Questions tagged [credentials]
Credentials in security context are elements that prove your identity to a system, for example a username and password or a client-side certificate. It is usually used to describe elements supplied by the authenticating client, not when the server authenticates to the client or in mutual authentication schemes.
194
questions
2
votes
2
answers
276
views
What auth info is locally revealed with eduroam WPA-Enterprise 802.1X?
If you authenticated with your eduroam credentials at a participating institution, your home institution is the one doing the authentication of the credentials, and the host institution is only ...
- 1,924
1
vote
2
answers
5k
views
Default user names to avoid
Following this answer on a question about fake users, is there a general list of users which would be deemed to be a common username?
The part of the linked answer I'm referring to is
Don't use a ...
- 384
8
votes
4
answers
2k
views
Can I replace username and password with a long random text in URL? [duplicate]
Scenario
One customer is facing a problem with his users: they use a (web) service a few times per year and they forget their credentials very often. There is a standard password recovery procedure ...
- 261
147
votes
8
answers
16k
views
How should I set up emergency access to business-critical secrets in case I am "hit by a bus"?
I work as the primary developer and IT administrator for a small business. I want to ensure that business can continue even if I suddenly become unavailable for some reason. Much of what I do requires ...
- 1,489
1
vote
1
answer
116
views
If You Use Secure Sites with Extended Validation Certificates How Much Do You Still Have To Worry About Phishing Sites Impersonating Them?
Was mulling over the issue of protecting users from password-stealing phishing sites when an interesting question that hadn't occurred to me before popped into my head:
Let's say that I decide to ...
- 2,735
4
votes
0
answers
2k
views
Security flaw in iOS, Safari weird behavior or what else?
some months ago I was travelling and flew from Frankfurt airport and, while there, I probably connected to some Telekom.de free hotspot. I have an iPhone 6 with iOS 9.02 (at that time it was 8.1.x).
...
- 153
14
votes
1
answer
7k
views
Why store a salt along side the hashed password? [duplicate]
Understand the need to protection credentials with hashes that are expensive and to use cryptographically random salts.
What I would like to understand is why you would store the salt along side the ...
- 394
9
votes
3
answers
3k
views
Protection of eduroam credentials
Recently my educational institution officially switched over from the their own wireless network to eduroam.
If I understand correctly from the FAQ, credential authentication is performed on the ...
- 2,257
2
votes
5
answers
604
views
How can a user detect when a web server is phishing his credentials?
These days so many websites/apps (including StackExchange) allow logging in using your Facebook, GoogleId, or LinkedIn credentials. Whatever method you choose, you are presented a box to enter your ...
- 21
2
votes
2
answers
251
views
Prevent Web Login with Credentials Exposed
We have a situation here. The client which I work for is currently placed as a finance brokerage firm and their current positioning are:
The firm has different branches in different locations
The ...
- 1,602
2
votes
0
answers
987
views
SEToolkit: havester not capturing credentials
I am using the Setoolkit on Ubuntu. I am testing it by cloning Facebook and logging myself in locally to see if I capture my own credentials. However,no POSTS are written to the harvester text file ...
- 737
2
votes
0
answers
129
views
Where should I store encrypted data so as to have app-exclusive access?
I am using windows Data Protection API (DPAPI) to protect private key used in my application. I cannot hide entropy used in DPAPI call because my application needs to be open source.
Where should I ...
- 131
9
votes
1
answer
32k
views
How to read password from Windows credentials?
What is the cipher used by windows Credential Manager to generate credentials backup files (*.crd)?
With a backup file from Credential Manager and the password used to created that backup file is it ...
- 201
7
votes
3
answers
2k
views
How are leaked government credentials possible and what's the point?
In the wake of all these leaked/stolen/hacked government login/passwords being stolen it got me thinking.
How is the leaking of these passwords even possible? Or are they of any real use?
Aren't all ...
- 221
1
vote
1
answer
534
views
QR-code based credential retrieval?
This is a sort of design review question that I'm hoping is suitable for this site.
I am designing a system that uses a cloud service to establish a secure connection between a PC and a mobile device....
- 111
1
vote
2
answers
996
views
Encrypting user credentials using AES: how to hide the key
One of my software (an R package) has to save on disk users sensitive information.
I encrypt such information using AES encryption using a random key that
is generated at the moment of installation (...
- 111
0
votes
1
answer
348
views
Does Linux and Mac OSX have built-in Credential/Password Managers with API access? [closed]
Does Linux and Mac OSX have built-in Credential/Password Managers with API access like Windows has with its CredMan (CredWrite, etc). It would be preferrable if they could be used without the need to ...
- 143
0
votes
1
answer
879
views
SSO software – where is symmetric key stored?
In SSO software (Oracle E-SSO …), I heard about (primary) key encrypting user’s credentials, but I can’t read anything about how this key is managed ?
When using smartcard, I can understand that ...
- 717
2
votes
1
answer
1k
views
Hiding remote database credentials in application
If I'm building an application that connects to a remote database, where should I hide the credentials?
I've seen many suggest that you go through a web-application and use POST and GET requests to ...
- 193
2
votes
3
answers
1k
views
Validating Credentials - Logic in Application vs Database
I am studying
Web Application Security, A Beginner's Guide Paperback – November 3, 2011
by Bryan Sullivan (Author), Vincent Liu (Author)
On pp 69, "Validating Credentials", they say you can ...
