Tag Info

New answers tagged

0

Lastpass or 1Password seem like good solutions as their online which will be easier to update than something offline like Keypass. Better for premium then you setup a token with it but I’m not sure if that would work with sharing. Offline password managers would have to be synched up between the team as you each add to it and probably eventually lead to the ...


0

KeePass works well for relatively static passwords, or for dynamic entries. See Password Vault - Enterprise for details. I have also found a really useful option (alternative?) for default shared accounts such as the local administrator. Pushing copies of your passwords to a SMB share or using SCP (with auditing for access and encryption in use) works ...


2

We are using a gnupg crypted plaintext file, which is distributed & versioned by git. Every Admin can decrypt either with a common known key (shared secret - maybe more risk in case of dismission) or each admin can decrypt with his own key (I think, the risk of secret leaking will be comparable) Git will save you in case of wrong configured ...


3

Your issue is quite common and in general referred to as Privileged Account/User/Identity Management short PAM/PUM/PIM/PxM. Keepass for sure is a solution used quite often, but from security, compliance and audit perspective not the best one. Since you are a team of five it's hard to tell if you have to comply with any policies. But if you have to, a ...


1

There are a number of providers available for this. You want to make sure that the provider you select has built in encryption options for which you can maintain the key. The below providers all support this. Crashplan BackBlaze Remember that you need configure the software to use an encryption key you have generated yourself and keep this secure and ...


0

The whole "unique and random" serves a double purpose in this imperfect world, where websites cannot be trusted to either do the right thing nor have good intentions. The website could sell the username password combos to crackers for research and incorporation into advanced dictionary attacks. Aka doing intentional harm. Provide a free game, require ...


2

I would personally disagree with the storing of plain-text passwords is ALWAYS bad, because it depends on the application or purpose of the password being stored. Generally speaking, yes, storing passwords in plain-text is a poor security choice for all of the obvious reasons. However, that doesn't mean it is a super-bad choice in all circumstances. If the ...


2

Short answer, it’s never ok to store plain-text passwords and doing so is a bad practice. From your description, there is limited risk associated with the organization supporting the app because there’s no compliance or direct monetary risks attached. That risk is passed on to the users. It’s possible for the users of this software to have their passwords ...


2

You are out of luck. There is no universally adopted standard for encryption of USB or SD cards. That means no matter which method you choose, you will have to install some software on the reading device to decrypt your data. Unfortunately most embedded devices like TVs don't allow to install any additional software on them. When your smart TV doesn't ...


1

Pretty much all mail systems have a limit on email size. You can howevr overcome it by splitting your big file in several mails. As for policy, you should read the terms of use of each provider to figure out. For instance GMail restricts (restricted?) usage of third-party applications to avoid that you use GMail as a virtual drive (there were several ...


0

The attacker do not brute force the entire search space for breaking the passwords. The attacker begins by trying the dictionary which is the collection of the most probable passwords. Let us consider 3 attacks, according to the strategy used to protect the password database. case 1: Passwords protected with Hash. For every word 'w' in the dictionary i. ...


3

This scheme is ok, but it's basically just a variant of a salted hash. These are generally considered old practice. Furthermore, this scheme is more complicated (more surface area for potential bugs) and relies upon multiple cryptographic algorithms being unbroken. Modern good practice is that passwords should be stored using a slow key derivation algorithm ...



Top 50 recent answers are included