Questions tagged [credentials]

Credentials in security context are elements that prove your identity to a system, for example a username and password or a client-side certificate. It is usually used to describe elements supplied by the authenticating client, not when the server authenticates to the client or in mutual authentication schemes.

Filter by
Sorted by
Tagged with
0
votes
1answer
96 views

How can I write a function that will log a user in an old system without knowing any username or password? [closed]

I'm studying Internet Security and I learned something about code injection in older websites (using the string ' OR 1 == 1 // as a username will log in with any password provided); but what if a ...
0
votes
1answer
61 views

Who (Designer or User) Should be Resposible for the Correct/Secure Usage of a Tool Intended for Developers/Admins? [closed]

There is a healthy debate around a series of stack overflow posts that refer to the "RunAs" command. Specifically the discussion is in reference to design decision that the folks at ...
0
votes
4answers
95 views

Does TLS hash passwords before encrypting?

Suppose I am logging into Gmail by giving my credentials. Does my plaintext get encrypted or is it first converted to the hash and the hash encrypted? And also if I am communicating to the bank web ...
4
votes
0answers
74 views

Security implications of using unfused U2F token

I noticed that both of the Feitian USB/NFC U2F Security Keys I purchased on Amazon a few years ago are unfused. This means that the pre-personalization step was partially performed but not completed ...
0
votes
0answers
36 views

Can passing credentials as parameters to CloudFormation templates via a build script be secure?

I have a CloudFormation stack that currently resolves credentials from the AWS Systems Manager parameter store. I'd like to change how it gets credentials. Now I would like to: Use the Python ...
1
vote
2answers
99 views

How do I securely store credentials and key files on my mac?

There must be a handy way to securely store, say, GCP key.json somewhere on my machine and access it whenever I'm deploying stuff. Backup to cloud is a must. The Apple's Keychain access seems ...
0
votes
2answers
223 views

Is using virtualbox for web browsing worth it for added security?

My host machine is running Windows 10. I've installed VirtualBox and use it to run an Ubuntu VM. Inside the VM I use Firefox to do all of my web browsing that doesn't involve entering sensitive data ...
0
votes
0answers
245 views

CORS issue with WebApp on Azure + AAD

I would like to get some experts' advice regarding the way I resolved the following issue: Let's say my personal app is hosted as an Azure App Service on https://example.azurewebsites.net The JS ...
3
votes
1answer
265 views

How to secure backup scripts so I do not have to hardcode passwords?

I have a secure and private aws ec2 environment but I need to do some backups of mongodb, postgresql, so I have a separate ec2 instance for doing backup and occasionally allow 80 and 443 to allow ...
0
votes
0answers
51 views

Preventing Credential Sharing

What technical methods can be implemented to force Nextcloud Pi users from sharing authentication credentials? For example, In the military, this is halted with a certificates held in a smartchip in ...
0
votes
0answers
106 views

How to change the default root password on my DIR-819 router (SSH login flaw)?

On my d-link router, a DIR-819, there is by default an open SSH port (22), which accepts a default username and password, namely root/root and admin/admin. I found this by running a network scanner ...
0
votes
2answers
74 views

Store sensitive decryptable data in database

I'm building a web application which configures and interconnects other applications through web services. In all the data I have to save for each applications, there are some that are quite ...
0
votes
0answers
24 views

Automation And Credential Security

I have a problem, that so far I can't find a complete answer on. I'm writing a script to connect to firewalls and update the configurations. Specifically Cisco ASA's. I'm using Linux CentOS 7 to do ...
1
vote
1answer
128 views

How to harden against credential stealing in EC2 via the http://169.254.169.254 API?

