Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
1,318
questions
2
votes
1
answer
249
views
Should newly password links reset old ones? if so, why?
I have noticed on most websites that all previous password reset links are automatically expired when a new one is requested.
Why is this so common and what are some possible consequences if this isn'...
- 285
-1
votes
1
answer
27
views
Migrating Large Export of Dashlane, 1password, lastpass data to another password manager. Delete old sites?
I'm curious what is best practice. I'm migrating a large export of an existing password manager data like lastpass, 1password, or dashlane into another password manager. Some of these services marked ...
- 195
3
votes
1
answer
267
views
What exactly is the security model of pass?
Linux pass is a program that lets you store passwords in regular text files, which you it then encrypts with your GPG key.
I'm confused at how this is considered secure. The GPG key has a passphrase ...
- 181
10
votes
5
answers
4k
views
How to best obfuscate a built-in key in an application?
We're building an application that needs to log into a website using built-in credentials. It's not optimal to say the least, but we're stuck with "knowing" the username and password ...
- 219
2
votes
0
answers
90
views
Why are Yubico Yubikeys limited to 32 OATH accounts? [closed]
Is the 32 OATH QR code account limit on Yubikeys due to a storage constraint?
Because the Yubikey 5 series has been out for a few years now it'd be amazing if there is a new version released soon with ...
- 123
4
votes
0
answers
157
views
How does Google Chrome's "Warn you if passwords are exposed in a data breach" feature work?
This feature is enabled by default. It says the usernames and passwords would be encrypted before sending to google. But google would know the encryption keys it used and to compare it with leaked ...
- 41
0
votes
1
answer
128
views
Do you need to invalidate JWT token upon password change?
We've got an Angular app that calls APIs with JWT token authentication (so an auth token and a refresh token). Now at some point the user changes his password (while normally logged in, so not with a &...
- 101
2
votes
2
answers
175
views
What are the risks of typing a password in a terminal, just to see before pasting it?
Yes, I do use a password manager. Yes, I do use complicated long passwords, a la XKCD.
However, sometimes I fail repeatedly when entering the master password to my password manager. Which has no &...
1
vote
1
answer
63
views
Is there any benefit to use different salt for different encryption algorithms for same user
There is two different passwords for a single user.
I'm hashing both for future validation. I'm currently using a single unique salt for the user, but each is hashed with a different algorithms (...
- 111
0
votes
0
answers
93
views
Optimal way to securely store password on client with server invalidation but not knowledge
A number of similar questions have been asked about this general topic before (e.g. How to store user credentials in browser securely?), but I wanted to seek some clarification on a specific scenario.
...
- 121
0
votes
0
answers
86
views
Is ISP sending WiFi password in plain text to phone necessarily a bad sign?
The new router I was given by my internet and phone provider can only be configured via their website. I logged in and went to the page where you can set things like the SSID and password for the WiFi ...
- 1
0
votes
0
answers
46
views
ow do I move password securely between api and web?
I would like to ask how I should go about securely transmitting the password between two applications. I have two projects that work with each other. The first one is a project called AuthApi, which ...
- 1
0
votes
0
answers
67
views
Choosing Encryption Strategies for Secure Long-Term Storage of Sensitive Data
When considering external drives for secure long-term storage of sensitive data, what are the pros and cons of using the same password for encrypting all files versus using random passwords for each ...
- 163
1
vote
0
answers
47
views
How could the contents of multiple LastPass vaults be compromised?
According to this newly published article:
Now, it appears that the LastPass hack has led cybercriminals to steal over $35 million in cryptocurrencies.
...
Nick Bax, director of analytics at ...
- 3,134
0
votes
2
answers
131
views
Should I be concerned that my bank told me that I have a strong password? [duplicate]
I recently ran an account security check through my bank's web site, and my bank "reassured" me that I have a strong password.
Should I be concerned that they know that? I had assumed that ...
- 151
0
votes
1
answer
68
views
Is Edge (Enterprise) Password feature less secure than open source local password manager? [closed]
For Enterprise, how to know if Edge Password AutoSave is less secure than copy/paste to a desktop password manager which is open source?
IMHO Edge should be more secure because:
copy/paste has ...
0
votes
0
answers
57
views
Is pass -> [via pbkdf2] -> seed -> ECDSA key pair better than pass(word) hashing?
