Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
0
votes
1answer
42 views
How to prevent replay attacks without exposing stored password security?
A common way to prevent replay attacks when logging in is for the server to present a challenge (chall) and request a response in the form hash(chall+secret) where the secret is already known by the ...
1
vote
0answers
58 views
Collection #1: Do we know the source of the leaks? [on hold]
With Collection #1 yet another large data set of email addresses and passwords was found out there. I happens that one of my frequently used email addresses shows up as 'pwned' when checked against ...
-2
votes
3answers
142 views
Why do services that use 2-factor authentication still ask you to provide a password?
The idea of 2 factor authentication is that if you can prove that you have both a password and a device, you are trusted to be who you say you are. My question is, why does the service still ask you ...
0
votes
0answers
31 views
Are there password managers that support a mobile app that returns a password based on a photographed bar code?
The company I'm working for has to manage the passwords of thousands of OT devices. Technicians out in the field must be able to retrieve the passwords that belong to a given OT device in a simple way....
23
votes
1answer
304 views
Is a password manager better than an encrypted file for storing passwords?
For any passwords other than websites I log into regularly (such as Gmail, Facebook, etc.), I use apg to generate a random 20 character password. I then add that password and a username or email ...
3
votes
1answer
81 views
Is it a common practice to give a user an unmodifiable password?
I created an online account on a website, they do not ask me for a password but just an email address, then, after acknowledging "terms of service" I was already logged-in.
Then I received an email ...
0
votes
1answer
50 views
Is it safe to share an encrypted GPG private key?
I use the pass password manager, and I am trying to come up with a convenient way to bootstrap new machines with access to the git repository. I also have a GPG smartcard (Yubikey) with a different ...
3
votes
1answer
80 views
How should I share the key of the AES algorithm in each client?
My doubt would be the following:
How should each client know the encryption key? Using the AES algorithm.
(or the best way):
Save it in a file encrypted by password?
Save it in a DB?
Send it over ...
2
votes
0answers
31 views
Is Privileged Access Management secured without regular Patch Update?
It is well know Privileged Access Management (PAM) is a solution that helps organizations restrict privileged access within an existing Active Directory environment.
Many big company use it to address ...
0
votes
1answer
89 views
Does having in-browser password managers further the risks of successful CSRF attacks?
When successful CSRF attacks are executed they have the ability to access credentials and other information between the victim and the site. Are the sites username and password that are stored in the ...
0
votes
1answer
313 views
An idea for a universal password management standard [closed]
Introduction
For a long time I have struggled with (the idea of) password management. Remembering unique strong passwords is impossible when one has more than a handful, which only leaves the option ...
6
votes
1answer
196 views
Is this vault-less password manager/generator design safe?
Counter
The counter is appended to the site name and incremented if you need to get a new password for a site or if the generated password is insecure because it randomly matches something like "...
7
votes
2answers
244 views
Does Chrome's password manager store plaintext passwords in their databases?
Chrome's password manager allows for users to view their saved passwords on passwords.google.com. The saved passwords can be viewed on different devices as long as the user logs into their Google ...
0
votes
0answers
87 views
What are KeePassXC Encryption Settings?
I'd like to know what is an extremely secure configuration with the given options for KeePassXC database:
Encryption Algorithm: AES 256, Twofish 256, ChaCha20 256
Key Derivation Function: Argon2, AES-...
1
vote
0answers
28 views
Sharing individually encrypted elements between users of a system
I'm creating a file sharing system, in which the unique key of a file is one of the critical components to the retrieval of that file.
For simplicity, lets say the unique keys are the file names.
I'd ...
2
votes
1answer
69 views
Storing password reset token in DB - what are the implications?
In multiple systems I've built/supported I've seen user management do the following for password reset: generated a password reset token via some hashing method and email the link with token to user. ...
0
votes
1answer
63 views
How to securely store and use a password for certificate authority
Other than purely memorizing a password in your head, I'm wondering what the next best thing is for storing a password and using it in a very secure environment without internet connection like a ...
