Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

Filter by
Sorted by
Tagged with
2 votes
1 answer
249 views

Should newly password links reset old ones? if so, why?

I have noticed on most websites that all previous password reset links are automatically expired when a new one is requested. Why is this so common and what are some possible consequences if this isn'...
user17886134's user avatar
-1 votes
1 answer
27 views

Migrating Large Export of Dashlane, 1password, lastpass data to another password manager. Delete old sites?

I'm curious what is best practice. I'm migrating a large export of an existing password manager data like lastpass, 1password, or dashlane into another password manager. Some of these services marked ...
Patoshi パトシ's user avatar
3 votes
1 answer
267 views

What exactly is the security model of pass?

Linux pass is a program that lets you store passwords in regular text files, which you it then encrypts with your GPG key. I'm confused at how this is considered secure. The GPG key has a passphrase ...
gomennathan's user avatar
10 votes
5 answers
4k views

How to best obfuscate a built-in key in an application?

We're building an application that needs to log into a website using built-in credentials. It's not optimal to say the least, but we're stuck with "knowing" the username and password ...
glades's user avatar
  • 219
2 votes
0 answers
90 views

Why are Yubico Yubikeys limited to 32 OATH accounts? [closed]

Is the 32 OATH QR code account limit on Yubikeys due to a storage constraint? Because the Yubikey 5 series has been out for a few years now it'd be amazing if there is a new version released soon with ...
AdamHurwitz's user avatar
4 votes
0 answers
157 views

How does Google Chrome's "Warn you if passwords are exposed in a data breach" feature work?

This feature is enabled by default. It says the usernames and passwords would be encrypted before sending to google. But google would know the encryption keys it used and to compare it with leaked ...
eee's user avatar
  • 41
0 votes
1 answer
128 views

Do you need to invalidate JWT token upon password change?

We've got an Angular app that calls APIs with JWT token authentication (so an auth token and a refresh token). Now at some point the user changes his password (while normally logged in, so not with a &...
Steven De Groote's user avatar
2 votes
2 answers
175 views

What are the risks of typing a password in a terminal, just to see before pasting it?

Yes, I do use a password manager. Yes, I do use complicated long passwords, a la XKCD. However, sometimes I fail repeatedly when entering the master password to my password manager. Which has no &...
Italian Philosophers 4 Monica's user avatar
1 vote
1 answer
63 views

Is there any benefit to use different salt for different encryption algorithms for same user

There is two different passwords for a single user. I'm hashing both for future validation. I'm currently using a single unique salt for the user, but each is hashed with a different algorithms (...
user526498's user avatar
0 votes
0 answers
93 views

Optimal way to securely store password on client with server invalidation but not knowledge

A number of similar questions have been asked about this general topic before (e.g. How to store user credentials in browser securely?), but I wanted to seek some clarification on a specific scenario. ...
InterLinked's user avatar
0 votes
0 answers
86 views

Is ISP sending WiFi password in plain text to phone necessarily a bad sign?

The new router I was given by my internet and phone provider can only be configured via their website. I logged in and went to the page where you can set things like the SSID and password for the WiFi ...
insecure's user avatar
0 votes
0 answers
46 views

ow do I move password securely between api and web?

I would like to ask how I should go about securely transmitting the password between two applications. I have two projects that work with each other. The first one is a project called AuthApi, which ...
nikki's user avatar
  • 1
0 votes
0 answers
67 views

Choosing Encryption Strategies for Secure Long-Term Storage of Sensitive Data

When considering external drives for secure long-term storage of sensitive data, what are the pros and cons of using the same password for encrypting all files versus using random passwords for each ...
S. G.'s user avatar
  • 163
1 vote
0 answers
47 views

How could the contents of multiple LastPass vaults be compromised?

According to this newly published article: Now, it appears that the LastPass hack has led cybercriminals to steal over $35 million in cryptocurrencies. ... Nick Bax, director of analytics at ...
End Anti-Semitic Hate's user avatar
0 votes
2 answers
131 views

Should I be concerned that my bank told me that I have a strong password? [duplicate]

I recently ran an account security check through my bank's web site, and my bank "reassured" me that I have a strong password. Should I be concerned that they know that? I had assumed that ...
Very Tiny Brain's user avatar
0 votes
1 answer
68 views

Is Edge (Enterprise) Password feature less secure than open source local password manager? [closed]

For Enterprise, how to know if Edge Password AutoSave is less secure than copy/paste to a desktop password manager which is open source? IMHO Edge should be more secure because: copy/paste has ...
panes-rubrics's user avatar
0 votes
0 answers
57 views

Is pass -> [via pbkdf2] -> seed -> ECDSA key pair better than pass(word) hashing?

