Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
1,109
questions
0
votes
1answer
44 views
How should we apply the salt to the password?
According to Wikipedia:
A rainbow table is ineffective against one-way hashes that include large salts. For example, consider a password hash that is generated using the following function (where "|...
1
vote
1answer
63 views
Is encrypting the FireFox folder with EFS protecting saved passwords in case of someone accessing the hard drive?
What I want to do:
Use the "save password" feature in FireFox (on Windows 10) without using FireFox's master password feature.
What I'm afraid of:
Someone stealing my laptop or getting access to my ...
0
votes
0answers
21 views
Can an employee be sued for gross negligence by reusing personal passwords at work? [migrated]
An employee is using some easy guessable reused passwords well known to Have I Been Pwned.
OUCH.
Something bad happens.
Can an employee be sued?
Option A: An organization does not have password ...
1
vote
1answer
111 views
Is there any security concern if I kept password hash on client side?
I have a mobile application that needs to be able to work when the phone is offline. In order to prevent misuse by others when they have a short physical access to the phone the requirement is to ...
0
votes
1answer
111 views
Security concept for password management
At the moment, I am struggling on a question to which I have not found a good answer so far.
I wan't to create a password manager, which will be used by a lot of people.
Used languages: PHP / ...
3
votes
2answers
108 views
How strong is a password consisting of words arbitrarily chosen from the dictionary?
Diceware wants us to actually randomly pick n words from a given set of m=65 words.
Assume a user does not actually use a dice. Instead they take a physical dictionary of m words and "randomly" picks ...
3
votes
1answer
106 views
Best practices to manage password for embedded Linux devices
Should we generate a strong password offline, keep it closely guarded secret, and use the same one across all copies of the device? The boot drive is eMMC flash soldered on the PCB, hard to read ...
0
votes
0answers
35 views
Is Argon2 secure to use? [duplicate]
Now that it's been 5 years since Argon2 has been released, is Argon2 secure for public use? (E.g. normal password hashing)
Also, what are the secure parameters for Argon2?
100
votes
3answers
18k views
Why is Sojdlg123aljg a common password?
I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
0
votes
0answers
42 views
Storing the master password in a keychain
I tend to avoid putting my master keychain password in the keychain itself (in OSX, for example), but sometimes with federation of accounts and things, it would be convenient to do so.
Am I right to ...
3
votes
3answers
158 views
Is a Whirlpool hash with random salt secure enough?
I copied the title from another question, but it wasn't answered there and my case is a bit different.
I have inherited an old website to maintain. I noticed that the password hashing is not up to ...
2
votes
0answers
135 views
Is using AES secure for password managers?
I'm developing an application that automates processes. The user connects to many accounts that the application uses then passwords are encrypted using AES. An example algorithm looks like this:
...
-9
votes
1answer
182 views
Does word store my passwords in plaintext? [closed]
I have a document which I wrote my passwords in and saved it to my disk, and I have been hearing a lot about programs storing passwords in plaintext
Did word store my password I saved in plaintext???
...
0
votes
3answers
124 views
Password generator and password limitations
I would like suggestions for a good strategy for dealing with web sites that have arcane rules about what must or must not appear in a password.
My ideal are the sites that allow a good range of ...
10
votes
1answer
529 views
Firefox bug permits stealing encrypted passwords: How is this possible?
It's my understanding that passwords I save in Firefox's Password Manager are encrypted and that setting a Master Password encrypts the encryption key used in this process. The Google hit for "Does ...
3
votes
1answer
295 views
How secure is KeePass KDBX4 by default?
How secure is KeePass KDBX4 by default if someone obtain the .kdbx file and attempt to brute-force it without knowing any hint of the master password?
With assumption :
The password length is equal/...
2
votes
1answer
143 views
Should a browser make its own password manager? [closed]
I'm trying to figure out if products such as Firefox's Lockwise are a superb idea or a terrible one.