1
vote
4answers
191 views
Mitigating the problem of single point of failure introduced by password managers
I understand the purpose of password managers and the fact that there seem to be a trade-off to accept, but well, I find that trade-off to be unacceptable and I wonder if there's a way to avoid it. A ...
1
vote
3answers
393 views
Any hints for programming my own password manager? [closed]
I mostly want whatever help & suggestions you can give me about what I should avoid & what I should think about when making this.
I'm a reasonable programmer & I want to make my own ...
6
votes
1answer
102 views
Password Managers: Which passwords to still remember?
Let’s say I use a password manager (like 1Password) on all my devices. In my personal opinion it makes sense to have some passwords in your head (you could still have them in the password manager, and ...
0
votes
1answer
41 views
Implementing SRP without storing the salt anywhere
I am attempting to use SRP to verify clients when they authenticate with a webserver, so that the password is never sent over the wire.
Looking at the SRP procedure, when a client registers with the ...
0
votes
1answer
69 views
What's the purpose of the lock and unlock feature in password managers?
I'm afraid this could be a very stupid question, yet I cannot think of an explanation. Password managers (keepass, etc.) often have a button that lets you "lock" the database, so if you need a ...
0
votes
1answer
61 views
Choose a sentence, a number, and the name as password [duplicate]
I would like to have your point of view about something I found on internet.
The goal here is to help people to use stronger passwords, it's not perfect, but I believe that asking people to use ...
2
votes
2answers
139 views
How long should a password reset token remain valid?
What is the recommended lifetime of a password reset token?
Too short will degrade user experience and too long would compromise security.
Microsoft identity default to one day but this very long.
50
votes
10answers
16k views
Is it OK that a sysadmin knows the password for a newcomer / act as a user (immediately after his/her recruiting)?
Somehow related to this other question. I am dealing with the following case: a medium-large company (with about 200 on-premises employees) is applying the following procedure for all the newly ...
3
votes
2answers
208 views
How to choose between password derivation or encryption?
Suppose you use a password manager having all possible features of modern password managers: encryption with a key derived from your master password, auto-filling, cloud or local storage, browser ...
1
vote
1answer
44 views
Lastpass - Can I use my old master password to decrypt local data?
I am a user of Lastpass and I have some concern about the storage of local data. According to my knowledge about Lastpass, there is an encrypted local vault stored in my devices with the Lastpass app ...
0
votes
2answers
186 views
What is the standard practice to maintain a password for different websites? [duplicate]
I have come across many users who maintain a re-used password for each and every website, such as P@ssw0rd123
The problem with this approach is if someone breaches the protections of a particular ...
1
vote
0answers
40 views
Password Reset URL strategy
Designing a new flow for a "forgot your password" feature we are developing, i came across a challenging question regarding the URL and the commitment that has to be made between frontend and backend ...
0
votes
2answers
49 views
Should I back up automatic strong passwords of iCloud?
I’ve recently started to use iCloud’s automatic strong passwords. I feel like that if iCloud were down for some reason, the passwords would be lost. Considering it, should I back them up on other ...
4
votes
5answers
273 views
Should admin users confirm their password before changing a user password?
In a hypothetical website, there are two types of users, admin users and normal users. Normal users can change their own password, and in keeping with best practices are required to provide their ...
0
votes
1answer
1k views
Keepass2 vs KeepassXC - KeePass-Http connector - Mono in Linux
please forgive beginner question.
I have been using Xubuntu for several years now; this question is regarding password managers under Linux/Ubuntu.
I have been using Keepass2 which is just such an ...
1
vote
1answer
40 views
Is the tomb's keyfile necessary when creating a password tomb with tomb-pass?
Pass tomb's documentation states
Usage:
pass tomb [-n] [-t time] [-f] [-p subfolder] gpg-id...
Create and initialise a new password tomb
Use gpg-id for encryption of both tomb and passwords
...
1
vote
1answer
51 views
What advantages do Secret Managers offer in terms of authentication [API usage]?
