Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

Filter by
Sorted by
Tagged with
1 vote
2 answers
179 views

Can we simply re-salt password on suspected session hijack?

Looking at people complaining about Yahoo forcing users to change their passwords. We can see that people do not particularly like to change passwords (and whether we change them regularly is an ...
grochmal's user avatar
  • 5,867
1 vote
0 answers
301 views

What can/should I do about gross lack of IT security at another company?

I used to login into a certain website a couple of years ago. Recently I've got an email suggesting that I should renew my membership, and that email included my old password. That's right, my old ...
Michael's user avatar
  • 113
1 vote
1 answer
211 views

Is using an app with a password generation algorithm as secure as a using a password manager? [duplicate]

I found the Master Password app which uses a password generation algorithm to generate a different password for each site based on the sites name, the users name and a master password. It seems like a ...
jesm00's user avatar
  • 11
3 votes
1 answer
219 views

Are there advisories on how actually to use a password safe?

I sense an overall push towards password safes (cloud/local). Now that people tend to use more and more those technologies I looked for best practices or formal advisories on password safes but did ...
Samuel's user avatar
  • 728
1 vote
1 answer
286 views

Should I keep hashed values secret? [duplicate]

Many client-server systems use hash functions for the authentication of users password.They use passwords as inputs of different hash functions like MD5,SHA-1 etc and compute hash values.Then they ...
Shahed al mamun's user avatar
1 vote
4 answers
334 views

Should users be allowed to login with the same password when a password change is requested but not changed?

I have noticed that some sites would not let you login with the old password if a new password is requested, but was not changed. Example: I forgot my password and requested a new one in the email. ...
Sambhav Bellani's user avatar
1 vote
1 answer
156 views

Secure symmetric encryption of passwords to allow admins to log in as users

I am trying to work out the best way to secure user credentials for the login of the service i am working on. The safest way would be to use hashing and salting however this project requires the ...
Andy's user avatar
  • 13
24 votes
4 answers
11k views

Is it secure to store a two factor authentication seed in a password manager?

I wonder whether it is really secure to store the Two Factor Authentication seed code (e.g. the secret key for TOTP) within a password manager together with the user and password for the service. If ...
Programie's user avatar
  • 341
5 votes
2 answers
987 views

Hashed passwords storage: iterations vs entropy [duplicate]

Context: A website is hosted on multiple dedicated servers. There are frontend webservers, backend DB servers and other servers between them. The DB holds user's accounts passwords. All connections ...
HashDoe's user avatar
  • 53
1 vote
1 answer
413 views

encrypted information that is not accessible to database administrators

I work with asp.net core 1 and I will introduce an encrypted storage of user data. These data must not be accessible to the database administrator but only for users with a passphrase. I thought of ...
Sergio's user avatar
  • 11
10 votes
2 answers
4k views

Is the macOS Universal Clipboard secure?

Since the introduction of Universal Clipboard on Apple's operating systems, I've found myself increasingly relying on it to paste passwords and authentication codes from my MacBook to my iPhone and ...
kettlepot's user avatar
  • 263
1 vote
2 answers
506 views

Is using password_verify($password, "") to block access to an account secure?

We are migrating an old website, which used pretty old password hashing to the new php password verify function. The old method used an old hash, and we would like to use password_verify instead of ...
user23127's user avatar
  • 203
19 votes
7 answers
12k views

Encrypting text file with AES 256 instead of password manager

I'm starting to have a big list of passwords I need safely stored. I was looking at password managers like LastPass, but these always seem to be targetted by hackers and have been compromised before. ...
magna_nz's user avatar
  • 319
2 votes
1 answer
686 views

What are the security risks of resetting your password every time you login?

Is it a good idea in terms of security to reset your password every time you login and just fill your password with a bunch of random symbols, letters and words that you don't memorise? Since ...
Kaynnc's user avatar
  • 125
8 votes
0 answers
3k views

bitwarden as alternative to LastPass? [closed]

I stumbled over bitwarden, a service that promises to provide a service like LastPass (all data encrypted on your device, but additionally stored on a central server for easy access). I am not ...
guntbert's user avatar
  • 1,953
0 votes
3 answers
290 views

How do I implement Multikey encryption? [closed]

I'm looking for an algorithm, by which I can encrypt a piece of data with n keys and that to decrypt I can use any of them. I think I remember bitcoin using something similar for blocks, but now I ...
Tlaloc-ES's user avatar
  • 101
1 vote
1 answer
230 views

Should Lockout Terminate The Session?

