Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
1,291
questions
0
votes
2
answers
61
views
How to reuse PIN codes in the most secure way?
I've made a list of the services/devices that require a PIN code. Shockingly, it's over 10, which I find impossible to remember, so I need a strategy to reuse the codes.
What could be a strategy for ...
0
votes
0
answers
26
views
What is the best way to protect passwords? [duplicate]
I noticed that I don't use many different passwords for all my stuff, which is very insecure. However, it is also difficult to remember really secure, long passwords which are different for every ...
- 1
0
votes
3
answers
189
views
Understanding Password Manager Chicken and Egg problem
I read that Password Managers are a more secure option than remembering passwords. I am currently evaluating Passwords Managers with cloud synchronization and there is something that really confused ...
- 103
0
votes
2
answers
59
views
Digital legacy: safe to save password manager login info in Gmail draft?
Google accounts have a "Digital Legacy" feature, where accounts that go inactive for a long period (3 months, 6 months, etc.) and do not respond to alerts will eventually trigger Inactive ...
- 373
23
votes
2
answers
4k
views
Why is 1Password sign-in to new device secure without MFA?
I'm trying to understand why it's not necessary with MFA in 1Password when signing in to a new device.
This was the case that triggered my curiosity:
I created a 1Password account
I downloaded the ...
- 341
2
votes
1
answer
191
views
Is CVE-2023-24055 applicable to other password managers using the same format as the original KeePass?
CVE-2023-24055 is a known vulnerability that enables an attacker to recover plaintext user credentials from the KeePass application.
However, due to the original KeePass being Windows-specific, I've ...
- 350
1
vote
2
answers
101
views
DNS hijacking/poisoning effect on URL/URI and password manager autotype/autofill
A benefit to password managers, at least some of them, is that they can look at the URL and only use autotype/autofill when on the correct site, which can help prevent pharming since if instead of ...
- 13
0
votes
1
answer
119
views
What threats can the use of a TPM by a password manager mitigate?
This question is about the use of a TPM by a password manager used by an end-user on a PC to store and use passwords to log in to web sites and other things that are protected only by a password.
...
- 569
1
vote
0
answers
100
views
How do password manager developers protect their app store accounts?
Basically every password manager (like LastPass, 1Password, ...) has its Android & iOS app and browser extensions for Chrome, Safari, Firefox etc., to automatically fill in usernames and passwords....
- 111
1
vote
3
answers
180
views
Why do I need to provide authentication when accessing a browser's built-in password manager?
Why do I have to provide authentication when I want to read a password stored in my own web browser while I have to do nothing to read the same password on a site's login page?
Is my conclusion ...
- 3,619
2
votes
1
answer
147
views
Why would garbage collection be a problem in password managers?
I was reading an infosec user's take on the LastPass data breach and noted something odd in his commentary on another password manager system (emphasis mine)
I have not done a thorough code review, ...
- 3,808
0
votes
2
answers
66
views
Whats the difference between secret and password managers?
Are there fundamental underlying differences in how secrets and passwords should be managed?
I'm curious of the technical/cryptographic differences between secret managers and password managers are. ...
0
votes
1
answer
66
views
My Bank Enforces A 6 Character Limit On Passwords. Is This Bad? [duplicate]
A bank I (previously) used in Australia forced users to comply with a 6-character limit on every password. Specifically, the rules were:
6 characters exactly, including at least 1 number and letter
...
- 101
51
votes
5
answers
6k
views
Should a bank be able to shorten your password without your involvement?
The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore.
He called his advisor, who ...
- 611
0
votes
0
answers
34
views
Benefit of only having MFA challenge on the very first login
I'm trying to select a suitable password store for a team - one of my main requirements is that users be authenticated via a removable key file rather than simply a master password.
I have been using ...
- 101
3
votes
2
answers
148
views
How do I remember passwords for environments where Password Manager is not available?
I am a big fan of 1Password. And I try to save my passwords in 1Password as much as possible.
However, there are environments where 1Password cannot be used. That is the password to protect 1Password ...
user284652
1
vote
0
answers
145
views
Does having authenticator app/OTP generator built into Password Manager defeat its purpose?