On the one hand, installing a third-party addon to your browser comes with inherent risks, so ...
165
votes
5answers
8k views
Password management for kids - what's a good way to start?
Consider a young (primary-school age) child who is starting to collect passwords for online services. How can a parent (or equivalent) help them manage their passwords?
An example to make things ...
45
votes
6answers
11k views
What are the cons of stateless password generators?
Does anybody have hands-on experience with stateless password generators (managers) like Getpass?
It seems like it does most of the work of cloud password managers, but leans more to the security ...
1
vote
1answer
90 views
Would Hashing a Decryption Key Significantly Lower Security? [duplicate]
I'm using the Haskell Codec.Crypto.SimpleAES package to create a crude password manager. The password manager seems secure but it's unable to warn the user when the decryption key is invalid. If a ...
0
votes
0answers
45 views
How can I trust the data integrity of LastPass [duplicate]
So I recently downloaded LastPass and I'm beginning to wonder how they can ensure that my information is kept secure. Is anyone aware of what kind of encryption algorithm they use or how they ensure ...
0
votes
1answer
76 views
Does Azure Key-Vault encrypt the values before storing?
We are using key-vault for storing the secrets, will it give any added advantage if we encrypt the values before storing it in key-vault?
1
vote
0answers
60 views
Apple Keychain Security Risk Assessment
What security measures has Apple taken to minimize security risk with respect to the Apple Keychain password manager?
I enjoy the capability of the password management across macOS and iOS devices, ...
1
vote
1answer
40 views
Having web client do requests with User's 3rd party API key?
I am trying to figure out the best way to do this. I have done some searching and all I have found is about storing API keys in a back end, nothing like my use-case where there is no back end.
...
3
votes
3answers
276 views
Should a password generator validate its output against a dictionary?
If I were to design a password generator, is it best to leave it truly random or validate its output to avoid certain passwords?
For example if my password generator was truly random, it's possible ...
2
votes
1answer
105 views
Does knowledge of one or more passwords from my password manager help an attacker crack the master password?
I use a keepass password manager with a master password of more than 100 bits. I keep the password file in cloud storage. If an attacker has my password file, it should be difficult for them to ...
-1
votes
1answer
119 views
Virgin air-gapped devices and password management [closed]
For password management:
"Practical" means it works in practice, and "secure" means protected against compromise and actually works. How do we get the highest P + S value?
I am convinced that all ...
3
votes
3answers
265 views
Password hashing algorithms suitable for IoT devices?
What password hashing algorithms and other cryptographic hashes (e.g. scrypt, bcrypt, PBKDF2, MD5, SHA-256) are suitable for resource-constrained IoT devices for the consumer-oriented smart home ...
1
vote
1answer
66 views
Banking app logon - multiple fingerprints on a device vs 2 passwords known by 1 person
Yesterday I logged on to my banking app via my iPhone. The normal procedure was to enter information that consisted of:
The answer to a security question. This had to be entered in full and was the ...
31
votes
12answers
12k views
How do I check that users don't write down their passwords?
I have a password policy which states that users must not write and store their passwords down in plaintext. How can I ensure that they haven't done so by writing their password in emails, scripts, ...
1
vote
0answers
56 views
Why is unistd's getpass unsafe?
While reading about how to properly ask a user for a password in CLIs, this SO answer and this SSE answer recommend the usage of unistd's getpass.
However, this function is being documented as ...
71
votes
9answers
15k views
What's the safest way to inform a new user of their password on an invite-only website?
I'm developing a web site where people will have accounts. However, unlike most web sites, user do not register, rather they are invited by the site admins. The site admins will create a new user ...
1
vote
0answers
45 views
Are character passwords on my iPad needed?
I have a 20 character password on my iPad. I've been wondering, do I REALLY need it to be that long? Should I switch to a 6 or even 4 digit numeral password? Or should I just shorten my password? ...
1
vote
1answer
128 views
Is it secure to store a cryptographic key in a class member variable?
