Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
0
votes
1answer
55 views
Store passwords in a text file… is it really much worse than a password manager?
My idea:
Storing my passwords in a text file kept on Dropbox and accessed through a python script to quickly retrieve the password for the site I want to access.
My motives:
I want to be platform-...
0
votes
0answers
39 views
How to set LastPass to verify before opening my vault and viewing all passwords [migrated]
I am new to LastPass and I was shocked when I realised that, once I logged in to LastPass browser extension, I could open my vault and view all the passwords even after I had exited my browser and ...
0
votes
0answers
27 views
SSLVPN client saving encrypted password in local xml file, is that secure?
Simply copy the specific xml file to another client's correspond path, I can login to the remote network automatically. If that is a vulnerability, what severity rate will you give to it? High, medium,...
1
vote
0answers
89 views
For cloud-based password managers, is it safe to login using public WiFi?
For cloud-based password managers, is it safe to login when using public WiFi?
To help get good answers to this question, let's define 3 terms:
Cloud-based password managers = Password managers such ...
1
vote
3answers
202 views
Is it advisable to create a system that stores passwords?
Please bear with me, I'm a total newbie about security.
I work in a company whose main goal is to maximize profits and use free stuff as much as possible. It's effect is that we use tons of freeware ...
1
vote
3answers
154 views
What security benefit does 2FA provide a password manager?
It's no secret that many popular password managers (1Password, Dashlane, LastPass, KeePass, and many others) support some form of two-factor authentication. This is often implemented via TOTP or other ...
1
vote
1answer
69 views
Setting passwords for domain users, not expiring them, and not allowing them to be changed by users
We are in a mid-sized enterprise environment and are looking at forcing specific passwords for all users. I've found nothing recent or relevant about this.
Justification:
The main reason is to ...
1
vote
1answer
85 views
Can my open Firefox Sync session be used to circumvent a Master Password?
In short I'm wondering what's stopping someone with access to my computer account to exploit an open Firefox Sync session to view my synced passwords, even if a Master Password has been set.
On this ...
28
votes
2answers
4k views
Does password expiry provide any benefit at all (when using randomly generated passwords)?
I have been seeing a shift in password policy, this has been going on for a while (Article from 2017) but I have only just picked up on this. In my organization we expire the user passwords every 90 ...
0
votes
0answers
86 views
Browser passwords used on multiple domains?
I have 100 domains with authentication backed by the same LDAP database. There is a single-sign on, but it's not implemented with OAuth. That is to say, per user, each domain accepts the same user/...
1
vote
3answers
109 views
Security concerns around sharing secret on a website
I need to share credentials with users. These credentials are created when the user wants them, but cannot be chosen by the user specifically (AAD credentials). I want to share the same with the user ...
0
votes
0answers
17 views
What are some secure methods to share pre-created password? [duplicate]
I am working on something that requires me to create and share AAD(Azure Active Directory) credentials with clients. To give some context, Azure automatically creates a secret and then that secret has ...
0
votes
1answer
46 views
How secure is pgAdmin to save database password?
When we are creating a new connection with pgAdmin, we are presented with an option to save the password into our computer, so we won't have to retype it every time we want to connect with the ...
0
votes
1answer
56 views
Password storage which avoids privileged insider attack
What are the standard password authentication protocols in client-server setting where authentication happens at the remote server? Is there any password/pin verification protocol which reveals zero ...
0
votes
0answers
30 views
Authenticated scan strategy for large enterprise network
I have been tasked with using Qualys Vulnerability Scanner in order to perform scans within a large enterprise network.
Within this network there are Windows machines and Linux machines.
CyberArk has ...
5
votes
1answer
135 views
Do ciphers and encoding schemes make passwords more secure?
I recently came across a tech professional advising a user to take some plaintext of their choice, run it through one of these ciphers, convert it to Base64, and then use the result as their master ...
2
votes
2answers
118 views
Best practices for sharing or managing passwords between teams
Consider this scenario.
A small company with several small teams (2-3 members). Each team manages their own passwords for their systems. Now, in the case when the whole team perishes in an accident, ...
59
votes
16answers
13k views
Alternative to sending password over mail?
Recently I've started working as a contractor for a company, which requires me to often log in to different b2b services.
The way I receive the login data is usually over email in plain text. My gut ...
0
votes
3answers
192 views
How to keep track of passwords and avoiding password-reuse
I have lurked for a time on security websites and similar. I came to wonder, with the number of passwords we have (or websites that need a password) how to manage this.
Since I have well over 400 ...
1
vote
0answers
21 views
Rememberable Password Formula [duplicate]
I was reading the comments under this answer and saw this comment
Your answer to the question is basically to use a password formula, and there is already an answer that covers that option. Your ...
45
votes
13answers
12k views
Is there a good way to store credentials outside of a password manager?
A lot of the users in my company are using their agendas to write down their password and usernames, or Excel sheets with a protected password. I'm hesitant to install software for password management ...
19
votes
2answers
2k views
Store Credit Card Information in Password Manager?
For convenience purposes I manage my passwords with the password manager Bitwarden on my personal computer and smartphone with autofill function (but with asking for the master password or fingerprint ...
0
votes
4answers
179 views
Finding a future-proof password manager
Currently, I am a Windows 10 user who uses Chrome's default password manager and let it autofill in passwords for me.
Apparently, if I were to accidentally execute malware or give someone momentary ...
1
vote
2answers
104 views
Deriving 2 keys from user password - one for login - one for encryption? [duplicate]
Context
We have a browser-based client-server application. The client registers with email and password. The password is enforced to some guidelines.
Problem
The User needs an encrypted vault on ...
102
votes
6answers
23k views
School performs periodic password audits. Is my password compromised?