For example the KeepassOTP plugin is one of a few plugins for Keepass, that allows users to view their OTP code from within the password manager itself. Does this defeat the purpose of having a OTP as ...
- 283
1
vote
1
answer
230
views
How do I secure sensitive information like system credentials in a configuration file?
I often get this question:
I have sensitive data such as system credentials which my web application needs to secure. Some things I can store in a database, but others (like the credentials to access ...
- 41
16
votes
4
answers
4k
views
Should one reject login attempts when the correct password is newly added to a password deny list?
Best practices say that when users choose a password (at signup or when changing an existing password), the application should reject that password if it appears on a list of passwords known to be ...
- 325
2
votes
2
answers
73
views
How can a users plaintext password be acquired while using biometricID with the following security model?
This is a slightly tough one to explain with my current experience, lacking mainstream terminology. But here goes.
I have an encryption/security model whereby I do not store users plaintext passwords. ...
- 251
0
votes
0
answers
96
views
Amnesia and death proof master password
I have been thinking about how to store my master passwords (password manager, email and device passwords) for quite a while and I just haven't been able to come up with a satisfying solution yet. I ...
- 1
4
votes
1
answer
1k
views
Practicality of outsourcing password hashing using enclaves
I've been pondering some potential cybersecurity applications for enclaves. One of them being the problem of password hashing.
Some clients have enclave support, meaning part of their CPU can securely ...
- 280
0
votes
1
answer
81
views
Using Single Sign-On and the usage of password managers is discouraged. Whay are alternatives for storing tokens for example?
What are the alternatives of storing tokens when password managers are discouraged?
Some of the ideas that come to my mind are storing in a text file and encrypting with GnuPG but that's asks for ...
- 293
0
votes
1
answer
79
views
Cryptographic hash functions and personal password management [duplicate]
Background: I've always reused same username/password on all websites and got hacked regularly. I am considering using a password manager, but I don't like the need of storing a database. So I came up ...
- 103
1
vote
2
answers
123
views
How to securely use `pass`, `sudo`, and `npm` on the same machine
TL;DR: running npm i ... not long after pass my-password allows a malicious package to steal my entire password store.
I use pass as a password manager, on Linux. And like probably all Linux users, I ...
- 13
0
votes
0
answers
115
views
Auto-login (password stored on device) vs refresh token
I’m asking myself what are the benefits of refresh token over saving the user password (securely) on user device and perform a transparent login (background) with its credentials to get a fresh new ...
- 101
1
vote
0
answers
112
views
Storing app specific PINs on mobile devices for local authentication
Are there any best practices for storing app specific PINs (e.g. 6 digit PIN that isn't part of the device lock screen) on mobile devices (Android/iOS)? I know several banking and authenticator apps ...
- 411
2
votes
3
answers
4k
views
Is this a secure approach to store a master password?
I have come up with the following approach to remember master passwords (to use in software like KeePass, etc): Since it is annoying to type the master password every time we power up the PC, we store ...
- 123
0
votes
2
answers
148
views
Storing backup keys (2FA) for online accounts
So I spent the day looking for a good solution of storing the backup keys or the 2FA codes and can't seem to find a convenient way for me, many people have different takes on this, so far I found 2 ...
- 1
2
votes
2
answers
137
views
Mitigating the performance impact of strong hashes with Basic HTTP authentication
I am trying to decide which work factor to use for our hashed passwords, and I am facing the following dilemma. Let me elaborate for a moment.
Basic HTTP authentication works as follows:
The user ...
- 2,966
0
votes
2
answers
142
views
Is it possible to design a system with two passwords?
Is it possible to design a system with two passwords prompts?
The system will have to prompt for two passwords
The system would have to validate first password before prompting for second password
...
- 1
3
votes
0
answers
900
views
How to Securely Store Database Password in Java .properties File
I would like to store my DB password in Java .property file and encrypt it using Jasypt. But from what I see, it just moves the problem from hiding the DB Password to hiding the encryption password.
I ...
- 41
2
votes
3
answers
146
views
Manage passwords from my personal website
So I'm a complete novice in security practices, and an amateur web developer. I have a personal website connected to a personal DB. Currently there is nothing in this DB that would be useful to anyone ...
