Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

Filter by
Sorted by
Tagged with
0 votes
2 answers
61 views

How to reuse PIN codes in the most secure way?

I've made a list of the services/devices that require a PIN code. Shockingly, it's over 10, which I find impossible to remember, so I need a strategy to reuse the codes. What could be a strategy for ...
0 votes
0 answers
26 views

What is the best way to protect passwords? [duplicate]

I noticed that I don't use many different passwords for all my stuff, which is very insecure. However, it is also difficult to remember really secure, long passwords which are different for every ...
  • 1
0 votes
3 answers
189 views

Understanding Password Manager Chicken and Egg problem

I read that Password Managers are a more secure option than remembering passwords. I am currently evaluating Passwords Managers with cloud synchronization and there is something that really confused ...
  • 103
0 votes
2 answers
59 views

Digital legacy: safe to save password manager login info in Gmail draft?

Google accounts have a "Digital Legacy" feature, where accounts that go inactive for a long period (3 months, 6 months, etc.) and do not respond to alerts will eventually trigger Inactive ...
  • 373
23 votes
2 answers
4k views

Why is 1Password sign-in to new device secure without MFA?

I'm trying to understand why it's not necessary with MFA in 1Password when signing in to a new device. This was the case that triggered my curiosity: I created a 1Password account I downloaded the ...
  • 341
2 votes
1 answer
191 views

Is CVE-2023-24055 applicable to other password managers using the same format as the original KeePass?

CVE-2023-24055 is a known vulnerability that enables an attacker to recover plaintext user credentials from the KeePass application. However, due to the original KeePass being Windows-specific, I've ...
  • 350
1 vote
2 answers
101 views

DNS hijacking/poisoning effect on URL/URI and password manager autotype/autofill

A benefit to password managers, at least some of them, is that they can look at the URL and only use autotype/autofill when on the correct site, which can help prevent pharming since if instead of ...
  • 13
0 votes
1 answer
119 views

What threats can the use of a TPM by a password manager mitigate?

This question is about the use of a TPM by a password manager used by an end-user on a PC to store and use passwords to log in to web sites and other things that are protected only by a password. ...
  • 569
1 vote
0 answers
100 views

How do password manager developers protect their app store accounts?

Basically every password manager (like LastPass, 1Password, ...) has its Android & iOS app and browser extensions for Chrome, Safari, Firefox etc., to automatically fill in usernames and passwords....
1 vote
3 answers
180 views

Why do I need to provide authentication when accessing a browser's built-in password manager?

Why do I have to provide authentication when I want to read a password stored in my own web browser while I have to do nothing to read the same password on a site's login page? Is my conclusion ...
  • 3,619
2 votes
1 answer
147 views

Why would garbage collection be a problem in password managers?

I was reading an infosec user's take on the LastPass data breach and noted something odd in his commentary on another password manager system (emphasis mine) I have not done a thorough code review, ...
  • 3,808
0 votes
2 answers
66 views

Whats the difference between secret and password managers?

Are there fundamental underlying differences in how secrets and passwords should be managed? I'm curious of the technical/cryptographic differences between secret managers and password managers are. ...
0 votes
1 answer
66 views

My Bank Enforces A 6 Character Limit On Passwords. Is This Bad? [duplicate]

A bank I (previously) used in Australia forced users to comply with a 6-character limit on every password. Specifically, the rules were: 6 characters exactly, including at least 1 number and letter ...
  • 101
51 votes
5 answers
6k views

Should a bank be able to shorten your password without your involvement?

The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore. He called his advisor, who ...
  • 611
0 votes
0 answers
34 views

Benefit of only having MFA challenge on the very first login

I'm trying to select a suitable password store for a team - one of my main requirements is that users be authenticated via a removable key file rather than simply a master password. I have been using ...
3 votes
2 answers
148 views

How do I remember passwords for environments where Password Manager is not available?

I am a big fan of 1Password. And I try to save my passwords in 1Password as much as possible. However, there are environments where 1Password cannot be used. That is the password to protect 1Password ...
user avatar
1 vote
0 answers
145 views

Does having authenticator app/OTP generator built into Password Manager defeat its purpose?

