Skip to main content

Questions tagged [credentials]

Credentials in security context are elements that prove your identity to a system, for example a username and password or a client-side certificate. It is usually used to describe elements supplied by the authenticating client, not when the server authenticates to the client or in mutual authentication schemes.

Filter by
Sorted by
Tagged with
40 votes
2 answers
39k views

How should an application store its credentials

Context When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, ...
Zar's user avatar
  • 502
150 votes
12 answers
29k views

Do I need to encrypt connections inside a corporate network?

Provided that I have a decent level of physical security in the office, I monitor the physical addresses of devices connected to the network and only give VPN access to trusted parties, do I need to ...
Robert Cutajar's user avatar
7 votes
4 answers
2k views

Can I replace username and password with a long random text in URL? [duplicate]

Scenario One customer is facing a problem with his users: they use a (web) service a few times per year and they forget their credentials very often. There is a standard password recovery procedure ...
Adriano Repetti's user avatar
125 votes
8 answers
27k views

Why is storing passwords in version control a bad idea?

My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?" I gave him an answer that ...
d33tah's user avatar
  • 6,564
27 votes
3 answers
13k views

How to handle emails as usernames under GDPR?

Using emails as usernames for webapps is a convenient way to avoid the "yet another online username" problem. As such, by using this approach, the emails should be easily available in the backend to ...
João Dias Amaro's user avatar
14 votes
1 answer
8k views

Why store a salt along side the hashed password? [duplicate]

Understand the need to protection credentials with hashes that are expensive and to use cryptographically random salts. What I would like to understand is why you would store the salt along side the ...
whoami's user avatar
  • 394
10 votes
1 answer
35k views

How to read password from Windows credentials?

What is the cipher used by windows Credential Manager to generate credentials backup files (*.crd)? With a backup file from Credential Manager and the password used to created that backup file is it ...
Pedro Custódio's user avatar
5 votes
3 answers
667 views

Distribute Program with Sheets API Credentials

I am trying to write a program that uses the Google Sheets API to read spreadsheets and operate on the data. My program contains a credentials.json file which I obtained from the Java Quickstart page ...
Cardinal System's user avatar
1 vote
1 answer
759 views

How does Mail.app handle account credentials?

I am looking for an iOS email client that is reasonably secure (ideally, this means that it doesn't store user credentials outside the device - so something like Spark or Outlook for iOS are a no go ...
user1301428's user avatar
  • 1,947
116 votes
13 answers
31k views

Is it good or bad practice to allow a user to change their username?

I have looked all over online as well as this site to try to find out more information regarding the security of this, but haven't found anything. In my particular case, the product is a website, but ...
Jeff Y's user avatar
  • 1,071
25 votes
2 answers
36k views

How secure is the Windows Credential Manager?

I'm a Lastpass user and many times I thought about switching to the Credential Manager, for auto sync and a certain comfort with the windows environment. The only thing that I'm worried about is its ...
user avatar
9 votes
3 answers
3k views

Protection of eduroam credentials

Recently my educational institution officially switched over from the their own wireless network to eduroam. If I understand correctly from the FAQ, credential authentication is performed on the ...
rink.attendant.6's user avatar
7 votes
2 answers
5k views

Are SOCKS5 credentials safe during authentication on proxy server

I've read several tutorials, but not totally sure. If I'll set up my own SOCKS5 proxy server on VPS, configure it to use username and password. Will this credentials be safe while authentication on ...
Storm's user avatar
  • 173
4 votes
1 answer
385 views

Keeping a user's passwords, but can't hash them

I'm making a web application to provide intermediary service for customers to facilitate their interaction with a set of other web applications. A simplified example would be to let a user access his ...
Juicy's user avatar
  • 1,447
3 votes
1 answer
821 views

Storing database credentials for multi server, multi db environment

What's the best practice for storing database credentials for an auto scaling environment, yet also requiring the ability to update database information? For instance I have an auto-scaling site on ...
TommyBs's user avatar
  • 817
2 votes
3 answers
7k views

Safe way to store credentials for an application

I want to use an API for one of the projects on which I am working. What's the good practice/way to store the credentials required for the API? For example, I don't want to later push the project into ...
mantrarush's user avatar
2 votes
3 answers
1k views

Validating Credentials - Logic in Application vs Database

I am studying Web Application Security, A Beginner's Guide Paperback – November 3, 2011 by Bryan Sullivan (Author), Vincent Liu (Author) On pp 69, "Validating Credentials", they say you can ...
Glowie's user avatar
  • 249