Tag Info

New answers tagged

0

You might want to look into Vault. Vault is an open source tool that provides centralized secret storage that can be accessed over a REST API. It has various methods of authentication (like auth tokens or certificates) and provides policies that can be used for authorization. Keep in mind that it is a good idea to take a step back and look at your ...


10

The normal mechanism for a password manager is to have some sort of "master key" and encrypt the data (symmetrically) with that key. The master key, in your case, being derived from the master password through proper password hashing (so it becomes, in this case, password-based key derivation). So use bcrypt or PBKDF2 to turn the user's master password into ...


2

What you're looking for sounds like Privileged Access Management - a central database that stores administrative and other non-user credentials and allows authorized users to "check them out" for use. Such systems often will programmatically change the credentials on the target system so as to prevent re-use outside the window for which access was granted. ...


1

See this for an introduction on password hashing. That your method ("sha1(password + md5(login))") may be guessed by the attacker is not a problem. Well, it is an indirect problem. Ideally, a "secret algorithm" would protect you even if the said secret algorithm was abysmally weak, because the attacker would still do not know the ends or tails of what you ...


0

The security in a hash function is not that the mechanism is unknown - it is that the hash function has been proven over time to be secure. For example, uniform distribution over the keyspace, and has cryptographic properties such as collision resistance, preimage resistance and second preimage resistance. For password hashing, collision resistance and ...


0

You've misunderstood the reason why you shouldn't attempt to roll your own password hashing procedure: It's not that knowing the details of the algorythm can lead to someone can understand the mechanism behind it (in fact, it is expected: see Kerechoff's principle), it's that writing good crypto is hard. As an example, the function you proposed is weak: ...


0

Are you worried that someone may break your AES/Rijndael 256-encrypted database? If your key sucks, then yeah, you should be worried. It's always good to elaborate what your fears are. If you're afraid that a government agency may have the resources to compromise your KeePass database - I wouldn't be worried about that, they have other ways to get what ...


0

AFAIK there is no such functionality. If you need such two level of password database, you should merely just use two databases. As mentioned by Neil Smithline in his comment, your second database may be on a separate partition protected by deniable encryption. However, be conscious that deniable encryption proved to be often counter-productive. Initially ...


1

Forgot about this…so here is how I done it. First off I used google academic to find papers on last pass, password managers and memory forensics. It was the last one I found to be more helpful Amari, K. (2009) Techniques and Tools for Recovering and Analysing Data from Volatile Memory. After gaining an understanding memory extracting and analysis I ...


0

From a security point of view, this should be fine provided the page protects against user enumeration and password guessing. It should validate the old user ID and password combination as a whole, and not specifically inform the user if the user ID does not exist - it should just output a generic error message: Your current user ID and password ...


1

Look at SQRL for a system that replaces a "password manager" with somethings that works without needing a central DB and can defeat the keyloggers as well. The web servers that you visit will not require secret state about you (like a password) with this system. The id that is provided to each website is unique for each website, so an id token from one site ...


0

I think there are pro/cons for both approaches. Remember that generally you need to think about a layered approach. First off, is this more useable, is it confusing the user, etc. More fields at one time may lead to more use confusion, typo frustration, etc. Perhaps the user gets frustrated and that results in them using a less complex password ...


7

In short, this method provides no additional security over a regular password manager, and makes it impossible to change your password for a single, specific service. For instance, you mentioned the example of malware using a keylogger to get your master password and then compromising all the passwords in your password file. Your proposed scheme provides no ...


4

Couple points about the question, too long for a comment, some stuff has already been mentioned separately: has been done lots of times, there are tools available from one leaked password the other passwords could in theory be compromised if someone guesses how and what you are hashing to get the passwords and then uses brute-force. Still much better than ...


0

In general, no. There are no significant additional security risks associated with this approach. Any attacker who can successfully change the user's password using a form like this could just as easily log in to the user's account and then change their password. Either way, the same information (username, current password, new password) is required. ...


5

What you're thinking of has been done quite a few times already. Here's an example: http://plevyak.com/dpg.html It's called a Deterministic Password Generator, meaning it creates passwords based on other information that you enter. Just like you said, using your master password, some other information, and the name of the site.


15

One problem with this kind of solution where a predictable algorithm is used to generate a secret from a master password/phrase, is that if your master password is compromised directly (e.g. keylogger) or indirectly (e.g. an attacker with a password of yours generated through this system who can carry out a brute-force attack on it), the attacker has ...


1

Normally the user needs to authenticate first in order to see the password change form. By entering the user name and password, the system should first authenticate the user and once authentication is successful, the password should be changed. This is something that can't be verified using the example URL you gave. However, in this case I would ...


0

One of possible risks is that such form doesn't require cookies or session support to login using stolen password and immediately change it. From the perspective of rogue software authors, there are many possible languages and frameworks, that can be used to create their software. Each of these require some knowledge to start. Eg. creating a bot that is ...


0

The question can't be answered by anyone other than google. You may want to ask them but I doubt they will give you a response. The only thing we can know for sure is that the passwords are not hashed because if they were then google would not be able to impersonate you to the mail server. So google is storing the passwords unhashed they may be stored as ...


4

The details of how Google implemented this functionality is unknown and proprietary to google so it isn't possible to answer your question completely. However, here are the high points: Google will have to save your POP3 account password in their system. There is no way around this because POP3 has no is no standard way to delegate rights to a third-party ...


-6

The password should be transmitted in plain text, otherwise Google can't send requests to the third party mail server as this mail server expects the password to be in plain text. Is this safe? No, it is not! Please note: Using POP3 to fetch your e-mail is also not considered secure as there is no transport layer protection. It is recommended to only ...



Top 50 recent answers are included