Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

Filter by
Sorted by
Tagged with
2 votes
3 answers
3k views

Is this a secure approach to store a master password?

I have come up with the following approach to remember master passwords (to use in software like KeePass, etc): Since it is annoying to type the master password every time we power up the PC, we store ...
user avatar
  • 123
0 votes
2 answers
56 views

Storing backup keys (2FA) for online accounts

So I spent the day looking for a good solution of storing the backup keys or the 2FA codes and can't seem to find a convenient way for me, many people have different takes on this, so far I found 2 ...
user avatar
  • 1
2 votes
2 answers
47 views

Mitigating the performance impact of strong hashes with Basic HTTP authentication

I am trying to decide which work factor to use for our hashed passwords, and I am facing the following dilemma. Let me elaborate for a moment. Basic HTTP authentication works as follows: The user ...
user avatar
  • 2,914
0 votes
1 answer
80 views

Is it possible to design a system with two passwords?

Is it possible to design a system with two passwords prompts? The system will have to prompt for two passwords The system would have to validate first password before prompting for second password ...
user avatar
1 vote
0 answers
95 views

How to Securely Store Database Password in Java .properties File

I would like to store my DB password in Java .property file and encrypt it using Jasypt. But from what I see, it just moves the problem from hiding the DB Password to hiding the encryption password. I ...
user avatar
2 votes
3 answers
140 views

Manage passwords from my personal website

So I'm a complete novice in security practices, and an amateur web developer. I have a personal website connected to a personal DB. Currently there is nothing in this DB that would be useful to anyone ...
user avatar
  • 23
0 votes
1 answer
35 views

Creating Password from 2 different part

I’m looking for Term Or Some platform for managing Password Authentication with this way : Password construct from 2 Part , First one is static and you can make it and second Part Generate From TOTP ...
user avatar
29 votes
7 answers
8k views

Is it safe to store account credentials in an Excel sheet protected with a password?

Basically the title. For example, how bad is it to store passwords in an Excel sheet protected with a password, instead of storing passwords in Keypass or something else like Zoho Vault? Of course, ...
user avatar
  • 393
1 vote
2 answers
92 views

How Google protects and syncs the passwords?

I read this post but I want to know more details. I know that Google uses a Windows' function called CryptProtectData to encrypt user passwords on Windows and Google only stores the encrypted forms of ...
user avatar
  • 21
0 votes
1 answer
40 views

SCrypt's goal and the role its salt plays

Am I right in stating that SCrypt as an algorithm is useful where many passwords are stored in a database, but not against one specific encryption key derived from one password of one user? For ...
user avatar
0 votes
0 answers
99 views

Google says my password has been found in data breach. HIBP knows nothing about it. Which data breach was that?

I've been using Chrome to save and sync my passwords across devices (and lately I am trying to switch to Bitwarden). Google warned me recently about a password I have used across multiple sites that ...
user avatar
  • 101
0 votes
0 answers
27 views

Secure method of creating sudoer password through cloud-init

We have automated a lot of things for server startup via cloud-config, and I want confirmation about whether there is any security concern in the following. users: - name: myuser groups: sudo ...
user avatar
0 votes
2 answers
80 views

Construct a strong, (almost) unique password? [duplicate]

After reading Why use random characters in passwords? it seems to me that one can solve the problem of how to remember a zillion passwords while each one remains secure by constructing each password ...
user avatar
0 votes
0 answers
45 views

Google Password I didn't create

I opened Google, and a popup occurred briefly before I reflexively closed it. I then realized it had said something about a new password saved to the Google Password Manager, I think - which is weird,...
user avatar
  • 111
1 vote
3 answers
171 views

Password manager vs Gmail

Is there any security issue if I use for example my Gmail account to store passwords from another resources instead of using any password manager like a KeePass? If my password for Gmail account is ...
user avatar
  • 115
0 votes
1 answer
86 views

Passing password back from server to client? [duplicate]

I've never seen any example of this and I'm just curious why? Why is it not okay just to pass it through HTTPs + encoded in a JWT? I will not be storing the password anywhere on the client side, I ...
user avatar
  • 1
0 votes
0 answers
57 views

Using pass cli for background (cron) jobs securely

Q: how to securely use pass tool to for scheduled jobs? One of the tools to store and manage passwords on a unix machine is pass, which is a layer on top of gpg. Any password that I create is ...
user avatar
  • 1
0 votes
0 answers
71 views

password manager and key management

I would love to gather some information on how to program my own password manager properly as I'm pretty new to security. Currently, I'm using pythons cryptography module and a sqlite database. The ...
user avatar
5 votes
1 answer
196 views

Design of a web based password vault

I'm designing a password vault that's accessible to clients through an existing web application. The clients are small, (and mostly non-technical) businesses that aren't using password managers, but ...
user avatar
4 votes
2 answers
230 views

What algorithm does 1Password use for encryption, AES-GCM-256 or AES-CBC-256?