- 249
9
votes
4
answers
5k
views
Where should a team store server credentials [duplicate]
Imagine we are working in a team of around 5 people. We all install new servers on a monthly base and need to find a better way of storing and sharing the server credentials (offline-location/...
- 215
4
votes
3
answers
15k
views
Where are the user credentials stored when remember password is selected?
Provided a user has chosen the remember me option while logged in last time into a web application,how does the web application server identifies the user next time when he logs in? The credentials ...
- 2,027
1
vote
1
answer
515
views
Connecting to Oracle Database from VBScript - Hiding Credentials
At work our first level support uses a ticket management system that allows us to add extra functionality via VBScripts that the application invokes. First level support also receives quite a few ...
- 303
1
vote
1
answer
190
views
How to maintain validity of user credentials?
In an example scenario consider that;
I am a customer of organisation and I have two separate accounts with two different departments X and Y.
I can login in to each department's website by using ...
- 133
5
votes
1
answer
9k
views
Correct way to perform secure two way encryption on a web site
I'm currently working a project that requires me to store sensitive information (mainly passwords and other information) on a web server via a standard python/flask website. This information is to be ...
- 151
5
votes
2
answers
942
views
Appropriate response to 2014 Russian Security Breach (CyberVor)
The report from Hold Security says that 1.2 billion sets of credentials are in the possession of this party. I have a feeling that this report may be a hoax or a partial hoax due to grammatical errors ...
- 535
4
votes
1
answer
647
views
Hard Coded Credentials in Equipment Serviced by Many People
According to National Public Radio, Ruben Santamarta has reported that gear aboard airliners and accessible through on-board WiFi or in-flight entertainment equipment uses hard-coded login credentials....
- 5,303
0
votes
2
answers
266
views
securely storing password in a file
I am working on making a log file for a small application. If an error occurs in the application then I have to send a mail to a person. I've figured out the code to send a mail to a person, but I don'...
- 1
2
votes
1
answer
280
views
Credential In Windows [closed]
How can I view the Credentials stored in Windows?
Is there any possible way to view the stored password?
I can just export them..
- 21
2
votes
0
answers
102
views
Storing Tenants Cloud Keys In a Database
Imagine you are building a public service where you need to store the customer's cloud credentials(like their aws secret and access keys) in your database to regularly use by your backend services in ...
- 323
1
vote
3
answers
10k
views
How to scan a website using Nessus with login credentials
I have scanned my website using Nessus. But I need to scan it as a logged in user since most of the URLs are accessible only if we are logged in. How can I set website login credentials in Nessus?
- 442
2
votes
1
answer
846
views
/WEB-INF/web.xml showing MySQL credentials?
I found the file /WEB-INF/web.xml on a domain I'm associated with. The XML file contains:
<database>
<jndi-name>jdbc/mysql</jndi-name>
<driver>
<type>...
- 21
1
vote
2
answers
113
views
Proving SSL need
I need to prove the need we have to install SSL certificates in our webservers.
For that I've been requested to try obtaining sample credentials (in lab enviroment) during a http authentication ...
- 145
1
vote
0
answers
286
views
Can ophcrack crack credential files?
I have obtained some credential files from another pc and would like to decrypt them. These are the ones found under local/roaming profile in Appdata folder
C:\Users\%USER%\Appdata\Microsoft\...
- 151
4
votes
0
answers
1k
views
copying roaming profile credential file of another computer
I am trying to recover login information of another computer. I have managed to copy the local/roaming profile credential files located in C:\users\%username%\APPDATA\local\Microsoft\Credentials\ and ...
- 151
0
votes
2
answers
890
views
How should I authenticate my SPA frontend with my API since I´ve got no authentication process in the site?
We are designing a web site for selling financial products online.
The following is a high level description of the components:
Our frontend will be a SPA built with AngularJs.
The frontend will ...
- 109
1
vote
1
answer
684
views
What are the implications of storing sensitive data in bookmarklets?
While discussing alternatives for asking the browser to remember your password, one guy suggested using a bookmarklet to store users' credentials. The original answer is in portuguese, but I'll ...
- 2,925
8
votes
2
answers
4k
views
Are userid and password needed in order to pentest a website?
We are a company that has many web applications developed in ASP.NET. Our Internet service provider (Telefonica) wants to test our web sites looking for vulnerabilities. For that, they are asking us ...
- 423
1
vote
1
answer
3k
views
How to pass credentials across applications securely?
To simplify the user experience , if we want to design a system such that the user login password for the desktop account itself can be shared with various applications like chat/email/skype etc.
...
- 511
3
votes
2
answers
1k
views
How are WPA Keys stored on a router?
Should the router only store a hash of my encryption key or is it stored as plaintext?
I believe (but not certain) that the WPA key is itself an encryption key, buy shouldn't that be encrypted like ...
- 31
0
votes
2
answers
122
views
How to alert webmaster if he does not put contact address
i found a session cookie that contains user status with two parameters NO for standard users when altering this to YES you become a Premium user and you can download content restricted to premium ...
- 109
4
votes
1
answer
358
views
Keeping a user's passwords, but can't hash them
I'm making a web application to provide intermediary service for customers to facilitate their interaction with a set of other web applications.
A simplified example would be to let a user access his ...
- 1,447
-1
votes
1
answer
328
views
Credential (et al) storage on Android - And general application credential storage inquiry [closed]
Please read before assuming this should go in another forum (like an android forum) - this is a Security question.
Here is the scenario:
Developing an health care based android application that has ...
- 1,719
40
votes
2
answers
38k
views
How should an application store its credentials
Context
When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, ...
- 502