Questions tagged [credentials]
Credentials in security context are elements that prove your identity to a system, for example a username and password or a client-side certificate. It is usually used to describe elements supplied by the authenticating client, not when the server authenticates to the client or in mutual authentication schemes.
194
questions
6
votes
1
answer
1k
views
Ruby Devise salt exposed
The remember_user_token cookie token generated by the Ruby Devise authentication component reveals part of a bcrypt salted credential when decoded.
For example:
remember_user_token=...
- 409
2
votes
1
answer
274
views
How does a "fake" network-adapter steal credentials?
I've read that devices that look like USB flash drives can be hidden network cards that can then steal credentials even when the screen is locked. (Like the Bash Bunny)
I understand that being the ...
- 773
4
votes
1
answer
311
views
How can I know that whoever called me is my cellphone service provider?
I just refused to give my credentials to a phone call operator who called me. and I wonder whether I did the right thing.
Background. My cellphone operator (call them Alpha) uses a simple ...
- 159
1
vote
1
answer
936
views
Is it secure to store encryption key (encrypted with master key) with the data it was used to encrypt?
I am working on a password sharing web site. I would like users to be able to enter their credentials and share them with other users. I am thinking about using KMS service to store master key (just ...
2
votes
2
answers
406
views
Sending Credentials On Each Request
I am going to be using a Symfony SMB Bundle like this to browse a Windows File System through PHP.
To do this - I'll create a Web API that will return a list of files and directories in a directory ...
- 21
0
votes
0
answers
210
views
Apple asked for password to recover data during repair, I said no
My girlfriend's Macbook Air gave off a loud, electrical pop! and instantly became an expensive metallic paperweight with a slight odour of burnt things (though that may have been High Sierra). Apple ...
- 1,302
116
votes
13
answers
30k
views
Is it good or bad practice to allow a user to change their username?
I have looked all over online as well as this site to try to find out more information regarding the security of this, but haven't found anything. In my particular case, the product is a website, but ...
- 1,061
5
votes
4
answers
508
views
Is it a bad idea to ask for user e-mail and e-mail password?
I work as a tester at a company that makes network security appliances, I am having some discussions with a developer about a feature.
The feature is that the notification e-mails sent to the user by ...
- 73
0
votes
1
answer
195
views
Should I expose AWS Credentials on github?
Before you screen "No, never!", please read on :)
Question:
Is hard-coding IAM creds with extremely restricted permissions (only GET requests to s3) ok? I realize that there are other ways, but they ...
- 171
3
votes
0
answers
139
views
Credential leaking while unconscious [closed]
Bear with me here, because this admittedly sounds nutty, but I had a dream last night in which I distinctly recall (accurately) typing the master password for my password manager into a (dream) ...
- 39
1
vote
1
answer
643
views
How to handle sensitive data like API-keys and DB passwords on production
I'm setting up a development and production environment for a web application. It uses some remote APIs for which you need a key to access them. You don't want those in your code, as well as the ...
- 115
1
vote
1
answer
141
views
Sharing credentials based on the network profile
Is there a way to share logins/passwords with a number of individuals, basing on their public network profile?
Example: a number of people working together in the office should have access ...
- 111
3
votes
1
answer
754
views
Storing database credentials for multi server, multi db environment
What's the best practice for storing database credentials for an auto scaling environment, yet also requiring the ability to update database information?
For instance I have an auto-scaling site on ...
- 737
8
votes
2
answers
636
views
How to separate storing sensitive data and hash passwords?
Scenario: I have a web application with an authentication system (classic). The application is basically an interface to a DB (MongoDB) which holds sensitive data. I properly hash the stored passwords....
- 81
1
vote
2
answers
254
views
HSM key management system on AWS/Azure
I need to store user database credentials securely for an application to access.
I have considered:
- using AWS RDS with an encrypted PostgreSQL instance
- using the AWS key management system, backed ...
- 111
-1
votes
1
answer
87
views
Is There Any Real Benefit To Encrypting A Password Before Sending Over SSL [duplicate]
If my application is sending credentials to an auth server over https, is there any real benefit of encrypting it (using RSA for example) before sending it to the auth server? Or is the benefit so ...
- 273
1
vote
1
answer
328
views
Under HIPAA, is it allowable to remember/store user credentials?