For a web service, I am considering generating random 25-49 recovery codes as a kind of pass that can be stored in a pass manager (no usernames). Instead of pass(word) hashing on the server, I ...
r j's user avatar
  • 101
1 vote
0 answers
66 views

Is it bad practice to store passwords in a JWE? If so, why?

First of all, I know that passwords generally do not have to be stored in a JWT or JWS since the token in itself can be used to authenticate. My circumstances are very specific though. In my program, ...
JoffLobster's user avatar
0 votes
0 answers
46 views

Recovering Lost Brave Browser Usernames and Passwords

I recently changed my password for my local Windows 10 account and found out that my usernames/passwords in Brave's password manager are no longer visible. Unfortunately, I executed Brave after the ...
arn's user avatar
  • 1
0 votes
2 answers
162 views

Security of password managers vs. risk of losing access

Is it safe not to have a 2FA for a password manager itself? It seems that using an app for TOTP authentication for a password manager could increase the security. But it turns out that in this case I ...
Broadways2's user avatar
0 votes
1 answer
219 views

Is a leaked encrypted password more secure than a leaked hash?

Encryption tech is obviously intended to secure things that we want to be private over an insecure medium. When I log into a site for example, my password is transmitted over HTTPS, hashed by the ...
joshperry's user avatar
  • 371
1 vote
1 answer
172 views

What are the risks of reusing the same passphrase for FDE, user account, and password manager?

Consider a home user who runs Linux on a laptop with full-disk encryption and uses a cloud-based password manager. Assume the laptop is firewall-protected with no SSH access. It seems reasonable to ...
jth's user avatar
  • 123
1 vote
0 answers
42 views

How can I reduce the number of passphrases that I must memorize (password manager, FDE, user accounts)? [closed]

I'm attempting to reduce the number of passphrases that I must memorize. Currently I need a different passphrase for each of: Password manager FDE for my personal computer User account for my ...
jth's user avatar
  • 123
1 vote
1 answer
391 views

Sending secret API Keys via email

I'm a customer of a big KYC provider and am using their API. The process to authenticate at the API requires a secret key that they are sending to me by email. If I want to revoke the key and get a ...
blues's user avatar
  • 143
0 votes
3 answers
314 views

Password managing apps seem to have access to my passwords

Keeper used to be free so I had stored most of passwords on that app a few years ago from a past device. When I tried to access the passwords after five years, the app had turned into a subscription ...
Jason Song's user avatar
14 votes
2 answers
4k views

Reasoning behind banning '#' from the start of passwords? [duplicate]

Today, on an official government website, I came across the following password rules: "Your password has to be at least 8 characters long. It can't have any blank spaces. It has to use characters ...
Hazsi's user avatar
  • 141
5 votes
3 answers
386 views

Using Proof of Work to slow down login attempts

For a while I've been pondering a user authentication protocol that aims to ensure that a client does some computational work before the server will attempt to authenticate the password. The reason ...
Cruncher's user avatar
  • 153
1 vote
0 answers
34 views

How should an argon2 hash be stored? [duplicate]

Given the following argon2 hash $argon2id$v=19$m=65536,t=32,p=8$mJmKA5qamzXOPJZYw4wCEUKY$COkMH0RckaZ/3bhYCdCQjLuzoLKxcAmk4TzmHRRgTQ8 How should the hash be stored in a database? From the answers of ...
Zack.B_'s user avatar
  • 11
0 votes
2 answers
123 views

How to reuse PIN codes in the most secure way?

I've made a list of the services/devices that require a PIN code. Shockingly, it's over 10, which I find impossible to remember, so I need a strategy to reuse the codes. What could be a strategy for ...
Gamutmapper's user avatar
0 votes
0 answers
43 views

What is the best way to protect passwords? [duplicate]

I noticed that I don't use many different passwords for all my stuff, which is very insecure. However, it is also difficult to remember really secure, long passwords which are different for every ...
Ladan's user avatar
  • 1
0 votes
3 answers
274 views

Understanding Password Manager Chicken and Egg problem

I read that Password Managers are a more secure option than remembering passwords. I am currently evaluating Passwords Managers with cloud synchronization and there is something that really confused ...
Robert's user avatar
  • 103
0 votes
2 answers
157 views

Digital legacy: safe to save password manager login info in Gmail draft?

Google accounts have a "Digital Legacy" feature, where accounts that go inactive for a long period (3 months, 6 months, etc.) and do not respond to alerts will eventually trigger Inactive ...
cr0's user avatar
  • 373
23 votes
2 answers
4k views

Why is 1Password sign-in to new device secure without MFA?

