Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

Filter by
Sorted by
Tagged with
2 votes
3 answers
3k views

Is this a secure approach to store a master password?

I have come up with the following approach to remember master passwords (to use in software like KeePass, etc): Since it is annoying to type the master password every time we power up the PC, we store ...
96 votes
10 answers
32k views

If a provider sees the last 4 characters of my password, can they see it in full?

I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
0 votes
1 answer
859 views

What can I do to improve my Keepass XC setup?

I'm planning on using KeePass XC for the first time and am trying to create a setup that: (1) would prevent hackers from stealing my passwords (2) would prevent me from losing access to my ...
0 votes
2 answers
43 views

Storing backup keys (2FA) for online accounts

So I spent the day looking for a good solution of storing the backup keys or the 2FA codes and can't seem to find a convenient way for me, many people have different takes on this, so far I found 2 ...
23 votes
5 answers
12k views

Best practices for storing 2FA recovery codes

I’ve recently started using 2FA on a bunch of services and I’m not sure how to best store the recovery codes. I can think of 3 options: In a secure note on LastPass In a Dropbox folder On a usb stick ...
2 votes
2 answers
47 views

Mitigating the performance impact of strong hashes with Basic HTTP authentication

I am trying to decide which work factor to use for our hashed passwords, and I am facing the following dilemma. Let me elaborate for a moment. Basic HTTP authentication works as follows: The user ...
0 votes
1 answer
286 views

iCloud Security Concern: browser session authentication storage after 2-factor?

Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie? My concern is, if ...
2 votes
2 answers
3k views

Is it secure to have two password managers?

For various reasons I use both Keepass 2 and Lastpass. They have 90% the same password database. Is it secure to be using and maintaining both of them? Is it secure if they both use the same password (...
2 votes
1 answer
186 views

Dangers of using the web applications provided by password managers

The password manager bitwarden requires the user to log in to their account on their web site to allow them to enable 2FA, import passwords and manage other account related details, as that ...
11 votes
4 answers
8k views

Temporary passwords e-mailed out as plain text

Is this a security issue? Many big ecommerce platform companies use this feature. Where if you forgot your password, they e-mail you a temp password. Could someone potentially figure out the ...
0 votes
1 answer
35 views

Creating Password from 2 different part

I’m looking for Term Or Some platform for managing Password Authentication with this way : Password construct from 2 Part , First one is static and you can make it and second Part Generate From TOTP ...
2 votes
3 answers
139 views

Manage passwords from my personal website

So I'm a complete novice in security practices, and an amateur web developer. I have a personal website connected to a personal DB. Currently there is nothing in this DB that would be useful to anyone ...
0 votes
1 answer
78 views

Is it possible to design a system with two passwords?

Is it possible to design a system with two passwords prompts? The system will have to prompt for two passwords The system would have to validate first password before prompting for second password ...
2 votes
2 answers
211 views

Password for embedded devices in automatic deployment

We are working with commercial embedded devices, where we install our software. Then, they are deployed in different client sites. The embedded devices have an Ethernet port and a console port for ...
1 vote
2 answers
88 views

How Google protects and syncs the passwords?

I read this post but I want to know more details. I know that Google uses a Windows' function called CryptProtectData to encrypt user passwords on Windows and Google only stores the encrypted forms of ...
1 vote
1 answer
252 views

Delete saved login credentials username and password

Scenario: Alice uses my website on her own computer and sometimes also on a computer that Mallory also has access to. Alice likes using the password manager built in to the browser. She is aware that ...
31 votes
2 answers
10k views

Should I assign my various passwords to my keyboard's macro keys?