I think it is OK not to terminate existing sessions if user is locked out due to a number of login attempts with the wrong password. Because it might be an attack and it would be inconvenient to ...
John L.'s user avatar
  • 741
3 votes
3 answers
14k views

Passwords in memory, practical ways to improve security

Storing a password in an application's memory is risky. The OS may write a portion of memory to disk as a swap file. Processes may access each others' memory, even though they shouldn't. (More) I'm ...
Atte Juvonen's user avatar
0 votes
1 answer
2k views

Is it safe to store passwords in a Browser? [closed]

We are used to store passwords in Browsers for online login accounts. Where and how those passwords are saved and I hope it is encrypted ? Normally, the browser prompts for credentials (local) when ...
user3496510's user avatar
  • 1,297
1 vote
1 answer
148 views

Managing security of a desktop/mobile app

I'm working on an app that stores sensitive data (think of it as a password locker) for the UWP (Universal Windows Platform). The most important requirement is the ability to roam the data between ...
StepTNT's user avatar
  • 111
2 votes
1 answer
4k views

Securely store password for Java Keystore

Background I am implementing set of Micro services using Java spring MVC and hosted in Undertow containers using Gradle. I am using a Java keystore to secure my keys which are using by the service to ...
user3496510's user avatar
  • 1,297
2 votes
6 answers
1k views

Password reset - Cryptographically signed user ID and timestamp or randomly generated value?

What are the pros and cons of the different ways of handling reset links? I see two ways of handling them: Generate a random string, for example with uuid4. Store it in the database with the user and ...
Testare1 Testsson's user avatar
3 votes
1 answer
200 views

Is it safe to call mount(2) and pass the password as a parameter?

I wanted to write a daemon that users can start, and that, every 2 hours, automatically mounts an authenticated network share. The daemon will prompt the user for the password only the first time, and ...
Johannes's user avatar
  • 165
5 votes
1 answer
2k views

Is there a best practice for storing passwords in a two way encryption?

I have a .NET system with users logging in normally and standard hashing and/or 3rd party login (google, fb etc). I have a 3rd party plugin that requires username/login for each user in addition to ...
BZN_DBer's user avatar
  • 153
2 votes
2 answers
3k views

Google login 2 factor authentication sms -fake or real?

All my 2 factor authentication used to come from Google sms, but recently I've had the following numbers come up on my phone. I realise that to do this the person would need to have my phone number. I ...
user637251's user avatar
2 votes
1 answer
2k views

Is there an easy way to generate all variations around a password?

I did something quite stupid while renewing my Keepass master password: a typo. I quickly checked what I did type before validating but I obviously overlooked something because it simply doesn't work ...
ubik's user avatar
  • 23
1 vote
1 answer
327 views

Are Portable Password Managers secure?

I have been using KeePass2 for a while now and I think it is a very good password manager. There also is a portable version and I often read recommendations for KeePass where the portable version is ...
user6287736's user avatar
0 votes
1 answer
1k views

Is there Algorithm determining weakness of PIN-code?

There are several algorithms that can tell us if our password is strong enough analyzing its length, considering if it uses upper and lowercases, special symbols and digits, considering if it is not a ...
Evgeniy Mishustin's user avatar
1 vote
2 answers
480 views

What is the Best Method to Store SQL Host, Username and Password for Multiple Databases?

I have a large project which has multiple web servers (one for each client), one application (for all clients), and multiple SQL databases (one for each client) as pictured below. . For security ...
Trevor's user avatar
  • 11
12 votes
3 answers
3k views

Storing password along with encrypted file

I was making a small application to encrypt files and ran into the problem of verifying that the provided key is the correct one when decrypting. My idea was to store the (padded, encrypted) key along ...
Oliver.m's user avatar
  • 123
2 votes
1 answer
97 views

Storing of customer creds from third party server with reading access to it

Our service will provide some automation over another service. Customers share the password with us, and our staff make the customer's work. Another work will going on our working agents(remote server)...
punksta's user avatar
  • 121
1 vote
1 answer
126 views

The difference between Management and Configuration Policies

I am trying to find out the difference between management and configuration policies. Kindly, can someone elaborate that or showing an example so that I can understand each case.
steve's user avatar
  • 85
2 votes
2 answers
278 views

Does setting a Firefox master password make sense given that full disk encryption is used?

I wonder if having a master password will make my login data saved in Firefox more secure given the fact that I use full disk encryption. The password database won't be exposed in plain text ...
raindev's user avatar
  • 253
2 votes
2 answers
542 views

Way to hash passwords client-side without javascript?