For a web service, I am considering generating random 25-49 recovery codes as a kind of pass that can be stored in a pass manager (no usernames).
Instead of pass(word) hashing on the server, I ...
- 101
1
vote
0
answers
66
views
Is it bad practice to store passwords in a JWE? If so, why?
First of all, I know that passwords generally do not have to be stored in a JWT or JWS since the token in itself can be used to authenticate. My circumstances are very specific though.
In my program, ...
- 11
0
votes
0
answers
46
views
Recovering Lost Brave Browser Usernames and Passwords
I recently changed my password for my local Windows 10 account and found out that my usernames/passwords in Brave's password manager are no longer visible.
Unfortunately, I executed Brave after the ...
- 1
0
votes
2
answers
162
views
Security of password managers vs. risk of losing access
Is it safe not to have a 2FA for a password manager itself?
It seems that using an app for TOTP authentication for a password manager could increase the security. But it turns out that in this case I ...
0
votes
1
answer
219
views
Is a leaked encrypted password more secure than a leaked hash?
Encryption tech is obviously intended to secure things that we want to be private over an insecure medium. When I log into a site for example, my password is transmitted over HTTPS, hashed by the ...
- 371
1
vote
1
answer
172
views
What are the risks of reusing the same passphrase for FDE, user account, and password manager?
Consider a home user who runs Linux on a laptop with full-disk encryption and uses a cloud-based password manager. Assume the laptop is firewall-protected with no SSH access. It seems reasonable to ...
- 123
1
vote
0
answers
42
views
How can I reduce the number of passphrases that I must memorize (password manager, FDE, user accounts)? [closed]
I'm attempting to reduce the number of passphrases that I must memorize. Currently I need a different passphrase for each of:
Password manager
FDE for my personal computer
User account for my ...
- 123
1
vote
1
answer
391
views
Sending secret API Keys via email
I'm a customer of a big KYC provider and am using their API. The process to authenticate at the API requires a secret key that they are sending to me by email. If I want to revoke the key and get a ...
- 143
0
votes
3
answers
314
views
Password managing apps seem to have access to my passwords
Keeper used to be free so I had stored most of passwords on that app a few years ago from a past device. When I tried to access the passwords after five years, the app had turned into a subscription ...
14
votes
2
answers
4k
views
Reasoning behind banning '#' from the start of passwords? [duplicate]
Today, on an official government website, I came across the following password rules:
"Your password has to be at least 8 characters long. It can't have any blank spaces. It has to use characters ...
- 141
5
votes
3
answers
386
views
Using Proof of Work to slow down login attempts
For a while I've been pondering a user authentication protocol that aims to ensure that a client does some computational work before the server will attempt to authenticate the password.
The reason ...
- 153
1
vote
0
answers
34
views
How should an argon2 hash be stored? [duplicate]
Given the following argon2 hash
$argon2id$v=19$m=65536,t=32,p=8$mJmKA5qamzXOPJZYw4wCEUKY$COkMH0RckaZ/3bhYCdCQjLuzoLKxcAmk4TzmHRRgTQ8
How should the hash be stored in a database? From the answers of ...
- 11
0
votes
2
answers
123
views
How to reuse PIN codes in the most secure way?
I've made a list of the services/devices that require a PIN code. Shockingly, it's over 10, which I find impossible to remember, so I need a strategy to reuse the codes.
What could be a strategy for ...
0
votes
0
answers
43
views
What is the best way to protect passwords? [duplicate]
I noticed that I don't use many different passwords for all my stuff, which is very insecure. However, it is also difficult to remember really secure, long passwords which are different for every ...
- 1
0
votes
3
answers
274
views
Understanding Password Manager Chicken and Egg problem
I read that Password Managers are a more secure option than remembering passwords. I am currently evaluating Passwords Managers with cloud synchronization and there is something that really confused ...
- 103
0
votes
2
answers
157
views
Digital legacy: safe to save password manager login info in Gmail draft?
Google accounts have a "Digital Legacy" feature, where accounts that go inactive for a long period (3 months, 6 months, etc.) and do not respond to alerts will eventually trigger Inactive ...
- 373
23
votes
2
answers
4k
views
Why is 1Password sign-in to new device secure without MFA?
I'm trying to understand why it's not necessary with MFA in 1Password when signing in to a new device.
