A password is a secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

learn more… | top users | synonyms

1
vote
2answers
105 views

How can I tell if a web sign up form actually encrypts my password?

Recently I signed up for new account for a service provider's web site. I entered the usual the name, email , password (strong) , repeat password and I was signed up. Great everything works well. A ...
4
votes
1answer
641 views

Client side authentication through signatures instead of passwords

I want to save some user-generated data with some signature of the user that generated it (let's say that the user has to fill some forms with some data and I want him to sign the written data). The ...
0
votes
3answers
76 views

Preventing information leakage while returning an error message

Say my website contains 2 functions: Allow a user to change their own password Allow an administrator to change a user's password (the user must change again before they login) Now let's say that ...
10
votes
7answers
2k views

Password hashing and support to your user

We've recently moved to a better password storage strategy, with it came all the good stuff: Passwords are stored after going through bCrypt User is sent an activation link on account creation to ...
-1
votes
1answer
76 views

Is the mechanism used in Passwordless module widely used? [closed]

I came across Passwordless which uses email/SMS to allow the user to login. Is this mechanism widely used? What are the advantages/disadvantages of using such mechanism? I'm asking because I haven't ...
0
votes
2answers
56 views

How can I effectively design password authentication for encryption in my project?

I'm working on a small personal project that involves a user entering a password that would then allow them to view a text file that would otherwise be encrypted. I'm having trouble wrapping my head ...
3
votes
3answers
271 views

Modern recommendations for password recovery

I'm going to implements password recovery in my authentication. I haven't put this together in a while and wondering if there is anything I ought to be aware of. My idea at the moment is: User ...
0
votes
2answers
67 views

Handling delay in entry of OTP for log in validation

There's an application, which accepts a user id and password to login. Validation of the id and password is processed by another system. Now after password validation, the application generates a One ...
0
votes
1answer
60 views

Creating service to distribute passwords to architecture

We have big legacy code working for big corporation connecting to multiple remote/local databases. The configuration files with IP, name and password for connecting to different databases are now ...
27
votes
6answers
7k views

Putting a password in a REST API call

Suppose I have a REST API that is also used to set/reset passwords. Let's also suppose that this works over a HTTPS connections. Is there any good reason not to put that password in the call path, let'...
0
votes
0answers
61 views

Web service security token storage

I have two operations in my JAX-WS web service: First takes username and password as parameters and generates random alphanumeric token, second takes this token and username as parameters, verifies ...
1
vote
2answers
226 views

Why are Strings in StringPool considered insecure?

Passwords are recommended to be stored in char[] instead of String, as Strings are stored in StringPool. Read more here As per this question Strings in StringPool are not available directly. To ...
2
votes
2answers
581 views

matching usernames with their password

We are working on a simple login/registration form. Our login script checks to see if the username and password exist in the same row of the database. If it does exist, we bring the user to a welcome ...
1
vote
2answers
157 views

How to store passwords which need to be re-read

I have a utility which runs at certain intervals. My customer now wishes for it to send an email when the task is completed. They want to be able to control the email address, meaning, they want to ...
16
votes
1answer
1k views

Is there an official standard regarding user password storage practices?

I recently used a government service that I had an account for from years ago. I couldn't remember my password for the service so I used the "forgot password" link and was astonished to see that this ...
3
votes
1answer
192 views

If passwords are stored hashed, does that mean that theoretically there exists another password that could be used to log in? [duplicate]

From what I understand, in most sites, passwords are stored as a hash; not in their original form. This means that if the database is hacked into, the attacker will see the (nearly) useless hashes ...
4
votes
2answers
1k views

What .NET objects should I use to create a cookie based session in MVC?

I'm writing a custom password reset application that uses a validation technique that doesn't fit cleanly with ASP.NET Membership Provider's challenge questions. Namely I need to invoke a workflow ...
1
vote
1answer
130 views

Resetting vs. re-sending forgotten passwords

When a user forgets their password, is it better practice to reset the password and email that to the user or just to email the current password to the user's email address.
2
votes
1answer
185 views

What's the best practise for storing web server credentials for your web app deployment?

I was looking at the Oracle documentation for the weblogic maven plugin. In it, they store the weblogic user name and password for accessing in the pom.xml. Just wondering, isn't this a terrible ...
9
votes
9answers
3k views

What is a reasonable and secure password requirement for user registration?

This is the password policy I just got from UPS (just for package status checking): Your password must be between 8 and 26 characters long. It must contain at least three of the following ...
5
votes
3answers
222 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...
-1
votes
1answer
500 views

Can someone please explain reverse look up tables? [closed]

Im finding it difficult to understand reverse look up tables and how it works, and the concept of hash chains. This is apart of a computer security model i am taking. So i understand that brute force, ...
1
vote
1answer
88 views

How to store sensitive information (e.g. clients' credentials) accessibly for everybody inside?

I just discovered that we store sensitive information on our SharePoint. Since it's accessible by a password alone (and we all know that others click for the password/user name to be automatically pre-...
2
votes
1answer
2k views

Difference between reverse lookup tables and rainbow tables

Using Reverse Lookup Tables, you create a lookup table consisting of the password hash of user accounts. Then you use another table which consists of hashes with guessed passwords. Then you compare ...
2
votes
2answers
1k views

SVN command line client: checkout refused when LDAP password changed “svn: OPTIONS of” (repo) “authorization failed” (but works in TortoiseSVN)

When using the command line/terminal svn client, a colleague is getting "svn: OPTIONS of " [repo] "...authorization failed" error message when they attempt to checkout the repo to be their local ...
1
vote
2answers
134 views

Administrator Rights for a set of code

I am developing a program for Windows 7 Enterprise Edition that will be used in a corporate environment. The application will automatically fix certain errors as soon as the user selects the ...
1
vote
2answers
403 views

Is hashing of just “username + password” as safe as salted hashing

I want to hash "user + password". [EDIT: prehashing "user" would be an improvement, so my question is also for hashing "hash(user) + password". If cross-site same user is a problem then the hashing ...
2
votes
1answer
284 views

Kerberos for key management?

