A password is a secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

learn more… | top users | synonyms

3
votes
2answers
834 views

What .NET objects should I use to create a cookie based session in MVC?

I'm writing a custom password reset application that uses a validation technique that doesn't fit cleanly with ASP.NET Membership Provider's challenge questions. Namely I need to invoke a workflow ...
4
votes
4answers
2k views

What type of Password Reset/Forgot Password (verification) mechanism would you recommend

I am looking for ways to verify the user in order to reset their passwords. 2 commonly used ones: Email verification Secret question I wonder which will you recommend? I am trying to avoid having ...
11
votes
5answers
2k views

“Forgot Password” - How to handle this?

I read this answer and found a comment insisting not to send password by email: passwords should not be able to be retrieved by email, I hate that. It means my password is stored in plain text ...
2
votes
4answers
2k views

Security Concerns with password storage in Scripting Languages (VBA)

The team I work with handles large amounts of consumer survey, and internal company metric data. Primarily the data is stored in a database, and we utilize various platforms and to work with that ...
0
votes
0answers
54 views

PHP Password_Hash Function [migrated]

I've been reading up on the usage of the PHP Password_Hash Function it states that it automatically generates a salt and manually generating one is not advised. With this in mind, does this mean I ...
1
vote
1answer
95 views

Password reset process

So I'm working on my first password reset mechanism. I'm going with what I understand to be a fairly common procedure: User clicks "Forgot Password" User is prompted for email address If the entered ...
68
votes
15answers
15k views

Why should passwords be encrypted if they are being stored in a secure database?

I have a web service. Right now, I have passwords stored in plain text in a MySQL table on my server. I know this isn't the best practice, and that is why I am working on it. Why should passwords be ...
0
votes
2answers
80 views

Strategy for storing passwords/credentials in the context of continuous delivery [closed]

It is common sense not to store passwords/credentials into SCM. I would like to know then what would be a good strategy for storing passwords/credentials in the context of continuous delivery. ...
7
votes
1answer
368 views

When allowing a user to change passwords, should I generate a new salt?

In my database, I have a column for the hashed password and the salt. My application allows users to change their password. Should I use the same salt for the password, or should I generate a new ...
2
votes
4answers
197 views

Storing web app passwords so that they can be retrieved

Short version My boss wants me to store user passwords for an ASP.NET Web Forms web app we're developing in clear text, so that a user with admin rights can click a button and get back the current ...
7
votes
8answers
1k views

Storing plaintext passwords for detecting fraud

I am well aware of best practices for storing user passwords: Never store passwords in plaintext Never store encrypted passwords; always store password hashes Always salt your password hash to deter ...
-7
votes
3answers
200 views

Is it possible to find a four-digit Username / Password by chance?

Imagine you have a login-form and it has two field : Username (Maximum length : 4 - digits only) Password (Maximum length : 4 - digits only) Is it possible to write a program to find the username ...
1
vote
2answers
203 views

How do I dissuade users from using the same password with similar systems?

I'm building a web application that connects to other web services (using strictly anonymous binding, so no user passwords are being used). However the web application maintains its own users itself, ...
1
vote
4answers
253 views

Is just using an email address for login a good idea?

Many a times I need to log into a website that I used months ago and have forgotten my password. So clicking the reset password link and the site sends me an email with a single use link which allows ...
1
vote
3answers
315 views

Security through obscurity and storing unencrypted passwords

What exactly does "Security through obscurity" means in the context of stroing unencrypted passwords? I'm using a small program (I won't name it, to not enlarge enough large shame on its author) that ...
11
votes
7answers
755 views

Why do modern websites still insist on archaic username/password requirements? [duplicate]

I was signing up for a website last night, and once again was greeted with the fact that my username cannot contain certain characters (including spaces), and neither could my password. Is there a ...
3
votes
2answers
274 views

Would using rainbow tables to detect weak user passwords feasible?

As I understand in most security breach where the list of hashed password are compromised, attackers do use brute-force to try to find weak password and, invariably, they always find quite some (like ...
28
votes
5answers
981 views

Updating password hashing without forcing a new password for existing users

You maintain an existing application with an established user base. Over time it is decided that the current password hashing technique is outdated and needs to be upgraded. Furthermore, for UX ...
2
votes
1answer
363 views

Does facebook store multiple password hashes for each user? [closed]

I noticed that Facebook allows multiple variants of my own password : My password as it is. My password with first letter capitalized. My password with all letters capitalized. It is commonly ...
5
votes
5answers
886 views

Is it safe to display information about old passwords on login failure?

When I changed my Facebook password yesterday, by mistake I entered the old one and got this: Am I missing something here or this is a big potencial risk for users. In my opinion this is a problem ...
10
votes
5answers
545 views

What are some possible alternatives for providing an 'Admin Password' for a desktop application?

