Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

-3
votes
0answers
66 views

Enterprise Password Management [on hold]

Does anyone have any recommendations for enterprise password management solutions? The main requirement is that it must be hosted and managed on premises by us.
0
votes
3answers
103 views

Finding a future-proof password manager

Currently, I am a Windows 10 user who uses Chrome's default password manager and let it autofill in passwords for me. Apparently, if I were to accidentally execute malware or give someone momentary ...
0
votes
0answers
46 views

Google passwords security or lack thereof [closed]

I have been wondering about to what degree the info can be stolen if someone hacks into Google. Suppose an attacker got access to all of Google's data. Let's assume my Google password is good enough ...
1
vote
2answers
93 views

Deriving 2 keys from user password - one for login - one for encryption? [duplicate]

Context We have a browser-based client-server application. The client registers with email and password. The password is enforced to some guidelines. Problem The User needs an encrypted vault on ...
102
votes
6answers
23k views

School performs periodic password audits. Is my password compromised?

My university sent me an email informing me that, during a "periodic check", my password was found to be "easily discoverable and at risk of compromise". As I understand it, there shouldn't be a way ...
0
votes
1answer
93 views

Is this method of hashing passwords good? Node.js [duplicate]

I am currently developing a login for my website, (using node.js and MySQL) and would like some feedback on the password hashing code. const crypto = require('crypto'); function RandomSaltString(...
-1
votes
0answers
46 views

List of recommendations for lambda user [closed]

I was discussing the other day with a friend and noticed he had no lock on his phone. Then he told me that his mailbox and FB account were registered. So someone who found the phone could use his mail ...
19
votes
6answers
8k views

Which password policy is more secure: one password of length 9 vs. two passwords each of length 8?

What is more secure, having one password of length 9 (salted and hashed) or having two different passwords, each of length 8 (salted and hashed using two different salts)?
1
vote
1answer
47 views

Is it at all possible to store Windows Sticky Notes in a secure manner?

Example: Users want to use Sticky Notes for quick note taking. They don't like other options, they want Sticky Notes. However, Sticky Notes normally stores the information in a SQL db that can be ...
0
votes
0answers
72 views

how good is “Chrome Password Checkup” extension for checking passwords?

From what I read so far Google "Chrome Password Checkup" extension (https://chrome.google.com/webstore/detail/password-checkup/pncabnpcffmalkkjpajodfhijclecjno) checking the password that you use for ...
2
votes
2answers
96 views

Committing encrypted passwords but not usernames

I’m arguing with a colleague about the security of storing encrypted password on GitHub. Our process is currently to commit a configuration file with environment variables including username and ...
1
vote
2answers
78 views

Is storing the bcrypt salt in isolated database a good idea?

I read many answers on the stackexchange about Bcrypt, Salt and Where exactly to place the salt. For hashes such as BCrypt it is trivial to extract salt from the hash. So, It doesn't matter really ...
4
votes
3answers
154 views

How to reset passwords without emailed reset link?

In an offline system what is the preferred method of resetting a user's password? Usually this would be handled with an emailed password reset link. However this system is offline, there is no access ...
1
vote
3answers
275 views

Question mark not allowed in password

Recently I came up with a password requirement rules as follows: The password must be 8-16 characters contain at least one number contain at least one lower case letter contain at least one upper ...
0
votes
3answers
124 views

How to store login information on the user's device

I'm developing an application that needs to store various pairs of username/password to automatically log in into third party services so that users don't have to insert them each time they open the ...
2
votes
1answer
104 views

Opera browser: no master password?

I've recently moved from Firefox to Opera (for performance issues). I used to protect my passwords in Firefox with a Master Password. But Opera, so it appears, lacks such feature. I use Debian 9.7 ...
3
votes
3answers
133 views

Login system using permanent “random” hashes in URLs

I am working with a company and have found the following: When a user registers, they make a "random" hash. This "random" hash often has collisions and has to be regenerated to keep the hash unique ...
1
vote
1answer
131 views

Why would a hacker bother with stealing your database password?

I read recently about whether you should store your database passwords in config files, environment variables, docker secrets, etc. But if somebody can steal it from those places, then s/he can ...
0
votes
0answers
25 views

Saving all secret keys, access data in heroku environ instead of config file?

I have a python/flask app and I use heroku to host it. I use some additional services, such as stripe, postgresql or emails. All these services have either secret keys or other access data, which ...
0
votes
0answers
41 views

Why doesn't Cox encrypt my password?

Cox does not encrypt my WiFi password on my account page. So anyone working for Cox has access to my WiFi password. How can I secure my WiFi password?
1
vote
1answer
127 views

Do I understand SHA-1 brute-forcing speeds correctly? (Firefox Password Manager)

I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force ...
1
vote
0answers
40 views

How to store credentials using JKS

Suppose a security team specifies that credentials for an application (specifically, a database username/password) should be stored in a JKS whose password is provided to the application in a local ...
1
vote
2answers
79 views

Should a system require a password confirmation for accounts managed by an administrator?

Suppose you have a user account management subsystem with a web UI. You can change user account passwords in regular masked input password fields in HTML POST forms. I'm wondering, is it fine if such ...
0
votes
2answers
89 views

Advice on password vault software

Do you have any recommendation on any password manager, which is used primarily as a vault? I don't need any browser extension, any special functions, just a regular vault with ability to structure ...
2
votes
2answers
114 views

How should clients' passwords be managed?

How should clients' passwords be managed? By "clients" of course I mean people who you provide a service to, people who need you to work on their stuff (their websites, their servers, their emails, or ...
0
votes
1answer
126 views

Recommended length of password [duplicate]

Why are we recommended to have at least 8 characters, and not 6 or 7 etc.? and the different set of character?. I only know that the longer the password is, the harder it is for brute force attack to ...
0
votes
1answer
56 views

Password managers, how do they get the credentials when you press enter?