My university sent me an email informing me that, during a "periodic check", my password was found to be "easily discoverable and at risk of compromise". As I understand it, there shouldn't be a way ...
0
votes
1answer
197 views
Is this method of hashing passwords good? Node.js [duplicate]
I am currently developing a login for my website, (using node.js and MySQL) and would like some feedback on the password hashing code.
const crypto = require('crypto');
function RandomSaltString(...
19
votes
6answers
8k views
Which password policy is more secure: one password of length 9 vs. two passwords each of length 8?
What is more secure, having one password of length 9 (salted and hashed) or having two different passwords, each of length 8 (salted and hashed using two different salts)?
1
vote
1answer
64 views
Is it at all possible to store Windows Sticky Notes in a secure manner?
Example: Users want to use Sticky Notes for quick note taking. They don't like other options, they want Sticky Notes.
However, Sticky Notes normally stores the information in a SQL db that can be ...
0
votes
0answers
88 views
how good is “Chrome Password Checkup” extension for checking passwords?
From what I read so far Google "Chrome Password Checkup" extension (https://chrome.google.com/webstore/detail/password-checkup/pncabnpcffmalkkjpajodfhijclecjno) checking the password that you use for ...
2
votes
2answers
98 views
Committing encrypted passwords but not usernames
I’m arguing with a colleague about the security of storing encrypted password on GitHub.
Our process is currently to commit a configuration file with environment variables including username and ...
1
vote
2answers
92 views
Is storing the bcrypt salt in isolated database a good idea?
I read many answers on the stackexchange about Bcrypt, Salt and Where exactly to place the salt. For hashes such as BCrypt it is trivial to extract salt from the hash. So, It doesn't matter really ...
4
votes
3answers
166 views
How to reset passwords without emailed reset link?
In an offline system what is the preferred method of resetting a user's password?
Usually this would be handled with an emailed password reset link. However this system is offline, there is no access ...
1
vote
3answers
300 views
Question mark not allowed in password
Recently I came up with a password requirement rules as follows:
The password must
be 8-16 characters
contain at least one number
contain at least one lower case letter
contain at least one upper ...
0
votes
3answers
132 views
How to store login information on the user's device
I'm developing an application that needs to store various pairs of username/password to automatically log in into third party services so that users don't have to insert them each time they open the ...
2
votes
1answer
130 views
Opera browser: no master password?
I've recently moved from Firefox to Opera (for performance issues).
I used to protect my passwords in Firefox with a Master Password. But Opera, so it appears, lacks such feature.
I use Debian 9.7 ...
3
votes
3answers
146 views
Login system using permanent “random” hashes in URLs
I am working with a company and have found the following:
When a user registers, they make a "random" hash. This "random" hash often has collisions and has to be regenerated to keep the hash unique ...
1
vote
1answer
133 views
Why would a hacker bother with stealing your database password?
I read recently about whether you should store your database passwords in config files, environment variables, docker secrets, etc. But if somebody can steal it from those places, then s/he can ...
0
votes
0answers
34 views
Saving all secret keys, access data in heroku environ instead of config file?
I have a python/flask app and I use heroku to host it.
I use some additional services, such as stripe, postgresql or emails.
All these services have either secret keys or other access data, which ...
0
votes
0answers
43 views
Why doesn't Cox encrypt my password?
Cox does not encrypt my WiFi password on my account page. So anyone working for Cox has access to my WiFi password. How can I secure my WiFi password?
1
vote
1answer
135 views
Do I understand SHA-1 brute-forcing speeds correctly? (Firefox Password Manager)
I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force ...
1
vote
0answers
48 views
How to store credentials using JKS
Suppose a security team specifies that credentials for an application (specifically, a database username/password) should be stored in a JKS whose password is provided to the application in a local ...
1
vote
2answers
79 views
Should a system require a password confirmation for accounts managed by an administrator?
Suppose you have a user account management subsystem with a web UI. You can change user account passwords in regular masked input password fields in HTML POST forms. I'm wondering, is it fine if such ...
0
votes
2answers
93 views
Advice on password vault software
Do you have any recommendation on any password manager, which is used primarily as a vault? I don't need any browser extension, any special functions, just a regular vault with ability to structure ...
2
votes
2answers
123 views
How should clients' passwords be managed?
How should clients' passwords be managed? By "clients" of course I mean people who you provide a service to, people who need you to work on their stuff (their websites, their servers, their emails, or ...
0
votes
1answer
225 views
Recommended length of password [duplicate]
Why are we recommended to have at least 8 characters, and not 6 or 7 etc.? and the different set of character?. I only know that the longer the password is, the harder it is for brute force attack to ...
0
votes
1answer
59 views
Password managers, how do they get the credentials when you press enter?
I was wondering how password managers (most of the at least) automatically prompt to save my username and password credentials after inserting them into any site.
I mean I am not first putting them ...
2
votes
1answer
242 views
What issues are there with Google's “Suggest Password” feature in Chrome?
I have for a long time used a fairly insecure method of having a series of different passwords - where I would use the same password on many sites. I would change between one of the series of ...
0
votes
1answer
67 views
How to prevent replay attacks without exposing stored password security?
A common way to prevent replay attacks when logging in is for the server to present a challenge (chall) and request a response in the form hash(chall+secret) where the secret is already known by the ...
1
vote
0answers
73 views
Collection #1: Do we know the source of the leaks? [closed]
With Collection #1 yet another large data set of email addresses and passwords was found out there. I happens that one of my frequently used email addresses shows up as 'pwned' when checked against ...
-2
votes
3answers
163 views
Why do services that use 2-factor authentication still ask you to provide a password?
The idea of 2 factor authentication is that if you can prove that you have both a password and a device, you are trusted to be who you say you are. My question is, why does the service still ask you ...
