Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
1,095
questions
9
votes
1answer
245 views
Firefox bug permits stealing encrypted passwords: How is this possible?
It's my understanding that passwords I save in Firefox's Password Manager are encrypted and that setting a Master Password encrypts the encryption key used in this process. The Google hit for "Does ...
2
votes
1answer
940 views
I want to deploy from GitLab to AWS - so where exactly do I store my private key?
This seems like an odd and simple question, but I'm trying to get my head around the principle of "never check a private key into version control".
I'm trying to build a startup of sorts, where ...
3
votes
1answer
200 views
How secure is KeePass KDBX4 by default? [closed]
How secure is KeePass KDBX4 by default if someone obtain the .kdbx file and attempt to brute-force it without knowing any hint of the master password?
With assumption :
The password length is equal/...
-1
votes
0answers
39 views
Is Apple Keyring data stored locally-only on devices? [migrated]
I would like to understand if the keyring database is stored only on the local Apple device or if it is also stored on servers on the internet.
2
votes
1answer
118 views
Should a browser make its own password manager? [on hold]
I'm trying to figure out if products such as Firefox's Lockwise are a superb idea or a terrible one.
On the one hand, installing a third-party addon to your browser comes with inherent risks, so ...
1
vote
1answer
134 views
Delete saved login credentials username and password
Scenario:
Alice uses my website on her own computer and sometimes also on a computer that Mallory also has access to. Alice likes using the password manager built in to the browser. She is aware that ...
7
votes
4answers
899 views
How do I convince others of the importance of password management?
I just got married, and my wife and I are in the midst of combining finances, etc.
We set up a joint bank account and the first thing I do during the account setup phase is generate a 16-character ...
1
vote
1answer
266 views
System Encryption With Veracrypt/Truecrypt- What is the difference between Wipe Mode “None” and 3 pass, 1 pass etc?
First I wanted to make sure we're talking about using a Non-SSD Hard drive. I know SSD drives work differently.
Here would be a good reference/guide on system encryption:
https://www.howtogeek.com/...
161
votes
5answers
8k views
Password management for kids - what's a good way to start?
Consider a young (primary-school age) child who is starting to collect passwords for online services. How can a parent (or equivalent) help them manage their passwords?
An example to make things ...
47
votes
6answers
11k views
What are the cons of stateless password generators?
Does anybody have hands-on experience with stateless password generators (managers) like Getpass?
It seems like it does most of the work of cloud password managers, but leans more to the security ...
5
votes
4answers
358 views
Forgot password best practice for mobile applications
There are known good practices for password reset functionality from OWASP and other resources. On the other hand, I believe most of us agree that security questions are not user friendly, they either ...
52
votes
4answers
20k views
How can I be sure Lastpass really can't access my passwords?
The recent, widely publicized security incident where millions of Linkedin were exposed reminded me to tighten up my password practices. I'm looking at several password managers now and I'm especially ...
1
vote
1answer
88 views
Would Hashing a Decryption Key Significantly Lower Security? [duplicate]
I'm using the Haskell Codec.Crypto.SimpleAES package to create a crude password manager. The password manager seems secure but it's unable to warn the user when the decryption key is invalid. If a ...
0
votes
0answers
44 views
How can I trust the data integrity of LastPass [duplicate]
So I recently downloaded LastPass and I'm beginning to wonder how they can ensure that my information is kept secure. Is anyone aware of what kind of encryption algorithm they use or how they ensure ...
0
votes
1answer
66 views
Does Azure Key-Vault encrypt the values before storing?
We are using key-vault for storing the secrets, will it give any added advantage if we encrypt the values before storing it in key-vault?
3
votes
3answers
270 views
Should a password generator validate its output against a dictionary?
If I were to design a password generator, is it best to leave it truly random or validate its output to avoid certain passwords?
For example if my password generator was truly random, it's possible ...