The problem I am seeing with secret managers (programs which serve as a store of secrets for other programs/APIs) is that at some level, a key or credentials must still be provided programmatically, ...
0
votes
2answers
173 views
What is Byzantine password system?
How safe are password managers like LastPass?
One comment there asks:
Does anyone know of any Byzantine password systems? E.g. 3 or 5 online
systems, where breaking any single system would not ...
1
vote
1answer
142 views
System Encryption With Veracrypt/Truecrypt- What is the difference between Wipe Mode “None” and 3 pass, 1 pass etc?
First I wanted to make sure we're talking about using a Non-SSD Hard drive. I know SSD drives work differently.
Here would be a good reference/guide on system encryption:
https://www.howtogeek.com/...
1
vote
1answer
79 views
Do hacks of mainstream web applications tend to happen more from random attackers brute forcing or from targeted heuristic attacks?
I'm writing up advice for selecting a master password for a password manager, and I'm wondering if there is available data about the likelihood of different attacks that result in a cracked password. ...
0
votes
1answer
56 views
What are the possible security issues (breach/losing access) with sharing passwords manually?
I am thinking of forming a team in either LastPass or 1Password.
LastPass is free if I don't intend to use it to share my passwords.
I am wondering, why would I need to form a team?
If I want to ...
1
vote
4answers
300 views
Dealing with users who reuse bad passwords
What is the best (or good) practise to deal with users, who are determined to reuse their old password, whether it be good or bad? Or simply use a bad password?
Scenario:
A user wants to create an ...
0
votes
1answer
35 views
iCloud Security Concern: browser session authentication storage after 2-factor?
Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie?
My concern is, if ...
-2
votes
2answers
255 views
What are most dangerous vulnerabilities of users of password management? [closed]
Are there any examples where something goes wrong. For example, say people misused password managers and got hacked or take some loss? If so how?
Basically, I sort of know the typical vulnerabilities ...
2
votes
1answer
78 views
What happens to a pass vault when the GPG key expires?
Say I were to use the Linux tool pass as my password manager and the corresponding GPG key were to expire. Would I still be able to get in?
1
vote
3answers
173 views
What happens if 1password or allpass are gone?
I am going to use one of them for my password management.
The thing is, what about if one day, the password management company is hacked or destroyed.
What would be my recourse?
0
votes
1answer
94 views
Are there security issues in not supporting TOTP 2FA for 1Password? [closed]
1Password sort of supports 2FA. We have a master password and an additional secret. But why don't they support TOTP for 2FA?
I just want to make really sure that unless I approve, no other devices ...
1
vote
1answer
392 views
iOS 12 built in password manager vs third party apps like Keepass
On my personal computers I have always used Keepass2, which however was a bit of a pain to set up with my browser. On my iPhone I have now started to use the built-in password manager (iOS 12 -> ...
1
vote
3answers
381 views
Passwords: store encrypted, view in plain text
I've already asked that question at stackoverflow but i was informed it is a bit too broad and relies more in here instead. So let me just copy and paste what i asked there:
I have a security related ...
10
votes
4answers
919 views
Why should we prevent users from saving their passwords in their password manager?
I understand there are a few other controls, like 2FA, for making transactions in many bank account websites, while only users required for username and password to access the account.
I noticed ...
6
votes
3answers
315 views
Validate Japanese passwords
For English we have some good practice when we want to create an password, like Add numbers, symbols and capital letters. As result we have password like this: P@ssW0rd.
Is there any rule like this ...
3
votes
1answer
72 views
gnupg keys and pass database - Protecting both from unauthorised access and loss
My target is to use pass to store a lot of passwords and be able to access those passwords from wherever I need them, possibly using just a single pass-thing (password, passphrase, my voice, my ...
1
vote
2answers
64 views
Is my personal data at risk with global digital giant's services?
The global digital giant's services like facebook/gmail/twitter/etc are not following standard password policies (like the standard password policies used by most of the Enterprises/Corporate).
For ...