Consider an application that runs locally on a Windows PC. The application uses a local folder for reading/storing encrypted data (i.e. images). A user logs in (authenticated from a local encrypted DB)...
1
vote
1answer
114 views
Safest place for small business to store passwords
Where is the safest place for a small business to store its passwords for servers, web domain credentials, etc.?
4
votes
3answers
433 views
How can a company tell if my password is similar to the previous 5 passwords?
Closely related (but not a duplicate): Company can tell if new and old passwords are too similar. Is there a security problem?
Also closely related (but not a duplicate): How can a system enforce a ...
1
vote
1answer
235 views
Store passwords in a text file… is it really much worse than a password manager?
My idea:
Storing my passwords in a text file kept on Dropbox and accessed through a python script to quickly retrieve the password for the site I want to access.
My motives:
I want to be platform-...
0
votes
0answers
33 views
SSLVPN client saving encrypted password in local xml file, is that secure?
Simply copy the specific xml file to another client's correspond path, I can login to the remote network automatically. If that is a vulnerability, what severity rate will you give to it? High, medium,...
2
votes
0answers
195 views
For cloud-based password managers, is it safe to login using public WiFi?
For cloud-based password managers, is it safe to login when using public WiFi?
To help get good answers to this question, let's define 3 terms:
Cloud-based password managers = Password managers such ...
1
vote
3answers
233 views
Is it advisable to create a system that stores passwords?
Please bear with me, I'm a total newbie about security.
I work in a company whose main goal is to maximize profits and use free stuff as much as possible. It's effect is that we use tons of freeware ...
1
vote
3answers
289 views
What security benefit does 2FA provide a password manager?
It's no secret that many popular password managers (1Password, Dashlane, LastPass, KeePass, and many others) support some form of two-factor authentication. This is often implemented via TOTP or other ...
1
vote
1answer
81 views
Setting passwords for domain users, not expiring them, and not allowing them to be changed by users
We are in a mid-sized enterprise environment and are looking at forcing specific passwords for all users. I've found nothing recent or relevant about this.
Justification:
The main reason is to ...
1
vote
1answer
98 views
Can my open Firefox Sync session be used to circumvent a Master Password?
In short I'm wondering what's stopping someone with access to my computer account to exploit an open Firefox Sync session to view my synced passwords, even if a Master Password has been set.
On this ...
28
votes
2answers
4k views
Does password expiry provide any benefit at all (when using randomly generated passwords)?
I have been seeing a shift in password policy, this has been going on for a while (Article from 2017) but I have only just picked up on this. In my organization we expire the user passwords every 90 ...
0
votes
0answers
89 views
Browser passwords used on multiple domains?
I have 100 domains with authentication backed by the same LDAP database. There is a single-sign on, but it's not implemented with OAuth. That is to say, per user, each domain accepts the same user/...
1
vote
3answers
124 views
Security concerns around sharing secret on a website
I need to share credentials with users. These credentials are created when the user wants them, but cannot be chosen by the user specifically (AAD credentials). I want to share the same with the user ...
0
votes
0answers
20 views
What are some secure methods to share pre-created password? [duplicate]
I am working on something that requires me to create and share AAD(Azure Active Directory) credentials with clients. To give some context, Azure automatically creates a secret and then that secret has ...
1
vote
1answer
378 views
How secure is pgAdmin to save database password?
When we are creating a new connection with pgAdmin, we are presented with an option to save the password into our computer, so we won't have to retype it every time we want to connect with the ...
0
votes
1answer
61 views
Password storage which avoids privileged insider attack
What are the standard password authentication protocols in client-server setting where authentication happens at the remote server? Is there any password/pin verification protocol which reveals zero ...
0
votes
0answers
40 views
Authenticated scan strategy for large enterprise network
I have been tasked with using Qualys Vulnerability Scanner in order to perform scans within a large enterprise network.
Within this network there are Windows machines and Linux machines.
CyberArk has ...