For example the KeepassOTP plugin is one of a few plugins for Keepass, that allows users to view their OTP code from within the password manager itself. Does this defeat the purpose of having a OTP as ...
1 vote
1 answer
230 views

How do I secure sensitive information like system credentials in a configuration file?

I often get this question: I have sensitive data such as system credentials which my web application needs to secure. Some things I can store in a database, but others (like the credentials to access ...
16 votes
4 answers
4k views

Should one reject login attempts when the correct password is newly added to a password deny list?

Best practices say that when users choose a password (at signup or when changing an existing password), the application should reject that password if it appears on a list of passwords known to be ...
2 votes
2 answers
73 views

How can a users plaintext password be acquired while using biometricID with the following security model?

This is a slightly tough one to explain with my current experience, lacking mainstream terminology. But here goes. I have an encryption/security model whereby I do not store users plaintext passwords. ...
  • 251
0 votes
0 answers
96 views

Amnesia and death proof master password

I have been thinking about how to store my master passwords (password manager, email and device passwords) for quite a while and I just haven't been able to come up with a satisfying solution yet. I ...
4 votes
1 answer
1k views

Practicality of outsourcing password hashing using enclaves

I've been pondering some potential cybersecurity applications for enclaves. One of them being the problem of password hashing. Some clients have enclave support, meaning part of their CPU can securely ...
0 votes
1 answer
81 views

Using Single Sign-On and the usage of password managers is discouraged. Whay are alternatives for storing tokens for example?

What are the alternatives of storing tokens when password managers are discouraged? Some of the ideas that come to my mind are storing in a text file and encrypting with GnuPG but that's asks for ...
  • 293
0 votes
1 answer
79 views

Cryptographic hash functions and personal password management [duplicate]

Background: I've always reused same username/password on all websites and got hacked regularly. I am considering using a password manager, but I don't like the need of storing a database. So I came up ...
  • 103
1 vote
2 answers
123 views

How to securely use `pass`, `sudo`, and `npm` on the same machine

TL;DR: running npm i ... not long after pass my-password allows a malicious package to steal my entire password store. I use pass as a password manager, on Linux. And like probably all Linux users, I ...
  • 13
0 votes
0 answers
115 views

Auto-login (password stored on device) vs refresh token

I’m asking myself what are the benefits of refresh token over saving the user password (securely) on user device and perform a transparent login (background) with its credentials to get a fresh new ...
1 vote
0 answers
112 views

Storing app specific PINs on mobile devices for local authentication

Are there any best practices for storing app specific PINs (e.g. 6 digit PIN that isn't part of the device lock screen) on mobile devices (Android/iOS)? I know several banking and authenticator apps ...
2 votes
3 answers
4k views

Is this a secure approach to store a master password?

I have come up with the following approach to remember master passwords (to use in software like KeePass, etc): Since it is annoying to type the master password every time we power up the PC, we store ...
  • 123
0 votes
2 answers
148 views

Storing backup keys (2FA) for online accounts

So I spent the day looking for a good solution of storing the backup keys or the 2FA codes and can't seem to find a convenient way for me, many people have different takes on this, so far I found 2 ...
  • 1
2 votes
2 answers
137 views

Mitigating the performance impact of strong hashes with Basic HTTP authentication

I am trying to decide which work factor to use for our hashed passwords, and I am facing the following dilemma. Let me elaborate for a moment. Basic HTTP authentication works as follows: The user ...
  • 2,966
0 votes
2 answers
142 views

Is it possible to design a system with two passwords?

Is it possible to design a system with two passwords prompts? The system will have to prompt for two passwords The system would have to validate first password before prompting for second password ...
3 votes
0 answers
900 views

How to Securely Store Database Password in Java .properties File

I would like to store my DB password in Java .property file and encrypt it using Jasypt. But from what I see, it just moves the problem from hiding the DB Password to hiding the encryption password. I ...
2 votes
3 answers
146 views

Manage passwords from my personal website

So I'm a complete novice in security practices, and an amateur web developer. I have a personal website connected to a personal DB. Currently there is nothing in this DB that would be useful to anyone ...
  • 23
1 vote
3 answers
71 views

Creating Password from 2 different part

I’m looking for Term Or Some platform for managing Password Authentication with this way : Password construct from 2 Part , First one is static and you can make it and second Part Generate From TOTP ...
  • 11
33 votes
6 answers
14k views

Is it safe to store account credentials in an Excel sheet protected with a password?