I had an idea to assign my keyboard's macro keys to various passwords so I can just hit the key and it will paste in (the passwords are long and random so I won't remember them). This is on a home ...
1 vote
0 answers
79 views

How to Securely Store Database Password in Java .properties File

I would like to store my DB password in Java .property file and encrypt it using Jasypt. But from what I see, it just moves the problem from hiding the DB Password to hiding the encryption password. I ...
0 votes
1 answer
39 views

SCrypt's goal and the role its salt plays

Am I right in stating that SCrypt as an algorithm is useful where many passwords are stored in a database, but not against one specific encryption key derived from one password of one user? For ...
1 vote
1 answer
331 views

How bad is it to store credentials in clear text on disk and in memory?

Yeah, it depends. A good answer would provide some reflections on this. I have two concrete scenarios in mind, in two concrete (and I believe common) contexts. Context 1. At home, you’re the only one ...
29 votes
7 answers
8k views

Is it safe to store account credentials in an Excel sheet protected with a password?

Basically the title. For example, how bad is it to store passwords in an Excel sheet protected with a password, instead of storing passwords in Keypass or something else like Zoho Vault? Of course, ...
50 votes
13 answers
17k views

Is there a good way to store credentials outside of a password manager?

A lot of the users in my company are using their agendas to write down their password and usernames, or Excel sheets with a protected password. I'm hesitant to install software for password management ...
1 vote
2 answers
242 views

Security of master password in a derived password manager

I am aware of other questions asking similar things as this one, but I believe this design addresses many of the issues raised in those questions. I'm also not concerned with making sure there's no ...
1 vote
2 answers
355 views

Safe or Unsafe to Store Passwords in Chrome on MacOS?

I've seen conflicting opinions on this, more than the below, but i.e. Unsafe: https://www.techrepublic.com/article/why-you-should-never-allow-your-web-browser-to-save-your-passwords/ Safe: https://...
2 votes
1 answer
1k views

Best Practice Storing Sensitive Information in Web Application

I am developing an application in php/MySql and looking for the best approach from a security standpoint. The application will use and store sensitive information. I realize there are risks to all ...
615 votes
23 answers
149k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
2 votes
1 answer
1k views

Bitwarden and gamecontrollerd on OsX Big Sur

Recently, I came across an issue concerning a daemon named gamecontrollerd in OsX Big Sur. On my laptop I'm running ReiKey (from Objective-See), which aims at identifying possible Key Loggers that ...
0 votes
1 answer
321 views

`pass` not asking for password anymore - gnome-keyring or gpg-agent related? How can I force password asking?

I cross-posted this on the manjaro forums and on server fault. So far no answer, so trying here. I have gnome-keyring running for sure, not sure it's gnome-keyring or gpg-agent or ssh-agent related......
0 votes
1 answer
109 views

How to change the password hashing scheme in LDAP using an external library with slapd.d config

I am trying to change the password hashing scheme for LDAP. Hypothetically, let's assume it's pw-argon.so I don't have slapd.conf I have the slapd.d directory where I can make changes dynamically to ...
0 votes
0 answers
99 views

Google says my password has been found in data breach. HIBP knows nothing about it. Which data breach was that?

I've been using Chrome to save and sync my passwords across devices (and lately I am trying to switch to Bitwarden). Google warned me recently about a password I have used across multiple sites that ...
3 votes
2 answers
4k views

Storing passwords in Confluence vs a password manager

My SysOP team is using a page in Confluence for sharing the passwords of common accounts. I suggested them to use a password manager, but now thinking... is there any benefit? The Confluence page is ...
0 votes
0 answers
27 views

Secure method of creating sudoer password through cloud-init

We have automated a lot of things for server startup via cloud-config, and I want confirmation about whether there is any security concern in the following. users: - name: myuser groups: sudo ...
0 votes
2 answers
79 views

Construct a strong, (almost) unique password? [duplicate]

After reading Why use random characters in passwords? it seems to me that one can solve the problem of how to remember a zillion passwords while each one remains secure by constructing each password ...
0 votes
0 answers
45 views

Google Password I didn't create

I opened Google, and a popup occurred briefly before I reflexively closed it. I then realized it had said something about a new password saved to the Google Password Manager, I think - which is weird,...
1 vote
3 answers
171 views

Password manager vs Gmail

Is there any security issue if I use for example my Gmail account to store passwords from another resources instead of using any password manager like a KeePass? If my password for Gmail account is ...
0 votes
2 answers
256 views

Firefox: What would be more secure/private: storing session cookies or saving password in the browser?

