Skip to main content

Questions tagged [credentials]

Credentials in security context are elements that prove your identity to a system, for example a username and password or a client-side certificate. It is usually used to describe elements supplied by the authenticating client, not when the server authenticates to the client or in mutual authentication schemes.

34 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
248 views

Security implications of using unfused U2F token

I noticed that both of the Feitian USB/NFC U2F Security Keys I purchased on Amazon a few years ago are unfused. This means that the pre-personalization step was partially performed but not completed ...
Robert Quattlebaum's user avatar
4 votes
0 answers
2k views

Security flaw in iOS, Safari weird behavior or what else?

some months ago I was travelling and flew from Frankfurt airport and, while there, I probably connected to some Telekom.de free hotspot. I have an iPhone 6 with iOS 9.02 (at that time it was 8.1.x). ...
int 2Eh's user avatar
  • 153
4 votes
0 answers
1k views

copying roaming profile credential file of another computer

I am trying to recover login information of another computer. I have managed to copy the local/roaming profile credential files located in C:\users\%username%\APPDATA\local\Microsoft\Credentials\ and ...
Syler's user avatar
  • 151
2 votes
0 answers
235 views

Windows AD - Fake User Account with Multiple Passwords to Detect Password Spray

TL;DR I'm trying to implement a fake user account that has multiple sets of credentials that can be used. Instead of a specific password, any one password from a list of them could be used to ...
CyberKnight's user avatar
2 votes
0 answers
582 views

Are there any risks associated with publishing AWS VPC ids, Subnet ids?

I have a CloudFormation template with parameters in my private Github repo. I'd like to make it public. I have vpc-id and subnet-id in my parameters.json. I have seen this type of data being scrubbed ...
knutole's user avatar
  • 121
2 votes
1 answer
292 views

what is the scope of google drive's OAuth credentials?

I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
Vasu Deo.S's user avatar
2 votes
0 answers
136 views

What is the current consensus on storage of primary credentials or long-lived cryptographic tokens?

The problem: some environments need to use plain text credentials or long-lived tokens in order to unlock a specific functionality. Examples include third party legacy services which need a login/...
WoJ's user avatar
  • 9,048
2 votes
1 answer
390 views

OAuth 2.0 Resource Owner Password Grant - Handling of Access Token Upon Logging Out

I am new to OAuth 2.0. I used BShaffer's OAuth PHP Server on Authorization Code Grant, and I understand that the client application can have its OAuth token separate from its session authentication, ...
Earl Lapura's user avatar
2 votes
0 answers
1k views

SEToolkit: havester not capturing credentials

I am using the Setoolkit on Ubuntu. I am testing it by cloning Facebook and logging myself in locally to see if I capture my own credentials. However,no POSTS are written to the harvester text file ...
dylan7's user avatar
  • 747
2 votes
0 answers
149 views

Where should I store encrypted data so as to have app-exclusive access?

I am using windows Data Protection API (DPAPI) to protect private key used in my application. I cannot hide entropy used in DPAPI call because my application needs to be open source. Where should I ...
Nilesh's user avatar
  • 131
2 votes
0 answers
119 views

Storing Tenants Cloud Keys In a Database

Imagine you are building a public service where you need to store the customer's cloud credentials(like their aws secret and access keys) in your database to regularly use by your backend services in ...
iCode's user avatar
  • 323
1 vote
1 answer
844 views

What is the risk of committing .npmrc file and exposing to the world?

I have seen multiple projects committing .npmrc file along with rest of the files. Are the auth credentials npm credentials? What is the risk if an attacker gets hold of the credentials? As npm ...
PenGeek's user avatar
  • 199
1 vote
0 answers
348 views

Is there any safe way to use Windows Credential Manager's generic credentials?

(note: VS Code is just an example, question is not specific to VS Code) I would like to use Windows Credential Manager's generic credentials, say store git passwords when using VS Code, so I have not ...
g.pickardou's user avatar
1 vote
0 answers
197 views

What prevents attackers from posing as legitimate smb server?

Let's suppose on my computer was a connection to a smb network share, set to reconnect automatically on startup. Now one of the following things happens: The computer is booted up in another network ...
md7's user avatar
  • 11
1 vote
0 answers
251 views

How is Firefox importing credentials from other browsers without the need for the admin password?

Im currently looking into the security of different browser password storing mechanisms. My main focus lies on the new Chromium based Microsoft Edge browser. As far as I can see, Chromium based ...
Senkaku's user avatar
  • 113
1 vote
1 answer
375 views

git reflog is showing plain text password used as a secret texts or files in Jenkins

We are using Jenkins Freestyle Project to push the changes on the remote server. We are executing shell script on remote host using ssh for it. To pull the changes on the remote server, we are using ...
Derek's user avatar
  • 89
1 vote
0 answers
132 views

Remote access to Windows Workstation with credentials, after Windows 10 - 1809

I am a newbie in terms of OS security and I started learning from Windows; in particular I downloaded Win10 virtual machine and I am simulating various attack / defense scenarios on it. I would like ...
user3455762's user avatar
1 vote
0 answers
160 views

git credential cache and store

I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
Dora's user avatar
  • 111
1 vote
0 answers
787 views

How can I safely use Get-Credential to obtain a username and password for a set period of time for use as command line arguments?

