Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
1,325
questions
1
vote
2
answers
179
views
Can we simply re-salt password on suspected session hijack?
Looking at people complaining about Yahoo forcing users to change their passwords. We can see that people do not particularly like to change passwords (and whether we change them regularly is an ...
1
vote
0
answers
301
views
What can/should I do about gross lack of IT security at another company?
I used to login into a certain website a couple of years ago. Recently I've got an email suggesting that I should renew my membership, and that email included my old password. That's right, my old ...
1
vote
1
answer
211
views
Is using an app with a password generation algorithm as secure as a using a password manager? [duplicate]
I found the Master Password app which uses a password generation algorithm to generate a different password for each site based on the sites name, the users name and a master password. It seems like a ...
3
votes
1
answer
219
views
Are there advisories on how actually to use a password safe?
I sense an overall push towards password safes (cloud/local).
Now that people tend to use more and more those technologies I looked for best practices or formal advisories on password safes but did ...
1
vote
1
answer
286
views
Should I keep hashed values secret? [duplicate]
Many client-server systems use hash functions for the authentication of users password.They use passwords as inputs of different hash functions like MD5,SHA-1 etc and compute hash values.Then they ...
1
vote
4
answers
334
views
Should users be allowed to login with the same password when a password change is requested but not changed?
I have noticed that some sites would not let you login with the old password if a new password is requested, but was not changed.
Example: I forgot my password and requested a new one in the email. ...
1
vote
1
answer
156
views
Secure symmetric encryption of passwords to allow admins to log in as users
I am trying to work out the best way to secure user credentials for the login of the service i am working on.
The safest way would be to use hashing and salting however this project requires the ...
24
votes
4
answers
11k
views
Is it secure to store a two factor authentication seed in a password manager?
I wonder whether it is really secure to store the Two Factor Authentication seed code (e.g. the secret key for TOTP) within a password manager together with the user and password for the service.
If ...
5
votes
2
answers
987
views
Hashed passwords storage: iterations vs entropy [duplicate]
Context: A website is hosted on multiple dedicated servers. There are frontend webservers, backend DB servers and other servers between them.
The DB holds user's accounts passwords. All connections ...
1
vote
1
answer
413
views
encrypted information that is not accessible to database administrators
I work with asp.net core 1 and I will introduce an encrypted storage of user data. These data must not be accessible to the database administrator but only for users with a passphrase.
I thought of ...
10
votes
2
answers
4k
views
Is the macOS Universal Clipboard secure?
Since the introduction of Universal Clipboard on Apple's operating systems, I've found myself increasingly relying on it to paste passwords and authentication codes from my MacBook to my iPhone and ...
1
vote
2
answers
506
views
Is using password_verify($password, "") to block access to an account secure?
We are migrating an old website, which used pretty old password hashing to the new php password verify function. The old method used an old hash, and we would like to use password_verify instead of ...
19
votes
7
answers
12k
views
Encrypting text file with AES 256 instead of password manager
I'm starting to have a big list of passwords I need safely stored. I was looking at password managers like LastPass, but these always seem to be targetted by hackers and have been compromised before.
...
2
votes
1
answer
686
views
What are the security risks of resetting your password every time you login?
Is it a good idea in terms of security to reset your password every time you login and just fill your password with a bunch of random symbols, letters and words that you don't memorise?
Since ...
8
votes
0
answers
3k
views
bitwarden as alternative to LastPass? [closed]
I stumbled over bitwarden, a service that promises to provide a service like LastPass (all data encrypted on your device, but additionally stored on a central server for easy access).
I am not ...
0
votes
3
answers
290
views
How do I implement Multikey encryption? [closed]
I'm looking for an algorithm, by which I can encrypt a piece of data with n keys and that to decrypt I can use any of them.
I think I remember bitcoin using something similar for blocks, but now I ...
1
vote
1
answer
230
views
Should Lockout Terminate The Session?
I think it is OK not to terminate existing sessions if user is locked out due to a number of login attempts with the wrong password. Because it might be an attack and it would be inconvenient to ...
