Questions tagged [credentials]
Credentials in security context are elements that prove your identity to a system, for example a username and password or a client-side certificate. It is usually used to describe elements supplied by the authenticating client, not when the server authenticates to the client or in mutual authentication schemes.
194
questions
150
votes
12
answers
28k
views
Do I need to encrypt connections inside a corporate network?
Provided that I have a decent level of physical security in the office, I monitor the physical addresses of devices connected to the network and only give VPN access to trusted parties, do I need to ...
- 1,451
147
votes
8
answers
16k
views
How should I set up emergency access to business-critical secrets in case I am "hit by a bus"?
I work as the primary developer and IT administrator for a small business. I want to ensure that business can continue even if I suddenly become unavailable for some reason. Much of what I do requires ...
- 1,489
127
votes
8
answers
27k
views
Why is storing passwords in version control a bad idea?
My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?"
I gave him an answer that ...
- 6,534
116
votes
13
answers
30k
views
Is it good or bad practice to allow a user to change their username?
I have looked all over online as well as this site to try to find out more information regarding the security of this, but haven't found anything. In my particular case, the product is a website, but ...
- 1,061
46
votes
5
answers
7k
views
Reasons to place a time limit on entering login credentials?
A service I use has a time limit (seemingly fairly short - 10-20 seconds maybe) on entering credentials at the login webpage. Attempting to login after this period gives the below message:
[For ...
- 550
40
votes
2
answers
38k
views
How should an application store its credentials
Context
When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, ...
- 502
30
votes
6
answers
6k
views
The most secure way to handle someone forgetting to verify their account?
Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account.
Suppose they forget to verify it, and later try to login.
Should the error ...
- 581
26
votes
3
answers
13k
views
How to handle emails as usernames under GDPR?
Using emails as usernames for webapps is a convenient way to avoid the "yet another online username" problem. As such, by using this approach, the emails should be easily available in the backend to ...
- 363
22
votes
2
answers
34k
views
How secure is the Windows Credential Manager?
I'm a Lastpass user and many times I thought about switching to the Credential Manager, for auto sync and a certain comfort with the windows environment. The only thing that I'm worried about is its ...
user106781
14
votes
1
answer
7k
views
Why store a salt along side the hashed password? [duplicate]
Understand the need to protection credentials with hashes that are expensive and to use cryptographically random salts.
What I would like to understand is why you would store the salt along side the ...
- 394
10
votes
1
answer
15k
views
Where should I store a refresh token
I'm building an oauth 2.0 protocol. I'm wondering how the refresh token works exactly.
My understanding is that the use of a refresh token enable short lived access token and therefore limits the ...
- 201
9
votes
3
answers
3k
views
Protection of eduroam credentials
Recently my educational institution officially switched over from the their own wireless network to eduroam.
If I understand correctly from the FAQ, credential authentication is performed on the ...
- 2,257
9
votes
1
answer
32k
views
How to read password from Windows credentials?
What is the cipher used by windows Credential Manager to generate credentials backup files (*.crd)?
With a backup file from Credential Manager and the password used to created that backup file is it ...
- 201
9
votes
4
answers
5k
views
Where should a team store server credentials [duplicate]
Imagine we are working in a team of around 5 people. We all install new servers on a monthly base and need to find a better way of storing and sharing the server credentials (offline-location/...
- 215
8
votes
4
answers
5k
views
Enabling a user to revert a hacked change in their email
I am writing a web app and I want to set up a system where, when a user changes their email, it gives them a link to have the change revert back. The purpose of this is for when a hacker changes an ...
- 493
8
votes
4
answers
2k
views
Can I replace username and password with a long random text in URL? [duplicate]
Scenario
One customer is facing a problem with his users: they use a (web) service a few times per year and they forget their credentials very often. There is a standard password recovery procedure ...
- 261
8
votes
2
answers
4k
views
Are userid and password needed in order to pentest a website?
We are a company that has many web applications developed in ASP.NET. Our Internet service provider (Telefonica) wants to test our web sites looking for vulnerabilities. For that, they are asking us ...
