Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

Filter by
Sorted by
Tagged with
0 votes
2 answers
109 views

How do databases/companies change their hashing algorithm? [duplicate]

Ok- so you all probably know that a hash is used to help secure a stored password in a database, if it was stolen. When a user logs in, and enters a password, it gets hashed, and then matched to a ...
security_paranoid's user avatar
0 votes
0 answers
65 views

Security implication of writing down passwords [duplicate]

Are there any risks to writing down your digital passwords on physical paper? I am asking because I once saw on a website that you shouldn’t do this… Any ideas, because I just really don’t see how ...
Hman66's user avatar
  • 1
1 vote
1 answer
123 views

Secure Offline Login and Data Encryption with PBKDF2 and AES-256

I'm working on a project that requires offline functionality, including offline login and secure data manipulation. I'd appreciate feedback on my chosen approach and best practices for secure design. ...
almog bar-el's user avatar
0 votes
1 answer
198 views

Passwords/password hashes in plaintext in service configs - why is this common practice?

A while ago I wanted to deploy a service using a OCI (docker/podman) container, and I noticed to me, what seemed like a possibly distributing trend. In the build file for a lot of the containers, the ...
The Floating Brain's user avatar
1 vote
2 answers
317 views

Is it bad practice to prompt users to reset password when there is no evidence of a breach?

I have received many security emails from LinkedIn over the past few weeks. An example is shown below (redaction mine) I do not live in the USA and I did not try to access LinkedIn at the times these ...
Josh's user avatar
  • 111
1 vote
1 answer
102 views

Sharing the key to a password vault securely

We have an application that holds a bunch of passwords in an encrypted vault for various purposes. What is the best practice for storing the key for that vault? There feels like there's a ...
Hovestar's user avatar
  • 113
0 votes
0 answers
61 views

What are the best practices for a scheduled program to store credentials to access a secure resource?

If I have a program that runs on a regular basis, such as a cron job or systemd timer and it needs to access a secure resource like a hsm or encrypted database, what are the best practices to store/...
user962460's user avatar
2 votes
1 answer
242 views

Why would website block password manager auto-fill?

I use a password manager and have a browser plugin installed for it to simplify entering passwords into websites. I recently encountered a website (enterprise SaaS solution I use at work), which ...
Aleks G's user avatar
  • 271
1 vote
2 answers
187 views

In general, are programs that store passwords safe?

The reason I was curious is because it provides a feature that saves the SSH password and allows me to not have to enter the password the next time I connect through VLC. If someone else gets access ...
C yp's user avatar
  • 13
1 vote
0 answers
119 views

Local development credential manager and best practices

I've long since been storing credentials to databases and services in local configuration files during development. Sometimes these need to be to production systems, which makes this a security issue. ...
John's user avatar
  • 149
3 votes
1 answer
378 views

Should newly password links reset old ones? if so, why?

I have noticed on most websites that all previous password reset links are automatically expired when a new one is requested. Why is this so common and what are some possible consequences if this isn'...
user17886134's user avatar
-1 votes
1 answer
92 views

Migrating Large Export of Dashlane, 1password, lastpass data to another password manager. Delete old sites?

I'm curious what is best practice. I'm migrating a large export of an existing password manager data like lastpass, 1password, or dashlane into another password manager. Some of these services marked ...
Patoshi パトシ's user avatar
3 votes
1 answer
381 views

What exactly is the security model of pass?

Linux pass is a program that lets you store passwords in regular text files, which you it then encrypts with your GPG key. I'm confused at how this is considered secure. The GPG key has a passphrase ...
gomennathan's user avatar
11 votes
5 answers
5k views

How to best obfuscate a built-in key in an application?

We're building an application that needs to log into a website using built-in credentials. It's not optimal to say the least, but we're stuck with "knowing" the username and password ...
glades's user avatar
  • 229
2 votes
0 answers
239 views

Why are Yubico Yubikeys limited to 32 OATH accounts? [closed]

Is the 32 OATH QR code account limit on Yubikeys due to a storage constraint? Because the Yubikey 5 series has been out for a few years now it'd be amazing if there is a new version released soon with ...
AdamHurwitz's user avatar
4 votes
0 answers
258 views

How does Google Chrome's "Warn you if passwords are exposed in a data breach" feature work?

This feature is enabled by default. It says the usernames and passwords would be encrypted before sending to google. But google would know the encryption keys it used and to compare it with leaked ...
eee's user avatar
  • 41
0 votes
1 answer
408 views

Do you need to invalidate JWT token upon password change?

We've got an Angular app that calls APIs with JWT token authentication (so an auth token and a refresh token). Now at some point the user changes his password (while normally logged in, so not with a &...
Steven De Groote's user avatar
2 votes
2 answers
250 views

What are the risks of typing a password in a terminal, just to see before pasting it?

