Questions tagged [credentials]
Credentials in security context are elements that prove your identity to a system, for example a username and password or a client-side certificate. It is usually used to describe elements supplied by the authenticating client, not when the server authenticates to the client or in mutual authentication schemes.
194
questions
2
votes
0
answers
95
views
Windows AD - Fake User Account with Multiple Passwords to Detect Password Spray
TL;DR
I'm trying to implement a fake user account that has multiple sets of credentials that can be used. Instead of a specific password, any one password from a list of them could be used to ...
- 21
0
votes
1
answer
875
views
routersploit bruteforce cred attack using http
While I'm trying to do a bruteforce attack on my router using routersploit.
Im getting the error
rsf (HTTP Basic/Digest Bruteforce) > run
[*] Running module creds/generic/...
CommunityBot
- 1
2
votes
1
answer
367
views
OAuth 2.0 Resource Owner Password Grant - Handling of Access Token Upon Logging Out
I am new to OAuth 2.0. I used BShaffer's OAuth PHP Server on Authorization Code Grant, and I understand that the client application can have its OAuth token separate from its session authentication, ...
CommunityBot
- 1
1
vote
1
answer
3k
views
Credentialed scanning through SSH tunnel
If I wish to run Nessus against a Windows server that is only accessible from another machine, I can setup an SSH tunnel like so:
ssh [email protected] -L 127.0.0.1:445:10.0.0.45:445 -L 127.0.0.1:139:10....
CommunityBot
- 1
1
vote
1
answer
567
views
What is the risk of committing .npmrc file and exposing to the world?
I have seen multiple projects committing .npmrc file along with rest of the files. Are the auth credentials npm credentials? What is the risk if an attacker gets hold of the credentials? As npm ...
CommunityBot
- 1
2
votes
1
answer
250
views
what is the scope of google drive's OAuth credentials?
I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
CommunityBot
- 1
1
vote
1
answer
124
views
Using public WPA2 Enterprise credentials for public Wi-Fi
In South Korea, I've seen a couple of public Wi-Fi networks advertise a "secure" option. Stickers on public buses in Seoul and the captive portal login page for unencrypted Wi-Fi instruct ...
- 1,382
1
vote
3
answers
160
views
Is it safe to check-in a RSA private key?
As far as I know, it is bad to check-in something like a password in a version control system. However, I saw in a project that a private_key.pem file with -----BEGIN RSA PRIVATE KEY----- ... content ...
CommunityBot
- 1
0
votes
1
answer
329
views
git reflog is showing plain text password used as a secret texts or files in Jenkins
We are using Jenkins Freestyle Project to push the changes on the remote server. We are executing shell script on remote host using ssh for it. To pull the changes on the remote server, we are using ...
CommunityBot
- 1
0
votes
0
answers
88
views
Why would Jenkins want to read the memory of lsass.exe?
Is there any legitimate reason why Jenkins would ever need to request the memory of c:\windows\system32\lsass.exe (Local Security Authority Subsystem Service)?
The endpoint protection (Carbon Black) ...
- 369
4
votes
3
answers
553
views
Best method to send credentials to clients
I'm constantly exchanging credentials with my clients for things like database servers, cloud accounts, etc. Neither I nor my clients, have time to implement a sophisticated method for secure ...
- 131
6
votes
3
answers
4k
views
Firefox not deleting HTTP Basic authentication credentials although being instructed to do so
On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters....
- 11
8
votes
4
answers
5k
views
Enabling a user to revert a hacked change in their email
I am writing a web app and I want to set up a system where, when a user changes their email, it gives them a link to have the change revert back. The purpose of this is for when a hacker changes an ...
- 493
1
vote
1
answer
517
views
Cracking WiFi credentials without handshake or PKMS
How can I crack WiFi credentials WITHOUT using the traditional method of capturing a PKMS or Handshake?
When I connect to a WiFi network, I simply enter a password into a text box just like any other ...
- 2,265
0
votes
1
answer
401
views
How long would it take to crack hashed password stored in plain sight?
I want to store a password hash in plain sight. If I am using a dictionary to crack an Argon2 hashed password that I am storing in plain sight, how long would it take (assuming my password is ...
- 12.2k
1
vote
0
answers
38
views
Why is PayPal asking for my bank password? [duplicate]
Another posted the exact same question and it was dismissed saying PayPal would never do such a thing.
Well, I was adding a bank acct yesterday to transfer funds and PayPal popped up a username and ...