I would like to know what encryption 1Password uses. On the About the 1Password security model page, it says: Your 1Password data is kept safe by AES-GCM-256 authenticated encryption. The data you ...
user avatar
  • 143
0 votes
0 answers
16 views

Application to archive a file with multiple passwords [duplicate]

Is there an application to create an archive (e.g. 7z, zip, rar, etc) that can be accessed with multiple valid passwords? For example the password protected archive "example.7z" can be ...
user avatar
  • 1
3 votes
2 answers
135 views

Do password autofill extensions securely validate the site they are autofilling?

I had a situation where I clicked an email link send to me by a financial institution. The link first sent me to their login page where my chrome password extension automatically filled in my username ...
user avatar
3 votes
2 answers
145 views

How to best separate password "tiers" or not at all?

While using a password+ manager is a know must for sensible security, one nuisance (from an UX point of view) I encounter is that there are different password "tiers". Pretty obviously my e....
user avatar
5 votes
3 answers
384 views

Is it a bad idea to replace passwords with OTP?

As I understand things, given a user with proper password management (e.g. with a libre password manager like KeePassXC) the only realistic threat is having passwords leaked the following ways: A: ...
user avatar
  • 189
0 votes
1 answer
91 views

Does a solution exist to permit account sharing without revealing the account password?

I'm looking for a process to replace the status quo of notepad and Excel. We've tested a market-leading password manager. An issue that comes up with this is that the secure sharing password facility ...
user avatar
  • 71
1 vote
1 answer
92 views

Web Application Sends Newly Registered Users Plaintext Password. Could you assume that passwords are not hashed in DB storage?

I was recently assessing a web application where during user registration the application would send a password reset link via email where the token portion of the URL was the following in base64: <...
user avatar
0 votes
1 answer
246 views

How do I properly secure my login using bcrypt in react and a python-flask backend?

I want to store the passwords of accounts hashed into a database that can be accessed through a python-flask application. When you would login, this python application is supposed to provide you with ...
user avatar
0 votes
0 answers
83 views

Reuse IV for KDF and Encryption

So I am writing a password manager (mostly low value, application specific passwords) for a game. I need a way to store a password safely. Light reading suggests using a key derivation function (like ...
user avatar
0 votes
0 answers
97 views

What are the advantages of password "leasing"

One the Hashicorp Vault basic feature is secret leasing. They state: Leasing and Renewal: All secrets in Vault have a lease associated with them. At the end of the lease, Vault will automatically ...
user avatar
  • 101
1 vote
1 answer
88 views

Password Based Encryption with Social Login

I have a question about implementing user password-based encryption in a database injunction with the Social Login feature. User private data in my database should be encrypted in order to provide ...
user avatar
0 votes
1 answer
115 views

How to change the password hashing scheme in LDAP using an external library with slapd.d config

I am trying to change the password hashing scheme for LDAP. Hypothetically, let's assume it's pw-argon.so I don't have slapd.conf I have the slapd.d directory where I can make changes dynamically to ...
user avatar
1 vote
0 answers
64 views

Constraints on the password imposed by m209 on first password management

I was going through the paper Password Security: A Case History By Robert Morris and Ken Thompson on authentication. It has been mentioned in the First Scheme that the first encryption used m209, in ...
user avatar
0 votes
1 answer
249 views

Storing OTP seeds in password manager [duplicate]

I am storing my passwords in a password manager (keepass). Also I am using keepass to set up one-time passwords for some accounts. Keepass is storing the seeds of the OTP's in its database. If my ...
user avatar
  • 101
0 votes
1 answer
160 views

Should email password be encrypted in a django app when using TLS?

