Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [credentials]

Credentials in security context are elements that prove your identity to a system, for example a username and password or a client-side certificate. It is usually used to describe elements supplied by the authenticating client, not when the server authenticates to the client or in mutual authentication schemes.

1
vote
0answers
19 views

git credential cache and store

I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
0
votes
0answers
29 views

How to properly store OAuth 2.0 client_id and client_secret in a web application?

In the PoC (Proof of Concept) that I'm currently developing, data from an API is consumed and OAuth 2.0 is required for authentication. The application is already working as expected, the users are ...
0
votes
1answer
59 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
1
vote
2answers
138 views

Getting access and logging into employee's laptop - Can IT get access without the employee's own credentials?

If an employee's laptop is taken back from him/her for purposes of investigation, can the IT department/team that is in charge of issuing laptops etc. log into the employee's network account on this ...
0
votes
2answers
62 views

How to write down user credentials? [closed]

Sometimes we cannot avoid to write down usernames and passwords internally in our organisation. This is mainly for personal usage, not for reading by programs. There are several ways to do this, e.g. ...
0
votes
1answer
40 views

Windows Credential Guard protects credentials but not the remote access with the same credentials?

I wonder what is the real purpose of having credentials protected by Windows Credential Guard (WCG) when it is possible for malicious admin to obtain cached credentials (i.e. the ones not protected by ...
4
votes
1answer
114 views

Why is Windows Credential Guard secure, when Windows is able to “access” credentials using RPC?

I've read some blogs that describe Windows Credential Guard: how it works and which security benefits it provides. However, some of them mention that Windows can "access" credentials using RPC calls ...
0
votes
0answers
24 views

How to protect encryption keys against accidentally installed malicious code?

I'm using AWS KMS to encrypt my database credentials for my Node server code. This means, however, that I have my AWS KMS profile credentials in plaintext in my server's environment variables. In ...
1
vote
3answers
74 views

Why allow a public API Key to change?

A common method of credentialing for an API is to give each use a public/private key pair. The public key is sent in with the request, and the private key is used to sign the request (and is verified ...
3
votes
3answers
216 views

Bank sends one-time password by e-mail (while sending on SMS) for transaction verification; is this insecure?

Most of the banks uses OTP (One Time Password) to enrich the authentication through dual factor. But I observed Banks are sending the OTP to mobile as well as email. I suppose sharing passwords on ...
1
vote
2answers
64 views

Is my personal data at risk with global digital giant's services?

The global digital giant's services like facebook/gmail/twitter/etc are not following standard password policies (like the standard password policies used by most of the Enterprises/Corporate). For ...
0
votes
1answer
28 views

Will evolving bio metric capabilities on mobiles replaces online transaction verification through SMS (OTP)?

We are working on an online eCommerce site and we need to have online transactions. The common mechanism of verifying the online transaction seems the OTP (one Time Passwords) over SMS. But this ...
3
votes
2answers
98 views

RDP violation without credentials

On a Windows Server 2003 machine seems like someone has logged in through RDP without using credentials: there is a logged access, but there are nor userid nor password. I am wondering how is this ...
3
votes
0answers
34 views

Firefox not deleting login data although being instructed to do so (possible security problem)

On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters....
-1
votes
1answer
111 views

Auto-Fill Windows Security Credentials

I am having a network issue that every time in a while it requires me to enter my windows credentials (it is company security thing) If I don't do that I will have no internet connection on my laptop ...
117
votes
8answers
19k views

Why is storing passwords in version control a bad idea?

My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?" I gave him an answer that ...
0
votes
0answers
35 views

How to safely store OAuth2 credentials in a Desktop application

I've been searching for a good answer to this problem for a while now, and have seen questions that could be duplicates, but none of them seem to have good/definitive answers that work for my case. I ...
0
votes
1answer
193 views

Why would a password reset method be like this? Is it especially safe?

The library of the Technical University in my city (Europe) has a password reset system which I did not encounter anywhere else. Students have to go to some office inside the university to get a new ...
7
votes
3answers
690 views

Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?

Recently, eslint-scope and eslint-config-eslint packages were hacked in an interesting way - one of the maintainer's account was compromised by an attacker and a new "patch" version with the malicious ...
1
vote
0answers
290 views

Should I hash my refresh tokens before storing them in the server's database? [duplicate]

I have a service with a client app (Mac). To log in, users enter their username and password in the client app, which sends this information to the server. The server verifies this information using ...
1
vote
1answer
79 views

Dealing with shared credentials when an employee leaves

We have around 20+ accounts of different services (company email inboxes, forums, social media, Github, etc.) we use in my team. For security reasons, whenever some employee leaves us, I need to ...
148
votes
12answers
21k views

Do I need to encrypt connections inside a corporate network?

Provided that I have a decent level of physical security in the office, I monitor the physical addresses of devices connected to the network and only give VPN access to trusted parties, do I need to ...
5
votes
3answers
1k views

How to protect our server from brute force attack? [closed]

One of the most common cyber attack is Bruteforce , what are the mechanisms available to protect this attack and how industry apply these mechanisms to mitigate the attacks (best practices)?
0
votes
1answer
31 views

E-Mail Web Client: How to handle credentials

I am thinking about building an e-mail web client that I can run on my server as a side project. The server addresses should be configured on the server side. Multiple Accounts should be able to ...
3
votes
2answers
129 views

How should large organisations manage credentials?

