Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
1
vote
0answers
25 views
Sharing individually encrypted elements between users of a system
I'm creating a file sharing system, in which the unique key of a file is one of the critical components to the retrieval of that file.
For simplicity, lets say the unique keys are the file names.
I'd ...
2
votes
1answer
60 views
Storing password reset token in DB - what are the implications?
In multiple systems I've built/supported I've seen user management do the following for password reset: generated a password reset token via some hashing method and email the link with token to user. ...
0
votes
1answer
51 views
How to securely store and use a password for certificate authority
Other than purely memorizing a password in your head, I'm wondering what the next best thing is for storing a password and using it in a very secure environment without internet connection like a ...
0
votes
1answer
53 views
Mitigating the problem of single point of failure introduced by password managers
I understand the purpose of password managers and the fact that there seem to be a trade-off to accept, but well, I find that trade-off to be unacceptable and I wonder if there's a way to avoid it. A ...
1
vote
3answers
312 views
Any hints for programming my own password manager? [closed]
I mostly want whatever help & suggestions you can give me about what I should avoid & what I should think about when making this.
I'm a reasonable programmer & I want to make my own ...
5
votes
1answer
77 views
Password Managers: Which passwords to still remember?
Let’s say I use a password manager (like 1Password) on all my devices. In my personal opinion it makes sense to have some passwords in your head (you could still have them in the password manager, and ...
0
votes
1answer
33 views
Implementing SRP without storing the salt anywhere
I am attempting to use SRP to verify clients when they authenticate with a webserver, so that the password is never sent over the wire.
Looking at the SRP procedure, when a client registers with the ...
0
votes
1answer
67 views
What's the purpose of the lock and unlock feature in password managers?
I'm afraid this could be a very stupid question, yet I cannot think of an explanation. Password managers (keepass, etc.) often have a button that lets you "lock" the database, so if you need a ...
0
votes
1answer
55 views
Choose a sentence, a number, and the name as password [duplicate]
I would like to have your point of view about something I found on internet.
The goal here is to help people to use stronger passwords, it's not perfect, but I believe that asking people to use ...
2
votes
2answers
82 views
How long should a password reset token remain valid?
What is the recommended lifetime of a password reset token?
Too short will degrade user experience and too long would compromise security.
Microsoft identity default to one day but this very long.
50
votes
10answers
16k views
Is it OK that a sysadmin knows the password for a newcomer / act as a user (immediately after his/her recruiting)?
Somehow related to this other question. I am dealing with the following case: a medium-large company (with about 200 on-premises employees) is applying the following procedure for all the newly ...
3
votes
2answers
200 views
How to choose between password derivation or encryption?
Suppose you use a password manager having all possible features of modern password managers: encryption with a key derived from your master password, auto-filling, cloud or local storage, browser ...
1
vote
1answer
41 views
Lastpass - Can I use my old master password to decrypt local data?
I am a user of Lastpass and I have some concern about the storage of local data. According to my knowledge about Lastpass, there is an encrypted local vault stored in my devices with the Lastpass app ...
0
votes
2answers
183 views
What is the standard practice to maintain a password for different websites? [duplicate]
I have come across many users who maintain a re-used password for each and every website, such as P@ssw0rd123
The problem with this approach is if someone breaches the protections of a particular ...
1
vote
0answers
37 views
Password Reset URL strategy
Designing a new flow for a "forgot your password" feature we are developing, i came across a challenging question regarding the URL and the commitment that has to be made between frontend and backend ...
0
votes
1answer
27 views
Should I back up automatic strong passwords of iCloud?
I’ve recently started to use iCloud’s automatic strong passwords. I feel like that if iCloud were down for some reason, the passwords would be lost. Considering it, should I back them up on other ...
4
votes
5answers
270 views
Should admin users confirm their password before changing a user password?
In a hypothetical website, there are two types of users, admin users and normal users. Normal users can change their own password, and in keeping with best practices are required to provide their ...
