Questions tagged [credentials]
Credentials in security context are elements that prove your identity to a system, for example a username and password or a client-side certificate. It is usually used to describe elements supplied by the authenticating client, not when the server authenticates to the client or in mutual authentication schemes.
16
questions
40
votes
2
answers
38k
views
How should an application store its credentials
Context
When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, ...
- 502
150
votes
12
answers
28k
views
Do I need to encrypt connections inside a corporate network?
Provided that I have a decent level of physical security in the office, I monitor the physical addresses of devices connected to the network and only give VPN access to trusted parties, do I need to ...
- 1,451
8
votes
4
answers
2k
views
Can I replace username and password with a long random text in URL? [duplicate]
Scenario
One customer is facing a problem with his users: they use a (web) service a few times per year and they forget their credentials very often. There is a standard password recovery procedure ...
- 261
127
votes
8
answers
27k
views
Why is storing passwords in version control a bad idea?
My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?"
I gave him an answer that ...
- 6,534
26
votes
3
answers
13k
views
How to handle emails as usernames under GDPR?
Using emails as usernames for webapps is a convenient way to avoid the "yet another online username" problem. As such, by using this approach, the emails should be easily available in the backend to ...
- 363
14
votes
1
answer
7k
views
Why store a salt along side the hashed password? [duplicate]
Understand the need to protection credentials with hashes that are expensive and to use cryptographically random salts.
What I would like to understand is why you would store the salt along side the ...
- 394
9
votes
1
answer
32k
views
How to read password from Windows credentials?
What is the cipher used by windows Credential Manager to generate credentials backup files (*.crd)?
With a backup file from Credential Manager and the password used to created that backup file is it ...
- 201
5
votes
3
answers
628
views
Distribute Program with Sheets API Credentials
I am trying to write a program that uses the Google Sheets API to read spreadsheets and operate on the data.
My program contains a credentials.json file which I obtained from the Java Quickstart page ...
1
vote
1
answer
702
views
How does Mail.app handle account credentials?
I am looking for an iOS email client that is reasonably secure (ideally, this means that it doesn't store user credentials outside the device - so something like Spark or Outlook for iOS are a no go ...
- 1,947
116
votes
13
answers
30k
views
Is it good or bad practice to allow a user to change their username?
I have looked all over online as well as this site to try to find out more information regarding the security of this, but haven't found anything. In my particular case, the product is a website, but ...
- 1,061
9
votes
3
answers
3k
views
Protection of eduroam credentials
Recently my educational institution officially switched over from the their own wireless network to eduroam.
If I understand correctly from the FAQ, credential authentication is performed on the ...
- 2,257
7
votes
2
answers
5k
views
Are SOCKS5 credentials safe during authentication on proxy server
I've read several tutorials, but not totally sure.
If I'll set up my own SOCKS5 proxy server on VPS, configure it to use username and password. Will this credentials be safe while authentication on ...
- 173
4
votes
1
answer
359
views
Keeping a user's passwords, but can't hash them
I'm making a web application to provide intermediary service for customers to facilitate their interaction with a set of other web applications.
A simplified example would be to let a user access his ...
- 1,447
3
votes
1
answer
755
views
Storing database credentials for multi server, multi db environment
What's the best practice for storing database credentials for an auto scaling environment, yet also requiring the ability to update database information?
For instance I have an auto-scaling site on ...
- 747
2
votes
3
answers
6k
views
Safe way to store credentials for an application
I want to use an API for one of the projects on which I am working. What's the good practice/way to store the credentials required for the API? For example, I don't want to later push the project into ...
- 21
2
votes
3
answers
1k
views
Validating Credentials - Logic in Application vs Database
I am studying
Web Application Security, A Beginner's Guide Paperback – November 3, 2011
by Bryan Sullivan (Author), Vincent Liu (Author)
On pp 69, "Validating Credentials", they say you can ...
- 249