I have seen multiple videos/tutorials regarding how to setup the email system in Django. It seems that they all assume as long as the password is stored in an environmental variable, no encryption is ...
user avatar
1 vote
0 answers
89 views

I need to secure my access to SQL Server for application accounts, but no one can know the application passwords. How?

Here's our scenario. I have a NodeJS server running that connects to a Microsoft SQL Server using an application account (SQL Basic Auth). The Username and Password were stored in the configuration ...
user avatar
0 votes
1 answer
319 views

VeraCrypt: Is it possible to change the master key?

The password in VeraCrypt is used to en-/decrypt a header, that contains a master key, that is used to en-/decrypt the data. I know, that I can change the password, which will not change the master ...
user avatar
0 votes
4 answers
236 views

Forget Me Not? Abandoning the Forgot Password Functionality

They say a chain is only as secure as its weakest link. When it comes to account security it seems to me that the Forgot My Password functionality is the weakest link in the security chain because it ...
user avatar
1 vote
2 answers
357 views

Safe or Unsafe to Store Passwords in Chrome on MacOS?

I've seen conflicting opinions on this, more than the below, but i.e. Unsafe: https://www.techrepublic.com/article/why-you-should-never-allow-your-web-browser-to-save-your-passwords/ Safe: https://...
user avatar
  • 302
0 votes
2 answers
101 views

Are there security concerns that might prevent database systems from providing password data types?

Software development environments seem to benefit when problems can be solved "higher up the chain". For example, many web platform features that are now natively supported in both ...
user avatar
4 votes
1 answer
241 views

How does Firefox protect Logins and Credit Card Data?

I have a question about how Firefox protects Login information (Website passwords) on the one hand and Credit Card data on the other. I noticed that there are two different approaches to how Login ...
user avatar
  • 153
0 votes
1 answer
128 views

Creating a unique password for each device/unit of the same product

We are currently working on an IoT product & having a hard time coming up with a strategy to create a unique password for each device/unit. I do understand that password based on a function of { ...
user avatar
1 vote
1 answer
162 views

Protection against different attack vectors, password manager

I'm a software dev working on an open-sourced password manager(dev lib, gui and cli) for educational and eventually usefulness purposes. There doesn't seem to be all that much information regarding ...
user avatar
  • 11
0 votes
0 answers
156 views

Where to store passwords needed by linux processes?

I am working with C++ processes on a linux (CentOS 8) environment. These processes should be able to access an encrypted file on the system. Where should I store the password for this encrypted file? ...
user avatar
1 vote
3 answers
208 views

Using Password Managers to store multiple factors, would this reduce security? [duplicate]

Assume I have a password manager that stores the credentials for a login to a 3rd party service. In this credentials the username, password and a TOTP-seed is stored and the current TOTP-token is ...
user avatar
  • 695
0 votes
0 answers
45 views

Why would I need a password manager when I use 2FA? [duplicate]

I have come across many questions concerning what security benefit 2FA provide a password manager. (e.g. this question) On the other hand, if I already use 2FA, why would I need a password manager? ...
user avatar
  • 1
1 vote
1 answer
337 views

How bad is it to store credentials in clear text on disk and in memory?

Yeah, it depends. A good answer would provide some reflections on this. I have two concrete scenarios in mind, in two concrete (and I believe common) contexts. Context 1. At home, you’re the only one ...
user avatar
  • 163
1 vote
0 answers
113 views

How should I store a password used by a service written in .NET

I have a Windows service that accesses a database connection. Since users rarely use Windows authentication, I encrypt the connection string. For development I have the password hard-coded, but I know ...
user avatar
  • 11
2 votes
0 answers
150 views

Why does the CIS benchmark consider the presence of passwd- a (high) risk [closed]

I've just seen a "high-risk security alert" for the presence of /etc/passwd- (note the trailing '-') on RHEL 8 servers, and don't understand the issue. Apparently the issue originates with ...
user avatar
0 votes
1 answer
114 views

Password hashing for local servers

I'm running a local web server on my Raspberry Pi and want to have a login screen. My plan is to hash the password and store the result in a text file ( This is where I'm storing settings for the ...
user avatar
4 votes
1 answer
299 views

Security risks of OAuth vs a password manager

Of the following two approaches, which is "more secure", under which circumstances, and why? In other words, please compare the security risks of these two approaches: Log in to an OAuth ...
user avatar
  • 181

1
2 3 4 5
26