Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
1,135
questions
0
votes
0answers
30 views
Best Practices for password/keys web-app management
Looking for ideas/feedback.
We have a django web-app with postgresql.
We use git for source code.
We have circleci for CI.
We deploy on AWS.
What is the most secured/best practices in terms of ...
3
votes
2answers
228 views
Creating a Password Policy for a Bank Corporation, what must one take into consideration?
When creating a Security Policy such as Password Policy, what are some of the typical assets that need to be protected?
And how does this affect, employees, contractors, vendors, suppliers, and ...
0
votes
0answers
29 views
Which is better practice: digital password manager or a physical book of passwords? [duplicate]
These days, it's not uncommon to have dozens and dozens of passwords for various sites and services. If you're using different passwords for each service it can be basically impossible to hold all the ...
0
votes
1answer
53 views
Logging into IOS applications Secure?
The IOS App Store has very high standards in regards to what goes on their App Store.
Do applications like Gmail, Outlook, banking Apps, and LastPass send your password securely when logging into ...
0
votes
0answers
6 views
Recovering local chrome passwords from dead pc [migrated]
recently my PC died and will not power on. The motherboard had a complete failure. My HDD survived. I have it set up as an external to pull my photos and such. My question comes down to transferring ...
1
vote
0answers
47 views
Does a shared (but encrypted) private key for a group of users reduce the effectiveness of the encryption?
That is, is it generally considered more secure to save a single application-wide private key on the web server compared to storing (protected/encrypted) private keys in the database?
More ...
1
vote
0answers
53 views
Store passwords local with plain text access on WinPE
I have an application that needs to store Network Credentials for a Network Drive/Share on the disk. The user shouldn't need to enter the password every time.
The OS is WinPE, so he cannot map the ...
1
vote
1answer
110 views
Is having multiple correct passwords for a single username a security problem?
This question occurred to me when using online banking. My wife and I have a joint account. The username to login to internet banking is just our account number, so it is the same for both of us. ...
2
votes
1answer
85 views
How do applications such as password managers check leaked credentials and how can I get more results?
I have been using LastPass for a while and I have just seen an option to generate an exposure report. By its output, I assume it checks various sources containing credentials dumps from hacked web ...
1
vote
2answers
77 views
How do I securely store credentials and key files on my mac?
There must be a handy way to securely store, say, GCP key.json somewhere on my machine and access it whenever I'm deploying stuff. Backup to cloud is a must. The Apple's Keychain access seems ...
4
votes
0answers
230 views
Is BitWarden trusted?
I've been using BitWarden as my main password keeper, would like to ask if it's safe? I know that everything is not 100% safe but still want to know if they are worth it.
All my passwords are ...
1
vote
1answer
45 views
What is a login flow method to prevent account jacking when your website has Email/Password sign in AND Google Sign in?
For example, my website has Email/Password login and the "sign in with Google" button. If a user creates an account with their email and a password, then decides to sign in using the "sign in with ...
2
votes
1answer
204 views
Is better to have as password a sentence or first letter of the sentence?
Which is better master KeePass password to prevent any type of bruteforce between theses two type of password :
Complete sentence invented by user like : I like cheeseburger,
tomatoes and fries ! :)
...
3
votes
1answer
91 views
Is it okay for websites to send passwords as plain text if they hash them when they are stored? [duplicate]
I was logging into a website and checking out the network requests, and in the network tab I saw the following:
method: "Login"
params: {username: "username", password: "password1234"}
With my ...
0
votes
1answer
165 views
Is my keepass great? How can I improve it?
Here is my keepass setup:
Cloud
Gmail 1 Google Drive: holds database
Gmail 2 Google Drive: holds key file
Hard Drive
Computer: holds database (leave at home)
USB 1: holds database (always have ...
0
votes
0answers
91 views
GPG — Synchronisation between machine and “No secret key” problem
I am running "pass: the standard unix password manager" v1.7.3 on Fedora 31.