Yes, I do use a password manager. Yes, I do use complicated long passwords, a la XKCD. However, sometimes I fail repeatedly when entering the master password to my password manager. Which has no &...
Italian Philosophers 4 Monica's user avatar
1 vote
1 answer
130 views

Is there any benefit to use different salt for different encryption algorithms for same user

There is two different passwords for a single user. I'm hashing both for future validation. I'm currently using a single unique salt for the user, but each is hashed with a different algorithms (...
user526498's user avatar
0 votes
0 answers
195 views

Optimal way to securely store password on client with server invalidation but not knowledge

A number of similar questions have been asked about this general topic before (e.g. How to store user credentials in browser securely?), but I wanted to seek some clarification on a specific scenario. ...
InterLinked's user avatar
0 votes
0 answers
146 views

Is ISP sending WiFi password in plain text to phone necessarily a bad sign?

The new router I was given by my internet and phone provider can only be configured via their website. I logged in and went to the page where you can set things like the SSID and password for the WiFi ...
insecure's user avatar
0 votes
0 answers
88 views

ow do I move password securely between api and web?

I would like to ask how I should go about securely transmitting the password between two applications. I have two projects that work with each other. The first one is a project called AuthApi, which ...
nikki's user avatar
  • 1
0 votes
0 answers
118 views

Choosing Encryption Strategies for Secure Long-Term Storage of Sensitive Data

When considering external drives for secure long-term storage of sensitive data, what are the pros and cons of using the same password for encrypting all files versus using random passwords for each ...
S. G.'s user avatar
  • 173
1 vote
0 answers
92 views

How could the contents of multiple LastPass vaults be compromised?

According to this newly published article: Now, it appears that the LastPass hack has led cybercriminals to steal over $35 million in cryptocurrencies. ... Nick Bax, director of analytics at ...
End Antisemitic Hate's user avatar
0 votes
2 answers
177 views

Should I be concerned that my bank told me that I have a strong password? [duplicate]

I recently ran an account security check through my bank's web site, and my bank "reassured" me that I have a strong password. Should I be concerned that they know that? I had assumed that ...
Very Tiny Brain's user avatar
0 votes
1 answer
119 views

Is Edge (Enterprise) Password feature less secure than open source local password manager? [closed]

For Enterprise, how to know if Edge Password AutoSave is less secure than copy/paste to a desktop password manager which is open source? IMHO Edge should be more secure because: copy/paste has ...
panes-rubrics's user avatar
0 votes
0 answers
102 views

Is pass -> [via pbkdf2] -> seed -> ECDSA key pair better than pass(word) hashing?

For a web service, I am considering generating random 25-49 recovery codes as a kind of pass that can be stored in a pass manager (no usernames). Instead of pass(word) hashing on the server, I ...
r j's user avatar
  • 138
1 vote
0 answers
130 views

Is it bad practice to store passwords in a JWE? If so, why?

First of all, I know that passwords generally do not have to be stored in a JWT or JWS since the token in itself can be used to authenticate. My circumstances are very specific though. In my program, ...
JoffLobster's user avatar
1 vote
0 answers
136 views

Recovering Lost Brave Browser Usernames and Passwords

I recently changed my password for my local Windows 10 account and found out that my usernames/passwords in Brave's password manager are no longer visible. Unfortunately, I executed Brave after the ...
arn's user avatar
  • 11
0 votes
2 answers
246 views

Security of password managers vs. risk of losing access

Is it safe not to have a 2FA for a password manager itself? It seems that using an app for TOTP authentication for a password manager could increase the security. But it turns out that in this case I ...
Broadways2's user avatar
1 vote
1 answer
437 views

Is a leaked encrypted password more secure than a leaked hash?

Encryption tech is obviously intended to secure things that we want to be private over an insecure medium. When I log into a site for example, my password is transmitted over HTTPS, hashed by the ...
joshperry's user avatar
  • 391
1 vote
1 answer
255 views

What are the risks of reusing the same passphrase for FDE, user account, and password manager?

