Questions tagged [credentials]
Credentials in security context are elements that prove your identity to a system, for example a username and password or a client-side certificate. It is usually used to describe elements supplied by the authenticating client, not when the server authenticates to the client or in mutual authentication schemes.
194
questions
0
votes
0
answers
110
views
Preventing Credential Sharing
What technical methods can be implemented to force Nextcloud Pi users from sharing authentication credentials? For example, In the military, this is halted with a certificates held in a smartchip in ...
- 1,541
1
vote
2
answers
186
views
Store sensitive decryptable data in database
I'm building a web application which configures and interconnects other applications through web services.
In all the data I have to save for each applications, there are some that are quite ...
- 11
1
vote
1
answer
841
views
How to harden against credential stealing in EC2 via the http://169.254.169.254 API?
AWS has a feature called Instance Metadata, which on EC2 gives you access to the AWS credentials through HTTP calls:
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>
...
- 1,064
0
votes
0
answers
50
views
How to stop the user from intercepting their own credentials in mobile apps? [duplicate]
We are experiencing fraud with our open API, so we're turning it private.
Let's suppose that I'm using OAuth and Bearer token to authorize who can access my API.
Request: App -> Credentials -> Auth ...
- 113
4
votes
1
answer
600
views
What can an attacker do with credentials.json [duplicate]
A few months ago I was experimenting with a project which needed to read a Google sheets page. It didn't end up going anywhere, but today I accidentally checked the project, including credentials.json ...
- 143
0
votes
2
answers
114
views
Failure on correct credentials with the consecutive success?
The idea to "improve" security is as follows - the service will reply with a failure code even if supplied credentials are correct, but then on a second (third/whatever configured) attempt it will ...
- 813
2
votes
2
answers
889
views
Securely provide AWS user with keys?
When creating a new user in AWS IAM, an admin sets the user's name and permissions for that user. The user's password and programmatic access keys (if programmatic access is granted) are then ...
3
votes
1
answer
579
views
Android Application - Credentials in RAM
I have been pen testing an android mobile application for security vulnerabilities.
As part of the test, I started Frida server on a mobile phone where the mobile application to be tested is installed,...
- 39
3
votes
1
answer
180
views
Is it unsafe to enter administrative Windows credentials when logged in as a regular user?
I was recently advised that when a user is logged in as a regular user and they need an administrator to do something (i.e. install an application) that entering the administrator credentials when the ...
- 133
30
votes
6
answers
6k
views
The most secure way to handle someone forgetting to verify their account?
Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account.
Suppose they forget to verify it, and later try to login.
Should the error ...
- 581
3
votes
1
answer
215
views
Technical realization of fraudulent credit card cash withdrawal
Somebody unauthorized in India managed to withdraw cash from my credit card account. The card I use (and which they claim to have used) is a German Visa prepaid card issued by Postbank. It has a chip ...
- 1,043
5
votes
3
answers
628
views
Distribute Program with Sheets API Credentials
I am trying to write a program that uses the Google Sheets API to read spreadsheets and operate on the data.
My program contains a credentials.json file which I obtained from the Java Quickstart page ...
2
votes
2
answers
796
views
If I turn off Windows Defender Credential Manager off in Windows 10 so I can run a virtual machine in Virtual Box, is that a bad idea?
My processor is supposed to support virtualization:
cpu.inf:5f63e534115a322c:IntelPPM_Inst.NT:10.0.17134.765:ACPI\GenuineIntel_-_Intel64
ACPI\GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_37_-_INTEL(R)_CORE(...
- 1,399
2
votes
1
answer
253
views
what is the scope of google drive's OAuth credentials?
I use google drive's OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive ...
- 185
0
votes
1
answer
269
views
Online payment integration requires handling my bank credentials. Why?
When doing a payment integration what would be the reasons the payment gateway would require your bank credentials instead of redirecting the client to his or her bank website?
The context of my ...
- 105
1
vote
2
answers
480
views
Device security in IOT
I am working on an IOT device that sends data to the server after authenticating itself to the server. Is there a way to safely store my device's credentials for logging onto the main server and ...