My medical chat application is handling PHI, and it enforcing unique, secure logins which ensure that only authorized / appropriate people can access that data. For now, I implemented touchID ...
- 111
1
vote
1
answer
172
views
Should I use different browsers for surfing and logging into accounts?
I use web in different ways, i.e.:
a) to log into my accounts (email, google, social, forums, etc.);
b) for downloading softwares;
c) for surfing trusted websites;
d) for surfing websites which I don'...
- 481
46
votes
5
answers
7k
views
Reasons to place a time limit on entering login credentials?
A service I use has a time limit (seemingly fairly short - 10-20 seconds maybe) on entering credentials at the login webpage. Attempting to login after this period gives the below message:
[For ...
- 550
1
vote
1
answer
6k
views
Credentials in URL for Python "Requests" library [closed]
Will using the following code result in credentials being passed in the URL?
I know it is a GET method, but how does the python requests library process this?
Does it attach it to the URL or attach it ...
- 137
1
vote
1
answer
3k
views
Credentialed scanning through SSH tunnel
If I wish to run Nessus against a Windows server that is only accessible from another machine, I can setup an SSH tunnel like so:
ssh [email protected] -L 127.0.0.1:445:10.0.0.45:445 -L 127.0.0.1:139:10....
- 34k
1
vote
2
answers
167
views
How to proceed after attempted cracking to accounts? [closed]
I was woken today at 05:15 by a phone call from my bank, notifying me that the PIN number is XXXX. I did not ask to change my PIN number, and actually, have not accessed the bank account ...
- 121
1
vote
0
answers
178
views
Implications of FirebaseAuth credentials in an Android .apk
I'm currently looking at an .apk for Android and I came across some hard-coded credentials. Apparently these are used for something called FireBaseAuth, which seems to be a Google service.
I'm not ...
6
votes
3
answers
1k
views
Is it OK to pass credentials to the client to allow it to upload files to Amazon S3?
Our mobile app will be uploading images to AWS S3. The question is whether to do one of the following options:
Upload the image to our APIs server, then our APIs server uploads the image to S3
Pros: ...
- 163
1
vote
0
answers
490
views
How to cache auth credentials to speed up authentication
I'm developing some REST API that requires a HTTP basic auth to access. The APIs are written in Django, and the auth is based on Django auth middleware that is: it checks against the DB, the username ...
- 703
2
votes
1
answer
320
views
Is it safe to include full filesystem paths in files published on Github?
Some of the configuration files I mean to publish as part of a Github project include full filesystem paths (including username login) in my localhost. Does this pose as a possible security ...
- 23
1
vote
3
answers
217
views
If LDAP credentials are leaked, is IP whitelist still sufficient protection?
In a situation where LDAP credentials get leaked but there is still an IP whitelist in place...
My gut feeling says this isn't right; the credentials should be changed. Is this correct? What ...
- 115
8
votes
2
answers
31k
views
How to securely store credentials in a bash variables?
I need to cache my user credentials in a shell script variable since they are required for multiple requests to a REST-API. It won't be stored in the bash script file itself: user is prompted to enter ...
- 81
1
vote
2
answers
3k
views
Storing user credentials in local file or database
I'm designing a webapp from ground up.
From a security standpoint, assuming in both cases I will be hashing with a salt, a peper and a proper hashing algorithm.
Am I better off storing the user ...
- 1,132
2
votes
1
answer
84
views
Storing of customer creds from third party server with reading access to it
Our service will provide some automation over another service. Customers share the password with us, and our staff make the customer's work. Another work will going on our working agents(remote server)...
- 121
0
votes
2
answers
1k
views
How to store user credentials in a web application? [closed]
I use the Twitter API in my app. I used to store the OAuth 2 tokens of the associated Twitter account within an application config.
But now the application's users have to be able, using the web ...
- 101
3
votes
1
answer
295
views
Where should we maintain external (subcontractors) usernames and passwords?
We have three environments:
Testing and development
Preproduction
Production
In our company all technical people, including sysadmins and network administrators, are subcontractors so a lot of them (...
