As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

Filter by
Sorted by
Tagged with
0 votes
2 answers
183 views

Whats the difference between secret and password managers?

Are there fundamental underlying differences in how secrets and passwords should be managed? I'm curious of the technical/cryptographic differences between secret managers and password managers are. ...
5 votes
3 answers
254 views

Using Proof of Work to slow down login attempts

For a while I've been pondering a user authentication protocol that aims to ensure that a client does some computational work before the server will attempt to authenticate the password. The reason ...
1 vote
1 answer
89 views

What are the risks of reusing the same passphrase for FDE, user account, and password manager?

Consider a home user who runs Linux on a laptop with full-disk encryption and uses a cloud-based password manager. Assume the laptop is firewall-protected with no SSH access. It seems reasonable to ...
1 vote
0 answers
28 views

How can I reduce the number of passphrases that I must memorize (password manager, FDE, user accounts)? [closed]

I'm attempting to reduce the number of passphrases that I must memorize. Currently I need a different passphrase for each of: Password manager FDE for my personal computer User account for my ...
2 votes
1 answer
1k views

Bitwarden and gamecontrollerd on OsX Big Sur

Recently, I came across an issue concerning a daemon named gamecontrollerd in OsX Big Sur. On my laptop I'm running ReiKey (from Objective-See), which aims at identifying possible Key Loggers that ...
0 votes
1 answer
556 views

`pass` not asking for password anymore - gnome-keyring or gpg-agent related? How can I force password asking?

I cross-posted this on the manjaro forums and on server fault. So far no answer, so trying here. I have gnome-keyring running for sure, not sure it's gnome-keyring or gpg-agent or ssh-agent related......
1 vote
3 answers
228 views

Password managing apps seem to have access to my passwords

Keeper used to be free so I had stored most of passwords on that app a few years ago from a past device. When I tried to access the passwords after five years, the app had turned into a subscription ...
0 votes
1 answer
243 views

How to change the password hashing scheme in LDAP using an external library with slapd.d config

I am trying to change the password hashing scheme for LDAP. Hypothetically, let's assume it's pw-argon.so I don't have slapd.conf I have the slapd.d directory where I can make changes dynamically to ...
0 votes
2 answers
166 views

Storing backup keys (2FA) for online accounts

So I spent the day looking for a good solution of storing the backup keys or the 2FA codes and can't seem to find a convenient way for me, many people have different takes on this, so far I found 2 ...
1 vote
3 answers
96 views

Creating Password from 2 different part

I’m looking for Term Or Some platform for managing Password Authentication with this way : Password construct from 2 Part , First one is static and you can make it and second Part Generate From TOTP ...
0 votes
0 answers
49 views

Sending secret API Keys via email

I'm a customer of a big KYC provider and am using their API. The process to authenticate at the API requires a secret key that they are sending to me by email. If I want to revoke the key and get a ...
1 vote
1 answer
1k views

What can I do to improve my Keepass XC setup?

I'm planning on using KeePass XC for the first time and am trying to create a setup that: (1) would prevent hackers from stealing my passwords (2) would prevent me from losing access to my ...
14 votes
2 answers
4k views

Reasoning behind banning '#' from the start of passwords? [duplicate]

Today, on an official government website, I came across the following password rules: "Your password has to be at least 8 characters long. It can't have any blank spaces. It has to use characters ...
0 votes
1 answer
358 views

iCloud Security Concern: browser session authentication storage after 2-factor?

Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie? My concern is, if ...
1 vote
0 answers
32 views

How should an argon2 hash be stored? [duplicate]

Given the following argon2 hash $argon2id$v=19$m=65536,t=32,p=8$mJmKA5qamzXOPJZYw4wCEUKY$COkMH0RckaZ/3bhYCdCQjLuzoLKxcAmk4TzmHRRgTQ8 How should the hash be stored in a database? From the answers of ...
2 votes
1 answer
259 views

Dangers of using the web applications provided by password managers

The password manager bitwarden requires the user to log in to their account on their web site to allow them to enable 2FA, import passwords and manage other account related details, as that ...
3 votes
2 answers
371 views

Password for embedded devices in automatic deployment

We are working with commercial embedded devices, where we install our software. Then, they are deployed in different client sites. The embedded devices have an Ethernet port and a console port for ...
1 vote
2 answers
302 views

How Google protects and syncs the passwords?

