A password is a secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

learn more… | top users | synonyms

1
vote
2answers
111 views

Administrator Rights for a set of code

I am developing a program for Windows 7 Enterprise Edition that will be used in a corporate environment. The application will automatically fix certain errors as soon as the user selects the ...
1
vote
2answers
364 views

Is hashing of just “username + password” as safe as salted hashing

I want to hash "user + password". [EDIT: prehashing "user" would be an improvement, so my question is also for hashing "hash(user) + password". If cross-site same user is a problem then the hashing ...
1
vote
1answer
306 views

Difference between reverse lookup tables and rainbow tables

Using Reverse Lookup Tables, you create a lookup table consisting of the password hash of user accounts. Then you use another table which consists of hashes with guessed passwords. Then you compare ...
1
vote
1answer
222 views

Kerberos for key management?

We have half-implemented proper key management at our dev shop. We have a SOAP web service (the key management web service) that can be used to retrieve passwords for other systems. So for instance, I ...
1
vote
1answer
111 views

Password reset process

So I'm working on my first password reset mechanism. I'm going with what I understand to be a fairly common procedure: User clicks "Forgot Password" User is prompted for email address If the entered ...
0
votes
2answers
144 views

Strategy for storing passwords/credentials in the context of continuous delivery [closed]

It is common sense not to store passwords/credentials into SCM. I would like to know then what would be a good strategy for storing passwords/credentials in the context of continuous delivery. ...
8
votes
1answer
388 views

When allowing a user to change passwords, should I generate a new salt?

In my database, I have a column for the hashed password and the salt. My application allows users to change their password. Should I use the same salt for the password, or should I generate a new ...
2
votes
4answers
236 views

Storing web app passwords so that they can be retrieved

Short version My boss wants me to store user passwords for an ASP.NET Web Forms web app we're developing in clear text, so that a user with admin rights can click a button and get back the current ...
1
vote
4answers
260 views

Is just using an email address for login a good idea?

Many a times I need to log into a website that I used months ago and have forgotten my password. So clicking the reset password link and the site sends me an email with a single use link which allows ...
73
votes
15answers
18k views

Why should passwords be encrypted if they are being stored in a secure database?

I have a web service. Right now, I have passwords stored in plain text in a MySQL table on my server. I know this isn't the best practice, and that is why I am working on it. Why should passwords be ...
11
votes
7answers
864 views

Why do modern websites still insist on archaic username/password requirements? [duplicate]

I was signing up for a website last night, and once again was greeted with the fact that my username cannot contain certain characters (including spaces), and neither could my password. Is there a ...
3
votes
2answers
289 views

Would using rainbow tables to detect weak user passwords feasible?

As I understand in most security breach where the list of hashed password are compromised, attackers do use brute-force to try to find weak password and, invariably, they always find quite some (like ...
1
vote
2answers
206 views

How do I dissuade users from using the same password with similar systems?

I'm building a web application that connects to other web services (using strictly anonymous binding, so no user passwords are being used). However the web application maintains its own users itself, ...
2
votes
1answer
394 views

Does facebook store multiple password hashes for each user? [closed]

I noticed that Facebook allows multiple variants of my own password : My password as it is. My password with first letter capitalized. My password with all letters capitalized. It is commonly ...
28
votes
5answers
1k views

Updating password hashing without forcing a new password for existing users

You maintain an existing application with an established user base. Over time it is decided that the current password hashing technique is outdated and needs to be upgraded. Furthermore, for UX ...
-7
votes
3answers
235 views

Is it possible to find a four-digit Username / Password by chance?

Imagine you have a login-form and it has two field : Username (Maximum length : 4 - digits only) Password (Maximum length : 4 - digits only) Is it possible to write a program to find the username ...
10
votes
5answers
561 views

What are some possible alternatives for providing an 'Admin Password' for a desktop application?

I'm currently managing and re-factoring a piece of software that has been used at my company for over a decade now. One of the elements of this application is a sort of admin or power-user mode which ...
-2
votes
2answers
103 views

A question about password storage concept [closed]

My previous question is here - A question about storing passwords This question is somewhat related to my previous one but with some new doubts. Take for example Windows. I've heard that Windows ...
3
votes
3answers
1k views

A question about storing passwords

I'm creating a program (in C++) that will password protects its user's database (.dat) file. I'm confused on where to store the password? In the user's database file or somewhere else. I'm new to ...
14
votes
6answers
945 views

How to assure users that website and passwords are secure

On reliable websites I always see claims such as "All data is encrypted" or "All passwords are encrypted using 128bit encryption" and etc. However I have never come across a claim such as "All ...
1
vote
1answer
62 views

Information protection when registering on web sites

Up until now it seems that when you register on a random web site you do so with blind trust. You assume that the site isn't harvesting information and passwords. You assume the site is reasonably ...
0
votes
2answers
669 views

Alternatives to Traditional Password Authentication [closed]

The third party login is excellent function that has come in recent years that relieves the load on a programmers mind so that I have to remember less useless passwords. I don't use the same ...
5
votes
3answers
366 views

How to store / not to store passwords

I am building an web site which will allow users to aggregate the information stored in their online profiles ("data feeds") in one place. I am wondering - what is the accepted (from a secureness ...
2
votes
1answer
421 views

Client side authentication through signatures instead of passwords

I want to save some user-generated data with some signature of the user that generated it (let's say that the user has to fill some forms with some data and I want him to sign the written data). The ...
1
vote
3answers
370 views

Security through obscurity and storing unencrypted passwords

What exactly does "Security through obscurity" means in the context of stroing unencrypted passwords? I'm using a small program (I won't name it, to not enlarge enough large shame on its author) that ...
1
vote
4answers
291 views

Why do web sites require certain characters in their credentials? [closed]

It seems like when web site lists requirements as to what characters MUST be in the password they're only providing a password map for someone who wants to hack their system. For instance, fsd.gov ...
-5
votes
3answers
479 views

Is sending password to user email secure? [closed]

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should I use encryption?
1
vote
1answer
180 views

Storing 'sensitive' data in settings file

I'm writing a small utility in AutoIt that connects to Twitter. I would like to store the username and password in the programs setting file, but I know that it needs to be encrypted obviously. ...
3
votes
2answers
939 views

What .NET objects should I use to create a cookie based session in MVC?