- 113
1
vote
0
answers
105
views
Remote access to Windows Workstation with credentials, after Windows 10 - 1809
I am a newbie in terms of OS security and I started learning from Windows; in particular I downloaded Win10 virtual machine and I am simulating various attack / defense scenarios on it.
I would like ...
- 11
0
votes
2
answers
108
views
How to secure an application deployed in some port [closed]
I was wondering, If there is a (private) application or service deployed at example.com:5000, how can someone prevent undesired requests to that port ?
I was thinking about a solution were the ...
- 115
3
votes
0
answers
329
views
Storing credentials in cookies? [closed]
Is there any use case where you would store hashed credentials in a cookie?
EDIT
I was discussing this problem with a colleague if it's advisable to do this.
Since then, I found an example where a ...
- 31
0
votes
3
answers
187
views
Shared terminal security hole
I want to ask you about what I think is a pretty obvious security hole and what can be done about it.
Suppose my library has a room containing network-connected workstations serving Linux. You log on ...
- 101
1
vote
0
answers
126
views
git credential cache and store
I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
- 111
0
votes
1
answer
177
views
What should be done if 2FA was turned off in an unexpected manner?
Today when I logged in Facebook, no 2FA was shown.
I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
- 2,257
1
vote
2
answers
758
views
Getting access and logging into employee's laptop - Can IT get access without the employee's own credentials?
If an employee's laptop is taken back from him/her for purposes of investigation, can the IT department/team that is in charge of issuing laptops etc. log into the employee's network account on this ...
- 11
0
votes
2
answers
2k
views
How to write down user credentials? [closed]
Sometimes we cannot avoid to write down usernames and passwords internally in our organisation. This is mainly for personal usage, not for reading by programs.
There are several ways to do this, e.g. ...
- 129
0
votes
1
answer
426
views
Windows Credential Guard protects credentials but not the remote access with the same credentials?
I wonder what is the real purpose of having credentials protected by Windows Credential Guard (WCG) when it is possible for malicious admin to obtain cached credentials (i.e. the ones not protected by ...
5
votes
1
answer
843
views
Why is Windows Credential Guard secure, when Windows is able to "access" credentials using RPC?
I've read some blogs that describe Windows Credential Guard: how it works and which security benefits it provides.
However, some of them mention that Windows can "access" credentials using RPC calls ...
- 1,207
1
vote
3
answers
279
views
Why allow a public API Key to change?
A common method of credentialing for an API is to give each use a public/private key pair. The public key is sent in with the request, and the private key is used to sign the request (and is verified ...
- 273
3
votes
3
answers
4k
views
Bank sends one-time password by e-mail (while sending on SMS) for transaction verification; is this insecure?
Most of the banks uses OTP (One Time Password) to enrich the authentication through dual factor.
But I observed Banks are sending the OTP to mobile as well as email.
I suppose sharing passwords on ...
- 2,043
1
vote
2
answers
113
views
Is my personal data at risk with global digital giant's services?
The global digital giant's services like facebook/gmail/twitter/etc are not following standard password policies (like the standard password policies used by most of the Enterprises/Corporate).
For ...
- 2,043
0
votes
1
answer
74
views
Will evolving bio metric capabilities on mobiles replaces online transaction verification through SMS (OTP)?
We are working on an online eCommerce site and we need to have online transactions. The common mechanism of verifying the online transaction seems the OTP (one Time Passwords) over SMS.
But this ...
- 2,043
3
votes
2
answers
208
views
RDP violation without credentials
On a Windows Server 2003 machine seems like someone has logged in through RDP without using credentials: there is a logged access, but there are nor userid nor password.
I am wondering how is this ...
- 33
6
votes
3
answers
4k
views
Firefox not deleting HTTP Basic authentication credentials although being instructed to do so
On one of my web servers, I have set up a password-protected directory using the well-known .htaccess / .htpasswd mechanism. The web server is run by Apache 2.4.10 under Debian jessie, if that matters....
- 567
-1
votes
1
answer
893
views
Auto-Fill Windows Security Credentials
I am having a network issue that every time in a while it requires me to enter my windows credentials (it is company security thing)
If I don't do that I will have no internet connection on my laptop
...
- 99
127
votes
8
answers
27k
views
Why is storing passwords in version control a bad idea?
