A password is a secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.
31
votes
9answers
1k views
Are there any valid reasons for disallowing characters and limiting the length of passwords?
I've come across quite a few sites that either limit the length they allow passwords to be and/or disallow certain characters. That's limiting to me as I want to widen and lengthen the search space of ...
26
votes
14answers
957 views
What if the client needs the ability to retrieve passwords?
I've currently inherited an application at work and to my dismay, I have realized that the user passwords stored in the database are encrypted using an in house encryption function, which also ...
21
votes
5answers
1k views
How to implement a safe password history
Passwords shouldn't be stored in plain text for obvious security reasons: you have to store hashes, and you should also generate the hash carefully to avoid rainbow table attacks.
However, usually ...
19
votes
9answers
2k views
Is an 'if password == XXXXXXX' enough for minimum security?
If I create a login for an app that has middle to low security risk (in other words, its not a banking app or anything), is it acceptable for me to verify a password entered by the user by just saying ...
17
votes
7answers
381 views
Citations for inadvisability of globally unique password
I am having a disagreement with someone (a client) about the user identification/authentication process for a system. The nub of it is that they want each user to have a globally unique password ...
13
votes
13answers
697 views
How do you keep track of all your passwords? [closed]
I'm going to ask this question at the risk of someone exposing me their own personal algorithm, if that's what you do please don't post that!
I'm interested in learning what software you use to ...
13
votes
4answers
481 views
How can I estimate the entropy of a password?
Having read various resources about password strength I'm trying to create an algorithm that will provide a rough estimation of how much entropy a password has.
I'm trying to create an algorithm ...
12
votes
8answers
991 views
Punishing users for insecure passwords [closed]
I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, ...
11
votes
6answers
1k views
Why do websites restrict the number & choice of characters in a password?
Registering on an insurance company's website right now, and my password is 16 characters long, using a nice variety of letters, numbers, special characters, etc. However, here's their list of ...
10
votes
5answers
1k views
“Forgot Password” - How to handle this?
I read this answer http://programmers.stackexchange.com/questions/15350/why-do-websites-restrict-the-number-choice-of-characters-in-a-password/15351#15351 and found a comment insisting not to send ...
8
votes
6answers
590 views
How to refuse to give an access to passwords to a customer without being unprofessional or rude?
Let's say you're creating a website for a customer. This website has its own registration (either combined with OpenID or not). The customer asks you to be able to see the passwords the users are ...
7
votes
8answers
798 views
Are you obliged to provide old employers with access to protected resources?
Firstly, a disclaimer. This question is not because I'm a disgruntled employee planning to hide some malicious code which I can later blackmail my employer with. I actually quite like the people I ...
7
votes
7answers
879 views
Storing plaintext passwords for detecting fraud
I am well aware of best practices for storing user passwords:
Never store passwords in plaintext
Never store encrypted passwords; always store password hashes
Always salt your password hash to deter ...
7
votes
8answers
1k views
What is a reasonable and secure password requirement for user registration?
This is the password policy I just got from UPS (just for package status checking):
Your password must be between 8 and 26 characters long. It must
contain at least three of the following ...
7
votes
3answers
231 views
Storing passwords for usage in scripts
There are few situations that require users to provide their password while automating things during development process. Site deployment is only one of the common situations. Creating dmg files under ...
6
votes
7answers
703 views
Password hashing and support to your user
We've recently moved to a better password storage strategy, with it came all the good stuff:
Passwords are stored after going through bCrypt
User is sent an activation link on account creation to ...
5
votes
3answers
2k views
How does a web browser save passwords?
How do current web browsers (or mobile mail clients and any software in general) save user passwords? All answers about storing passwords say we should store only hashes, not the password themselves. ...
5
votes
3answers
527 views
Is there any legislation requiring how we store passwords?
Given the Sony data breach and other events recently, is there any actual laws or regulation regarding how to store passwords? I think there are with credit cards, you're not allowed to store the 3 ...
5
votes
1answer
164 views
Using account (login) password in generated PDF?
Ever since I heard about programming, I was told that any password (especially the one used on login) should be stored in database using any kind of one-way hashing algorithm, and never ever as plain ...
5
votes
4answers
683 views
Facebook - Isn't this a big vulnerability risk for users? (After Password Change)
I would like to know you opinions as programmers / developers.
When I changed my Facebook password yesterday, by mistake I entered the old one and got this:
Am I missing something here or this is ...