I'm writing a custom password reset application that uses a validation technique that doesn't fit cleanly with ASP.NET Membership Provider's challenge questions. Namely I need to invoke a workflow ...
21
votes
5answers
2k views

How to implement a safe password history

Passwords shouldn't be stored in plain text for obvious security reasons: you have to store hashes, and you should also generate the hash carefully to avoid rainbow table attacks. However, usually ...
3
votes
3answers
689 views

Securing credentials passed to web service

I'm attempting to design a single sign on system for use in a distributed architecture. Specifically, I must provide a way for a client website (that is, a website on a different ...
4
votes
4answers
169 views

System that splits passwords across two servers

I stumbled upon this news article on BBC, RSA splits passwords in two to foil hackers' attacks tl;dr - a (randomized) password is split in half and is stored across two separate servers, to foil ...
14
votes
4answers
2k views

How can I estimate the entropy of a password?

Having read various resources about password strength I'm trying to create an algorithm that will provide a rough estimation of how much entropy a password has. I'm trying to create an algorithm ...
7
votes
8answers
1k views

Storing plaintext passwords for detecting fraud

I am well aware of best practices for storing user passwords: Never store passwords in plaintext Never store encrypted passwords; always store password hashes Always salt your password hash to deter ...
5
votes
1answer
286 views

Using account (login) password in generated PDF?

Ever since I heard about programming, I was told that any password (especially the one used on login) should be stored in database using any kind of one-way hashing algorithm, and never ever as plain ...
2
votes
2answers
972 views

SVN command line client: checkout refused when LDAP password changed “svn: OPTIONS of” (repo) “authorization failed” (but works in TortoiseSVN)

When using the command line/terminal svn client, a colleague is getting "svn: OPTIONS of " [repo] "...authorization failed" error message when they attempt to checkout the repo to be their local ...
3
votes
3answers
402 views

Saving Passwords To The Local Device

So In my app (iOS), you have to register in order to use the service (a food service). But in order to change details about your account (username, password, and email), you have to reenter your ...
8
votes
6answers
658 views

How to refuse to give an access to passwords to a customer without being unprofessional or rude?

Let's say you're creating a website for a customer. This website has its own registration (either combined with OpenID or not). The customer asks you to be able to see the passwords the users are ...
2
votes
4answers
2k views

Security Concerns with password storage in Scripting Languages (VBA)

The team I work with handles large amounts of consumer survey, and internal company metric data. Primarily the data is stored in a database, and we utilize various platforms and to work with that ...
5
votes
3answers
4k views

How does a web browser save passwords?

How do current web browsers (or mobile mail clients and any software in general) save user passwords? All answers about storing passwords say we should store only hashes, not the password themselves. ...
6
votes
7answers
2k views

Password hashing and support to your user

We've recently moved to a better password storage strategy, with it came all the good stuff: Passwords are stored after going through bCrypt User is sent an activation link on account creation to ...
7
votes
8answers
2k views

What is a reasonable and secure password requirement for user registration?

This is the password policy I just got from UPS (just for package status checking): Your password must be between 8 and 26 characters long. It must contain at least three of the following ...
3
votes
5answers
291 views

Secure way to remember usernames and passwords [closed]

Maybe it was already discussed. After browsing through some alike questions here about password management, I still would like to ask this question. If there are 100 sites which require username ...
8
votes
3answers
334 views

Storing passwords for usage in scripts

There are few situations that require users to provide their password while automating things during development process. Site deployment is only one of the common situations. Creating dmg files under ...
3
votes
4answers
298 views

Password insanity! Recommended approaches to password management on multiple client systems? [closed]

A software development company I work with has a web based product they are successfully selling to clients. All of these clients have a support agreement with us that generally requires us to access ...
12
votes
8answers
1k views

Punishing users for insecure passwords [closed]

I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, ...
31
votes
9answers
2k views

Are there any valid reasons for disallowing characters and limiting the length of passwords?

I've come across quite a few sites that either limit the length they allow passwords to be and/or disallow certain characters. That's limiting to me as I want to widen and lengthen the search space of ...
2
votes
4answers
294 views

How do you manage passwords in your team for db with multiple env and security constraints?

I don't want any tools, but more methods to help us manage our passwords. I know this question has been closed, but I think this one, even if it's related, is more a programmers problem than a super ...
5
votes
3answers
1k views

Is there any legislation requiring how we store passwords?

Given the Sony data breach and other events recently, is there any actual laws or regulation regarding how to store passwords? I think there are with credit cards, you're not allowed to store the 3 ...
26
votes
14answers
1k views

What if the client needs the ability to retrieve passwords?

I've currently inherited an application at work and to my dismay, I have realized that the user passwords stored in the database are encrypted using an in house encryption function, which also ...