3
votes
3
answers
14k
views
Passwords in memory, practical ways to improve security
Storing a password in an application's memory is risky. The OS may write a portion of memory to disk as a swap file. Processes may access each others' memory, even though they shouldn't. (More)
I'm ...
0
votes
1
answer
2k
views
Is it safe to store passwords in a Browser? [closed]
We are used to store passwords in Browsers for online login accounts. Where and how those passwords are saved and I hope it is encrypted ?
Normally, the browser prompts for credentials (local) when ...
1
vote
1
answer
148
views
Managing security of a desktop/mobile app
I'm working on an app that stores sensitive data (think of it as a password locker) for the UWP (Universal Windows Platform).
The most important requirement is the ability to roam the data between ...
2
votes
1
answer
4k
views
Securely store password for Java Keystore
Background
I am implementing set of Micro services using Java spring MVC and hosted in Undertow containers using Gradle. I am using a Java keystore to secure my keys which are using by the service to ...
2
votes
6
answers
1k
views
Password reset - Cryptographically signed user ID and timestamp or randomly generated value?
What are the pros and cons of the different ways of handling reset links?
I see two ways of handling them:
Generate a random string, for example with uuid4. Store it in the database with the user and ...
3
votes
1
answer
200
views
Is it safe to call mount(2) and pass the password as a parameter?
I wanted to write a daemon that users can start, and that, every 2 hours, automatically mounts an authenticated network share. The daemon will prompt the user for the password only the first time, and ...
5
votes
1
answer
2k
views
Is there a best practice for storing passwords in a two way encryption?
I have a .NET system with users logging in normally and standard hashing and/or 3rd party login (google, fb etc). I have a 3rd party plugin that requires username/login for each user in addition to ...
2
votes
2
answers
3k
views
Google login 2 factor authentication sms -fake or real?
All my 2 factor authentication used to come from Google sms, but recently I've had the following numbers come up on my phone. I realise that to do this the person would need to have my phone number. I ...
2
votes
1
answer
2k
views
Is there an easy way to generate all variations around a password?
I did something quite stupid while renewing my Keepass master password: a typo.
I quickly checked what I did type before validating but I obviously overlooked something because it simply doesn't work ...
1
vote
1
answer
327
views
Are Portable Password Managers secure?
I have been using KeePass2 for a while now and I think it is a very good password manager. There also is a portable version and I often read recommendations for KeePass where the portable version is ...
0
votes
1
answer
1k
views
Is there Algorithm determining weakness of PIN-code?
There are several algorithms that can tell us if our password is strong enough analyzing its length, considering if it uses upper and lowercases, special symbols and digits, considering if it is not a ...
1
vote
2
answers
480
views
What is the Best Method to Store SQL Host, Username and Password for Multiple Databases?
I have a large project which has multiple web servers (one for each client), one application (for all clients), and multiple SQL databases (one for each client) as pictured below.
.
For security ...
12
votes
3
answers
3k
views
Storing password along with encrypted file
I was making a small application to encrypt files and ran into the problem of verifying that the provided key is the correct one when decrypting. My idea was to store the (padded, encrypted) key along ...
2
votes
1
answer
97
views
Storing of customer creds from third party server with reading access to it
Our service will provide some automation over another service. Customers share the password with us, and our staff make the customer's work. Another work will going on our working agents(remote server)...
1
vote
1
answer
126
views
The difference between Management and Configuration Policies
I am trying to find out the difference between management and configuration policies. Kindly, can someone elaborate that or showing an example so that I can understand each case.
2
votes
2
answers
278
views
Does setting a Firefox master password make sense given that full disk encryption is used?
I wonder if having a master password will make my login data saved in Firefox more secure given the fact that I use full disk encryption. The password database won't be exposed in plain text ...
2
votes
2
answers
542
views
Way to hash passwords client-side without javascript?
I'm working on implementing a basic login system (I know, don't roll your own security, blah blah blah) using PHP and MySQL. However, I don't want the user to need to have JavaScript enabled, meaning ...