- 423
8
votes
2
answers
31k
views
How to securely store credentials in a bash variables?
I need to cache my user credentials in a shell script variable since they are required for multiple requests to a REST-API. It won't be stored in the bash script file itself: user is prompted to enter ...
- 81
8
votes
3
answers
1k
views
Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?
Recently, eslint-scope and eslint-config-eslint packages were hacked in an interesting way - one of the maintainer's account was compromised by an attacker and a new "patch" version with the malicious ...
- 1,585
8
votes
2
answers
636
views
How to separate storing sensitive data and hash passwords?
Scenario: I have a web application with an authentication system (classic). The application is basically an interface to a DB (MongoDB) which holds sensitive data. I properly hash the stored passwords....
- 81
7
votes
3
answers
2k
views
How are leaked government credentials possible and what's the point?
In the wake of all these leaked/stolen/hacked government login/passwords being stolen it got me thinking.
How is the leaking of these passwords even possible? Or are they of any real use?
Aren't all ...
- 221
7
votes
1
answer
4k
views
Logging in as another user - Security Issue
Two users are using same web application online. Suddenly, I checked my profile and it was data of another user. How this is possible? We both are using the same app at the same time, the app is on ...
- 87
7
votes
2
answers
5k
views
Are SOCKS5 credentials safe during authentication on proxy server
I've read several tutorials, but not totally sure.
If I'll set up my own SOCKS5 proxy server on VPS, configure it to use username and password. Will this credentials be safe while authentication on ...
- 173
7
votes
1
answer
634
views
What is Credential forwarding attack?
What is credential forwarding attack? Does this happen only when the client connects to two servers with same credentials?
- 285
6
votes
3
answers
4k
views
Firefox not deleting HTTP Basic authentication credentials although being instructed to do so
On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters....
- 567
6
votes
1
answer
7k
views
Read all git cached password
in a 10+ people team we access the same ubuntu VM and we 'su' to the same user. On that user we make use of git-credential-cache feature to not type our personal password again and again.
As all ...
- 163
6
votes
1
answer
3k
views
When should I generate new public & private keys using RSA?
I'm creating a huge, online mobile game. I have a few questions for you guys because my knowledge in cryptography and sending data across the network securely is kinda poor.
Some details:
Each user ...
- 212
6
votes
2
answers
3k
views
Should user credentials and user info be stored in seperate tables?
Should I store credentials (like email, hashed password) in a separate table than the user's profile information (bio, gender, etc)?
My main concern is that I'll be sending other user's information (...
Brandon-Perry
6
votes
3
answers
1k
views
Is it OK to pass credentials to the client to allow it to upload files to Amazon S3?
Our mobile app will be uploading images to AWS S3. The question is whether to do one of the following options:
Upload the image to our APIs server, then our APIs server uploads the image to S3
Pros: ...
- 163
6
votes
1
answer
1k
views
Ruby Devise salt exposed
The remember_user_token cookie token generated by the Ruby Devise authentication component reveals part of a bcrypt salted credential when decoded.
For example:
remember_user_token=...
- 409
5
votes
3
answers
6k
views
How to protect our server from brute force attack? [closed]
One of the most common cyber attack is Bruteforce , what are the mechanisms available to protect this attack and how industry apply these mechanisms to mitigate the attacks (best practices)?
- 67
5
votes
1
answer
9k
views
Correct way to perform secure two way encryption on a web site
I'm currently working a project that requires me to store sensitive information (mainly passwords and other information) on a web server via a standard python/flask website. This information is to be ...
- 151
5
votes
1
answer
1k
views
Explanation of capabilities: CAP_NET_BIND_SERVICE
I am still studying kernel credential management (https://kernel.org/doc/html/v5.9/security/credentials.html) and I have encountered a use case I cannot explain.
I am in a VM (Kali).
❯ uname -a
...
- 205
5
votes
3
answers
626
views
Distribute Program with Sheets API Credentials
I am trying to write a program that uses the Google Sheets API to read spreadsheets and operate on the data.
My program contains a credentials.json file which I obtained from the Java Quickstart page ...