- 1,507
3
votes
0
answers
210
views
Is it possible to avoid storing username and password in settings.xml in Jenkins? [closed]
In the project's source files there is settings.xml, which according to the official documentation contains the credentials of the servers jenkins needs to authenticate, but in plain text. Is there ...
- 131
6
votes
1
answer
7k
views
Read all git cached password
in a 10+ people team we access the same ubuntu VM and we 'su' to the same user. On that user we make use of git-credential-cache feature to not type our personal password again and again.
As all ...
- 163
2
votes
5
answers
2k
views
Scan the codebase for username passwords
What would be the best way to scan a codebase to ensure there are no production-level credentials included in the codebase? We have tried doing Static Scans via some major tools but I do still see ...
- 177
1
vote
1
answer
540
views
Automatic detection of credential leaking and secret servers
Are there any frameworks or applications available for automatic detection of credential or secrets being leaked?
So far, I've found a number of academic papers on papers on the subject but no ...
- 111
6
votes
1
answer
3k
views
When should I generate new public & private keys using RSA?
I'm creating a huge, online mobile game. I have a few questions for you guys because my knowledge in cryptography and sending data across the network securely is kinda poor.
Some details:
Each user ...
- 212
4
votes
1
answer
646
views
What is the best practice for giving Oracle DB credentials to a Java Application?
I have Java applications (using Spring running in Jetty Servlet containers) that need to access an Oracle database. What is the best practice for giving the DB credentials to the applications?
I came ...
- 143
-2
votes
1
answer
252
views
Logging into another another person's account [closed]
There were instances in the past where I logged in with my own credentials, but it showed me as a different user after logging in.
How does this usually happen?
0
votes
2
answers
459
views
session credentials on the client
I am developing an IE11 based application running on a web server inside our corporate network
The application makes calls to a 3rd party API which requires client certificates and username/password ...
- 3
10
votes
1
answer
15k
views
Where should I store a refresh token
I'm building an oauth 2.0 protocol. I'm wondering how the refresh token works exactly.
My understanding is that the use of a refresh token enable short lived access token and therefore limits the ...
- 201
4
votes
2
answers
323
views
Identify malicious hosts in our network by sending valid domain credentials
We are currently whitelisting the hosts owned by our company on our Cisco switches to prevent private hosts in our network. This works pretty well but someone can still spoof the MAC address of his ...
- 4,313
1
vote
1
answer
1k
views
How to secure android REST basic authentication credentials against reverse engineering?
As far as I know, in basic REST API authentication, username and password to access web service resources are baked into the app's code.
On the other hand, it seems not difficult to reverse engineer ...
- 145
2
votes
0
answers
115
views
What is the current consensus on storage of primary credentials or long-lived cryptographic tokens?
The problem: some environments need to use plain text credentials or long-lived tokens in order to unlock a specific functionality. Examples include
third party legacy services which need a login/...
- 9,028
2
votes
1
answer
366
views
OAuth 2.0 Resource Owner Password Grant - Handling of Access Token Upon Logging Out
I am new to OAuth 2.0. I used BShaffer's OAuth PHP Server on Authorization Code Grant, and I understand that the client application can have its OAuth token separate from its session authentication, ...
- 21
1
vote
1
answer
700
views
How does Mail.app handle account credentials?
I am looking for an iOS email client that is reasonably secure (ideally, this means that it doesn't store user credentials outside the device - so something like Spark or Outlook for iOS are a no go ...
- 1,947
22
votes
2
answers
34k
views
How secure is the Windows Credential Manager?
I'm a Lastpass user and many times I thought about switching to the Credential Manager, for auto sync and a certain comfort with the windows environment. The only thing that I'm worried about is its ...
user106781
1
vote
1
answer
2k
views
How can I manually add login credentials through the Windows Credential Manager? [closed]
For example I'd like to add the Steam login credentials, since the browsers won't ask to save the password. Is there a way to do it manually?
If I choose to add a new windows credentials and put in ...
user106781
2
votes
3
answers
6k
views
Safe way to store credentials for an application
I want to use an API for one of the projects on which I am working. What's the good practice/way to store the credentials required for the API? For example, I don't want to later push the project into ...
- 21
7
votes
1
answer
634
views
What is Credential forwarding attack?
What is credential forwarding attack? Does this happen only when the client connects to two servers with same credentials?
- 285