We have half-implemented proper key management at our dev shop. We have a SOAP web service (the key management web service) that can be used to retrieve passwords for other systems. So for instance, I ...
6
votes
4answers
3k views

What type of Password Reset/Forgot Password (verification) mechanism would you recommend

I am looking for ways to verify the user in order to reset their passwords. 2 commonly used ones: Email verification Secret question I wonder which will you recommend? I am trying to avoid having ...
12
votes
5answers
3k views

“Forgot Password” - How to handle this?

I read this answer and found a comment insisting not to send password by email: passwords should not be able to be retrieved by email, I hate that. It means my password is stored in plain text ...
2
votes
4answers
3k views

Security Concerns with password storage in Scripting Languages (VBA)

The team I work with handles large amounts of consumer survey, and internal company metric data. Primarily the data is stored in a database, and we utilize various platforms and to work with that data,...
1
vote
1answer
151 views

Password reset process

So I'm working on my first password reset mechanism. I'm going with what I understand to be a fairly common procedure: User clicks "Forgot Password" User is prompted for email address If the entered ...
77
votes
15answers
25k views

Why should passwords be encrypted if they are being stored in a secure database?

I have a web service. Right now, I have passwords stored in plain text in a MySQL table on my server. I know this isn't the best practice, and that is why I am working on it. Why should passwords be ...
0
votes
2answers
899 views

Strategy for storing passwords/credentials in the context of continuous delivery [closed]

It is common sense not to store passwords/credentials into SCM. I would like to know then what would be a good strategy for storing passwords/credentials in the context of continuous delivery. ...
8
votes
1answer
424 views

When allowing a user to change passwords, should I generate a new salt?

In my database, I have a column for the hashed password and the salt. My application allows users to change their password. Should I use the same salt for the password, or should I generate a new ...
2
votes
4answers
395 views

Storing web app passwords so that they can be retrieved

Short version My boss wants me to store user passwords for an ASP.NET Web Forms web app we're developing in clear text, so that a user with admin rights can click a button and get back the current ...
7
votes
8answers
1k views

Storing plaintext passwords for detecting fraud

I am well aware of best practices for storing user passwords: Never store passwords in plaintext Never store encrypted passwords; always store password hashes Always salt your password hash to deter ...
1
vote
4answers
305 views

Is just using an email address for login a good idea?

Many a times I need to log into a website that I used months ago and have forgotten my password. So clicking the reset password link and the site sends me an email with a single use link which allows ...
1
vote
3answers
671 views

Security through obscurity and storing unencrypted passwords

What exactly does "Security through obscurity" means in the context of stroing unencrypted passwords? I'm using a small program (I won't name it, to not enlarge enough large shame on its author) that ...
11
votes
7answers
1k views

Why do modern websites still insist on archaic username/password requirements? [duplicate]

I was signing up for a website last night, and once again was greeted with the fact that my username cannot contain certain characters (including spaces), and neither could my password. Is there a ...
3
votes
2answers
327 views

Would using rainbow tables to detect weak user passwords feasible?

As I understand in most security breach where the list of hashed password are compromised, attackers do use brute-force to try to find weak password and, invariably, they always find quite some (like ...
28
votes
5answers
1k views

Updating password hashing without forcing a new password for existing users

You maintain an existing application with an established user base. Over time it is decided that the current password hashing technique is outdated and needs to be upgraded. Furthermore, for UX ...
5
votes
5answers
963 views

Is it safe to display information about old passwords on login failure?

When I changed my Facebook password yesterday, by mistake I entered the old one and got this: Am I missing something here or this is a big potencial risk for users. In my opinion this is a problem ...
10
votes
5answers
656 views

What are some possible alternatives for providing an 'Admin Password' for a desktop application?

I'm currently managing and re-factoring a piece of software that has been used at my company for over a decade now. One of the elements of this application is a sort of admin or power-user mode which ...
4
votes
3answers
2k views

A question about storing passwords

I'm creating a program (in C++) that will password protects its user's database (.dat) file. I'm confused on where to store the password? In the user's database file or somewhere else. I'm new to ...
14
votes
6answers
997 views

How to assure users that website and passwords are secure [closed]

On reliable websites I always see claims such as "All data is encrypted" or "All passwords are encrypted using 128bit encryption" and etc. However I have never come across a claim such as "All ...
1
vote
1answer
65 views

Information protection when registering on web sites

Up until now it seems that when you register on a random web site you do so with blind trust. You assume that the site isn't harvesting information and passwords. You assume the site is reasonably ...
3
votes
2answers
1k views

Alternatives to Traditional Password Authentication [closed]

The third party login is excellent function that has come in recent years that relieves the load on a programmers mind so that I have to remember less useless passwords. I don't use the same ...
5
votes
3answers
408 views

How to store / not to store passwords

I am building an web site which will allow users to aggregate the information stored in their online profiles ("data feeds") in one place. I am wondering - what is the accepted (from a secureness ...
14
votes
4answers
3k views

How can I estimate the entropy of a password?

Having read various resources about password strength I'm trying to create an algorithm that will provide a rough estimation of how much entropy a password has. I'm trying to create an algorithm that'...