Questions tagged [credentials]

Credentials in security context are elements that prove your identity to a system, for example a username and password or a client-side certificate. It is usually used to describe elements supplied by the authenticating client, not when the server authenticates to the client or in mutual authentication schemes.

Filter by
Sorted by
Tagged with
150
votes
12answers
27k views

Do I need to encrypt connections inside a corporate network?

Provided that I have a decent level of physical security in the office, I monitor the physical addresses of devices connected to the network and only give VPN access to trusted parties, do I need to ...
146
votes
8answers
16k views

How should I set up emergency access to business-critical secrets in case I am “hit by a bus”?

I work as the primary developer and IT administrator for a small business. I want to ensure that business can continue even if I suddenly become unavailable for some reason. Much of what I do requires ...
125
votes
8answers
24k views

Why is storing passwords in version control a bad idea?

My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?" I gave him an answer that ...
116
votes
13answers
26k views

Is it good or bad practice to allow a user to change their username?

I have looked all over online as well as this site to try to find out more information regarding the security of this, but haven't found anything. In my particular case, the product is a website, but ...
46
votes
5answers
7k views

Reasons to place a time limit on entering login credentials?

A service I use has a time limit (seemingly fairly short - 10-20 seconds maybe) on entering credentials at the login webpage. Attempting to login after this period gives the below message: [For ...
38
votes
2answers
35k views

How should an application store its credentials

Context When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, ...
30
votes
6answers
5k views

The most secure way to handle someone forgetting to verify their account?

Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account. Suppose they forget to verify it, and later try to login. Should the error ...
17
votes
3answers
9k views

How to handle emails as usernames under GDPR?

Using emails as usernames for webapps is a convenient way to avoid the "yet another online username" problem. As such, by using this approach, the emails should be easily available in the backend to ...
16
votes
2answers
24k views

How secure is the Windows Credential Manager?

I'm a Lastpass user and many times I thought about switching to the Credential Manager, for auto sync and a certain comfort with the windows environment. The only thing that I'm worried about is its ...
10
votes
1answer
4k views

Why store a salt along side the hashed password? [duplicate]

Understand the need to protection credentials with hashes that are expensive and to use cryptographically random salts. What I would like to understand is why you would store the salt along side the ...
9
votes
3answers
2k views

Protection of eduroam credentials

Recently my educational institution officially switched over from the their own wireless network to eduroam. If I understand correctly from the FAQ, credential authentication is performed on the ...
9
votes
1answer
22k views

How to read password from Windows credentials?

What is the cipher used by windows Credential Manager to generate credentials backup files (*.crd)? With a backup file from Credential Manager and the password used to created that backup file is it ...
9
votes
4answers
4k views

Where should a team store server credentials [duplicate]

Imagine we are working in a team of around 5 people. We all install new servers on a monthly base and need to find a better way of storing and sharing the server credentials (offline-location/...
9
votes
1answer
12k views

Where should I store a refresh token

I'm building an oauth 2.0 protocol. I'm wondering how the refresh token works exactly. My understanding is that the use of a refresh token enable short lived access token and therefore limits the ...
8
votes
4answers
2k views

Can I replace username and password with a long random text in URL? [duplicate]

Scenario One customer is facing a problem with his users: they use a (web) service a few times per year and they forget their credentials very often. There is a standard password recovery procedure ...
8
votes
2answers
3k views

Are userid and password needed in order to pentest a website?

We are a company that has many web applications developed in ASP.NET. Our Internet service provider (Telefonica) wants to test our web sites looking for vulnerabilities. For that, they are asking us ...
8
votes
3answers
934 views

Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?

Recently, eslint-scope and eslint-config-eslint packages were hacked in an interesting way - one of the maintainer's account was compromised by an attacker and a new "patch" version with the malicious ...
8
votes
2answers
484 views

How to separate storing sensitive data and hash passwords?

Scenario: I have a web application with an authentication system (classic). The application is basically an interface to a DB (MongoDB) which holds sensitive data. I properly hash the stored passwords....
7
votes
3answers
2k views

How are leaked government credentials possible and what's the point?

In the wake of all these leaked/stolen/hacked government login/passwords being stolen it got me thinking. How is the leaking of these passwords even possible? Or are they of any real use? Aren't all ...
7
votes
1answer
498 views

What is Credential forwarding attack?

What is credential forwarding attack? Does this happen only when the client connects to two servers with same credentials?
6
votes
2answers
3k views

Are SOCKS5 credentials safe during authentication on proxy server

I've read several tutorials, but not totally sure. If I'll set up my own SOCKS5 proxy server on VPS, configure it to use username and password. Will this credentials be safe while authentication on ...
6
votes
1answer
20k views

How to securely store credentials in a bash variables?

I need to cache my user credentials in a shell script variable since they are required for multiple requests to a REST-API. It won't be stored in the bash script file itself: user is prompted to enter ...
6
votes
1answer
2k views

When should I generate new public & private keys using RSA?

I'm creating a huge, online mobile game. I have a few questions for you guys because my knowledge in cryptography and sending data across the network securely is kinda poor. Some details: Each user ...
6
votes
3answers
603 views

Is it OK to pass credentials to the client to allow it to upload files to Amazon S3?