I was wondering how password managers (most of the at least) automatically prompt to save my username and password credentials after inserting them into any site. I mean I am not first putting them ...
2
votes
1answer
92 views

What issues are there with Google's “Suggest Password” feature in Chrome?

I have for a long time used a fairly insecure method of having a series of different passwords - where I would use the same password on many sites. I would change between one of the series of ...
0
votes
1answer
51 views

How to prevent replay attacks without exposing stored password security?

A common way to prevent replay attacks when logging in is for the server to present a challenge (chall) and request a response in the form hash(chall+secret) where the secret is already known by the ...
1
vote
0answers
72 views

Collection #1: Do we know the source of the leaks? [closed]

With Collection #1 yet another large data set of email addresses and passwords was found out there. I happens that one of my frequently used email addresses shows up as 'pwned' when checked against ...
-2
votes
3answers
157 views

Why do services that use 2-factor authentication still ask you to provide a password?

The idea of 2 factor authentication is that if you can prove that you have both a password and a device, you are trusted to be who you say you are. My question is, why does the service still ask you ...
23
votes
1answer
478 views

Is a password manager better than an encrypted file for storing passwords?

For any passwords other than websites I log into regularly (such as Gmail, Facebook, etc.), I use apg to generate a random 20 character password. I then add that password and a username or email ...
3
votes
1answer
92 views

Is it a common practice to give a user an unmodifiable password?

I created an online account on a website, they do not ask me for a password but just an email address, then, after acknowledging "terms of service" I was already logged-in. Then I received an email ...
1
vote
1answer
74 views

Is it safe to share an encrypted GPG private key?

I use the pass password manager, and I am trying to come up with a convenient way to bootstrap new machines with access to the git repository. I also have a GPG smartcard (Yubikey) with a different ...
3
votes
1answer
87 views

How should I share the key of the AES algorithm in each client?

My doubt would be the following: How should each client know the encryption key? Using the AES algorithm. (or the best way): Save it in a file encrypted by password? Save it in a DB? Send it over ...
2
votes
0answers
34 views

Is Privileged Access Management secured without regular Patch Update?

It is well know Privileged Access Management (PAM) is a solution that helps organizations restrict privileged access within an existing Active Directory environment. Many big company use it to address ...
0
votes
1answer
95 views

Does having in-browser password managers further the risks of successful CSRF attacks?

When successful CSRF attacks are executed they have the ability to access credentials and other information between the victim and the site. Are the sites username and password that are stored in the ...
0
votes
1answer
352 views

An idea for a universal password management standard [closed]

Introduction For a long time I have struggled with (the idea of) password management. Remembering unique strong passwords is impossible when one has more than a handful, which only leaves the option ...
6
votes
1answer
213 views

Is this vault-less password manager/generator design safe?

Counter The counter is appended to the site name and incremented if you need to get a new password for a site or if the generated password is insecure because it randomly matches something like "...
7
votes
2answers
514 views

Does Chrome's password manager store plaintext passwords in their databases?

Chrome's password manager allows for users to view their saved passwords on passwords.google.com. The saved passwords can be viewed on different devices as long as the user logs into their Google ...
0
votes
0answers
169 views

What are KeePassXC Encryption Settings?

I'd like to know what is an extremely secure configuration with the given options for KeePassXC database: Encryption Algorithm: AES 256, Twofish 256, ChaCha20 256 Key Derivation Function: Argon2, AES-...
1
vote
0answers
32 views

Sharing individually encrypted elements between users of a system

I'm creating a file sharing system, in which the unique key of a file is one of the critical components to the retrieval of that file. For simplicity, lets say the unique keys are the file names. I'd ...
2
votes
1answer
84 views

Storing password reset token in DB - what are the implications?

In multiple systems I've built/supported I've seen user management do the following for password reset: generated a password reset token via some hashing method and email the link with token to user. ...
0
votes
1answer
66 views

How to securely store and use a password for certificate authority

Other than purely memorizing a password in your head, I'm wondering what the next best thing is for storing a password and using it in a very secure environment without internet connection like a ...
1
vote
4answers
211 views

Mitigating the problem of single point of failure introduced by password managers

I understand the purpose of password managers and the fact that there seem to be a trade-off to accept, but well, I find that trade-off to be unacceptable and I wonder if there's a way to avoid it. A ...
1
vote
3answers
625 views

Any hints for programming my own password manager? [closed]

I mostly want whatever help & suggestions you can give me about what I should avoid & what I should think about when making this. I'm a reasonable programmer & I want to make my own ...
6
votes
1answer
108 views

Password Managers: Which passwords to still remember?

Let’s say I use a password manager (like 1Password) on all my devices. In my personal opinion it makes sense to have some passwords in your head (you could still have them in the password manager, and ...
0
votes
1answer
57 views

Implementing SRP without storing the salt anywhere

I am attempting to use SRP to verify clients when they authenticate with a webserver, so that the password is never sent over the wire. Looking at the SRP procedure, when a client registers with the ...
0
votes
1answer
69 views

What's the purpose of the lock and unlock feature in password managers?

I'm afraid this could be a very stupid question, yet I cannot think of an explanation. Password managers (keepass, etc.) often have a button that lets you "lock" the database, so if you need a ...
0
votes
1answer
71 views

Choose a sentence, a number, and the name as password [duplicate]

I would like to have your point of view about something I found on internet. The goal here is to help people to use stronger passwords, it's not perfect, but I believe that asking people to use ...