My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?"
I gave him an answer that ...
- 6,534
0
votes
1
answer
249
views
Why would a password reset method be like this? Is it especially safe?
The library of the Technical University in my city (Europe) has a password reset system which I did not encounter anywhere else.
Students have to go to some office inside the university to get a new ...
user182259
8
votes
3
answers
1k
views
Recent ESLint hack or how can we protect ourselves from installing malicious npm packages?
Recently, eslint-scope and eslint-config-eslint packages were hacked in an interesting way - one of the maintainer's account was compromised by an attacker and a new "patch" version with the malicious ...
- 1,585
4
votes
0
answers
2k
views
Should I hash my refresh tokens before storing them in the server's database? [duplicate]
I have a service with a client app (Mac).
To log in, users enter their username and password in the client app, which sends this information to the server.
The server verifies this information using ...
- 151
1
vote
1
answer
326
views
Dealing with shared credentials when an employee leaves
We have around 20+ accounts of different services (company email inboxes, forums, social media, Github, etc.) we use in my team. For security reasons, whenever some employee leaves us, I need to ...
user15194
150
votes
12
answers
28k
views
Do I need to encrypt connections inside a corporate network?
Provided that I have a decent level of physical security in the office, I monitor the physical addresses of devices connected to the network and only give VPN access to trusted parties, do I need to ...
- 1,451
5
votes
3
answers
6k
views
How to protect our server from brute force attack? [closed]
One of the most common cyber attack is Bruteforce , what are the mechanisms available to protect this attack and how industry apply these mechanisms to mitigate the attacks (best practices)?
- 67
0
votes
1
answer
93
views
E-Mail Web Client: How to handle credentials
I am thinking about building an e-mail web client that I can run on my server as a side project. The server addresses should be configured on the server side.
Multiple Accounts should be able to ...
- 145
3
votes
2
answers
232
views
How should large organisations manage credentials?
How should large companies store credentials for important systems, such as root access to an integral machine (e.g. high-traffic web server), or social media accounts?
- 435
-2
votes
1
answer
2k
views
Storing SSH credentials, need to decrypt them later for connection by python script
I am developing an application where one can add SSH credentials for servers and then an automated python script can fetch those credentials to login to the server and perform certain automated tasks. ...
- 101
1
vote
1
answer
6k
views
Using Windows LSA Hashes obtained from crackmapexec
I have obtained some hashes using crackmapexec and dumping from the LSA process. The hashes are in this form (data below is fake):
adm_name:c6f132a235209036744ba5d303bd5d9b:SOME.ORGANISATION.COM:...
- 409
26
votes
3
answers
13k
views
How to handle emails as usernames under GDPR?
Using emails as usernames for webapps is a convenient way to avoid the "yet another online username" problem. As such, by using this approach, the emails should be easily available in the backend to ...
- 363
1
vote
0
answers
740
views
How can I safely use Get-Credential to obtain a username and password for a set period of time for use as command line arguments?
Credentials in the form of SSH keys can be stored in memory using SSH Agent; However, if clicking the wrong link, or running a malicious program they can also be snatched from memory and sent ...
- 1,399
2
votes
3
answers
3k
views
Managing db credentials for web applications
Is there an alternative to properties files for managing DB (and other service) connection credentials for a group of web applications? Couldn't you use something similar to a service registry?
For ...
- 184
4
votes
4
answers
1k
views
How do large organisations manage access for their Instagram account?
A platform like Facebook has fairly standard access management for Facebook pages - where multiple individual user accounts can be assigned to roles with varying privileges on the Facebook page, and ...
- 717
4
votes
1
answer
4k
views
MsChapV2 authentication and Evil Twin attack
I'm trying to understand the dynamics of the authentication process in the MS-CHAPV2 protocol. In particular, if I implement an Evil Twin attack I can't understand how it's possible that I can ...
- 41
7
votes
2
answers
5k
views
Are SOCKS5 credentials safe during authentication on proxy server
I've read several tutorials, but not totally sure.
If I'll set up my own SOCKS5 proxy server on VPS, configure it to use username and password. Will this credentials be safe while authentication on ...
- 173