Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [passwords]

A password is a secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

1
vote
1answer
105 views

Should usernames and passwords to external systems be documented?

This is basically an extension to my previous question. That time our internal discussions didn't end up anywhere and the whole issue was forgotten for the time being. Now we've touched upon it again,...
0
votes
3answers
159 views

Is there a secure way to check previous passwords purely on the client-side?

We have a requirement for a security audit that our password policy must disallow the re-use of a previous password from the last 4 used passwords. We can accomplish this fairly easily by making a ...
11
votes
5answers
782 views

If passwords are stored hashed, how would a computer know that your password is similar to the last one if you try resetting your password?

If passwords are stored hashed, how would a computer know that your password is similar to the last one if you try resetting your password? Wouldn't the two passwords be totally different since one is ...
0
votes
1answer
63 views

Password manager inside application

Firstly this is not about how to store password for access to the application itself. That is handled using .Net Identity. Authentication is handled using JWT. So it is a web application. The problem ...
0
votes
1answer
54 views

LDAP with Dovecot

I have a mail server setup with Postfix and Dovecot, and an application server setup with node.js. I have user credentials stored in my application server, and I want to use the same credentials for ...
3
votes
3answers
118 views

How to pass credentials to client

When installing application on client's server at the end of the project, how to give admin's password to client? (On paper, by word?) Client may not be very technical so script generating password ...
11
votes
1answer
431 views

During account creation, is it better to generate the password automatically and send it to the user, or to let the user create his own password?

This question came up today while discussing with a colleague about the 'create account' page for the website we're working on. My colleague's opinion is that we should make the registration as quick ...
1
vote
3answers
142 views

Possible way to handle multiple reset password email

It's a C#, ASP.NET MVC Project and here is the problem: User can enter their email address in the reset password text field and click on the Reset Password button. Each time the user clicks on the ...
9
votes
1answer
188 views

Integration tests in OSS projects - how to handle 3rd parties with authentication?

One of my (open source) hobby projects is a backup tool which makes offline backups of repositories from GitHub, Bitbucket etc. It calls the hosters' API to get a list of repositories, and then it ...
-1
votes
1answer
109 views

Complete statelessness, how to save password on client in secure way

Thinking about statelessness I wonder how I can overcome the issue of saving the user's password on the client side in a secure but also comfy way. I assume the client always sends credentials to the ...
4
votes
3answers
871 views

Saving Passwords for autologin

I know I should encrypt the password whenever I save passwords for security. But I don't know how should I encrypt password that when I save for autologin. If the password was just for checking user,...
-1
votes
1answer
126 views

Combinations of a password

I am trying to encrypt a password for my school project. Here is the process: Let's assume that I have a string p (n characters long) which contains the password. The program reverses the string and ...
3
votes
2answers
6k views

Will quantum computers be able to easily crack passwords?

I've recently read a number of (layman's) articles on quantum mechanics and quantum computing, and keep seeing examples along the lines of "Quantum computing can crack passwords quickly by trying all ...
3
votes
5answers
486 views

Is it stupid to not save the last two characters of a password hash

As any good password storing developer I have user unique salts that I use to generate password hashes. ie I store a uniquesalt and SHA1(salt + password + "applicationuniquestring") in the database ...
0
votes
2answers
2k views

Best way to hash passwords in PHP?

I've switched to PHP 7.0 very recently and I was wondering that if password_hash was better than making your own salt and using the crypt function. I have three examples of code and I don't know which ...
7
votes
1answer
222 views

Why is it more unsafe to store your password in the URL of a git repo?

As a comment on a response to this question, someone says: It is not advisable to put the password in the URL for this file is saved on the .git/config . Is not safe, it is better to use ssh key ...
2
votes
2answers
117 views

How can I tell if a web sign up form actually encrypts my password?

Recently I signed up for new account for a service provider's web site. I entered the usual the name, email , password (strong) , repeat password and I was signed up. Great everything works well. A ...
0
votes
3answers
113 views

Preventing information leakage while returning an error message

Say my website contains 2 functions: Allow a user to change their own password Allow an administrator to change a user's password (the user must change again before they login) Now let's say that ...
-1
votes
1answer
91 views

Is the mechanism used in Passwordless module widely used? [closed]

I came across Passwordless which uses email/SMS to allow the user to login. Is this mechanism widely used? What are the advantages/disadvantages of using such mechanism? I'm asking because I haven't ...
0
votes
2answers
96 views

How can I effectively design password authentication for encryption in my project?

I'm working on a small personal project that involves a user entering a password that would then allow them to view a text file that would otherwise be encrypted. I'm having trouble wrapping my head ...
3
votes
3answers
1k views

Modern recommendations for password recovery

I'm going to implements password recovery in my authentication. I haven't put this together in a while and wondering if there is anything I ought to be aware of. My idea at the moment is: User ...
0
votes
2answers
927 views

Handling delay in entry of OTP for log in validation

There's an application, which accepts a user id and password to login. Validation of the id and password is processed by another system. Now after password validation, the application generates a One ...
30
votes
6answers
31k views

Putting a password in a REST API call

Suppose I have a REST API that is also used to set/reset passwords. Let's also suppose that this works over a HTTPS connections. Is there any good reason not to put that password in the call path, let'...
0
votes
1answer
69 views

Creating service to distribute passwords to architecture

We have big legacy code working for big corporation connecting to multiple remote/local databases. The configuration files with IP, name and password for connecting to different databases are now ...
2
votes
2answers
3k views

matching usernames with their password

We are working on a simple login/registration form. Our login script checks to see if the username and password exist in the same row of the database. If it does exist, we bring the user to a welcome ...
1
vote
2answers
267 views

Why are Strings in StringPool considered insecure?