How should large companies store credentials for important systems, such as root access to an integral machine (e.g. high-traffic web server), or social media accounts?
-2
votes
1answer
524 views

Storing SSH credentials, need to decrypt them later for connection by python script

I am developing an application where one can add SSH credentials for servers and then an automated python script can fetch those credentials to login to the server and perform certain automated tasks. ...
1
vote
1answer
660 views

Using Windows LSA Hashes obtained from crackmapexec

I have obtained some hashes using crackmapexec and dumping from the LSA process. The hashes are in this form (data below is fake): adm_name:c6f132a235209036744ba5d303bd5d9b:SOME.ORGANISATION.COM:...
10
votes
2answers
2k views

How to handle emails as usernames under GDPR?

Using emails as usernames for webapps is a convenient way to avoid the "yet another online username" problem. As such, by using this approach, the emails should be easily available in the backend to ...
1
vote
0answers
210 views

How can I safely use Get-Credential to obtain a username and password for a set period of time for use as command line arguments?

Credentials in the form of SSH keys can be stored in memory using SSH Agent; However, if clicking the wrong link, or running a malicious program they can also be snatched from memory amd sent ...
1
vote
3answers
94 views

Managing db credentials for web applications

Is there an alternative to properties files for managing DB (and other service) connection credentials for a group of web applications? Couldn't you use something similar to a service registry? For ...
4
votes
4answers
272 views

How do large organisations manage access for their Instagram account?

A platform like Facebook has fairly standard access management for Facebook pages - where multiple individual user accounts can be assigned to roles with varying privileges on the Facebook page, and ...
3
votes
1answer
425 views

MsChapV2 authentication and Evil Twin attack

I'm trying to understand the dynamics of the authentication process in the MS-CHAPV2 protocol. In particular, if I implement an Evil Twin attack I can't understand how it's possible that I can ...
3
votes
2answers
815 views

Is SOCKS5 credentials are safe during authentication on proxy server

I've read several tutorials, but not totally sure. If I'll set up my own SOCKS5 proxy server on VPS, configure it to use username and password. Will this credentials be safe while authentication on ...
5
votes
0answers
218 views

Ruby Devise salt exposed

The remember_user_token cookie token generated by the Ruby Devise authentication component reveals part of a bcrypt salted credential when decoded. For example: remember_user_token=...
0
votes
0answers
36 views

Reaction to bulk stolen credentials checks on my site

There are huge lists of email-password pairs available for download on the web. Is there anything reasonable I can do when I notice an attempt to walk over such list on my website? Just to be clear, ...
2
votes
1answer
121 views

How does a “fake” network-adapter steal credentials?

I've read that devices that look like USB flash drives can be hidden network cards that can then steal credentials even when the screen is locked. (Like the Bash Bunny) I understand that being the ...
3
votes
1answer
189 views

How can I know that whoever called me is my cellphone service provider?

I just refused to give my credentials to a phone call operator who called me. and I wonder whether I did the right thing. Background. My cellphone operator (call them Alpha) uses a simple ...
0
votes
0answers
33 views

Separating and securing credentials & keys from app code in NodeJs

What are recommended approaches to separating out private credentials and keys from application code files to a separate utility. Threat Model: We do not want to allow any network operator to let ...
1
vote
1answer
412 views

Is it secure to store encryption key (encrypted with master key) with the data it was used to encrypt?

I am working on a password sharing web site. I would like users to be able to enter their credentials and share them with other users. I am thinking about using KMS service to store master key (just ...
0
votes
0answers
99 views

Best practices for automated service authentication with Vault

I'm new to Vault and its patterns but think they're great, having to manually unseal a Vault instance gives some great security. However it seems like those benefits are somewhat reduced by a weak ...
2
votes
2answers
145 views

Sending Credentials On Each Request

I am going to be using a Symfony SMB Bundle like this to browse a Windows File System through PHP. To do this - I'll create a Web API that will return a list of files and directories in a directory ...
0
votes
0answers
130 views

Apple asked for password to recover data during repair, I said no

My girlfriend's Macbook Air gave off a loud, electrical pop! and instantly became an expensive metallic paperweight with a slight odour of burnt things (though that may have been High Sierra). Apple ...
112
votes
13answers
21k views

Is it good or bad practice to allow a user to change their username?

I have looked all over online as well as this site to try to find out more information regarding the security of this, but haven't found anything. In my particular case, the product is a website, but ...
5
votes
4answers
415 views

Is it a bad idea to ask for user e-mail and e-mail password?

I work as a tester at a company that makes network security appliances, I am having some discussions with a developer about a feature. The feature is that the notification e-mails sent to the user by ...
0
votes
1answer
127 views

Should I expose AWS Credentials on github?

Before you screen "No, never!", please read on :) Question: Is hard-coding IAM creds with extremely restricted permissions (only GET requests to s3) ok? I realize that there are other ways, but they ...
3
votes
0answers
88 views

Credential leaking while unconscious [closed]

Bear with me here, because this admittedly sounds nutty, but I had a dream last night in which I distinctly recall (accurately) typing the master password for my password manager into a (dream) ...
1
vote
1answer
139 views

How to handle sensitive data like API-keys and DB passwords on production

I'm setting up a development and production environment for a web application. It uses some remote APIs for which you need a key to access them. You don't want those in your code, as well as the ...
1
vote
1answer
86 views

Sharing credentials based on the network profile

Is there a way to share logins/passwords with a number of individuals, basing on their public network profile? Example: a number of people working together in the office should have access ...
3
votes
1answer
206 views

Storing database credentials for multi server, multi db environment

What's the best practice for storing database credentials for an auto scaling environment, yet also requiring the ability to update database information? For instance I have an auto-scaling site on ...
8
votes
2answers
318 views

How to separate storing sensitive data and hash passwords?

Scenario: I have a web application with an authentication system (classic). The application is basically an interface to a DB (MongoDB) which holds sensitive data. I properly hash the stored passwords....