5
votes
1
answer
842
views
Why is Windows Credential Guard secure, when Windows is able to "access" credentials using RPC?
I've read some blogs that describe Windows Credential Guard: how it works and which security benefits it provides.
However, some of them mention that Windows can "access" credentials using RPC calls ...
- 1,207
5
votes
2
answers
942
views
Appropriate response to 2014 Russian Security Breach (CyberVor)
The report from Hold Security says that 1.2 billion sets of credentials are in the possession of this party. I have a feeling that this report may be a hoax or a partial hoax due to grammatical errors ...
- 535
5
votes
4
answers
508
views
Is it a bad idea to ask for user e-mail and e-mail password?
I work as a tester at a company that makes network security appliances, I am having some discussions with a developer about a feature.
The feature is that the notification e-mails sent to the user by ...
- 73
4
votes
4
answers
1k
views
How do large organisations manage access for their Instagram account?
A platform like Facebook has fairly standard access management for Facebook pages - where multiple individual user accounts can be assigned to roles with varying privileges on the Facebook page, and ...
- 717
4
votes
3
answers
15k
views
Where are the user credentials stored when remember password is selected?
Provided a user has chosen the remember me option while logged in last time into a web application,how does the web application server identifies the user next time when he logs in? The credentials ...
- 2,027
4
votes
3
answers
539
views
Best method to send credentials to clients
I'm constantly exchanging credentials with my clients for things like database servers, cloud accounts, etc. Neither I nor my clients, have time to implement a sophisticated method for secure ...
- 141
4
votes
1
answer
311
views
How can I know that whoever called me is my cellphone service provider?
I just refused to give my credentials to a phone call operator who called me. and I wonder whether I did the right thing.
Background. My cellphone operator (call them Alpha) uses a simple ...
- 159
4
votes
1
answer
358
views
Keeping a user's passwords, but can't hash them
I'm making a web application to provide intermediary service for customers to facilitate their interaction with a set of other web applications.
A simplified example would be to let a user access his ...
- 1,447
4
votes
1
answer
597
views
What can an attacker do with credentials.json [duplicate]
A few months ago I was experimenting with a project which needed to read a Google sheets page. It didn't end up going anywhere, but today I accidentally checked the project, including credentials.json ...
- 143
4
votes
1
answer
4k
views
MsChapV2 authentication and Evil Twin attack
I'm trying to understand the dynamics of the authentication process in the MS-CHAPV2 protocol. In particular, if I implement an Evil Twin attack I can't understand how it's possible that I can ...
- 41
4
votes
1
answer
646
views
What is the best practice for giving Oracle DB credentials to a Java Application?
I have Java applications (using Spring running in Jetty Servlet containers) that need to access an Oracle database. What is the best practice for giving the DB credentials to the applications?
I came ...
- 143
4
votes
1
answer
647
views
Hard Coded Credentials in Equipment Serviced by Many People
According to National Public Radio, Ruben Santamarta has reported that gear aboard airliners and accessible through on-board WiFi or in-flight entertainment equipment uses hard-coded login credentials....
- 5,303
4
votes
0
answers
187
views
Security implications of using unfused U2F token
I noticed that both of the Feitian USB/NFC U2F Security Keys I purchased on Amazon a few years ago are unfused. This means that the pre-personalization step was partially performed but not completed ...
4
votes
0
answers
2k
views
Should I hash my refresh tokens before storing them in the server's database? [duplicate]
I have a service with a client app (Mac).
To log in, users enter their username and password in the client app, which sends this information to the server.
The server verifies this information using ...
- 151
4
votes
0
answers
2k
views
Security flaw in iOS, Safari weird behavior or what else?
some months ago I was travelling and flew from Frankfurt airport and, while there, I probably connected to some Telekom.de free hotspot. I have an iPhone 6 with iOS 9.02 (at that time it was 8.1.x).
...
- 153
4
votes
0
answers
1k
views
copying roaming profile credential file of another computer
I am trying to recover login information of another computer. I have managed to copy the local/roaming profile credential files located in C:\users\%username%\APPDATA\local\Microsoft\Credentials\ and ...
- 151