a Java Web application ...
- 183
14
votes
2
answers
304
views
Would suggesting a random passphrase during sign-up hurt overall security?
I've been looking for ways to improve security and security awareness for both internal and external clients and I happened upon the idea of generating a one-time, random "password suggestion" on the ...
- 363
88
votes
11
answers
25k
views
What to do about websites that store plain text passwords
I recently received an email from a popular graduate job website (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
- 1,103