1
vote
0answers
58 views
Apple Keychain Security Risk Assessment
What security measures has Apple taken to minimize security risk with respect to the Apple Keychain password manager?
I enjoy the capability of the password management across macOS and iOS devices, ...
6
votes
1answer
1k views
Can a user's Apple Keychain be opened on a different computer?
Apple uses a nice keychain. This is used by, for example, Google's Chrome browser.
Imagine a user copies all the keychain files.
Would that user be able to unlock the keychain, if they knew the ...
21
votes
3answers
14k views
Is Firefox Password Manager less secure than LastPass?
After installing the LastPass password manager, I am presented with a login dialog including the option to "Disable Insecure Firefox Password Manager".
(This option appears as long as the Firefox ...
1
vote
1answer
39 views
Having web client do requests with User's 3rd party API key?
I am trying to figure out the best way to do this. I have done some searching and all I have found is about storing API keys in a back end, nothing like my use-case where there is no back end.
...
2
votes
1answer
217 views
Opera browser: no master password?
I've recently moved from Firefox to Opera (for performance issues).
I used to protect my passwords in Firefox with a Master Password. But Opera, so it appears, lacks such feature.
I use Debian 9.7 ...
2
votes
1answer
96 views
Does knowledge of one or more passwords from my password manager help an attacker crack the master password?
I use a keepass password manager with a master password of more than 100 bits. I keep the password file in cloud storage. If an attacker has my password file, it should be difficult for them to ...
0
votes
1answer
49 views
DB Service accounts: is it possible to avoid storing a password somewhere
Is it possible to avoid having to store DB passwords applications/service accounts needing access to the DB? I would like to avoid the risk of a system admin obtaining the password and then accessing ...
31
votes
12answers
12k views
How do I check that users don't write down their passwords?
I have a password policy which states that users must not write and store their passwords down in plaintext. How can I ensure that they haven't done so by writing their password in emails, scripts, ...
-1
votes
1answer
113 views
Virgin air-gapped devices and password management [closed]
For password management:
"Practical" means it works in practice, and "secure" means protected against compromise and actually works. How do we get the highest P + S value?
I am convinced that all ...
3
votes
3answers
251 views
Password hashing algorithms suitable for IoT devices?
What password hashing algorithms and other cryptographic hashes (e.g. scrypt, bcrypt, PBKDF2, MD5, SHA-256) are suitable for resource-constrained IoT devices for the consumer-oriented smart home ...
51
votes
9answers
9k views
Can users make use of a password manager when banks tell them never to write passwords down?
Consider a user who wants to use a password manager for their banking passwords. Advice from banks usually says they should never write down their password. The user would be concerned about going ...
2
votes
1answer
115 views
Is there a benefit to changing a password everytime it is used?
I have a script that connects to Azure Key Vault obtains credentials, and then uses those to login to Azure.
These credentials are only ever used by the scripts, and Key Vault is the only repository ...
22
votes
5answers
23k views
How does a key file increase the security of a password manager?
Password managers like KeePass often have an option to use a key file in addition to a master password.
I don't understand how this increases security.
(Note: KeePass also allows using a key file ...
1
vote
1answer
65 views
Banking app logon - multiple fingerprints on a device vs 2 passwords known by 1 person
Yesterday I logged on to my banking app via my iPhone. The normal procedure was to enter information that consisted of:
The answer to a security question. This had to be entered in full and was the ...
4
votes
2answers
690 views
Pros and cons of this password reset scheme?
I handle the process of password resets at the institution where I work. Currently, we require users to make up questions and answers (three minimum and five maximum); the questions cannot repeat, nor ...
72
votes
9answers
15k views
What's the safest way to inform a new user of their password on an invite-only website?
I'm developing a web site where people will have accounts. However, unlike most web sites, user do not register, rather they are invited by the site admins. The site admins will create a new user ...
11
votes
1answer
2k views
How to get a 'million rounds of PKCS#8 + PBKDF2' with OpenSSL?
