Questions tagged [credentials]
Credentials in security context are elements that prove your identity to a system, for example a username and password or a client-side certificate. It is usually used to describe elements supplied by the authenticating client, not when the server authenticates to the client or in mutual authentication schemes.
33
questions with no upvoted or accepted answers
4
votes
0
answers
189
views
Security implications of using unfused U2F token
I noticed that both of the Feitian USB/NFC U2F Security Keys I purchased on Amazon a few years ago are unfused. This means that the pre-personalization step was partially performed but not completed ...
4
votes
0
answers
2k
views
Security flaw in iOS, Safari weird behavior or what else?
some months ago I was travelling and flew from Frankfurt airport and, while there, I probably connected to some Telekom.de free hotspot. I have an iPhone 6 with iOS 9.02 (at that time it was 8.1.x).
...
- 153
4
votes
0
answers
1k
views
copying roaming profile credential file of another computer
I am trying to recover login information of another computer. I have managed to copy the local/roaming profile credential files located in C:\users\%username%\APPDATA\local\Microsoft\Credentials\ and ...
- 151
2
votes
0
answers
98
views
Windows AD - Fake User Account with Multiple Passwords to Detect Password Spray
TL;DR
I'm trying to implement a fake user account that has multiple sets of credentials that can be used. Instead of a specific password, any one password from a list of them could be used to ...
- 21
2
votes
0
answers
350
views
Are there any risks associated with publishing AWS VPC ids, Subnet ids?
I have a CloudFormation template with parameters in my private Github repo. I'd like to make it public.
I have vpc-id and subnet-id in my parameters.json. I have seen this type of data being scrubbed ...
- 121
2
votes
1
answer
251
views
what is the scope of google drive's OAuth credentials?
I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
- 185
2
votes
0
answers
116
views
What is the current consensus on storage of primary credentials or long-lived cryptographic tokens?
The problem: some environments need to use plain text credentials or long-lived tokens in order to unlock a specific functionality. Examples include
third party legacy services which need a login/...
- 9,028
2
votes
1
answer
367
views
OAuth 2.0 Resource Owner Password Grant - Handling of Access Token Upon Logging Out
I am new to OAuth 2.0. I used BShaffer's OAuth PHP Server on Authorization Code Grant, and I understand that the client application can have its OAuth token separate from its session authentication, ...
- 21
2
votes
0
answers
989
views
SEToolkit: havester not capturing credentials
I am using the Setoolkit on Ubuntu. I am testing it by cloning Facebook and logging myself in locally to see if I capture my own credentials. However,no POSTS are written to the harvester text file ...
- 737
2
votes
0
answers
130
views
Where should I store encrypted data so as to have app-exclusive access?
I am using windows Data Protection API (DPAPI) to protect private key used in my application. I cannot hide entropy used in DPAPI call because my application needs to be open source.
Where should I ...
- 131
2
votes
0
answers
103
views
Storing Tenants Cloud Keys In a Database
Imagine you are building a public service where you need to store the customer's cloud credentials(like their aws secret and access keys) in your database to regularly use by your backend services in ...
- 323
1
vote
3
answers
160
views
Is it safe to check-in a RSA private key?
As far as I know, it is bad to check-in something like a password in a version control system. However, I saw in a project that a private_key.pem file with -----BEGIN RSA PRIVATE KEY----- ... content ...
- 111
1
vote
1
answer
568
views
What is the risk of committing .npmrc file and exposing to the world?
I have seen multiple projects committing .npmrc file along with rest of the files. Are the auth credentials npm credentials? What is the risk if an attacker gets hold of the credentials? As npm ...
- 189
1
vote
0
answers
259
views
Is there any safe way to use Windows Credential Manager's generic credentials?
(note: VS Code is just an example, question is not specific to VS Code)
I would like to use Windows Credential Manager's generic credentials, say store git passwords when using VS Code, so I have not ...
- 220
1
vote
0
answers
155
views
What prevents attackers from posing as legitimate smb server?
Let's suppose on my computer was a connection to a smb network share, set to reconnect automatically on startup. Now one of the following things happens:
The computer is booted up in another network
...
- 11
1
vote
0
answers
198
views
How is Firefox importing credentials from other browsers without the need for the admin password?
Im currently looking into the security of different browser password storing mechanisms. My main focus lies on the new Chromium based Microsoft Edge browser.
