New posts in Password Management

Salted hashes vs HMAC?

Are services like "LastPass" less secure, as they have all my passwords protected by a single password?

Why don't people hash and salt usernames before storing them

Why do we ask for a user's existing password when changing their password?

Reset password - should I prevent abusing it?

How can I avoid putting the database password in a perl script?

Requiring regular password change but storing previous passwords?

Is there more to password hashing?

Is there any explanation (other than storing plaintext) for case-insensitive passwords?

Is it common practice to log rejected passwords?