- 23
1
vote
3
answers
71
views
Creating Password from 2 different part
I’m looking for Term Or Some platform for managing Password Authentication with this way :
Password construct from 2 Part ,
First one is static and you can make it and second Part Generate From TOTP ...
- 11
33
votes
6
answers
14k
views
Is it safe to store account credentials in an Excel sheet protected with a password?
Basically the title. For example, how bad is it to store passwords in an Excel sheet protected with a password, instead of storing passwords in Keypass or something else like Zoho Vault? Of course, ...
- 433
1
vote
2
answers
258
views
How Google protects and syncs the passwords?
I read this post but I want to know more details. I know that Google uses a Windows' function called CryptProtectData to encrypt user passwords on Windows and Google only stores the encrypted forms of ...
- 21
1
vote
1
answer
91
views
SCrypt's goal and the role its salt plays
Am I right in stating that SCrypt as an algorithm is useful where many passwords are stored in a database, but not against one specific encryption key derived from one password of one user?
For ...
- 11
0
votes
0
answers
173
views
Google says my password has been found in data breach. HIBP knows nothing about it. Which data breach was that?
I've been using Chrome to save and sync my passwords across devices (and lately I am trying to switch to Bitwarden). Google warned me recently about a password I have used across multiple sites that ...
- 101
0
votes
0
answers
84
views
Secure method of creating sudoer password through cloud-init
We have automated a lot of things for server startup via cloud-config, and I want confirmation about whether there is any security concern in the following.
users:
- name: myuser
groups: sudo
...
0
votes
2
answers
87
views
Construct a strong, (almost) unique password? [duplicate]
After reading Why use random characters in passwords? it seems to me that one can solve the problem of how to remember a zillion passwords while each one remains secure by constructing each password ...
- 1
0
votes
0
answers
132
views
Google Password I didn't create
I opened Google, and a popup occurred briefly before I reflexively closed it. I then realized it had said something about a new password saved to the Google Password Manager, I think - which is weird,...
- 111
1
vote
3
answers
201
views
Password manager vs Gmail
Is there any security issue if I use for example my Gmail account to store passwords from another resources instead of using any password manager like a KeePass?
If my password for Gmail account is ...
- 115
0
votes
1
answer
218
views
Passing password back from server to client? [duplicate]
I've never seen any example of this and I'm just curious why? Why is it not okay just to pass it through HTTPs + encoded in a JWT? I will not be storing the password anywhere on the client side, I ...
- 1
1
vote
0
answers
209
views
Using pass cli for background (cron) jobs securely
Q: how to securely use pass tool to for scheduled jobs?
One of the tools to store and manage passwords on a unix machine is pass, which is a layer on top of gpg. Any password that I create is ...
- 11
0
votes
0
answers
127
views
password manager and key management
I would love to gather some information on how to program my own password manager properly as I'm pretty new to security. Currently, I'm using pythons cryptography module and a sqlite database.
The ...
- 1
5
votes
1
answer
292
views
Design of a web based password vault
I'm designing a password vault that's accessible to clients through an existing web application. The clients are small, (and mostly non-technical) businesses that aren't using password managers, but ...
- 163
4
votes
2
answers
469
views
What algorithm does 1Password use for encryption, AES-GCM-256 or AES-CBC-256?
I would like to know what encryption 1Password uses.
On the About the 1Password security model page, it says:
Your 1Password data is kept safe by AES-GCM-256 authenticated encryption. The data you ...
- 143
0
votes
0
answers
16
views
Application to archive a file with multiple passwords [duplicate]
Is there an application to create an archive (e.g. 7z, zip, rar, etc) that can be accessed with multiple valid passwords?
For example the password protected archive "example.7z" can be ...
- 1
3
votes
2
answers
152
views
Do password autofill extensions securely validate the site they are autofilling?
I had a situation where I clicked an email link send to me by a financial institution. The link first sent me to their login page where my chrome password extension automatically filled in my username ...
- 273
3
votes
2
answers
156
views
How to best separate password "tiers" or not at all?
While using a password+ manager is a know must for sensible security, one nuisance (from an UX point of view) I encounter is that there are different password "tiers". Pretty obviously my e....
- 7,668