I create a password for "mysite" via
$ pass generate mysite
It creates an entry in my .password-store folder: mysite....
26
votes
4answers
4k views
Secure Implementation of Password Database
Disclaimer I am not a security professional, just a programmer trying to do my best. Additionally, this is my first post to this community so I appologise if this question is too broad.
The ...
0
votes
0answers
14 views
Save salt in DB [duplicate]
I'm trying to create a random salt on the user thing and complement the salt on the user thing in the DB.
Is it safe to add salt to DB?
If you attack DB and salt is stolen, there is a concern that ...
31
votes
1answer
8k views
Should I assign my various passwords to my keyboard's macro keys?
I had an idea to assign my keyboard's macro keys to various passwords so I can just hit the key and it will paste in (the passwords are long and random so I won't remember them). This is on a home ...
4
votes
0answers
174 views
How to do client + server side hashing?
I don't want the password to be sent in clear text over the internet, even when using HTTPS the server admin can read the password if they somehow cache or log post requests.
Now, what I have come ...
2
votes
0answers
47 views
How do biometric password managers work?
Many password managers for mobile offer the option to unlock the password vault with a fingerprint instead of a password. If you never type in your master password, how is it possible to decrypt the ...
3
votes
1answer
106 views
Password seal by paper or by password manager?
At my current company, the IT Risk team decided to ensure root passwords of about 90 systems by the following conventional method:
The length of each password must be 16 characters, where they input ...
10
votes
4answers
4k views
How can I check password strength client-side?
I have a website and my users will be using their selected password to encrypt their RSA private key using JavaScript client-side. How should I be making sure they are using a strong password without ...
3
votes
5answers
2k views
Is Firefox's Lockwise secure?
I have lot's of passwords saved in Firefox Password Manager, now called Lockwise. I recently installed Opera Browser on my machine. It somehow managed to import all the history-data and form fields, ...
1
vote
0answers
69 views
Hosting password compromised [closed]
Last Monday I received two emails from my hoster:
10h42: Connection notification
10h42: Confirm your notification
I didn't login that day, so I knew something was wrong. I immediately logged in, ...
0
votes
1answer
93 views
Remote extraction of passwords from browser password managers
I'm writing an essay about "Browser Password Managers". As part of this I have to write about vulnerabilities and exploits. I stumbled across the following scientific paper from 2013: "Password ...
0
votes
0answers
35 views
Handing login information to the customer
We have a software system with several different users (let's say 10) and a single super user. A super user is a regular user with the privileges needed for managing other user accounts.
This is a ...
1
vote
0answers
45 views
Security of the native Password Autofill function in iOS 12
I have read Apple documents on the iOS 12 password autofill function for iPhones. But I could not find much information pertaining to where the passwords are stored and what vulnerabilities might ...
0
votes
1answer
81 views
How should we apply the salt to the password? [duplicate]
According to Wikipedia:
A rainbow table is ineffective against one-way hashes that include large salts. For example, consider a password hash that is generated using the following function (where "|...
1
vote
1answer
112 views
Is encrypting the FireFox folder with EFS protecting saved passwords in case of someone accessing the hard drive?
What I want to do:
Use the "save password" feature in FireFox (on Windows 10) without using FireFox's master password feature.
What I'm afraid of:
Someone stealing my laptop or getting access to my ...
1
vote
1answer
125 views
Is there any security concern if I kept password hash on client side?
I have a mobile application that needs to be able to work when the phone is offline. In order to prevent misuse by others when they have a short physical access to the phone the requirement is to ...
0
votes
1answer
126 views
Security concept for password management
At the moment, I am struggling on a question to which I have not found a good answer so far.
I wan't to create a password manager, which will be used by a lot of people.
Used languages: PHP / ...
3
votes
2answers
132 views
How strong is a password consisting of words arbitrarily chosen from the dictionary?
Diceware wants us to actually randomly pick n words from a given set of m=65 words.
