Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
-3
votes
0answers
66 views
Enterprise Password Management [on hold]
Does anyone have any recommendations for enterprise password management solutions? The main requirement is that it must be hosted and managed on premises by us.
0
votes
3answers
103 views
Finding a future-proof password manager
Currently, I am a Windows 10 user who uses Chrome's default password manager and let it autofill in passwords for me.
Apparently, if I were to accidentally execute malware or give someone momentary ...
0
votes
0answers
46 views
Google passwords security or lack thereof [closed]
I have been wondering about to what degree the info can be stolen if someone hacks into Google. Suppose an attacker got access to all of Google's data. Let's assume my Google password is good enough ...
1
vote
2answers
93 views
Deriving 2 keys from user password - one for login - one for encryption? [duplicate]
Context
We have a browser-based client-server application. The client registers with email and password. The password is enforced to some guidelines.
Problem
The User needs an encrypted vault on ...
102
votes
6answers
23k views
School performs periodic password audits. Is my password compromised?
My university sent me an email informing me that, during a "periodic check", my password was found to be "easily discoverable and at risk of compromise". As I understand it, there shouldn't be a way ...
0
votes
1answer
93 views
Is this method of hashing passwords good? Node.js [duplicate]
I am currently developing a login for my website, (using node.js and MySQL) and would like some feedback on the password hashing code.
const crypto = require('crypto');
function RandomSaltString(...
-1
votes
0answers
46 views
List of recommendations for lambda user [closed]
I was discussing the other day with a friend and noticed he had no lock on his phone. Then he told me that his mailbox and FB account were registered. So someone who found the phone could use his mail ...
19
votes
6answers
8k views
Which password policy is more secure: one password of length 9 vs. two passwords each of length 8?
What is more secure, having one password of length 9 (salted and hashed) or having two different passwords, each of length 8 (salted and hashed using two different salts)?
1
vote
1answer
47 views
Is it at all possible to store Windows Sticky Notes in a secure manner?
Example: Users want to use Sticky Notes for quick note taking. They don't like other options, they want Sticky Notes.
However, Sticky Notes normally stores the information in a SQL db that can be ...
0
votes
0answers
72 views
how good is “Chrome Password Checkup” extension for checking passwords?
From what I read so far Google "Chrome Password Checkup" extension (https://chrome.google.com/webstore/detail/password-checkup/pncabnpcffmalkkjpajodfhijclecjno) checking the password that you use for ...
2
votes
2answers
96 views
Committing encrypted passwords but not usernames
I’m arguing with a colleague about the security of storing encrypted password on GitHub.
Our process is currently to commit a configuration file with environment variables including username and ...
1
vote
2answers
78 views
Is storing the bcrypt salt in isolated database a good idea?
I read many answers on the stackexchange about Bcrypt, Salt and Where exactly to place the salt. For hashes such as BCrypt it is trivial to extract salt from the hash. So, It doesn't matter really ...
4
votes
3answers
154 views
How to reset passwords without emailed reset link?
In an offline system what is the preferred method of resetting a user's password?
Usually this would be handled with an emailed password reset link. However this system is offline, there is no access ...
1
vote
3answers
275 views
Question mark not allowed in password
Recently I came up with a password requirement rules as follows:
The password must
be 8-16 characters
contain at least one number
contain at least one lower case letter
contain at least one upper ...
0
votes
3answers
124 views
How to store login information on the user's device
I'm developing an application that needs to store various pairs of username/password to automatically log in into third party services so that users don't have to insert them each time they open the ...
2
votes
1answer
104 views
Opera browser: no master password?
I've recently moved from Firefox to Opera (for performance issues).
I used to protect my passwords in Firefox with a Master Password. But Opera, so it appears, lacks such feature.
I use Debian 9.7 ...
3
votes
3answers
133 views
Login system using permanent “random” hashes in URLs
I am working with a company and have found the following:
When a user registers, they make a "random" hash. This "random" hash often has collisions and has to be regenerated to keep the hash unique ...
1
vote
1answer
131 views
Why would a hacker bother with stealing your database password?
I read recently about whether you should store your database passwords in config files, environment variables, docker secrets, etc. But if somebody can steal it from those places, then s/he can ...
0
votes
0answers
25 views
Saving all secret keys, access data in heroku environ instead of config file?
I have a python/flask app and I use heroku to host it.
I use some additional services, such as stripe, postgresql or emails.
All these services have either secret keys or other access data, which ...
0
votes
0answers
41 views
Why doesn't Cox encrypt my password?
Cox does not encrypt my WiFi password on my account page. So anyone working for Cox has access to my WiFi password. How can I secure my WiFi password?
1
vote
1answer
127 views
Do I understand SHA-1 brute-forcing speeds correctly? (Firefox Password Manager)
I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force ...
1
vote
0answers
40 views
How to store credentials using JKS
Suppose a security team specifies that credentials for an application (specifically, a database username/password) should be stored in a JKS whose password is provided to the application in a local ...
1
vote
2answers
79 views
Should a system require a password confirmation for accounts managed by an administrator?
Suppose you have a user account management subsystem with a web UI. You can change user account passwords in regular masked input password fields in HTML POST forms. I'm wondering, is it fine if such ...
0
votes
2answers
89 views
Advice on password vault software
Do you have any recommendation on any password manager, which is used primarily as a vault? I don't need any browser extension, any special functions, just a regular vault with ability to structure ...
2
votes
2answers
114 views
How should clients' passwords be managed?
How should clients' passwords be managed? By "clients" of course I mean people who you provide a service to, people who need you to work on their stuff (their websites, their servers, their emails, or ...