0
votes
1answer
349 views
Keepass2 vs KeepassXC - KeePass-Http connector - Mono in Linux
please forgive beginner question.
I have been using Xubuntu for several years now; this question is regarding password managers under Linux/Ubuntu.
I have been using Keepass2 which is just such an ...
1
vote
1answer
38 views
Is the tomb's keyfile necessary when creating a password tomb with tomb-pass?
Pass tomb's documentation states
Usage:
pass tomb [-n] [-t time] [-f] [-p subfolder] gpg-id...
Create and initialise a new password tomb
Use gpg-id for encryption of both tomb and passwords
...
1
vote
1answer
39 views
What advantages do Secret Managers offer in terms of authentication [API usage]?
The problem I am seeing with secret managers (programs which serve as a store of secrets for other programs/APIs) is that at some level, a key or credentials must still be provided programmatically, ...
0
votes
0answers
72 views
Where/how to store the password for (REST) authentication?
What I have at the moment is as follows:
There are Java clients where I store the passwords locally in files in clean-text format. There is a REST endpoint where I store all the passwords in one file. ...
0
votes
2answers
173 views
What is Byzantine password system?
How safe are password managers like LastPass?
One comment there asks:
Does anyone know of any Byzantine password systems? E.g. 3 or 5 online
systems, where breaking any single system would not ...
1
vote
1answer
108 views
System Encryption With Veracrypt/Truecrypt- What is the difference between Wipe Mode “None” and 3 pass, 1 pass etc?
First I wanted to make sure we're talking about using a Non-SSD Hard drive. I know SSD drives work differently.
Here would be a good reference/guide on system encryption:
https://www.howtogeek.com/...
1
vote
1answer
79 views
Do hacks of mainstream web applications tend to happen more from random attackers brute forcing or from targeted heuristic attacks?
I'm writing up advice for selecting a master password for a password manager, and I'm wondering if there is available data about the likelihood of different attacks that result in a cracked password. ...
0
votes
1answer
53 views
What are the possible security issues (breach/losing access) with sharing passwords manually?
I am thinking of forming a team in either LastPass or 1Password.
LastPass is free if I don't intend to use it to share my passwords.
I am wondering, why would I need to form a team?
If I want to ...
1
vote
4answers
289 views
Dealing with users who reuse bad passwords
What is the best (or good) practise to deal with users, who are determined to reuse their old password, whether it be good or bad? Or simply use a bad password?
Scenario:
A user wants to create an ...
0
votes
1answer
28 views
iCloud Security Concern: browser session authentication storage after 2-factor?
Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie?
My concern is, if ...
-2
votes
2answers
235 views
What are most dangerous vulnerabilities of users of password management? [closed]
Are there any examples where something goes wrong. For example, say people misused password managers and got hacked or take some loss? If so how?
Basically, I sort of know the typical vulnerabilities ...
2
votes
1answer
69 views
What happens to a pass vault when the GPG key expires?
Say I were to use the Linux tool pass as my password manager and the corresponding GPG key were to expire. Would I still be able to get in?
1
vote
3answers
166 views
What happens if 1password or allpass are gone?
I am going to use one of them for my password management.
The thing is, what about if one day, the password management company is hacked or destroyed.
What would be my recourse?
0
votes
1answer
83 views
Are there security issues in not supporting TOTP 2FA for 1Password? [closed]
1Password sort of supports 2FA. We have a master password and an additional secret. But why don't they support TOTP for 2FA?
I just want to make really sure that unless I approve, no other devices ...
1
vote
1answer
215 views
iOS 12 built in password manager vs third party apps like Keepass
On my personal computers I have always used Keepass2, which however was a bit of a pain to set up with my browser. On my iPhone I have now started to use the built-in password manager (iOS 12 -> ...
1
vote
3answers
215 views
Passwords: store encrypted, view in plain text
I've already asked that question at stackoverflow but i was informed it is a bit too broad and relies more in here instead. So let me just copy and paste what i asked there:
I have a security related ...