Passwords are recommended to be stored in char[] instead of String, as Strings are stored in StringPool. Read more here As per this question Strings in StringPool are not available directly. To ...
1
vote
2answers
181 views

How to store passwords which need to be re-read

I have a utility which runs at certain intervals. My customer now wishes for it to send an email when the task is completed. They want to be able to control the email address, meaning, they want to ...
3
votes
1answer
258 views

If passwords are stored hashed, does that mean that theoretically there exists another password that could be used to log in? [duplicate]

From what I understand, in most sites, passwords are stored as a hash; not in their original form. This means that if the database is hacked into, the attacker will see the (nearly) useless hashes ...
0
votes
2answers
193 views

Resetting vs. re-sending forgotten passwords

When a user forgets their password, is it better practice to reset the password and email that to the user or just to email the current password to the user's email address.
3
votes
1answer
3k views

What's the best practise for storing web server credentials for your web app deployment?

I was looking at the Oracle documentation for the weblogic maven plugin. In it, they store the weblogic user name and password for accessing in the pom.xml. Just wondering, isn't this a terrible ...
6
votes
3answers
307 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...
-1
votes
1answer
3k views

Can someone please explain reverse look up tables? [closed]

Im finding it difficult to understand reverse look up tables and how it works, and the concept of hash chains. This is apart of a computer security model i am taking. So i understand that brute force, ...
1
vote
1answer
110 views

How to store sensitive information (e.g. clients' credentials) accessibly for everybody inside?

I just discovered that we store sensitive information on our SharePoint. Since it's accessible by a password alone (and we all know that others click for the password/user name to be automatically pre-...
1
vote
2answers
155 views

Administrator Rights for a set of code

I am developing a program for Windows 7 Enterprise Edition that will be used in a corporate environment. The application will automatically fix certain errors as soon as the user selects the ...
1
vote
2answers
458 views

Is hashing of just “username + password” as safe as salted hashing

I want to hash "user + password". [EDIT: prehashing "user" would be an improvement, so my question is also for hashing "hash(user) + password". If cross-site same user is a problem then the hashing ...
4
votes
1answer
5k views

Difference between reverse lookup tables and rainbow tables

Using Reverse Lookup Tables, you create a lookup table consisting of the password hash of user accounts. Then you use another table which consists of hashes with guessed passwords. Then you compare ...
2
votes
1answer
462 views

Kerberos for key management?

We have half-implemented proper key management at our dev shop. We have a SOAP web service (the key management web service) that can be used to retrieve passwords for other systems. So for instance, I ...
2
votes
1answer
330 views

Password reset process

So I'm working on my first password reset mechanism. I'm going with what I understand to be a fairly common procedure: User clicks "Forgot Password" User is prompted for email address If the entered ...
3
votes
2answers
3k views

Strategy for storing passwords/credentials in the context of continuous delivery [closed]

It is common sense not to store passwords/credentials into SCM. I would like to know then what would be a good strategy for storing passwords/credentials in the context of continuous delivery. Where ...
8
votes
1answer
460 views

When allowing a user to change passwords, should I generate a new salt?

In my database, I have a column for the hashed password and the salt. My application allows users to change their password. Should I use the same salt for the password, or should I generate a new ...
2
votes
4answers
613 views

Storing web app passwords so that they can be retrieved

Short version My boss wants me to store user passwords for an ASP.NET Web Forms web app we're developing in clear text, so that a user with admin rights can click a button and get back the current ...
1
vote
4answers
346 views

Is just using an email address for login a good idea?

Many a times I need to log into a website that I used months ago and have forgotten my password. So clicking the reset password link and the site sends me an email with a single use link which allows ...
78
votes
15answers
28k views

Why should passwords be encrypted if they are being stored in a secure database?

I have a web service. Right now, I have passwords stored in plain text in a MySQL table on my server. I know this isn't the best practice, and that is why I am working on it. Why should passwords be ...
11
votes
7answers
1k views

Why do modern websites still insist on archaic username/password requirements? [duplicate]

I was signing up for a website last night, and once again was greeted with the fact that my username cannot contain certain characters (including spaces), and neither could my password. Is there a ...
3
votes
2answers
351 views

Would using rainbow tables to detect weak user passwords feasible?

As I understand in most security breach where the list of hashed password are compromised, attackers do use brute-force to try to find weak password and, invariably, they always find quite some (like ...
32
votes
6answers
4k views

Updating password hashing without forcing a new password for existing users

You maintain an existing application with an established user base. Over time it is decided that the current password hashing technique is outdated and needs to be upgraded. Furthermore, for UX ...
10
votes
5answers
772 views

What are some possible alternatives for providing an 'Admin Password' for a desktop application?

I'm currently managing and re-factoring a piece of software that has been used at my company for over a decade now. One of the elements of this application is a sort of admin or power-user mode which ...
5
votes
3answers
5k views

A question about storing passwords

I'm creating a program (in C++) that will password protects its user's database (.dat) file. I'm confused on where to store the password? In the user's database file or somewhere else. I'm new to ...
15
votes
6answers
1k views

How to assure users that website and passwords are secure [closed]

On reliable websites I always see claims such as "All data is encrypted" or "All passwords are encrypted using 128bit encryption" and etc. However I have never come across a claim such as "All ...
1
vote
1answer
70 views

Information protection when registering on web sites

Up until now it seems that when you register on a random web site you do so with blind trust. You assume that the site isn't harvesting information and passwords. You assume the site is reasonably ...