5
votes
1answer
547 views
Is there an official standard regarding user password storage practices?
I recently used a government service that I had an account for from years ago. I couldn't remember my password for the service so I used the "forgot password" link and was astonished to see that this ...
4
votes
3answers
186 views
How to store / not to store passwords
I am building an web site which will allow users to aggregate the information stored in their online profiles ("data feeds") in one place.
I am wondering - what is the accepted (from a secureness ...
4
votes
4answers
129 views
System that splits passwords across two servers
I stumbled upon this news article on BBC,
RSA splits passwords in two to foil hackers' attacks
tl;dr - a (randomized) password is split in half and is stored across two separate servers, to foil ...
3
votes
4answers
1k views
What type of Password Reset/Forgot Password (verification) mechanism would you recommend
I am looking for ways to verify the user in order to reset their passwords. 2 commonly used ones:
Email verification
Secret question
I wonder which will you recommend? I am trying to avoid having ...
3
votes
3answers
261 views
Saving Passwords To The Local Device
So In my app (iOS), you have to register in order to use the service (a food service). But in order to change details about your account (username, password, and email), you have to reenter your ...
3
votes
3answers
237 views
Securing credentials passed to web service
I'm attempting to design a single sign on system for use in a distributed architecture. Specifically, I must provide a way for a client website (that is, a website on a different ...
3
votes
4answers
258 views
Password insanity! Recommended approaches to password management on multiple client systems? [closed]
A software development company I work with has a web based product they are successfully selling to clients. All of these clients have a support agreement with us that generally requires us to access ...
3
votes
5answers
245 views
Secure way to remember usernames and passwords [closed]
Maybe it was already discussed. After browsing through some alike questions here about password management, I still would like to ask this question.
If there are 100 sites which require username ...
3
votes
2answers
392 views
What .NET objects should I use to create a cookie based session in MVC?
I'm writing a custom password reset application that uses a validation technique that doesn't fit cleanly with ASP.NET Membership Provider's challenge questions.
Namely I need to invoke a workflow ...
2
votes
2answers
474 views
SVN command line client: checkout refused when LDAP password changed “svn: OPTIONS of” (repo) “authorization failed” (but works in TortoiseSVN)
When using the command line/terminal svn client, a colleague is getting "svn: OPTIONS of " [repo] "...authorization failed" error message when they attempt to checkout the repo to be their local ...
2
votes
4answers
250 views
How do you manage passwords in your team for db with multiple env and security constraints?
I don't want any tools, but more methods to help us manage our passwords.
I know this question has been closed, but I think this one, even if it's related, is more a programmers problem than a super ...
2
votes
1answer
114 views
Client side authentication through signatures instead of passwords
I want to save some user-generated data with some signature of the user that generated it (let's say that the user has to fill some forms with some data and I want him to sign the written data).
The ...
1
vote
4answers
232 views
Why do web sites require certain characters in their credentials? [closed]
It seems like when web site lists requirements as to what characters MUST be in the password they're only providing a password map for someone who wants to hack their system.
For instance, fsd.gov ...
1
vote
2answers
518 views
Security Concerns with password storage in Scripting Languages (VBA)
The team I work with handles large amounts of consumer survey, and internal company metric data. Primarily the data is stored in a database, and we utilize various platforms and to work with that ...
1
vote
1answer
121 views
Storing 'sensitive' data in settings file
I'm writing a small utility in AutoIt that connects to Twitter. I would like to store the username and password in the programs setting file, but I know that it needs to be encrypted obviously. ...
1
vote
1answer
85 views
Why don't smart phones have an auto-forget password feature? [closed]
Storing passwords to external services (e.g. corporate email servers) on smart phones is very insecure, since phones are more easily stolen. Has any vendor implemented a feature to only cache a ...
1
vote
0answers
133 views
How to manage company passwords when employing temporary freelancers? [migrated]
I am from a marketing firm which now has a development team, which i am part of. We have been tasked with finding a few freelancers who can come in and work when either me and the other developer is ...
0
votes
2answers
138 views
Security through obscurity and storing unencrypted passwords
What exactly does "Security through obscurity" means in the context of stroing unencrypted passwords?
I'm using a small program (I won't name it, to not enlarge enough large shame on its author) that ...
-5
votes
3answers
292 views
Is sending password to user email secure? [closed]
How secure is sending passwords through email to a user, since email isn't secured by HTTPS.
What is the best way to secure it? Should I use encryption?