0
votes
1answer
126 views
Recommended length of password [duplicate]
Why are we recommended to have at least 8 characters, and not 6 or 7 etc.? and the different set of character?. I only know that the longer the password is, the harder it is for brute force attack to ...
0
votes
1answer
56 views
Password managers, how do they get the credentials when you press enter?
I was wondering how password managers (most of the at least) automatically prompt to save my username and password credentials after inserting them into any site.
I mean I am not first putting them ...
2
votes
1answer
92 views
What issues are there with Google's “Suggest Password” feature in Chrome?
I have for a long time used a fairly insecure method of having a series of different passwords - where I would use the same password on many sites. I would change between one of the series of ...
0
votes
1answer
51 views
How to prevent replay attacks without exposing stored password security?
A common way to prevent replay attacks when logging in is for the server to present a challenge (chall) and request a response in the form hash(chall+secret) where the secret is already known by the ...
1
vote
0answers
72 views
Collection #1: Do we know the source of the leaks? [closed]
With Collection #1 yet another large data set of email addresses and passwords was found out there. I happens that one of my frequently used email addresses shows up as 'pwned' when checked against ...
-2
votes
3answers
157 views
Why do services that use 2-factor authentication still ask you to provide a password?
The idea of 2 factor authentication is that if you can prove that you have both a password and a device, you are trusted to be who you say you are. My question is, why does the service still ask you ...
23
votes
1answer
478 views
Is a password manager better than an encrypted file for storing passwords?
For any passwords other than websites I log into regularly (such as Gmail, Facebook, etc.), I use apg to generate a random 20 character password. I then add that password and a username or email ...
3
votes
1answer
92 views
Is it a common practice to give a user an unmodifiable password?
I created an online account on a website, they do not ask me for a password but just an email address, then, after acknowledging "terms of service" I was already logged-in.
Then I received an email ...
1
vote
1answer
74 views
Is it safe to share an encrypted GPG private key?
I use the pass password manager, and I am trying to come up with a convenient way to bootstrap new machines with access to the git repository. I also have a GPG smartcard (Yubikey) with a different ...
3
votes
1answer
87 views
How should I share the key of the AES algorithm in each client?
My doubt would be the following:
How should each client know the encryption key? Using the AES algorithm.
(or the best way):
Save it in a file encrypted by password?
Save it in a DB?
Send it over ...
2
votes
0answers
34 views
Is Privileged Access Management secured without regular Patch Update?
It is well know Privileged Access Management (PAM) is a solution that helps organizations restrict privileged access within an existing Active Directory environment.
Many big company use it to address ...
0
votes
1answer
95 views
Does having in-browser password managers further the risks of successful CSRF attacks?
When successful CSRF attacks are executed they have the ability to access credentials and other information between the victim and the site. Are the sites username and password that are stored in the ...
0
votes
1answer
352 views
An idea for a universal password management standard [closed]
Introduction
For a long time I have struggled with (the idea of) password management. Remembering unique strong passwords is impossible when one has more than a handful, which only leaves the option ...
6
votes
1answer
213 views
Is this vault-less password manager/generator design safe?
Counter
The counter is appended to the site name and incremented if you need to get a new password for a site or if the generated password is insecure because it randomly matches something like "...
7
votes
2answers
514 views
Does Chrome's password manager store plaintext passwords in their databases?
Chrome's password manager allows for users to view their saved passwords on passwords.google.com. The saved passwords can be viewed on different devices as long as the user logs into their Google ...
0
votes
0answers
169 views
What are KeePassXC Encryption Settings?
I'd like to know what is an extremely secure configuration with the given options for KeePassXC database:
Encryption Algorithm: AES 256, Twofish 256, ChaCha20 256
Key Derivation Function: Argon2, AES-...
1
vote
0answers
32 views
Sharing individually encrypted elements between users of a system
I'm creating a file sharing system, in which the unique key of a file is one of the critical components to the retrieval of that file.
For simplicity, lets say the unique keys are the file names.
I'd ...
2
votes
1answer
84 views
Storing password reset token in DB - what are the implications?
In multiple systems I've built/supported I've seen user management do the following for password reset: generated a password reset token via some hashing method and email the link with token to user. ...
0
votes
1answer
66 views
How to securely store and use a password for certificate authority
Other than purely memorizing a password in your head, I'm wondering what the next best thing is for storing a password and using it in a very secure environment without internet connection like a ...
1
vote
4answers
211 views
Mitigating the problem of single point of failure introduced by password managers
I understand the purpose of password managers and the fact that there seem to be a trade-off to accept, but well, I find that trade-off to be unacceptable and I wonder if there's a way to avoid it. A ...
1
vote
3answers
625 views
Any hints for programming my own password manager? [closed]
I mostly want whatever help & suggestions you can give me about what I should avoid & what I should think about when making this.
I'm a reasonable programmer & I want to make my own ...
6
votes
1answer
108 views
Password Managers: Which passwords to still remember?
Let’s say I use a password manager (like 1Password) on all my devices. In my personal opinion it makes sense to have some passwords in your head (you could still have them in the password manager, and ...
0
votes
1answer
57 views
Implementing SRP without storing the salt anywhere
I am attempting to use SRP to verify clients when they authenticate with a webserver, so that the password is never sent over the wire.
Looking at the SRP procedure, when a client registers with the ...
0
votes
1answer
69 views
What's the purpose of the lock and unlock feature in password managers?
I'm afraid this could be a very stupid question, yet I cannot think of an explanation. Password managers (keepass, etc.) often have a button that lets you "lock" the database, so if you need a ...
0
votes
1answer
71 views
Choose a sentence, a number, and the name as password [duplicate]
I would like to have your point of view about something I found on internet.
The goal here is to help people to use stronger passwords, it's not perfect, but I believe that asking people to use ...