AWS has a feature called Instance Metadata, which on EC2 gives you access to the AWS credentials through HTTP calls: curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role> ...
0
votes
0answers
45 views

How to stop the user from intercepting their own credentials in mobile apps? [duplicate]

We are experiencing fraud with our open API, so we're turning it private. Let's suppose that I'm using OAuth and Bearer token to authorize who can access my API. Request: App -> Credentials -> Auth ...
3
votes
1answer
163 views

What can an attacker do with credentials.json [duplicate]

A few months ago I was experimenting with a project which needed to read a Google sheets page. It didn't end up going anywhere, but today I accidentally checked the project, including credentials.json ...
0
votes
2answers
67 views

Failure on correct credentials with the consecutive success?

The idea to "improve" security is as follows - the service will reply with a failure code even if supplied credentials are correct, but then on a second (third/whatever configured) attempt it will ...
1
vote
2answers
157 views

Securely provide AWS user with keys?

When creating a new user in AWS IAM, an admin sets the user's name and permissions for that user. The user's password and programmatic access keys (if programmatic access is granted) are then ...
3
votes
1answer
122 views

Android Application - Credentials in RAM

I have been pen testing an android mobile application for security vulnerabilities. As part of the test, I started Frida server on a mobile phone where the mobile application to be tested is installed,...
3
votes
1answer
117 views

Is it unsafe to enter administrative Windows credentials when logged in as a regular user?

I was recently advised that when a user is logged in as a regular user and they need an administrator to do something (i.e. install an application) that entering the administrator credentials when the ...
30
votes
6answers
5k views

The most secure way to handle someone forgetting to verify their account?

Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account. Suppose they forget to verify it, and later try to login. Should the error ...
3
votes
1answer
117 views

Technical realization of fraudulent credit card cash withdrawal

Somebody unauthorized in India managed to withdraw cash from my credit card account. The card I use (and which they claim to have used) is a German Visa prepaid card issued by Postbank. It has a chip ...
4
votes
3answers
318 views

Distribute Program with Sheets API Credentials

I am trying to write a program that uses the Google Sheets API to read spreadsheets and operate on the data. My program contains a credentials.json file which I obtained from the Java Quickstart page ...
2
votes
2answers
401 views

If I turn off Windows Defender Credential Manager off in Windows 10 so I can run a virtual machine in Virtual Box, is that a bad idea?

My processor is supposed to support virtualization: cpu.inf:5f63e534115a322c:IntelPPM_Inst.NT:10.0.17134.765:ACPI\GenuineIntel_-_Intel64 ACPI\GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_37_-_INTEL(R)_CORE(...
1
vote
0answers
113 views

Extracting passwords from Windows Credential Manager

I've read that when an encrypted zip file is opened using explorer, windows caches the passwords in the Credential Manager. Given the memory image of a machine where I've opened an encrypted zip, is ...
1
vote
1answer
96 views

what is the scope of google drive's OAuth credentials?

I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
0
votes
1answer
109 views

Online payment integration requires handling my bank credentials. Why?

When doing a payment integration what would be the reasons the payment gateway would require your bank credentials instead of redirecting the client to his or her bank website? The context of my ...
1
vote
2answers
229 views

Device security in IOT

I am working on an IOT device that sends data to the server after authenticating itself to the server. Is there a way to safely store my device's credentials for logging onto the main server and ...
1
vote
0answers
54 views

Remote access to Windows Workstation with credentials, after Windows 10 - 1809

I am a newbie in terms of OS security and I started learning from Windows; in particular I downloaded Win10 virtual machine and I am simulating various attack / defense scenarios on it. I would like ...
0
votes
2answers
58 views

How to secure an application deployed in some port [closed]

I was wondering, If there is a (private) application or service deployed at example.com:5000, how can someone prevent undesired requests to that port ? I was thinking about a solution were the ...
3
votes
0answers
142 views

Storing credentials in cookies? [closed]

Is there any use case where you would store hashed credentials in a cookie? EDIT I was discussing this problem with a colleague if it's advisable to do this. Since then, I found an example where a ...
0
votes
3answers
101 views

Shared terminal security hole

I want to ask you about what I think is a pretty obvious security hole and what can be done about it. Suppose my library has a room containing network-connected workstations serving Linux. You log on ...
1
vote
0answers
54 views

git credential cache and store

I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
0
votes
1answer
116 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
1
vote
2answers
147 views

Getting access and logging into employee's laptop - Can IT get access without the employee's own credentials?

