Skip to main content
Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Code code:"if (foo != bar)"
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Saves in:saves
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with
Search options not deleted user 35158

The functions performed by the person or processes responsible for security of passwords on a given system.

4 votes

Does the average user really need a password manager?

Others have pointed out the benefits for security, I'll just focus on the convenience and inconvenience. If you use your password manager for everything like I do, save for places where the manager i …
Andrew Hoffman's user avatar
3 votes

What would be a good way to send sensitive information to users that are not very tech-savvy?

Passwords are stored as one-way hashes if done correctly, so you can't send them those. And if you can, make it your top priority to not be able to do so. Password reset workflows through SSL are the …
Andrew Hoffman's user avatar
0 votes

How secure could the LastPass Android application be with a four-digit PIN?

Your data is encrypted locally with key derived from your master password hash with 4000 repetitions by default. The PIN is a local convenience option. If you were to install lastpass on a new device …
Andrew Hoffman's user avatar
1 vote

LastPass Bootstrap on New Android Phone

You can try pasting it into notepad, print it out, then enter it manually into android. If its like 100 characters long, this is one good reason for why you may want to make it shorter. I asked a qu …
Andrew Hoffman's user avatar
2 votes

Password reset system code system vs long hash

The token is just to verify that you received the email, that you own the account. Password reset links in emails are a convenience that provide proof that you own the email account and allow you eas …
Andrew Hoffman's user avatar
2 votes
2 answers
445 views

Is upgrading key-stretching algorithms and/or repetitions a thing?

Consider back in the 90s you're ahead of the curve, you hashed and salted your passwords with SHA, and you're a big site, millions of accounts, etc. Well the web evolves, and over time more advanced …
Andrew Hoffman's user avatar
5 votes
2 answers
269 views

Should password recommendations be different for devices, networks, and internet?

I started using a password manager last year and updated nearly all of my internet accounts to super-strong, unique passwords, and that isn't a problem, cause I only access them from web browsers or m …
Andrew Hoffman's user avatar
1 vote

Aren't password managers still incredibly risky?

Are you mistaking a password manager with OpenID? I don't know how you can phish a password manager master password. Anyways, my password manager is accessed either by app or by browser plugin, and r …
Andrew Hoffman's user avatar
0 votes

Is it ok for software to store passwords locally in plain-text?

The whole "unique and random" serves a double purpose in this imperfect world, where websites cannot be trusted to either do the right thing nor have good intentions. The website could sell the usern …
Andrew Hoffman's user avatar
2 votes

What are the weaknesses of my authentication scheme?

I do very similar, and the way I see it there are two major potential points of failure and I don't really have a good solution for one of them. First major risk is that LastPass itself is hacked and …
Andrew Hoffman's user avatar