Our mobile app will be uploading images to AWS S3. The question is whether to do one of the following options: Upload the image to our APIs server, then our APIs server uploads the image to S3 Pros: ...
6
votes
1answer
747 views

Ruby Devise salt exposed

The remember_user_token cookie token generated by the Ruby Devise authentication component reveals part of a bcrypt salted credential when decoded. For example: remember_user_token=...
5
votes
2answers
2k views

Firefox not deleting HTTP Basic authentication credentials although being instructed to do so

On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters....
5
votes
3answers
5k views

How to protect our server from brute force attack? [closed]

One of the most common cyber attack is Bruteforce , what are the mechanisms available to protect this attack and how industry apply these mechanisms to mitigate the attacks (best practices)?
5
votes
1answer
9k views

Correct way to perform secure two way encryption on a web site

I'm currently working a project that requires me to store sensitive information (mainly passwords and other information) on a web server via a standard python/flask website. This information is to be ...
5
votes
3answers
448 views

Distribute Program with Sheets API Credentials

I am trying to write a program that uses the Google Sheets API to read spreadsheets and operate on the data. My program contains a credentials.json file which I obtained from the Java Quickstart page ...
5
votes
1answer
634 views

Why is Windows Credential Guard secure, when Windows is able to “access” credentials using RPC?

I've read some blogs that describe Windows Credential Guard: how it works and which security benefits it provides. However, some of them mention that Windows can "access" credentials using RPC calls ...
5
votes
2answers
904 views

Appropriate response to 2014 Russian Security Breach (CyberVor)

The report from Hold Security says that 1.2 billion sets of credentials are in the possession of this party. I have a feeling that this report may be a hoax or a partial hoax due to grammatical errors ...
5
votes
4answers
438 views

Is it a bad idea to ask for user e-mail and e-mail password?

I work as a tester at a company that makes network security appliances, I am having some discussions with a developer about a feature. The feature is that the notification e-mails sent to the user by ...
4
votes
4answers
608 views

How do large organisations manage access for their Instagram account?

A platform like Facebook has fairly standard access management for Facebook pages - where multiple individual user accounts can be assigned to roles with varying privileges on the Facebook page, and ...
4
votes
3answers
14k views

Where are the user credentials stored when remember password is selected?

Provided a user has chosen the remember me option while logged in last time into a web application,how does the web application server identifies the user next time when he logs in? The credentials ...
4
votes
1answer
6k views

Read all git cached password

in a 10+ people team we access the same ubuntu VM and we 'su' to the same user. On that user we make use of git-credential-cache feature to not type our personal password again and again. As all ...
4
votes
1answer
239 views

How can I know that whoever called me is my cellphone service provider?

I just refused to give my credentials to a phone call operator who called me. and I wonder whether I did the right thing. Background. My cellphone operator (call them Alpha) uses a simple ...
4
votes
1answer
289 views

Keeping a user's passwords, but can't hash them

I'm making a web application to provide intermediary service for customers to facilitate their interaction with a set of other web applications. A simplified example would be to let a user access his ...
4
votes
1answer
237 views

What can an attacker do with credentials.json [duplicate]

A few months ago I was experimenting with a project which needed to read a Google sheets page. It didn't end up going anywhere, but today I accidentally checked the project, including credentials.json ...
4
votes
1answer
2k views

MsChapV2 authentication and Evil Twin attack

I'm trying to understand the dynamics of the authentication process in the MS-CHAPV2 protocol. In particular, if I implement an Evil Twin attack I can't understand how it's possible that I can ...
4
votes
1answer
478 views

What is the best practice for giving Oracle DB credentials to a Java Application?

I have Java applications (using Spring running in Jetty Servlet containers) that need to access an Oracle database. What is the best practice for giving the DB credentials to the applications? I came ...
4
votes
1answer
604 views

Hard Coded Credentials in Equipment Serviced by Many People

According to National Public Radio, Ruben Santamarta has reported that gear aboard airliners and accessible through on-board WiFi or in-flight entertainment equipment uses hard-coded login credentials....
4
votes
0answers
84 views

Security implications of using unfused U2F token

I noticed that both of the Feitian USB/NFC U2F Security Keys I purchased on Amazon a few years ago are unfused. This means that the pre-personalization step was partially performed but not completed ...
4
votes
0answers
2k views

Security flaw in iOS, Safari weird behavior or what else?

some months ago I was travelling and flew from Frankfurt airport and, while there, I probably connected to some Telekom.de free hotspot. I have an iPhone 6 with iOS 9.02 (at that time it was 8.1.x). ...
4
votes
0answers
1k views

copying roaming profile credential file of another computer

I am trying to recover login information of another computer. I have managed to copy the local/roaming profile credential files located in C:\users\%username%\APPDATA\local\Microsoft\Credentials\ and ...
4
votes
2answers
280 views

Identify malicious hosts in our network by sending valid domain credentials

We are currently whitelisting the hosts owned by our company on our Cisco switches to prevent private hosts in our network. This works pretty well but someone can still spoof the MAC address of his ...
3
votes
2answers
149 views

How should large organisations manage credentials?

How should large companies store credentials for important systems, such as root access to an integral machine (e.g. high-traffic web server), or social media accounts?
3
votes
1answer
127 views

Technical realization of fraudulent credit card cash withdrawal

Somebody unauthorized in India managed to withdraw cash from my credit card account. The card I use (and which they claim to have used) is a German Visa prepaid card issued by Postbank. It has a chip ...
3
votes
2answers
137 views

RDP violation without credentials

On a Windows Server 2003 machine seems like someone has logged in through RDP without using credentials: there is a logged access, but there are nor userid nor password. I am wondering how is this ...
3
votes
3answers
3k views

Bank sends one-time password by e-mail (while sending on SMS) for transaction verification; is this insecure?

Most of the banks uses OTP (One Time Password) to enrich the authentication through dual factor. But I observed Banks are sending the OTP to mobile as well as email. I suppose sharing passwords on ...
3
votes
2answers
1k views

How are WPA Keys stored on a router?

Should the router only store a hash of my encryption key or is it stored as plaintext? I believe (but not certain) that the WPA key is itself an encryption key, buy shouldn't that be encrypted like ...