I posted this question Is a passphrase-protected SSH private key susceptible to a dictionary attack? a few days back.
An excerpt from the final answer:
With PKCS#8 + PBKDF2 and one million rounds ...
8
votes
5answers
1k views
What would be a good way to send sensitive information to users that are not very tech-savvy?
As web developers we need to supply sensitive data to the clients. Clients are usually not very good with computers. They can send an email, pick up a phone call or open a webpage. But won't be able ...
1
vote
0answers
53 views
Why is unistd's getpass unsafe?
While reading about how to properly ask a user for a password in CLIs, this SO answer and this SSE answer recommend the usage of unistd's getpass.
However, this function is being documented as ...
7
votes
2answers
3k views
Keepass client on Android (reliable one) [closed]
I need some advice to choose a Keepass client on Android phone which can synchronize using Dropbox.
As i keep all my passwords in one place, I would like to keep it safe. Is KeepassDroid client safe ...
0
votes
2answers
75 views
Should I back up automatic strong passwords of iCloud?
I’ve recently started to use iCloud’s automatic strong passwords. I feel like that if iCloud were down for some reason, the passwords would be lost. Considering it, should I back them up on other ...
1
vote
0answers
44 views
Are character passwords on my iPad needed?
I have a 20 character password on my iPad. I've been wondering, do I REALLY need it to be that long? Should I switch to a 6 or even 4 digit numeral password? Or should I just shorten my password? ...
1
vote
3answers
240 views
What security benefit does 2FA provide a password manager?
It's no secret that many popular password managers (1Password, Dashlane, LastPass, KeePass, and many others) support some form of two-factor authentication. This is often implemented via TOTP or other ...
29
votes
8answers
3k views
Best way to administer all my passwords
I am trying to figure out what the best solution is to store different types of passwords:
Personal passwords (my personal email, my company's email, all the services I use to buy things like ...
23
votes
8answers
10k views
On two-step login forms, why is it the login name and not the password that's asked first?
There are several login forms (e.g. Google's) on the internet where you first enter your login name and then, once that's submitted, you get to enter your password.
One of the advantages of this is, ...
2
votes
1answer
40 views
Is Privileged Access Management secured without regular Patch Update?
It is well know Privileged Access Management (PAM) is a solution that helps organizations restrict privileged access within an existing Active Directory environment.
Many big company use it to address ...
10
votes
1answer
8k views
Best practices for storing credentials used by code
Currently, I've many scripts that need to log in as superuser to automate many tasks. (For example, creating tables in databases, creating other users, etc.)
Instead of having the credentials (...
1
vote
1answer
124 views
Is it secure to store a cryptographic key in a class member variable?
Consider an application that runs locally on a Windows PC. The application uses a local folder for reading/storing encrypted data (i.e. images). A user logs in (authenticated from a local encrypted DB)...
2
votes
0answers
470 views
Digital signature based authentication schema using two passwords
I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
3answers
561 views
What are the serious weaknesses in this free password management system?
I want to protect my passwords for free and store them on a machine that might get stolen but have the passwords very securely backed-up in the cloud, again for free, and minimize the total lifetime ...
4
votes
3answers
414 views
How can a company tell if my password is similar to the previous 5 passwords?
Closely related (but not a duplicate): Company can tell if new and old passwords are too similar. Is there a security problem?
Also closely related (but not a duplicate): How can a system enforce a ...
4
votes
4answers
879 views
How secure is this method of password generation?
Introduction:
I used to use the same password for everything (it was at least a really random password with fake words). Then I found out that I should have different passwords for different sites ...
84
votes
12answers
20k views
What to do about websites that store plain text passwords
I recently received an email from a popular graduate job website (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
1
vote
1answer
221 views
Store passwords in a text file… is it really much worse than a password manager?
My idea:
Storing my passwords in a text file kept on Dropbox and accessed through a python script to quickly retrieve the password for the site I want to access.
My motives:
I want to be platform-...