I'm currently managing and re-factoring a piece of software that has been used at my company for over a decade now. One of the elements of this application is a sort of admin or power-user mode which ...
-2
votes
2answers
101 views

A question about password storage concept [closed]

My previous question is here - A question about storing passwords This question is somewhat related to my previous one but with some new doubts. Take for example Windows. I've heard that Windows ...
3
votes
3answers
954 views

A question about storing passwords

I'm creating a program (in C++) that will password protects its user's database (.dat) file. I'm confused on where to store the password? In the user's database file or somewhere else. I'm new to ...
14
votes
6answers
927 views

How to assure users that website and passwords are secure

On reliable websites I always see claims such as "All data is encrypted" or "All passwords are encrypted using 128bit encryption" and etc. However I have never come across a claim such as "All ...
1
vote
1answer
62 views

Information protection when registering on web sites

Up until now it seems that when you register on a random web site you do so with blind trust. You assume that the site isn't harvesting information and passwords. You assume the site is reasonably ...
-2
votes
2answers
89 views

Methods to secure user log-in's [closed]

I guess this question has been asked before, but I wish to have fresh answers/ideas - Problem details: Let's say there's a system which allows users to participate in a survey. Users will sign on to ...
3
votes
5answers
288 views

Secure way to remember usernames and passwords [closed]

Maybe it was already discussed. After browsing through some alike questions here about password management, I still would like to ask this question. If there are 100 sites which require username ...
0
votes
2answers
501 views

Alternatives to Traditional Password Authentication [closed]

The third party login is excellent function that has come in recent years that relieves the load on a programmers mind so that I have to remember less useless passwords. I don't use the same ...
5
votes
3answers
358 views

How to store / not to store passwords

I am building an web site which will allow users to aggregate the information stored in their online profiles ("data feeds") in one place. I am wondering - what is the accepted (from a secureness ...
2
votes
1answer
365 views

Client side authentication through signatures instead of passwords

I want to save some user-generated data with some signature of the user that generated it (let's say that the user has to fill some forms with some data and I want him to sign the written data). The ...
6
votes
7answers
1k views

Password hashing and support to your user

We've recently moved to a better password storage strategy, with it came all the good stuff: Passwords are stored after going through bCrypt User is sent an activation link on account creation to ...
14
votes
4answers
1k views

How can I estimate the entropy of a password?

Having read various resources about password strength I'm trying to create an algorithm that will provide a rough estimation of how much entropy a password has. I'm trying to create an algorithm ...
1
vote
4answers
288 views

Why do web sites require certain characters in their credentials? [closed]

It seems like when web site lists requirements as to what characters MUST be in the password they're only providing a password map for someone who wants to hack their system. For instance, fsd.gov ...
-5
votes
3answers
463 views

Is sending password to user email secure? [closed]

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should I use encryption?
1
vote
1answer
156 views

Storing 'sensitive' data in settings file

I'm writing a small utility in AutoIt that connects to Twitter. I would like to store the username and password in the programs setting file, but I know that it needs to be encrypted obviously. ...
21
votes
5answers
2k views

How to implement a safe password history

Passwords shouldn't be stored in plain text for obvious security reasons: you have to store hashes, and you should also generate the hash carefully to avoid rainbow table attacks. However, usually ...
3
votes
3answers
550 views

Securing credentials passed to web service

I'm attempting to design a single sign on system for use in a distributed architecture. Specifically, I must provide a way for a client website (that is, a website on a different ...
4
votes
4answers
165 views

System that splits passwords across two servers

I stumbled upon this news article on BBC, RSA splits passwords in two to foil hackers' attacks tl;dr - a (randomized) password is split in half and is stored across two separate servers, to foil ...
2
votes
2answers
777 views

SVN command line client: checkout refused when LDAP password changed “svn: OPTIONS of” (repo) “authorization failed” (but works in TortoiseSVN)

When using the command line/terminal svn client, a colleague is getting "svn: OPTIONS of " [repo] "...authorization failed" error message when they attempt to checkout the repo to be their local ...
3
votes
3answers
357 views

Saving Passwords To The Local Device

So In my app (iOS), you have to register in order to use the service (a food service). But in order to change details about your account (username, password, and email), you have to reenter your ...
5
votes
1answer
259 views

Using account (login) password in generated PDF?

Ever since I heard about programming, I was told that any password (especially the one used on login) should be stored in database using any kind of one-way hashing algorithm, and never ever as plain ...
19
votes
9answers
2k views

Is an 'if password == XXXXXXX' enough for minimum security?

If I create a login for an app that has middle to low security risk (in other words, its not a banking app or anything), is it acceptable for me to verify a password entered by the user by just saying ...
8
votes
6answers
643 views

How to refuse to give an access to passwords to a customer without being unprofessional or rude?

Let's say you're creating a website for a customer. This website has its own registration (either combined with OpenID or not). The customer asks you to be able to see the passwords the users are ...
5
votes
3answers
3k views

How does a web browser save passwords?

How do current web browsers (or mobile mail clients and any software in general) save user passwords? All answers about storing passwords say we should store only hashes, not the password themselves. ...
7
votes
8answers
2k views

What is a reasonable and secure password requirement for user registration?

This is the password policy I just got from UPS (just for package status checking): Your password must be between 8 and 26 characters long. It must contain at least three of the following ...
8
votes
3answers
314 views

Storing passwords for usage in scripts

There are few situations that require users to provide their password while automating things during development process. Site deployment is only one of the common situations. Creating dmg files under ...
3
votes
4answers
290 views

Password insanity! Recommended approaches to password management on multiple client systems? [closed]

A software development company I work with has a web based product they are successfully selling to clients. All of these clients have a support agreement with us that generally requires us to access ...
12
votes
8answers
1k views

Punishing users for insecure passwords [closed]

I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, ...
31
votes
9answers
2k views

Are there any valid reasons for disallowing characters and limiting the length of passwords?

I've come across quite a few sites that either limit the length they allow passwords to be and/or disallow certain characters. That's limiting to me as I want to widen and lengthen the search space of ...
2
votes
4answers
290 views

How do you manage passwords in your team for db with multiple env and security constraints?

I don't want any tools, but more methods to help us manage our passwords. I know this question has been closed, but I think this one, even if it's related, is more a programmers problem than a super ...