Credentials in the form of SSH keys can be stored in memory using SSH Agent; However, if clicking the wrong link, or running a malicious program they can also be snatched from memory and sent ...
leeand00's user avatar
  • 1,441
1 vote
1 answer
3k views

Credentialed scanning through SSH tunnel

If I wish to run Nessus against a Windows server that is only accessible from another machine, I can setup an SSH tunnel like so: ssh [email protected] -L 127.0.0.1:445:10.0.0.45:445 -L 127.0.0.1:139:10....
SilverlightFox's user avatar
1 vote
0 answers
208 views

Implications of FirebaseAuth credentials in an Android .apk

I'm currently looking at an .apk for Android and I came across some hard-coded credentials. Apparently these are used for something called FireBaseAuth, which seems to be a Google service. I'm not ...
Dolores The Third's user avatar
1 vote
0 answers
560 views

How to cache auth credentials to speed up authentication

I'm developing some REST API that requires a HTTP basic auth to access. The APIs are written in Django, and the auth is based on Django auth middleware that is: it checks against the DB, the username ...
EsseTi's user avatar
  • 713
1 vote
0 answers
306 views

Can ophcrack crack credential files?

I have obtained some credential files from another pc and would like to decrypt them. These are the ones found under local/roaming profile in Appdata folder C:\Users\%USER%\Appdata\Microsoft\...
Syler's user avatar
  • 151
1 vote
1 answer
1k views

Is it secure to store encryption key (encrypted with master key) with the data it was used to encrypt?

I am working on a password sharing web site. I would like users to be able to enter their credentials and share them with other users. I am thinking about using KMS service to store master key (just ...
Vitalii Kalinin's user avatar
0 votes
0 answers
83 views

Are centralized credentials an antipattern?

At my organization we have a lot of servers. We have many common manual maintenance tasks that we'd like to automate. There's currently three approaches we're fighting over internally: Ops engineers ...
Noodle's user avatar
  • 1
0 votes
0 answers
67 views

What are the best practices for a scheduled program to store credentials to access a secure resource?

If I have a program that runs on a regular basis, such as a cron job or systemd timer and it needs to access a secure resource like a hsm or encrypted database, what are the best practices to store/...
user962460's user avatar
0 votes
0 answers
158 views

Why would Jenkins want to read the memory of lsass.exe?

Is there any legitimate reason why Jenkins would ever need to request the memory of c:\windows\system32\lsass.exe (Local Security Authority Subsystem Service)? The endpoint protection (Carbon Black) ...
Amedee Van Gasse's user avatar
0 votes
0 answers
661 views

Is storing a username in session storage a security risk?

Goal I have a page which verifies the user's email address, that has access to their user id. From this page they're redirected to the login page. I want their username to be filled in already. In ...
Mike V.'s user avatar
  • 11
0 votes
0 answers
435 views

ESP32: Secure WiFi credentials via WebCrypto?

Background information: I am not a computer scientist. However, in a research project I am currently building a ESP32-based sensor. Multiple sensors of this type are going to be used by multiple users....
reg.cs's user avatar
  • 101
0 votes
1 answer
1k views

routersploit bruteforce cred attack using http

While I'm trying to do a bruteforce attack on my router using routersploit. Im getting the error rsf (HTTP Basic/Digest Bruteforce) > run [*] Running module creds/generic/...
Abrit Pal Singh's user avatar
0 votes
0 answers
135 views

Preventing Credential Sharing

What technical methods can be implemented to force Nextcloud Pi users from sharing authentication credentials? For example, In the military, this is halted with a certificates held in a smartchip in ...
gatorback's user avatar
  • 1,521
0 votes
0 answers
234 views

Apple asked for password to recover data during repair, I said no

My girlfriend's Macbook Air gave off a loud, electrical pop! and instantly became an expensive metallic paperweight with a slight odour of burnt things (though that may have been High Sierra). Apple ...
ian's user avatar
  • 1,302
-1 votes
1 answer
975 views

Auto-Fill Windows Security Credentials

I am having a network issue that every time in a while it requires me to enter my windows credentials (it is company security thing) If I don't do that I will have no internet connection on my laptop ...
Mohammad Ali's user avatar
-2 votes
1 answer
2k views

Storing SSH credentials, need to decrypt them later for connection by python script

I am developing an application where one can add SSH credentials for servers and then an automated python script can fetch those credentials to login to the server and perform certain automated tasks. ...
Aneesh Relan's user avatar