- 128k
0
votes
1
answer
134
views
Security and practicality of passing secrets to services running as non-privileged user
I strongly dislike and mistrust the practice to store secrets in plain text files for unattended access by services.
This is increasingly less of an issue in modern deployments where secrets are ...
- 11
0
votes
1
answer
254
views
How to store secret network share credentials in desktop application?
I have a .net winforms application used in LAN by the company's employees, and it should access a network share to copy files to it. The share has credentials that should not be known to end users.
...
CommunityBot
- 1
6
votes
2
answers
3k
views
Should user credentials and user info be stored in seperate tables?
Should I store credentials (like email, hashed password) in a separate table than the user's profile information (bio, gender, etc)?
My main concern is that I'll be sending other user's information (...
- 65.4k
0
votes
1
answer
76
views
Can my name be revealed from a stolen Verifiable Credential?
Let vc be a W3C Verifiable Credential Standard compliant verifiable credential. If I print it out on paper and loose it on the subway, can an attacker pick up the paper, type in the information into a ...
- 111
5
votes
1
answer
1k
views
Explanation of capabilities: CAP_NET_BIND_SERVICE
I am still studying kernel credential management (https://kernel.org/doc/html/v5.9/security/credentials.html) and I have encountered a use case I cannot explain.
I am in a VM (Kali).
❯ uname -a
...
- 205
1
vote
1
answer
102
views
Git pre receive hook and fragments left behind
Quite a common use of a git pre-receive hook is to scan for sensitive information and then block from entering the repository. It appears from looking at examples, that conventionally, you are given ...
- 126
8
votes
2
answers
31k
views
How to securely store credentials in a bash variables?
I need to cache my user credentials in a shell script variable since they are required for multiple requests to a REST-API. It won't be stored in the bash script file itself: user is prompted to enter ...
- 11
2
votes
2
answers
2k
views
OAuth2 - What is the advantage of using certificate over client secret credentials? (Azure)
When using OAuth2 in Azure, why Certificates are more secure than using Secrets?
The Secrets have expiration and are strong, and generated automatically.
The application needs to send a JWT containing ...
- 121
0
votes
0
answers
504
views
Is storing a username in session storage a security risk?
Goal
I have a page which verifies the user's email address, that has access to their user id. From this page they're redirected to the login page. I want their username to be filled in already. In ...
- 11
1
vote
2
answers
89
views
Securely storing password and encryption key on AWS
I have an EC2 Webserver on AWS which has a MYSQL database. The login data is stored on AWS using the Secret Manager. I have added an IAM role for the Server to get access to the password and an ...
- 46.3k
0
votes
0
answers
20
views
Store login credentials securely with JavaScript [duplicate]
Today I have a web application that needs to store the user's email and password, so that when he opens the login screen, the authentication is done automatically.
For this, our application saves the ...
- 174
1
vote
2
answers
96
views
"encrypting" a physical copy of a number by remembering a series of mathemtical operations rather than a key. Is this safe?
For example I want to have a hard copy of my backup 2FA codes so that if I lose/destroy/don't have my phone or laptop on me. I, of course, do not want them in plain text. I don't want to encrypt them ...
- 128k
1
vote
0
answers
257
views
Is there any safe way to use Windows Credential Manager's generic credentials?
(note: VS Code is just an example, question is not specific to VS Code)
I would like to use Windows Credential Manager's generic credentials, say store git passwords when using VS Code, so I have not ...
- 220
7
votes
1
answer
4k
views
Logging in as another user - Security Issue
Two users are using same web application online. Suddenly, I checked my profile and it was data of another user. How this is possible? We both are using the same app at the same time, the app is on ...
- 34.1k
1
vote
1
answer
717
views
At-rest encryption. Use SFTP log-in credentials to unlock/decrypt encrypted drive or folder on an Ubuntu Linux server
I have a simple file server running on a small Ubuntu machine that facilitates file sharing and 2 way folder syncing between my and my girlfriend's 4 computers through SFTP over a private network.
The ...
- 13
1
vote
1
answer
131
views
Could a bad actor get hold of your credential sent via https if you are connect to their fake network?
Imagine this typical Fake WiFi scenario:
A bad actor creates a fake coffee shop Wifi and therefore is in full control of the network. An unsuspecting victim would connect to the Wifi and log in to ...
- 1,619
1
vote
1
answer
444
views
Your username can only be changed once?
I've seen quite a few security centric sites enforce this policy:
Your username can only be changed once
My question is: Is this done from a security standpoint? If yes, what is the logic behind it? ...
