2022 Developer Survey is open! Take survey.

Questions tagged [credentials]

Credentials in security context are elements that prove your identity to a system, for example a username and password or a client-side certificate. It is usually used to describe elements supplied by the authenticating client, not when the server authenticates to the client or in mutual authentication schemes.

Filter by
Sorted by
Tagged with
0 votes
0 answers
8 views

Personally identifiable information not behind account credentials [duplicate]

This is the first time I've posted to this site, so if this question belongs somewhere else please let me know. I recently was using an online service which I will not name, and I realized that there ...
user avatar
  • 101
0 votes
0 answers
9 views

Abusing Saved mscash2 Credentials in Active Directory

Is it possible, with NT Authority/SYSTEM access, to reuse mscash2 credentials in any way on a local system or AD network? Perhaps with runas /savecred or mimikatz or something similar? I know that the ...
user avatar
0 votes
0 answers
25 views

What is the risk of committing .npmrc file and exposing to the world?

I have seen multiple projects committing .npmrc file along with rest of the files. Are the auth credentials npm credentials? What is the risk if an attacker gets hold of the credentials? As npm ...
user avatar
  • 179
1 vote
2 answers
65 views

Securely storing password and encryption key on AWS

I have an EC2 Webserver on AWS which has a MYSQL database. The login data is stored on AWS using the Secret Manager. I have added an IAM role for the Server to get access to the password and an ...
user avatar
0 votes
0 answers
19 views

Store login credentials securely with JavaScript [duplicate]

Today I have a web application that needs to store the user's email and password, so that when he opens the login screen, the authentication is done automatically. For this, our application saves the ...
user avatar
  • 123
0 votes
0 answers
47 views

How to store and call MySQL's db credentials in production? Does it matter in my use case?

I have a system that uses MySQL's local connection for authenticating both me and clients. This system was actually an API system that acts as a database hosting. If I get the reasoning correct, each ...
user avatar
  • 1
1 vote
2 answers
81 views

"encrypting" a physical copy of a number by remembering a series of mathemtical operations rather than a key. Is this safe?

For example I want to have a hard copy of my backup 2FA codes so that if I lose/destroy/don't have my phone or laptop on me. I, of course, do not want them in plain text. I don't want to encrypt them ...
user avatar
2 votes
0 answers
68 views

Is there any safe way to use Windows Credential Manager's generic credentials?

(note: VS Code is just an example, question is not specific to VS Code) I would like to use Windows Credential Manager's generic credentials, say store git passwords when using VS Code, so I have not ...
user avatar
7 votes
1 answer
4k views

Logging in as another user - Security Issue

Two users are using same web application online. Suddenly, I checked my profile and it was data of another user. How this is possible? We both are using the same app at the same time, the app is on ...
user avatar
1 vote
1 answer
160 views

At-rest encryption. Use SFTP log-in credentials to unlock/decrypt encrypted drive or folder on an Ubuntu Linux server

I have a simple file server running on a small Ubuntu machine that facilitates file sharing and 2 way folder syncing between my and my girlfriend's 4 computers through SFTP over a private network. The ...
user avatar
1 vote
1 answer
111 views

Could a bad actor get hold of your credential sent via https if you are connect to their fake network?

Imagine this typical Fake WiFi scenario: A bad actor creates a fake coffee shop Wifi and therefore is in full control of the network. An unsuspecting victim would connect to the Wifi and log in to ...
user avatar
1 vote
1 answer
180 views

Your username can only be changed once?

I've seen quite a few security centric sites enforce this policy: Your username can only be changed once My question is: Is this done from a security standpoint? If yes, what is the logic behind it? ...
user avatar
0 votes
0 answers
61 views

Identifying the method which an attacker used to harvest important account credentials, while the security logs are deleted

Is there a way to spot the method which an attacker used to do all of the necessary credential dumping, or stealing/forging tickets/using pass-the-hash/ticket techniques, if we don't have access to ...
user avatar
  • 33
1 vote
0 answers
104 views

What prevents attackers from posing as legitimate smb server?

Let's suppose on my computer was a connection to a smb network share, set to reconnect automatically on startup. Now one of the following things happens: The computer is booted up in another network ...
user avatar
  • 11
0 votes
1 answer
133 views

How to store secret network share credentials in desktop application?

I have a .net winforms application used in LAN by the company's employees, and it should access a network share to copy files to it. The share has credentials that should not be known to end users. ...
user avatar
  • 101
0 votes
1 answer
437 views

Why some payment methods allow being embedded in an iframe and some don't?