Assume a user does not actually use a dice. Instead they take a physical dictionary of m words and "randomly" picks ...
3
votes
1answer
133 views
Best practices to manage password for embedded Linux devices
Should we generate a strong password offline, keep it closely guarded secret, and use the same one across all copies of the device? The boot drive is eMMC flash soldered on the PCB, hard to read ...
0
votes
0answers
43 views
Is Argon2 secure to use? [duplicate]
Now that it's been 5 years since Argon2 has been released, is Argon2 secure for public use? (E.g. normal password hashing)
Also, what are the secure parameters for Argon2?
101
votes
3answers
18k views
Why is Sojdlg123aljg a common password?
I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
0
votes
0answers
45 views
Storing the master password in a keychain
I tend to avoid putting my master keychain password in the keychain itself (in OSX, for example), but sometimes with federation of accounts and things, it would be convenient to do so.
Am I right to ...
3
votes
3answers
202 views
Is a Whirlpool hash with random salt secure enough?
I copied the title from another question, but it wasn't answered there and my case is a bit different.
I have inherited an old website to maintain. I noticed that the password hashing is not up to ...
2
votes
0answers
143 views
Is using AES secure for password managers?
I'm developing an application that automates processes. The user connects to many accounts that the application uses then passwords are encrypted using AES. An example algorithm looks like this:
...
-9
votes
1answer
211 views
Does word store my passwords in plaintext? [closed]
I have a document which I wrote my passwords in and saved it to my disk, and I have been hearing a lot about programs storing passwords in plaintext
Did word store my password I saved in plaintext???
...
0
votes
3answers
138 views
Password generator and password limitations
I would like suggestions for a good strategy for dealing with web sites that have arcane rules about what must or must not appear in a password.
My ideal are the sites that allow a good range of ...
10
votes
1answer
633 views
Firefox bug permits stealing encrypted passwords: How is this possible?
It's my understanding that passwords I save in Firefox's Password Manager are encrypted and that setting a Master Password encrypts the encryption key used in this process. The Google hit for "Does ...
3
votes
1answer
464 views
How secure is KeePass KDBX4 by default?
How secure is KeePass KDBX4 by default if someone obtain the .kdbx file and attempt to brute-force it without knowing any hint of the master password?
With assumption :
The password length is equal/...
2
votes
1answer
181 views
Should a browser make its own password manager? [closed]
I'm trying to figure out if products such as Firefox's Lockwise are a superb idea or a terrible one.
On the one hand, installing a third-party addon to your browser comes with inherent risks, so ...
165
votes
5answers
8k views
Password management for kids - what's a good way to start?
Consider a young (primary-school age) child who is starting to collect passwords for online services. How can a parent (or equivalent) help them manage their passwords?
An example to make things ...
45
votes
6answers
12k views
What are the cons of stateless password generators?
Does anybody have hands-on experience with stateless password generators (managers) like Getpass?
It seems like it does most of the work of cloud password managers, but leans more to the security ...
1
vote
1answer
93 views
Would Hashing a Decryption Key Significantly Lower Security? [duplicate]
I'm using the Haskell Codec.Crypto.SimpleAES package to create a crude password manager. The password manager seems secure but it's unable to warn the user when the decryption key is invalid. If a ...
0
votes
0answers
45 views
How can I trust the data integrity of LastPass [duplicate]
So I recently downloaded LastPass and I'm beginning to wonder how they can ensure that my information is kept secure. Is anyone aware of what kind of encryption algorithm they use or how they ensure ...
0
votes
1answer
82 views
Does Azure Key-Vault encrypt the values before storing?
We are using key-vault for storing the secrets, will it give any added advantage if we encrypt the values before storing it in key-vault?
1
vote
0answers
70 views
Apple Keychain Security Risk Assessment
What security measures has Apple taken to minimize security risk with respect to the Apple Keychain password manager?
I enjoy the capability of the password management across macOS and iOS devices, ...