This was the case that triggered my curiosity:
I created a 1Password account
I downloaded the ...
- 341
2
votes
1
answer
281
views
Is CVE-2023-24055 applicable to other password managers using the same format as the original KeePass?
CVE-2023-24055 is a known vulnerability that enables an attacker to recover plaintext user credentials from the KeePass application.
However, due to the original KeePass being Windows-specific, I've ...
- 370
1
vote
2
answers
183
views
DNS hijacking/poisoning effect on URL/URI and password manager autotype/autofill
A benefit to password managers, at least some of them, is that they can look at the URL and only use autotype/autofill when on the correct site, which can help prevent pharming since if instead of ...
- 13
0
votes
1
answer
438
views
What threats can the use of a TPM by a password manager mitigate?
This question is about the use of a TPM by a password manager used by an end-user on a PC to store and use passwords to log in to web sites and other things that are protected only by a password.
...
- 569
1
vote
0
answers
146
views
How do password manager developers protect their app store accounts?
Basically every password manager (like LastPass, 1Password, ...) has its Android & iOS app and browser extensions for Chrome, Safari, Firefox etc., to automatically fill in usernames and passwords....
- 111
1
vote
3
answers
254
views
Why do I need to provide authentication when accessing a browser's built-in password manager?
Why do I have to provide authentication when I want to read a password stored in my own web browser while I have to do nothing to read the same password on a site's login page?
Is my conclusion ...
- 3,619
2
votes
1
answer
179
views
Why would garbage collection be a problem in password managers?
I was reading an infosec user's take on the LastPass data breach and noted something odd in his commentary on another password manager system (emphasis mine)
I have not done a thorough code review, ...
- 3,808
0
votes
2
answers
598
views
Whats the difference between secret and password managers?
Are there fundamental underlying differences in how secrets and passwords should be managed?
I'm curious of the technical/cryptographic differences between secret managers and password managers are. ...
0
votes
1
answer
115
views
My Bank Enforces A 6 Character Limit On Passwords. Is This Bad? [duplicate]
A bank I (previously) used in Australia forced users to comply with a 6-character limit on every password. Specifically, the rules were:
6 characters exactly, including at least 1 number and letter
...
- 101
51
votes
5
answers
6k
views
Should a bank be able to shorten your password without your involvement?
The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore.
He called his advisor, who ...
- 611
0
votes
0
answers
52
views
Benefit of only having MFA challenge on the very first login
I'm trying to select a suitable password store for a team - one of my main requirements is that users be authenticated via a removable key file rather than simply a master password.
I have been using ...
- 101
3
votes
2
answers
179
views
How do I remember passwords for environments where Password Manager is not available?
I am a big fan of 1Password. And I try to save my passwords in 1Password as much as possible.
However, there are environments where 1Password cannot be used. That is the password to protect 1Password ...
user284652
1
vote
0
answers
220
views
Does having authenticator app/OTP generator built into Password Manager defeat its purpose?
For example the KeepassOTP plugin is one of a few plugins for Keepass, that allows users to view their OTP code from within the password manager itself. Does this defeat the purpose of having a OTP as ...
- 283
1
vote
1
answer
856
views
How do I secure sensitive information like system credentials in a configuration file?
I often get this question:
I have sensitive data such as system credentials which my web application needs to secure. Some things I can store in a database, but others (like the credentials to access ...
- 41
17
votes
4
answers
4k
views
Should one reject login attempts when the correct password is newly added to a password deny list?
Best practices say that when users choose a password (at signup or when changing an existing password), the application should reject that password if it appears on a list of passwords known to be ...
- 335
2
votes
2
answers
96
views
How can a users plaintext password be acquired while using biometricID with the following security model?
This is a slightly tough one to explain with my current experience, lacking mainstream terminology. But here goes.
I have an encryption/security model whereby I do not store users plaintext passwords. ...
- 261
1
vote
0
answers
142
views
Amnesia and death proof master password
I have been thinking about how to store my master passwords (password manager, email and device passwords) for quite a while and I just haven't been able to come up with a satisfying solution yet. I ...
- 11
4
votes
1
answer
1k
views
Practicality of outsourcing password hashing using enclaves
I've been pondering some potential cybersecurity applications for enclaves. One of them being the problem of password hashing.
Some clients have enclave support, meaning part of their CPU can securely ...
- 280