Basically the title. For example, how bad is it to store passwords in an Excel sheet protected with a password, instead of storing passwords in Keypass or something else like Zoho Vault? Of course, ...
  • 433
1 vote
2 answers
258 views

How Google protects and syncs the passwords?

I read this post but I want to know more details. I know that Google uses a Windows' function called CryptProtectData to encrypt user passwords on Windows and Google only stores the encrypted forms of ...
  • 21
1 vote
1 answer
91 views

SCrypt's goal and the role its salt plays

Am I right in stating that SCrypt as an algorithm is useful where many passwords are stored in a database, but not against one specific encryption key derived from one password of one user? For ...
0 votes
0 answers
173 views

Google says my password has been found in data breach. HIBP knows nothing about it. Which data breach was that?

I've been using Chrome to save and sync my passwords across devices (and lately I am trying to switch to Bitwarden). Google warned me recently about a password I have used across multiple sites that ...
  • 101
0 votes
0 answers
84 views

Secure method of creating sudoer password through cloud-init

We have automated a lot of things for server startup via cloud-config, and I want confirmation about whether there is any security concern in the following. users: - name: myuser groups: sudo ...
0 votes
2 answers
87 views

Construct a strong, (almost) unique password? [duplicate]

After reading Why use random characters in passwords? it seems to me that one can solve the problem of how to remember a zillion passwords while each one remains secure by constructing each password ...
0 votes
0 answers
132 views

Google Password I didn't create

I opened Google, and a popup occurred briefly before I reflexively closed it. I then realized it had said something about a new password saved to the Google Password Manager, I think - which is weird,...
  • 111
1 vote
3 answers
201 views

Password manager vs Gmail

Is there any security issue if I use for example my Gmail account to store passwords from another resources instead of using any password manager like a KeePass? If my password for Gmail account is ...
  • 115
0 votes
1 answer
218 views

Passing password back from server to client? [duplicate]

I've never seen any example of this and I'm just curious why? Why is it not okay just to pass it through HTTPs + encoded in a JWT? I will not be storing the password anywhere on the client side, I ...
  • 1
1 vote
0 answers
209 views

Using pass cli for background (cron) jobs securely

Q: how to securely use pass tool to for scheduled jobs? One of the tools to store and manage passwords on a unix machine is pass, which is a layer on top of gpg. Any password that I create is ...
  • 11
0 votes
0 answers
127 views

password manager and key management

I would love to gather some information on how to program my own password manager properly as I'm pretty new to security. Currently, I'm using pythons cryptography module and a sqlite database. The ...
5 votes
1 answer
292 views

Design of a web based password vault

I'm designing a password vault that's accessible to clients through an existing web application. The clients are small, (and mostly non-technical) businesses that aren't using password managers, but ...
4 votes
2 answers
469 views

What algorithm does 1Password use for encryption, AES-GCM-256 or AES-CBC-256?

I would like to know what encryption 1Password uses. On the About the 1Password security model page, it says: Your 1Password data is kept safe by AES-GCM-256 authenticated encryption. The data you ...
  • 143
0 votes
0 answers
16 views

Application to archive a file with multiple passwords [duplicate]

Is there an application to create an archive (e.g. 7z, zip, rar, etc) that can be accessed with multiple valid passwords? For example the password protected archive "example.7z" can be ...
  • 1
3 votes
2 answers
152 views

Do password autofill extensions securely validate the site they are autofilling?

I had a situation where I clicked an email link send to me by a financial institution. The link first sent me to their login page where my chrome password extension automatically filled in my username ...
3 votes
2 answers
156 views

How to best separate password "tiers" or not at all?

While using a password+ manager is a know must for sensible security, one nuisance (from an UX point of view) I encounter is that there are different password "tiers". Pretty obviously my e....

1
2 3 4 5
26