Let's take some examples: Pay Pal, Apple Pay (examples via Saferpay) - will not load in an iFrame Visa Checkout, Stripe (example), Saferpay (link above) - credit card data can be input in an iFrame ...
user avatar
3 votes
1 answer
246 views

AWS credentials seem terribly insecure. Why? [closed]

In my ~/.aws/credentials I have the following: [default] aws_access_key_id = <something> aws_secret_access_key = <something-else> This file has permissions 0600 but doesn't ...
user avatar
  • 335
0 votes
0 answers
229 views

ESP32: Secure WiFi credentials via WebCrypto?

Background information: I am not a computer scientist. However, in a research project I am currently building a ESP32-based sensor. Multiple sensors of this type are going to be used by multiple users....
user avatar
  • 101
0 votes
1 answer
212 views

Python desktop application: storing cloud database passwords

I am currently building a Python desktop application in PyQt/PySide which will be compiled to .exe. I am planning to use the Azure SQL database and a remote file storage (like S3). An issue arises ...
user avatar
1 vote
2 answers
604 views

How is TDS authentication data protected?

I'm currently testing an application, which connects to a MS-SQL database. Through Wireshark, I can see that the application uses TDS to connect to the database. Furthermore, I can see that both the ...
user avatar
2 votes
0 answers
95 views

Are there any risks associated with publishing AWS VPC ids, Subnet ids?

I have a CloudFormation template with parameters in my private Github repo. I'd like to make it public. I have vpc-id and subnet-id in my parameters.json. I have seen this type of data being scrubbed ...
user avatar
  • 121
0 votes
1 answer
231 views

How to securely share credentials between two local applications?

My employer has a system that clinicians use to capture video data for patient bookings. This comprises two applications running on Windows: A GUI application (Electron/Javascript) A local service (C#...
user avatar
  • 25
1 vote
1 answer
134 views

How do sites detect credential sniffing, and what is the purpose of this attack?

I just got an email from the Unsplash service telling me that someone had logged into my account via credential sniffing: Five minutes later I get three more emails, each one notifying that a (...
user avatar
0 votes
1 answer
82 views

Difference between access control systems that can/can't be compromised without valid credentials?

Take the following examples: When I run sshd, it can in theory grant access to anything that the process itself has access to, regardless of provided credentials. For example, I could in theory ...
user avatar
2 votes
1 answer
286 views

Using Google Docs to share passwords

Background Often developers and clients need to exchange passwords to be able to access some services. Of course the best option would be to never use someone else's credentials to log in, and instead ...
user avatar
  • 15.3k
0 votes
0 answers
133 views

How is Firefox importing credentials from other browsers without the need for the admin password?

Im currently looking into the security of different browser password storing mechanisms. My main focus lies on the new Chromium based Microsoft Edge browser. As far as I can see, Chromium based ...
user avatar
  • 103
2 votes
1 answer
101 views

How to handle AWS credentials

Our web application features a lot of media upload. We are making use of AWS S3 buckets for media storage. As per the current implementation, whenever a new file upload API is called, we send the AWS ...
user avatar
0 votes
1 answer
390 views

routersploit bruteforce cred attcack using http

while i'm trying to do a brutforce attack on my router using routersploit. Im getting the error rsf (HTTP Basic/Digest Bruteforce) > run [*] Running module creds/generic/...
user avatar
0 votes
1 answer
252 views

git reflog is showing plain text password used as a secret texts or files in Jenkins

We are using Jenkins Freestyle Project to push the changes on the remote server. We are executing shell script on remote host using ssh for it. To pull the changes on the remote server, we are using ...
user avatar
  • 79
2 votes
1 answer
278 views

Login with AD credentials on behalf of a user

We have a web solution (running in IIS) where AD users and non-AD users need to log into. We sell this to companies and will run this on-prem only. non-AD-FS and only AD question (so no federation) I ...
user avatar
  • 123
1 vote
1 answer
154 views

Protecting a website from being kidnapped

I have a MediaWiki website in Hebrew; As common with MediaWiki websites, it has lots of content and rebuilding it in case of a disaster isn't feasible. I chose to give that website a Global TLD (a non ...
user avatar
  • 11
0 votes
1 answer
190 views

How can I write a function that will log a user in an old system without knowing any username or password? [closed]

I'm studying Internet Security and I learned something about code injection in older websites (using the string ' OR 1 == 1 // as a username will log in with any password provided); but what if a ...
user avatar
0 votes
1 answer
112 views

Who (Designer or User) Should be Resposible for the Correct/Secure Usage of a Tool Intended for Developers/Admins? [closed]

There is a healthy debate around a series of stack overflow posts that refer to the "RunAs" command. Specifically the discussion is in reference to design decision that the folks at ...
user avatar
0 votes
4 answers
341 views

Does TLS hash passwords before encrypting?