Consider a home user who runs Linux on a laptop with full-disk encryption and uses a cloud-based password manager. Assume the laptop is firewall-protected with no SSH access. It seems reasonable to ...
jth's user avatar
  • 123
1 vote
0 answers
81 views

How can I reduce the number of passphrases that I must memorize (password manager, FDE, user accounts)? [closed]

I'm attempting to reduce the number of passphrases that I must memorize. Currently I need a different passphrase for each of: Password manager FDE for my personal computer User account for my ...
jth's user avatar
  • 123
1 vote
1 answer
1k views

Sending secret API Keys via email

I'm a customer of a big KYC provider and am using their API. The process to authenticate at the API requires a secret key that they are sending to me by email. If I want to revoke the key and get a ...
blues's user avatar
  • 143
0 votes
3 answers
393 views

Password managing apps seem to have access to my passwords

Keeper used to be free so I had stored most of passwords on that app a few years ago from a past device. When I tried to access the passwords after five years, the app had turned into a subscription ...
Jason Song's user avatar
14 votes
2 answers
5k views

Reasoning behind banning '#' from the start of passwords? [duplicate]

Today, on an official government website, I came across the following password rules: "Your password has to be at least 8 characters long. It can't have any blank spaces. It has to use characters ...
Hazsi's user avatar
  • 141
5 votes
3 answers
574 views

Using Proof of Work to slow down login attempts

For a while I've been pondering a user authentication protocol that aims to ensure that a client does some computational work before the server will attempt to authenticate the password. The reason ...
Cruncher's user avatar
  • 153
1 vote
0 answers
34 views

How should an argon2 hash be stored? [duplicate]

Given the following argon2 hash $argon2id$v=19$m=65536,t=32,p=8$mJmKA5qamzXOPJZYw4wCEUKY$COkMH0RckaZ/3bhYCdCQjLuzoLKxcAmk4TzmHRRgTQ8 How should the hash be stored in a database? From the answers of ...
Zack.B_'s user avatar
  • 11
0 votes
2 answers
205 views

How to reuse PIN codes in the most secure way?

I've made a list of the services/devices that require a PIN code. Shockingly, it's over 10, which I find impossible to remember, so I need a strategy to reuse the codes. What could be a strategy for ...
Gamutmapper's user avatar
0 votes
3 answers
353 views

Understanding Password Manager Chicken and Egg problem

I read that Password Managers are a more secure option than remembering passwords. I am currently evaluating Passwords Managers with cloud synchronization and there is something that really confused ...
Robert's user avatar
  • 103
0 votes
2 answers
248 views

Digital legacy: safe to save password manager login info in Gmail draft?

Google accounts have a "Digital Legacy" feature, where accounts that go inactive for a long period (3 months, 6 months, etc.) and do not respond to alerts will eventually trigger Inactive ...
cr0's user avatar
  • 373
23 votes
2 answers
5k views

Why is 1Password sign-in to new device secure without MFA?

I'm trying to understand why it's not necessary with MFA in 1Password when signing in to a new device. This was the case that triggered my curiosity: I created a 1Password account I downloaded the ...
martin's user avatar
  • 341
2 votes
1 answer
332 views

Is CVE-2023-24055 applicable to other password managers using the same format as the original KeePass?

CVE-2023-24055 is a known vulnerability that enables an attacker to recover plaintext user credentials from the KeePass application. However, due to the original KeePass being Windows-specific, I've ...
DannyNiu's user avatar
  • 374
1 vote
2 answers
263 views

DNS hijacking/poisoning effect on URL/URI and password manager autotype/autofill

A benefit to password managers, at least some of them, is that they can look at the URL and only use autotype/autofill when on the correct site, which can help prevent pharming since if instead of ...
vertigo's user avatar
  • 13
0 votes
1 answer
629 views

What threats can the use of a TPM by a password manager mitigate?

This question is about the use of a TPM by a password manager used by an end-user on a PC to store and use passwords to log in to web sites and other things that are protected only by a password. ...
alx9r's user avatar
  • 569
1 vote
0 answers
187 views

How do password manager developers protect their app store accounts?

Basically every password manager (like LastPass, 1Password, ...) has its Android & iOS app and browser extensions for Chrome, Safari, Firefox etc., to automatically fill in usernames and passwords....
David Scherfgen's user avatar
1 vote
3 answers
373 views

Why do I need to provide authentication when accessing a browser's built-in password manager?

Why do I have to provide authentication when I want to read a password stored in my own web browser while I have to do nothing to read the same password on a site's login page? Is my conclusion ...
trejder's user avatar
  • 3,639
2 votes
1 answer
227 views

Why would garbage collection be a problem in password managers?

I was reading an infosec user's take on the LastPass data breach and noted something odd in his commentary on another password manager system (emphasis mine) I have not done a thorough code review, ...
Machavity's user avatar
  • 3,798
0 votes
2 answers
923 views

Whats the difference between secret and password managers?

Are there fundamental underlying differences in how secrets and passwords should be managed? I'm curious of the technical/cryptographic differences between secret managers and password managers are. ...
alecthompson's user avatar
0 votes
1 answer
191 views

My Bank Enforces A 6 Character Limit On Passwords. Is This Bad? [duplicate]

A bank I (previously) used in Australia forced users to comply with a 6-character limit on every password. Specifically, the rules were: 6 characters exactly, including at least 1 number and letter ...
GROVER.'s user avatar
  • 101

1
2 3 4 5
27