I'm trying to understand why it's not necessary with MFA in 1Password when signing in to a new device. This was the case that triggered my curiosity: I created a 1Password account I downloaded the ...
martin's user avatar
  • 341
2 votes
1 answer
281 views

Is CVE-2023-24055 applicable to other password managers using the same format as the original KeePass?

CVE-2023-24055 is a known vulnerability that enables an attacker to recover plaintext user credentials from the KeePass application. However, due to the original KeePass being Windows-specific, I've ...
DannyNiu's user avatar
  • 370
1 vote
2 answers
183 views

DNS hijacking/poisoning effect on URL/URI and password manager autotype/autofill

A benefit to password managers, at least some of them, is that they can look at the URL and only use autotype/autofill when on the correct site, which can help prevent pharming since if instead of ...
vertigo's user avatar
  • 13
0 votes
1 answer
438 views

What threats can the use of a TPM by a password manager mitigate?

This question is about the use of a TPM by a password manager used by an end-user on a PC to store and use passwords to log in to web sites and other things that are protected only by a password. ...
alx9r's user avatar
  • 569
1 vote
0 answers
146 views

How do password manager developers protect their app store accounts?

Basically every password manager (like LastPass, 1Password, ...) has its Android & iOS app and browser extensions for Chrome, Safari, Firefox etc., to automatically fill in usernames and passwords....
David Scherfgen's user avatar
1 vote
3 answers
254 views

Why do I need to provide authentication when accessing a browser's built-in password manager?

Why do I have to provide authentication when I want to read a password stored in my own web browser while I have to do nothing to read the same password on a site's login page? Is my conclusion ...
trejder's user avatar
  • 3,619
2 votes
1 answer
179 views

Why would garbage collection be a problem in password managers?

I was reading an infosec user's take on the LastPass data breach and noted something odd in his commentary on another password manager system (emphasis mine) I have not done a thorough code review, ...
Machavity's user avatar
  • 3,808
0 votes
2 answers
598 views

Whats the difference between secret and password managers?

Are there fundamental underlying differences in how secrets and passwords should be managed? I'm curious of the technical/cryptographic differences between secret managers and password managers are. ...
alecthompson's user avatar
0 votes
1 answer
115 views

My Bank Enforces A 6 Character Limit On Passwords. Is This Bad? [duplicate]

A bank I (previously) used in Australia forced users to comply with a 6-character limit on every password. Specifically, the rules were: 6 characters exactly, including at least 1 number and letter ...
GROVER.'s user avatar
  • 101
51 votes
5 answers
6k views

Should a bank be able to shorten your password without your involvement?

The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore. He called his advisor, who ...
Wulle's user avatar
  • 611
0 votes
0 answers
52 views

Benefit of only having MFA challenge on the very first login

I'm trying to select a suitable password store for a team - one of my main requirements is that users be authenticated via a removable key file rather than simply a master password. I have been using ...
charliefortune's user avatar
3 votes
2 answers
179 views

How do I remember passwords for environments where Password Manager is not available?

I am a big fan of 1Password. And I try to save my passwords in 1Password as much as possible. However, there are environments where 1Password cannot be used. That is the password to protect 1Password ...
user avatar
1 vote
0 answers
220 views

Does having authenticator app/OTP generator built into Password Manager defeat its purpose?

For example the KeepassOTP plugin is one of a few plugins for Keepass, that allows users to view their OTP code from within the password manager itself. Does this defeat the purpose of having a OTP as ...
northerner's user avatar
1 vote
1 answer
856 views

How do I secure sensitive information like system credentials in a configuration file?

I often get this question: I have sensitive data such as system credentials which my web application needs to secure. Some things I can store in a database, but others (like the credentials to access ...
Frugal Guy's user avatar
17 votes
4 answers
4k views

Should one reject login attempts when the correct password is newly added to a password deny list?

Best practices say that when users choose a password (at signup or when changing an existing password), the application should reject that password if it appears on a list of passwords known to be ...
Jens Bannmann's user avatar
2 votes
2 answers
96 views

How can a users plaintext password be acquired while using biometricID with the following security model?

This is a slightly tough one to explain with my current experience, lacking mainstream terminology. But here goes. I have an encryption/security model whereby I do not store users plaintext passwords. ...
RobbB's user avatar
  • 261
1 vote
0 answers
142 views

Amnesia and death proof master password

I have been thinking about how to store my master passwords (password manager, email and device passwords) for quite a while and I just haven't been able to come up with a satisfying solution yet. I ...
Americat's user avatar
4 votes
1 answer
1k views

Practicality of outsourcing password hashing using enclaves

I've been pondering some potential cybersecurity applications for enclaves. One of them being the problem of password hashing. Some clients have enclave support, meaning part of their CPU can securely ...
Expectator's user avatar

1
2 3 4 5
27