4
votes
3
answers
2k
views
Is it a bad idea to use base-64 encoded strings for passwords?
First off, forgive me if this seems like an extremely naive and un-educated question. Any ways, so as above, is it a bad idea? I mean, thinking about it, it doesn't seem like a bad idea. My logic is ...
1
vote
2
answers
202
views
Security of a password container in the cloud
I currently use Keypass to manage my passwords and I sync the container between my desktop and my smartphone via USB.
My wife has an older tablet that I cannot sync via USB because I cannot mount it ...
4
votes
1
answer
334
views
Does predictable input (like bcrypt headers) threaten password-based encryption?
I am making a system for storing hashed version of some secrets. I have read through dropbox's blog about how they store their passwords, and have taken inspiration from what they are doing.
Dropbox, ...
2
votes
1
answer
394
views
Is it dangerous to program a user-called deamon that sends passwords via https?
I have this problem:
My console app needs to connect to a server. However, the server requires passwords in plain text per HTTP POST for login. The connection is HTTPS.
The app is only called now and ...
-1
votes
1
answer
982
views
Why are some big companies using MD5 as hashing algorithm for their passwords? [closed]
I have seen many companies that are using MD5 to hash their passwords, and it seems like most of them don't want to change algorithm. My question is why are they still using it?
Many say that MD5 ...
0
votes
1
answer
154
views
Is there a way to make linux pass ls require decryption?
So pass, the standard unix password manager is great and I've started to use it to encrypt my passwords. But there is one thing that bugs me. When you run pass ls it shows you all your identities. I ...
3
votes
3
answers
2k
views
Password Manager or Password Generator [duplicate]
If you use the same email and password for every site, one breach and all your accounts are hacked. This is why I like to create a unique password for every site.
This causes a problem since the ...
55
votes
3
answers
11k
views
Secret salts; why do they slow down attacker more than they do me?
When studying Dan Boneh's slides for 'Session Management and
User Authentication' (2011) he mentions 'secret salts' on the slide 'Further defences' (slide 48 out of 58).
He suggest to store in the ...
1
vote
4
answers
255
views
Authentication even with incomplete password
When one enters a password to access one's online account, one has to type out the complete password, and submit it to be authenticated. If the password is very long, and if the account is accessed ...
5
votes
2
answers
1k
views
How to make Automated API calls which are at least minimally secure? [duplicate]
How do I go about writing scripts (for automation) in Powershell (and possibly even Python) that help me access APIs while keeping the credentialing information either secure IN the script and/or ...
24
votes
6
answers
5k
views
Does Rehashing a weak hash with a strong algorithm make it strong?
Imagine the following situation. We're making a web application which should be really safe
Now the accounts/users are not directly added by us but they receive a letter with a logincode. We get a ...
2
votes
1
answer
478
views
Why is it bad to use your browser's password manager? [duplicate]
I keep hearing various security-minded people saying that using your browser's password manager is a bad idea because it's not safe. How true is this?
I know that Safari uses the system keychain to ...
12
votes
2
answers
4k
views
Is it safe to expose bcrypt password hashes?
I'm building a web app that needs to support user-switching offline and am wondering if it is safe to expose bcrypt hashes to authenticate users.
The basic flow:
Primary users logs in while web app ...
1
vote
4
answers
353
views
How to securely store information without a key or password?
For a hypothetical situation, imagine a program that saves its user's password, then automatically signs them in without prompting them for their password again. The password must be secured somehow, ...
0
votes
1
answer
883
views
Email notification on accounts lockout
I am debating the merits of a feature being requested for our web application.
The request is asking for an email to be issued to a user when an account is locked. Accounts are
locked after 5 failed ...
3
votes
2
answers
567
views
Is there a way to check whether the application saves password in clear text or in hashed format? [duplicate]
I have four kind of passwords and I use them according to the importance of the web application. So if I see an application not using SSL and I have to make an account, I will use a basic password ...