I'm working on implementing a basic login system (I know, don't roll your own security, blah blah blah) using PHP and MySQL. However, I don't want the user to need to have JavaScript enabled, meaning ...
user avatar
4 votes
3 answers
2k views

Is it a bad idea to use base-64 encoded strings for passwords?

First off, forgive me if this seems like an extremely naive and un-educated question. Any ways, so as above, is it a bad idea? I mean, thinking about it, it doesn't seem like a bad idea. My logic is ...
matthew walker's user avatar
1 vote
2 answers
202 views

Security of a password container in the cloud

I currently use Keypass to manage my passwords and I sync the container between my desktop and my smartphone via USB. My wife has an older tablet that I cannot sync via USB because I cannot mount it ...
Serge Ballesta's user avatar
4 votes
1 answer
334 views

Does predictable input (like bcrypt headers) threaten password-based encryption?

I am making a system for storing hashed version of some secrets. I have read through dropbox's blog about how they store their passwords, and have taken inspiration from what they are doing. Dropbox, ...
Automatico's user avatar
2 votes
1 answer
394 views

Is it dangerous to program a user-called deamon that sends passwords via https?

I have this problem: My console app needs to connect to a server. However, the server requires passwords in plain text per HTTP POST for login. The connection is HTTPS. The app is only called now and ...
Johannes's user avatar
  • 165
-1 votes
1 answer
982 views

Why are some big companies using MD5 as hashing algorithm for their passwords? [closed]

I have seen many companies that are using MD5 to hash their passwords, and it seems like most of them don't want to change algorithm. My question is why are they still using it? Many say that MD5 ...
Daniel's user avatar
  • 11
0 votes
1 answer
154 views

Is there a way to make linux pass ls require decryption?

So pass, the standard unix password manager is great and I've started to use it to encrypt my passwords. But there is one thing that bugs me. When you run pass ls it shows you all your identities. I ...
Openbaringen's user avatar
3 votes
3 answers
2k views

Password Manager or Password Generator [duplicate]

If you use the same email and password for every site, one breach and all your accounts are hacked. This is why I like to create a unique password for every site. This causes a problem since the ...
iProgram's user avatar
  • 1,187
55 votes
3 answers
11k views

Secret salts; why do they slow down attacker more than they do me?

When studying Dan Boneh's slides for 'Session Management and User Authentication' (2011) he mentions 'secret salts' on the slide 'Further defences' (slide 48 out of 58). He suggest to store in the ...
harm's user avatar
  • 603
1 vote
4 answers
255 views

Authentication even with incomplete password

When one enters a password to access one's online account, one has to type out the complete password, and submit it to be authenticated. If the password is very long, and if the account is accessed ...
Flux's user avatar
  • 873
5 votes
2 answers
1k views

How to make Automated API calls which are at least minimally secure? [duplicate]

How do I go about writing scripts (for automation) in Powershell (and possibly even Python) that help me access APIs while keeping the credentialing information either secure IN the script and/or ...
AdilZ's user avatar
  • 151
24 votes
6 answers
5k views

Does Rehashing a weak hash with a strong algorithm make it strong?

Imagine the following situation. We're making a web application which should be really safe Now the accounts/users are not directly added by us but they receive a letter with a logincode. We get a ...
Jester's user avatar
  • 663
2 votes
1 answer
478 views

Why is it bad to use your browser's password manager? [duplicate]

I keep hearing various security-minded people saying that using your browser's password manager is a bad idea because it's not safe. How true is this? I know that Safari uses the system keychain to ...
crc32's user avatar
  • 23
12 votes
2 answers
4k views

Is it safe to expose bcrypt password hashes?

I'm building a web app that needs to support user-switching offline and am wondering if it is safe to expose bcrypt hashes to authenticate users. The basic flow: Primary users logs in while web app ...
Alex Dunae's user avatar
1 vote
4 answers
353 views

How to securely store information without a key or password?

For a hypothetical situation, imagine a program that saves its user's password, then automatically signs them in without prompting them for their password again. The password must be secured somehow, ...
ins0maniac's user avatar
0 votes
1 answer
883 views

Email notification on accounts lockout

I am debating the merits of a feature being requested for our web application. The request is asking for an email to be issued to a user when an account is locked. Accounts are locked after 5 failed ...
Darragh's user avatar
  • 1,102
3 votes
2 answers
567 views

Is there a way to check whether the application saves password in clear text or in hashed format? [duplicate]

I have four kind of passwords and I use them according to the importance of the web application. So if I see an application not using SSL and I have to make an account, I will use a basic password ...
one's user avatar
  • 1,811

1
10 11
12
13 14
27