Suppose I am logging into Gmail by giving my credentials. Does my plaintext get encrypted or is it first converted to the hash and the hash encrypted? And also if I am communicating to the bank web ...
user avatar
4 votes
0 answers
138 views

Security implications of using unfused U2F token

I noticed that both of the Feitian USB/NFC U2F Security Keys I purchased on Amazon a few years ago are unfused. This means that the pre-personalization step was partially performed but not completed ...
user avatar
  • 205
1 vote
2 answers
473 views

How do I securely store credentials and key files on my mac?

There must be a handy way to securely store, say, GCP key.json somewhere on my machine and access it whenever I'm deploying stuff. Backup to cloud is a must. The Apple's Keychain access seems ...
user avatar
  • 153
0 votes
3 answers
3k views

Is using virtualbox for web browsing worth it for added security?

My host machine is running Windows 10. I've installed VirtualBox and use it to run an Ubuntu VM. Inside the VM I use Firefox to do all of my web browsing that doesn't involve entering sensitive data ...
user avatar
3 votes
1 answer
385 views

How to secure backup scripts so I do not have to hardcode passwords?

I have a secure and private aws ec2 environment but I need to do some backups of mongodb, postgresql, so I have a separate ec2 instance for doing backup and occasionally allow 80 and 443 to allow ...
user avatar
0 votes
0 answers
101 views

Preventing Credential Sharing

What technical methods can be implemented to force Nextcloud Pi users from sharing authentication credentials? For example, In the military, this is halted with a certificates held in a smartchip in ...
user avatar
  • 1,541
0 votes
2 answers
153 views

Store sensitive decryptable data in database

I'm building a web application which configures and interconnects other applications through web services. In all the data I have to save for each applications, there are some that are quite ...
user avatar
1 vote
1 answer
487 views

How to harden against credential stealing in EC2 via the http://169.254.169.254 API?

AWS has a feature called Instance Metadata, which on EC2 gives you access to the AWS credentials through HTTP calls: curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role> ...
user avatar
0 votes
0 answers
50 views

How to stop the user from intercepting their own credentials in mobile apps? [duplicate]

We are experiencing fraud with our open API, so we're turning it private. Let's suppose that I'm using OAuth and Bearer token to authorize who can access my API. Request: App -> Credentials -> Auth ...
user avatar
4 votes
1 answer
372 views

What can an attacker do with credentials.json [duplicate]

A few months ago I was experimenting with a project which needed to read a Google sheets page. It didn't end up going anywhere, but today I accidentally checked the project, including credentials.json ...
user avatar
  • 143
0 votes
2 answers
106 views

Failure on correct credentials with the consecutive success?

The idea to "improve" security is as follows - the service will reply with a failure code even if supplied credentials are correct, but then on a second (third/whatever configured) attempt it will ...
user avatar
  • 803
2 votes
2 answers
490 views

Securely provide AWS user with keys?

When creating a new user in AWS IAM, an admin sets the user's name and permissions for that user. The user's password and programmatic access keys (if programmatic access is granted) are then ...
user avatar
3 votes
1 answer
344 views

Android Application - Credentials in RAM

I have been pen testing an android mobile application for security vulnerabilities. As part of the test, I started Frida server on a mobile phone where the mobile application to be tested is installed,...
user avatar
3 votes
1 answer
169 views

Is it unsafe to enter administrative Windows credentials when logged in as a regular user?

I was recently advised that when a user is logged in as a regular user and they need an administrator to do something (i.e. install an application) that entering the administrator credentials when the ...
user avatar
30 votes
6 answers
5k views

The most secure way to handle someone forgetting to verify their account?

Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account. Suppose they forget to verify it, and later try to login. Should the error ...
user avatar
  • 529
3 votes
1 answer
182 views

Technical realization of fraudulent credit card cash withdrawal

Somebody unauthorized in India managed to withdraw cash from my credit card account. The card I use (and which they claim to have used) is a German Visa prepaid card issued by Postbank. It has a chip ...
user avatar
5 votes
3 answers
564 views

Distribute Program with Sheets API Credentials

I am trying to write a program that uses the Google Sheets API to read spreadsheets and operate on the data. My program contains a credentials.json file which I obtained from the Java Quickstart page ...
user avatar