If an employee's laptop is taken back from him/her for purposes of investigation, can the IT department/team that is in charge of issuing laptops etc. log into the employee's network account on this ...
0
votes
2answers
194 views

How to write down user credentials? [closed]

Sometimes we cannot avoid to write down usernames and passwords internally in our organisation. This is mainly for personal usage, not for reading by programs. There are several ways to do this, e.g. ...
0
votes
1answer
204 views

Windows Credential Guard protects credentials but not the remote access with the same credentials?

I wonder what is the real purpose of having credentials protected by Windows Credential Guard (WCG) when it is possible for malicious admin to obtain cached credentials (i.e. the ones not protected by ...
5
votes
1answer
496 views

Why is Windows Credential Guard secure, when Windows is able to “access” credentials using RPC?

I've read some blogs that describe Windows Credential Guard: how it works and which security benefits it provides. However, some of them mention that Windows can "access" credentials using RPC calls ...
1
vote
3answers
128 views

Why allow a public API Key to change?

A common method of credentialing for an API is to give each use a public/private key pair. The public key is sent in with the request, and the private key is used to sign the request (and is verified ...
3
votes
3answers
2k views

Bank sends one-time password by e-mail (while sending on SMS) for transaction verification; is this insecure?

Most of the banks uses OTP (One Time Password) to enrich the authentication through dual factor. But I observed Banks are sending the OTP to mobile as well as email. I suppose sharing passwords on ...
1
vote
2answers
67 views

Is my personal data at risk with global digital giant's services?

The global digital giant's services like facebook/gmail/twitter/etc are not following standard password policies (like the standard password policies used by most of the Enterprises/Corporate). For ...
0
votes
1answer
33 views

Will evolving bio metric capabilities on mobiles replaces online transaction verification through SMS (OTP)?

We are working on an online eCommerce site and we need to have online transactions. The common mechanism of verifying the online transaction seems the OTP (one Time Passwords) over SMS. But this ...
3
votes
2answers
127 views

RDP violation without credentials

On a Windows Server 2003 machine seems like someone has logged in through RDP without using credentials: there is a logged access, but there are nor userid nor password. I am wondering how is this ...
4
votes
1answer
597 views

Firefox not deleting HTTP Basic authentication credentials although being instructed to do so

On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters....
-1
votes
1answer
395 views

Auto-Fill Windows Security Credentials

I am having a network issue that every time in a while it requires me to enter my windows credentials (it is company security thing) If I don't do that I will have no internet connection on my laptop ...
124
votes
8answers
22k views

Why is storing passwords in version control a bad idea?

My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?" I gave him an answer that ...
0
votes
1answer
204 views

Why would a password reset method be like this? Is it especially safe?

The library of the Technical University in my city (Europe) has a password reset system which I did not encounter anywhere else. Students have to go to some office inside the university to get a new ...
7
votes
3answers
874 views

Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?

Recently, eslint-scope and eslint-config-eslint packages were hacked in an interesting way - one of the maintainer's account was compromised by an attacker and a new "patch" version with the malicious ...
3
votes
0answers
2k views

Should I hash my refresh tokens before storing them in the server's database? [duplicate]

I have a service with a client app (Mac). To log in, users enter their username and password in the client app, which sends this information to the server. The server verifies this information using ...
1
vote
1answer
159 views

Dealing with shared credentials when an employee leaves

We have around 20+ accounts of different services (company email inboxes, forums, social media, Github, etc.) we use in my team. For security reasons, whenever some employee leaves us, I need to ...