As far as I can see, Chromium based ...
- 113
1
vote
0
answers
105
views
Remote access to Windows Workstation with credentials, after Windows 10 - 1809
I am a newbie in terms of OS security and I started learning from Windows; in particular I downloaded Win10 virtual machine and I am simulating various attack / defense scenarios on it.
I would like ...
- 11
1
vote
0
answers
124
views
git credential cache and store
I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
- 111
1
vote
0
answers
740
views
How can I safely use Get-Credential to obtain a username and password for a set period of time for use as command line arguments?
Credentials in the form of SSH keys can be stored in memory using SSH Agent; However, if clicking the wrong link, or running a malicious program they can also be snatched from memory and sent ...
- 1,399
1
vote
1
answer
3k
views
Credentialed scanning through SSH tunnel
If I wish to run Nessus against a Windows server that is only accessible from another machine, I can setup an SSH tunnel like so:
ssh [email protected] -L 127.0.0.1:445:10.0.0.45:445 -L 127.0.0.1:139:10....
- 34k
1
vote
0
answers
178
views
Implications of FirebaseAuth credentials in an Android .apk
I'm currently looking at an .apk for Android and I came across some hard-coded credentials. Apparently these are used for something called FireBaseAuth, which seems to be a Google service.
I'm not ...
1
vote
0
answers
493
views
How to cache auth credentials to speed up authentication
I'm developing some REST API that requires a HTTP basic auth to access. The APIs are written in Django, and the auth is based on Django auth middleware that is: it checks against the DB, the username ...
- 703
1
vote
0
answers
287
views
Can ophcrack crack credential files?
I have obtained some credential files from another pc and would like to decrypt them. These are the ones found under local/roaming profile in Appdata folder
C:\Users\%USER%\Appdata\Microsoft\...
- 151
1
vote
1
answer
938
views
Is it secure to store encryption key (encrypted with master key) with the data it was used to encrypt?
I am working on a password sharing web site. I would like users to be able to enter their credentials and share them with other users. I am thinking about using KMS service to store master key (just ...
0
votes
0
answers
88
views
Why would Jenkins want to read the memory of lsass.exe?
Is there any legitimate reason why Jenkins would ever need to request the memory of c:\windows\system32\lsass.exe (Local Security Authority Subsystem Service)?
The endpoint protection (Carbon Black) ...
- 369
0
votes
0
answers
506
views
Is storing a username in session storage a security risk?
Goal
I have a page which verifies the user's email address, that has access to their user id. From this page they're redirected to the login page. I want their username to be filled in already. In ...
- 11
0
votes
0
answers
374
views
ESP32: Secure WiFi credentials via WebCrypto?
Background information:
I am not a computer scientist. However, in a research project I am currently building a ESP32-based sensor. Multiple sensors of this type are going to be used by multiple users....
- 101
0
votes
1
answer
876
views
routersploit bruteforce cred attack using http
While I'm trying to do a bruteforce attack on my router using routersploit.
Im getting the error
rsf (HTTP Basic/Digest Bruteforce) > run
[*] Running module creds/generic/...
0
votes
1
answer
329
views
git reflog is showing plain text password used as a secret texts or files in Jenkins
We are using Jenkins Freestyle Project to push the changes on the remote server. We are executing shell script on remote host using ssh for it. To pull the changes on the remote server, we are using ...
- 79
0
votes
0
answers
110
views
Preventing Credential Sharing
What technical methods can be implemented to force Nextcloud Pi users from sharing authentication credentials? For example, In the military, this is halted with a certificates held in a smartchip in ...
- 1,541
0
votes
0
answers
211
views
Apple asked for password to recover data during repair, I said no
My girlfriend's Macbook Air gave off a loud, electrical pop! and instantly became an expensive metallic paperweight with a slight odour of burnt things (though that may have been High Sierra). Apple ...
- 1,302
-1
votes
1
answer
892
views
Auto-Fill Windows Security Credentials
I am having a network issue that every time in a while it requires me to enter my windows credentials (it is company security thing)
If I don't do that I will have no internet connection on my laptop
...
- 99
-2
votes
1
answer
2k
views
Storing SSH credentials, need to decrypt them later for connection by python script
I am developing an application where one can add SSH credentials for servers and then an automated python script can fetch those credentials to login to the server and perform certain automated tasks. ...
- 101