- 141
4
votes
0
answers
1k
views
copying roaming profile credential file of another computer
I am trying to recover login information of another computer. I have managed to copy the local/roaming profile credential files located in C:\users\%username%\APPDATA\local\Microsoft\Credentials\ and ...
- 128k
1
vote
0
answers
155
views
What prevents attackers from posing as legitimate smb server?
Let's suppose on my computer was a connection to a smb network share, set to reconnect automatically on startup. Now one of the following things happens:
The computer is booted up in another network
...
- 11
0
votes
1
answer
1k
views
Why some payment methods allow being embedded in an iframe and some don't?
Let's take some examples:
Pay Pal, Apple Pay (examples via Saferpay) - will not load in an iFrame
Visa Checkout, Stripe (example), Saferpay (link above) - credit card data can be input in an iFrame
...
- 72.7k
3
votes
1
answer
451
views
AWS credentials seem terribly insecure. Why? [closed]
In my ~/.aws/credentials I have the following:
[default]
aws_access_key_id = <something>
aws_secret_access_key = <something-else>
This file has permissions 0600 but doesn't ...
- 2,305
0
votes
0
answers
374
views
ESP32: Secure WiFi credentials via WebCrypto?
Background information:
I am not a computer scientist. However, in a research project I am currently building a ESP32-based sensor. Multiple sensors of this type are going to be used by multiple users....
- 101
0
votes
3
answers
5k
views
Is using virtualbox for web browsing worth it for added security?
My host machine is running Windows 10. I've installed VirtualBox and use it to run an Ubuntu VM. Inside the VM I use Firefox to do all of my web browsing that doesn't involve entering sensitive data ...
0
votes
1
answer
391
views
Python desktop application: storing cloud database passwords
I am currently building a Python desktop application in PyQt/PySide which will be compiled to .exe. I am planning to use the Azure SQL database and a remote file storage (like S3).
An issue arises ...
- 46.3k
1
vote
2
answers
2k
views
How is TDS authentication data protected?
I'm currently testing an application, which connects to a MS-SQL database. Through Wireshark, I can see that the application uses TDS to connect to the database. Furthermore, I can see that both the ...
CommunityBot
- 1
2
votes
0
answers
350
views
Are there any risks associated with publishing AWS VPC ids, Subnet ids?
I have a CloudFormation template with parameters in my private Github repo. I'd like to make it public.
I have vpc-id and subnet-id in my parameters.json. I have seen this type of data being scrubbed ...
- 121
0
votes
3
answers
187
views
Shared terminal security hole
I want to ask you about what I think is a pretty obvious security hole and what can be done about it.
Suppose my library has a room containing network-connected workstations serving Linux. You log on ...
- 187
0
votes
1
answer
620
views
How to securely share credentials between two local applications?
My employer has a system that clinicians use to capture video data for patient bookings. This comprises two applications running on Windows:
A GUI application (Electron/Javascript)
A local service (C#...
- 53.5k
1
vote
3
answers
10k
views
How to scan a website using Nessus with login credentials
I have scanned my website using Nessus. But I need to scan it as a logged in user since most of the URLs are accessible only if we are logged in. How can I set website login credentials in Nessus?
- 442
1
vote
1
answer
167
views
How do sites detect credential sniffing, and what is the purpose of this attack?
I just got an email from the Unsplash service telling me that someone had logged into my account via credential sniffing:
Five minutes later I get three more emails, each one notifying that a (...
- 9,284
0
votes
1
answer
89
views
Difference between access control systems that can/can't be compromised without valid credentials?
Take the following examples:
When I run sshd, it can in theory grant access to anything that the process itself has access to, regardless of provided credentials. For example, I could in theory ...
- 128k
2
votes
1
answer
510
views
Using Google Docs to share passwords
Background
Often developers and clients need to exchange passwords to be able to access some services. Of course the best option would be to never use someone else's credentials to log in, and instead ...
- 128k
1
vote
0
answers
198
views
How is Firefox importing credentials from other browsers without the need for the admin password?
Im currently looking into the security of different browser password storing mechanisms. My main focus lies on the new Chromium based Microsoft Edge browser.
As far as I can see, Chromium based ...
- 61.5k
2
votes
1
answer
125
views
How to handle AWS credentials
Our web application features a lot of media upload. We are making use of AWS S3 buckets for media storage. As per the current implementation, whenever a new file upload API is called, we send the AWS ...
- 29.5k