Questions tagged [password-protection]

Password protection is used to ensure only authorized users (i.e. those who know the password) can access or modify certain information.

Password protection is a technique used in information security to limit access to information.

Typically, a combination of a user name and a corresponding password will be used, since this allows access to be issued and revoked (as well as audit logging) on an individual basis, making a single person responsible for use and abuse of the password.

In case of confidential information, passwords will be required even for read-only access, with different users having access to different subsets of information. But even for public information, passwords are often used to selectively grant edit privileges. Probably the most common use of passwords is to limit access to user account information to the owner of the account.

Secure storage of passwords is an important topic, neglect of which can lead to significant security breaches, especially due to password reuse. Use of secure password hashes or, even better, purpose-built algorithms such as BCrypt for this purpose is critical.

Related tags:

1630 questions
1292
votes
11 answers

How do you use bcrypt for hashing passwords in PHP?

Every now and then I hear the advice "Use bcrypt for storing passwords in PHP, bcrypt rules". But what is bcrypt? PHP doesn't offer any such functions, Wikipedia babbles about a file-encryption utility and Web searches just reveal a few…
Vilx-
  • 97,629
  • 82
  • 259
  • 398
151
votes
18 answers

HTTP authentication logout via PHP

What is the correct way to log out of HTTP authentication protected folder? There are workarounds that can achieve this, but they are potentially dangerous because they can be buggy or don't work in certain situations / browsers. That is why I am…
Josef Sábl
  • 7,097
  • 9
  • 51
  • 60
149
votes
9 answers

SQLite with encryption/password protection

I'm just learning to use SQLite and I was curious if such is possible: Encryption of the database file? Password protect opening of the database? PS. I know that there is this "SQLite Encryption Extension (SEE).", but according to the…
ahmd0
  • 14,832
  • 29
  • 117
  • 218
114
votes
9 answers

PHP and MySQL - how to avoid password in source code?

I have a small PHP application storing data in a MySQL database. Currently username / password are hard-coded in the PHP code. A situation I do not really like, for example, since the code is also available in a repository. The best idea I have is…
Horst Walter
  • 12,873
  • 28
  • 104
  • 201
108
votes
7 answers

Eclipse secure storage

Is it possible to disable completely the secure storage password of Eclipse? I am running Eclipse Helios on Windows 7.
yannisf
  • 5,568
  • 9
  • 37
  • 59
98
votes
7 answers

Plain text password over HTTPS

I'm currently working on a PHP OpenID provider that will work over HTTPS (hence SSL encrypted). Is it wrong for me to transmit the password as plain text? HTTPS in theory, cannot be intercepted, so I don't see anything wrong. Or is this unsafe at…
WhyNotHugo
  • 8,246
  • 5
  • 56
  • 63
98
votes
6 answers

How to remove .htaccess password protection from a subdirectory

I have password protected my entire website using .htaccess but I would like to expose one of the sub directories so that it can be viewed without a password. How can I disable htaccess password protection for a sub directory? Specifically what is…
justinl
  • 9,764
  • 19
  • 67
  • 87
90
votes
9 answers

Non-random salt for password hashes

UPDATE: I recently learned from this question that in the entire discussion below, I (and I am sure others did too) was a bit confusing: What I keep calling a rainbow table, is in fact called a hash table. Rainbow tables are more complex creatures,…
AviD
  • 12,592
  • 6
  • 59
  • 90
61
votes
11 answers

How to send password securely via HTTP using Javascript in absence of HTTPS?

The very basic issue all developers face: Whenever user submits the form, the password is sent via network and it must be protected. The site I develop for doesn't have HTTPS. Neither does the owner want to buy a SSL certificate, nor is he…
Viet
  • 16,604
  • 31
  • 94
  • 134
57
votes
4 answers

Reading a password from std::cin

I need to read a password from standard input and wanted std::cin not to echo the characters typed by the user... How can I disable the echo from std::cin? here is the code that I'm currently using: string passwd; cout << "Enter the password:…
Vargas
  • 1,940
  • 2
  • 30
  • 51
56
votes
2 answers

What are Salt Rounds and how are Salts stored in Bcrypt?

I'm trying to configure Bcrypt for a node app that I'm making and have several questions about salts that I hope someone here can help kindly answer. What is a salt 'round'? For example, in the github docs…
doctopus
  • 4,073
  • 4
  • 30
  • 65
56
votes
6 answers

Removing the password from a VBA project

How can I programmatically remove a (known) password from an Excel VBA project? To be clear: I want to remove the password from the VBA Project, not the workbook or any worksheets.
Barry-Jon
  • 1,211
  • 4
  • 12
  • 16
56
votes
8 answers

How do I implement salt into my login for passwords?

I want to implement a salt into my login system but am a bit confused on how this is supposed to work. I can't understand the logic behind it. I understand md5 is a one-way algorithm and all of the functions that I have come across seem to hash…
Timmay
  • 561
  • 1
  • 4
  • 6
48
votes
11 answers

Easy way to password-protect php page

I have a page I want to password-protect. I've tried doing HTTP authentication, but for some reason it doesn't work on my hosting. Any other quick (and easy) way to do this? Thanks!
Leticia Meyer
  • 537
  • 1
  • 7
  • 7
48
votes
5 answers

"Remember Me On This Computer" - How Should It Work?

Looking at Gmail's cookies it's easy to see what's stored in the "remember me" cookie. The username/one-time-access-token. It could be implemented differently in cases where the username is secret, as well. But whatever... the thing is not very high…
Dan Rosenstark
  • 64,546
  • 54
  • 267
  • 405
1
2 3
99 100