I am wondering, assuming the latest version of Firefox, which of the following options would be more preferable security-wise (e.g. assess and/or password to user account will be stolen) and which one ...
3 votes
3 answers
1k views

Is a Whirlpool hash with random salt secure enough?

I copied the title from another question, but it wasn't answered there and my case is a bit different. I have inherited an old website to maintain. I noticed that the password hashing is not up to ...
1 vote
1 answer
2k views

What are security advantages of pass in comparison to KeepassXC (GUI App)?

At the moment I use KeepassXC on macOS. Before I used KeepassX, which discontinued their development. I am considering switching to command line client pass - the standard unix password manager, ...
24 votes
6 answers
27k views

SSH password vs. key authentication

I've usually been told that public key authentication is strongly preferred over password authentication for SSH. However our previous admin was against public keys and only issued passwords and took ...
5 votes
3 answers
374 views

Is it a bad idea to replace passwords with OTP?

As I understand things, given a user with proper password management (e.g. with a libre password manager like KeePassXC) the only realistic threat is having passwords leaked the following ways: A: ...
0 votes
1 answer
82 views

Passing password back from server to client? [duplicate]

I've never seen any example of this and I'm just curious why? Why is it not okay just to pass it through HTTPs + encoded in a JWT? I will not be storing the password anywhere on the client side, I ...
0 votes
0 answers
53 views

Using pass cli for background (cron) jobs securely

Q: how to securely use pass tool to for scheduled jobs? One of the tools to store and manage passwords on a unix machine is pass, which is a layer on top of gpg. Any password that I create is ...
4 votes
2 answers
227 views

What algorithm does 1Password use for encryption, AES-GCM-256 or AES-CBC-256?

I would like to know what encryption 1Password uses. On the About the 1Password security model page, it says: Your 1Password data is kept safe by AES-GCM-256 authenticated encryption. The data you ...
0 votes
0 answers
68 views

password manager and key management

I would love to gather some information on how to program my own password manager properly as I'm pretty new to security. Currently, I'm using pythons cryptography module and a sqlite database. The ...
5 votes
1 answer
196 views

Design of a web based password vault

I'm designing a password vault that's accessible to clients through an existing web application. The clients are small, (and mostly non-technical) businesses that aren't using password managers, but ...
0 votes
0 answers
16 views

Application to archive a file with multiple passwords [duplicate]

Is there an application to create an archive (e.g. 7z, zip, rar, etc) that can be accessed with multiple valid passwords? For example the password protected archive "example.7z" can be ...
3 votes
2 answers
134 views

Do password autofill extensions securely validate the site they are autofilling?

I had a situation where I clicked an email link send to me by a financial institution. The link first sent me to their login page where my chrome password extension automatically filled in my username ...
3 votes
2 answers
145 views

How to best separate password "tiers" or not at all?

While using a password+ manager is a know must for sensible security, one nuisance (from an UX point of view) I encounter is that there are different password "tiers". Pretty obviously my e....
17 votes
6 answers
10k views

How YubiKey Challenge-Response works "locally"?

I have got a YubiKey NEO recently (and a bit disappointed that you can only have two activated second factor authentication methods out of all the listed). In password managers those support YubiKey, ...
0 votes
1 answer
91 views

Does a solution exist to permit account sharing without revealing the account password?

I'm looking for a process to replace the status quo of notepad and Excel. We've tested a market-leading password manager. An issue that comes up with this is that the secure sharing password facility ...

1
2 3 4 5
26