10
votes
4answers
845 views
Why should we prevent users from saving their passwords in their password manager?
I understand there are a few other controls, like 2FA, for making transactions in many bank account websites, while only users required for username and password to access the account.
I noticed ...
6
votes
3answers
303 views
Validate Japanese passwords
For English we have some good practice when we want to create an password, like Add numbers, symbols and capital letters. As result we have password like this: P@ssW0rd.
Is there any rule like this ...
3
votes
1answer
68 views
gnupg keys and pass database - Protecting both from unauthorised access and loss
My target is to use pass to store a lot of passwords and be able to access those passwords from wherever I need them, possibly using just a single pass-thing (password, passphrase, my voice, my ...
1
vote
2answers
64 views
Is my personal data at risk with global digital giant's services?
The global digital giant's services like facebook/gmail/twitter/etc are not following standard password policies (like the standard password policies used by most of the Enterprises/Corporate).
For ...
5
votes
3answers
123 views
Doesn't persisting previous passwords pose a vulnerability?
Recently I attempted to log in to Facebook, but I'd forgotten that I'd changed my password. Facebook bounced me back to the login screen and advised me that I'd attempted to enter an old password.
...
0
votes
1answer
41 views
Are auto-type features of password managers actually effective against keyloggers?
Of course if you think of a "keylogger" as a program that can only read keystrokes, then copy-pasting on the clipboard is going to be enough. But we know that keyloggers are not really only "logging ...
4
votes
2answers
280 views
How risky is using e-mail to manage passwords?
No doubt there are better ways and more secure ways to manage passwords, but I'd like to make an informed decision to determine if this is just too risky.
Briefly, when I receive a "welcome new user" ...
3
votes
1answer
102 views
Best way to save username/password programatically
I have a requirement to programmatically save a username and password on the local workstation and retrieve them back.
What would be the most secure way of doing this?
I have used DPAPI in the ...
0
votes
1answer
92 views
Reuse an email address with a leaked password
I just found that the password of a very old email address was leaked. I did not use this email address for a long time cause I lost its password. But now that the password is out, I'm thinking of ...
39
votes
14answers
11k views
How can I make a strong password that's easy to remember? Is the 4 Word method safe? [duplicate]
I have heard of the method of using 4 random dictionary words, it gives you lots of characters and is easy to remember.
But that seems to be open to dictionary attacks, especially if the attacker has ...
2
votes
2answers
230 views
Is it a good idea to upload your gnupg files to github?
I have a GNUPG file that i use to store all my passwords locally(Dont know if it is a good idea). The question is, is it safe to push the GNUPG file to github so i can access it from anywhere?
0
votes
0answers
30 views
Are REST Authentication schemes that expose shared key protected against reverse proxies acting as bad user agents?
Recently a situation arose where a client wants a public API that doesn't require registration or login by the user (no password). The security team has identified that the server-side API needs to ...
1
vote
3answers
137 views
Why keep track of user password changes in web application?
For some reason, it has become a common security* practice for websites to keep track of password changes. Sites like Google can even tell you how long ago you changed your password. Aside from just ...
0
votes
1answer
131 views
What's the best way to store the passwords? [closed]
What is the best way of storing my passwords? Which storage is considered the safest one? How safe/unsafe is to store passwords in the local MySQL database?
0
votes
2answers
155 views
Why do most ip camera manufacturers set an easy default password?
A good chunk of ip cameras come with an easy default password which is the same for all models. It usually is something like admin, 1234, root ...
The basic customer doesn't know that millions of ip ...
3
votes
2answers
365 views
Does PCI-DSS password guidance apply to service accounts?
A service account is a user account created for the sole purpose of running an application. For example, an online banking web site may have a single service account under which the code runs.
...
2
votes
0answers
59 views
password managers and FIDO
I've just been reading some posts about FIDO support (or the lack thereof) in password managers and want to check whether my understanding is correct.
My understanding of FIDO (v1) is that the device ...
