Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [credentials]

Credentials in security context are elements that prove your identity to a system, for example a username and password or a client-side certificate. It is usually used to describe elements supplied by the authenticating client, not when the server authenticates to the client or in mutual authentication schemes.

0
votes
0answers
13 views

Device security in IOT

I am working on an IOT device that sends data to the server after authenticating itself to the server. Is there a way to safely store my device's credentials for logging onto the main server and ...
0
votes
0answers
22 views

Remote access to Windows Workstation with credentials, after Windows 10 - 1809

I am a newbie in terms of OS security and I started learning from Windows; in particular I downloaded Win10 virtual machine and I am simulating various attack / defense scenarios on it. I would like ...
0
votes
2answers
52 views

How to secure an application deployed in some port [closed]

I was wondering, If there is a (private) application or service deployed at example.com:5000, how can someone prevent undesired requests to that port ? I was thinking about a solution were the ...
2
votes
0answers
64 views

Storing credentials in cookies? [closed]

Is there any use case where you would store hashed credentials in a cookie? EDIT I was discussing this problem with a colleague if it's advisable to do this. Since then, I found an example where a ...
0
votes
3answers
93 views

Shared terminal security hole

I want to ask you about what I think is a pretty obvious security hole and what can be done about it. Suppose my library has a room containing network-connected workstations serving Linux. You log on ...
1
vote
0answers
21 views

git credential cache and store

I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
0
votes
0answers
57 views

How to properly store OAuth 2.0 client_id and client_secret in a web application?

In the PoC (Proof of Concept) that I'm currently developing, data from an API is consumed and OAuth 2.0 is required for authentication. The application is already working as expected, the users are ...
0
votes
1answer
64 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
1
vote
2answers
138 views

Getting access and logging into employee's laptop - Can IT get access without the employee's own credentials?

If an employee's laptop is taken back from him/her for purposes of investigation, can the IT department/team that is in charge of issuing laptops etc. log into the employee's network account on this ...
0
votes
2answers
66 views

How to write down user credentials? [closed]

Sometimes we cannot avoid to write down usernames and passwords internally in our organisation. This is mainly for personal usage, not for reading by programs. There are several ways to do this, e.g. ...
0
votes
1answer
68 views

Windows Credential Guard protects credentials but not the remote access with the same credentials?

I wonder what is the real purpose of having credentials protected by Windows Credential Guard (WCG) when it is possible for malicious admin to obtain cached credentials (i.e. the ones not protected by ...
4
votes
1answer
166 views

Why is Windows Credential Guard secure, when Windows is able to “access” credentials using RPC?

I've read some blogs that describe Windows Credential Guard: how it works and which security benefits it provides. However, some of them mention that Windows can "access" credentials using RPC calls ...
1
vote
3answers
79 views

Why allow a public API Key to change?

A common method of credentialing for an API is to give each use a public/private key pair. The public key is sent in with the request, and the private key is used to sign the request (and is verified ...
3
votes
3answers
346 views

Bank sends one-time password by e-mail (while sending on SMS) for transaction verification; is this insecure?

Most of the banks uses OTP (One Time Password) to enrich the authentication through dual factor. But I observed Banks are sending the OTP to mobile as well as email. I suppose sharing passwords on ...
1
vote
2answers
64 views

Is my personal data at risk with global digital giant's services?

The global digital giant's services like facebook/gmail/twitter/etc are not following standard password policies (like the standard password policies used by most of the Enterprises/Corporate). For ...
0
votes
1answer
29 views

Will evolving bio metric capabilities on mobiles replaces online transaction verification through SMS (OTP)?

We are working on an online eCommerce site and we need to have online transactions. The common mechanism of verifying the online transaction seems the OTP (one Time Passwords) over SMS. But this ...
3
votes
2answers
106 views

RDP violation without credentials

On a Windows Server 2003 machine seems like someone has logged in through RDP without using credentials: there is a logged access, but there are nor userid nor password. I am wondering how is this ...
3
votes
0answers
36 views

Firefox not deleting login data although being instructed to do so (possible security problem)

On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters....
-1
votes
1answer
149 views

Auto-Fill Windows Security Credentials

I am having a network issue that every time in a while it requires me to enter my windows credentials (it is company security thing) If I don't do that I will have no internet connection on my laptop ...
117
votes
8answers
19k views

Why is storing passwords in version control a bad idea?

My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?" I gave him an answer that ...
0
votes
1answer
196 views

Why would a password reset method be like this? Is it especially safe?

The library of the Technical University in my city (Europe) has a password reset system which I did not encounter anywhere else. Students have to go to some office inside the university to get a new ...
7
votes
3answers
726 views

Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?

Recently, eslint-scope and eslint-config-eslint packages were hacked in an interesting way - one of the maintainer's account was compromised by an attacker and a new "patch" version with the malicious ...
1
vote
0answers
473 views

Should I hash my refresh tokens before storing them in the server's database? [duplicate]

I have a service with a client app (Mac). To log in, users enter their username and password in the client app, which sends this information to the server. The server verifies this information using ...
1
vote
1answer
119 views

Dealing with shared credentials when an employee leaves

We have around 20+ accounts of different services (company email inboxes, forums, social media, Github, etc.) we use in my team. For security reasons, whenever some employee leaves us, I need to ...
148
votes
12answers
22k views

Do I need to encrypt connections inside a corporate network?

