Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [credential-reuse]

Credential reuse is the practice of users to reuse the same credentials (e.g. password) for multiple systems.

Filter by
Sorted by
Tagged with
0 votes
2 answers

How does it "allow a malicious website to obtain valid credentials." - WebAuthn

I'm not entirely convinced of the importance of verifying the authenticator attestation, and I've asked a question about it, I'm open to it, and if you want, you can post an answer at that question, ...
DannyNiu's user avatar
  • 374
0 votes
3 answers

AES mode for reusing same keyset

I'm building a sharing protocol where users share data. To make it so only those authorised to read the data can do it, I'm using AES256 encryption. Every authorized person has a keyset (IV & key) ...
Valmond's user avatar
  • 123
0 votes
2 answers

How to reuse PIN codes in the most secure way?

I've made a list of the services/devices that require a PIN code. Shockingly, it's over 10, which I find impossible to remember, so I need a strategy to reuse the codes. What could be a strategy for ...
Gamutmapper's user avatar
1 vote
1 answer

Does a password-derived public key authentication improve security over pure password-based authentication?

Despite best efforts it is pretty clear that most users reuse their credentials, especially for what they consider non-critical sites such as forums. While TFA does mitigate the potential damage of ...
Tobias Kienzler's user avatar
0 votes
2 answers

Password reuse for similar accounts

Assume I have two Github accounts, one for regular use and one for testing purposes. Or two PGP keys, one for pass and the other for encrypted email communication, and my backup scheme is exactly the ...
e18r's user avatar
  • 153
42 votes
4 answers

What are the differences between credential stuffing and password spraying?

Wikipedia describes credential stuffing as a type of cyberattack where stolen account credentials typically consisting of lists of usernames and/or email addresses and the corresponding ...
Motivated's user avatar
  • 1,513
28 votes
12 answers

Reusing passwords that can possibly never be cracked

Reusing passwords pose as a terrible risk for users because in the event of a data breach, with the passwords not being stored securely enough, this means that, by default, all other services that ...
user avatar
3 votes
1 answer

Can I use HashiCorp Vault to restrict access to credentials based on CIDR ranges?

This seems like a pretty simple use case, but it would depend on some pretty recently added functionality which I might not understand yet: A python script gets populated by configuration management ...
Nathan Basanese's user avatar
1 vote
0 answers

How to cache auth credentials to speed up authentication

I'm developing some REST API that requires a HTTP basic auth to access. The APIs are written in Django, and the auth is based on Django auth middleware that is: it checks against the DB, the username ...
EsseTi's user avatar
  • 703
1 vote
0 answers

Storing password or access token in standalone Java app

I have a simple Java app that use Eclipse JGit to pull remote repositories into the app to analyze and provide the user with code metric details on their projects. This app is supposed to be able to ...
Edward McNealy's user avatar
1 vote
2 answers

Should users be allowed to reuse/recyle the same login credentials across a network for different systems?

Should users be allowed to reuse/recycle the same login credentials across a network for different systems? Should this be disallowed/discouraged, or are the security implications minimal? If it's ...
user389823's user avatar