Provided that I have a decent level of physical security in the office, I monitor the physical addresses of devices connected to the network and only give VPN access to trusted parties, do I need to ...
5
votes
3answers
2k views

How to protect our server from brute force attack? [closed]

One of the most common cyber attack is Bruteforce , what are the mechanisms available to protect this attack and how industry apply these mechanisms to mitigate the attacks (best practices)?
0
votes
1answer
32 views

E-Mail Web Client: How to handle credentials

I am thinking about building an e-mail web client that I can run on my server as a side project. The server addresses should be configured on the server side. Multiple Accounts should be able to ...
3
votes
2answers
134 views

How should large organisations manage credentials?

How should large companies store credentials for important systems, such as root access to an integral machine (e.g. high-traffic web server), or social media accounts?
-2
votes
1answer
681 views

Storing SSH credentials, need to decrypt them later for connection by python script

I am developing an application where one can add SSH credentials for servers and then an automated python script can fetch those credentials to login to the server and perform certain automated tasks. ...
1
vote
1answer
880 views

Using Windows LSA Hashes obtained from crackmapexec

I have obtained some hashes using crackmapexec and dumping from the LSA process. The hashes are in this form (data below is fake): adm_name:c6f132a235209036744ba5d303bd5d9b:SOME.ORGANISATION.COM:...
11
votes
3answers
3k views

How to handle emails as usernames under GDPR?

Using emails as usernames for webapps is a convenient way to avoid the "yet another online username" problem. As such, by using this approach, the emails should be easily available in the backend to ...
1
vote
0answers
239 views

How can I safely use Get-Credential to obtain a username and password for a set period of time for use as command line arguments?

Credentials in the form of SSH keys can be stored in memory using SSH Agent; However, if clicking the wrong link, or running a malicious program they can also be snatched from memory amd sent ...
1
vote
3answers
117 views

Managing db credentials for web applications

Is there an alternative to properties files for managing DB (and other service) connection credentials for a group of web applications? Couldn't you use something similar to a service registry? For ...
4
votes
4answers
319 views

How do large organisations manage access for their Instagram account?

A platform like Facebook has fairly standard access management for Facebook pages - where multiple individual user accounts can be assigned to roles with varying privileges on the Facebook page, and ...
3
votes
1answer
567 views

MsChapV2 authentication and Evil Twin attack

I'm trying to understand the dynamics of the authentication process in the MS-CHAPV2 protocol. In particular, if I implement an Evil Twin attack I can't understand how it's possible that I can ...
3
votes
2answers
1k views

Is SOCKS5 credentials are safe during authentication on proxy server

I've read several tutorials, but not totally sure. If I'll set up my own SOCKS5 proxy server on VPS, configure it to use username and password. Will this credentials be safe while authentication on ...
5
votes
0answers
256 views

Ruby Devise salt exposed

The remember_user_token cookie token generated by the Ruby Devise authentication component reveals part of a bcrypt salted credential when decoded. For example: remember_user_token=...
0
votes
0answers
37 views

Reaction to bulk stolen credentials checks on my site

There are huge lists of email-password pairs available for download on the web. Is there anything reasonable I can do when I notice an attempt to walk over such list on my website? Just to be clear, ...
2
votes
1answer
129 views

How does a “fake” network-adapter steal credentials?

I've read that devices that look like USB flash drives can be hidden network cards that can then steal credentials even when the screen is locked. (Like the Bash Bunny) I understand that being the ...
3
votes
1answer
191 views

How can I know that whoever called me is my cellphone service provider?

I just refused to give my credentials to a phone call operator who called me. and I wonder whether I did the right thing. Background. My cellphone operator (call them Alpha) uses a simple ...
1
vote
1answer
459 views

Is it secure to store encryption key (encrypted with master key) with the data it was used to encrypt?

I am working on a password sharing web site. I would like users to be able to enter their credentials and share them with other users. I am thinking about using KMS service to store master key (just ...
2
votes
2answers
150 views

Sending Credentials On Each Request

I am going to be using a Symfony SMB Bundle like this to browse a Windows File System through PHP. To do this - I'll create a Web API that will return a list of files and directories in a directory ...
0
votes
0answers
132 views

Apple asked for password to recover data during repair, I said no

My girlfriend's Macbook Air gave off a loud, electrical pop! and instantly became an expensive metallic paperweight with a slight odour of burnt things (though that may have been High Sierra). Apple ...
112
votes
13answers
21k views

Is it good or bad practice to allow a user to change their username?

I have looked all over online as well as this site to try to find out more information regarding the security of this, but haven't found anything. In my particular case, the product is a website, but ...
5
votes
4answers
417 views

Is it a bad idea to ask for user e-mail and e-mail password?

I work as a tester at a company that makes network security appliances, I am having some discussions with a developer about a feature. The feature is that the notification e-mails sent to the user by ...
0
votes
1answer
130 views

Should I expose AWS Credentials on github?

Before you screen "No, never!", please read on :) Question: Is hard-coding IAM creds with extremely restricted permissions (only GET requests to s3) ok? I realize that there are other ways, but they ...
3
votes
0answers
88 views

Credential leaking while unconscious [closed]

Bear with me here, because this admittedly sounds nutty, but I had a dream last night in which I distinctly recall (accurately) typing the master password for my password manager into a (dream) ...
1
vote
1answer
150 views

How to handle sensitive data like API-keys and DB passwords on production

I'm setting up a development and production environment for a web application. It uses some remote APIs for which you need a key to access them. You don't want those in your code, as well as the ...
1
vote
1answer
90 views

Sharing credentials based on the network profile

Is there a way to share logins/passwords with a number of individuals, basing on their public network profile? Example: a number of people working together in the office should have access ...
3
votes
1answer
237 views

Storing database credentials for multi server, multi db environment

What's the best practice for storing database credentials for an auto scaling environment, yet also requiring the ability to update database information? For instance I have an auto-scaling site on ...