I read this post but I want to know more details. I know that Google uses a Windows' function called CryptProtectData to encrypt user passwords on Windows and Google only stores the encrypted forms of ...
0 votes
2 answers
83 views

How to reuse PIN codes in the most secure way?

I've made a list of the services/devices that require a PIN code. Shockingly, it's over 10, which I find impossible to remember, so I need a strategy to reuse the codes. What could be a strategy for ...
0 votes
0 answers
156 views

Google Password I didn't create

I opened Google, and a popup occurred briefly before I reflexively closed it. I then realized it had said something about a new password saved to the Google Password Manager, I think - which is weird,...
1 vote
1 answer
272 views

Delete saved login credentials username and password

Scenario: Alice uses my website on her own computer and sometimes also on a computer that Mallory also has access to. Alice likes using the password manager built in to the browser. She is aware that ...
30 votes
4 answers
8k views

Security of LastPass together with YubiKey

I'm looking at password manager solutions and came across LastPass. I see that they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What ...
1 vote
1 answer
98 views

SCrypt's goal and the role its salt plays

Am I right in stating that SCrypt as an algorithm is useful where many passwords are stored in a database, but not against one specific encryption key derived from one password of one user? For ...
0 votes
0 answers
29 views

What is the best way to protect passwords? [duplicate]

I noticed that I don't use many different passwords for all my stuff, which is very insecure. However, it is also difficult to remember really secure, long passwords which are different for every ...
0 votes
2 answers
166 views

Dealing with password vault recovery after a catastrophic failure as a home user

I had a dinner with some friends today, and I mentioned that I use 1Password combined with Dropbox to manage my password. One of them then remarked something which I actually hadn't considered: ...
3 votes
2 answers
6k views

Make password using special characters

Is it a great idea to make passwords with special characters from your language? (If you have it) BTW it´s not allowed on every website. Is it a way to make it a bit harder for hackers to crack your ...
20 votes
3 answers
9k views

Is it secure to store a two factor authentication seed in a password manager?

I wonder whether it is really secure to store the Two Factor Authentication seed code (e.g. the secret key for TOTP) within a password manager together with the user and password for the service. If ...
0 votes
3 answers
224 views

Understanding Password Manager Chicken and Egg problem

I read that Password Managers are a more secure option than remembering passwords. I am currently evaluating Passwords Managers with cloud synchronization and there is something that really confused ...
2 votes
2 answers
303 views

Security of master password in a derived password manager

I am aware of other questions asking similar things as this one, but I believe this design addresses many of the issues raised in those questions. I'm also not concerned with making sure there's no ...
54 votes
8 answers
6k views

You're an IT consultant. Should you discourage a client from telling you their password?

I'm an IT consultant. One client has known me for a few years. He wants me to do some work on his kids' laptop again. I'll need to log into his kids' Windows user account. (I'm guessing that multiple ...
31 votes
3 answers
11k views

Should I assign my various passwords to my keyboard's macro keys?

I had an idea to assign my keyboard's macro keys to various passwords so I can just hit the key and it will paste in (the passwords are long and random so I won't remember them). This is on a home ...
0 votes
2 answers
80 views

Digital legacy: safe to save password manager login info in Gmail draft?

Google accounts have a "Digital Legacy" feature, where accounts that go inactive for a long period (3 months, 6 months, etc.) and do not respond to alerts will eventually trigger Inactive ...
23 votes
2 answers
4k views

Why is 1Password sign-in to new device secure without MFA?

I'm trying to understand why it's not necessary with MFA in 1Password when signing in to a new device. This was the case that triggered my curiosity: I created a 1Password account I downloaded the ...
2 votes
1 answer
240 views

Is CVE-2023-24055 applicable to other password managers using the same format as the original KeePass?

CVE-2023-24055 is a known vulnerability that enables an attacker to recover plaintext user credentials from the KeePass application. However, due to the original KeePass being Windows-specific, I've ...
24 votes
6 answers
5k views

Does Rehashing a weak hash with a strong algorithm make it strong?

Imagine the following situation. We're making a web application which should be really safe Now the accounts/users are not directly added by us but they receive a letter with a logincode. We get a ...
1 vote
2 answers
113 views

DNS hijacking/poisoning effect on URL/URI and password manager autotype/autofill

A benefit to password managers, at least some of them, is that they can look at the URL and only use autotype/autofill when on the correct site, which can help prevent pharming since if instead of ...
0 votes
1 answer
209 views

What threats can the use of a TPM by a password manager mitigate?

This question is about the use of a TPM by a password manager used by an end-user on a PC to store and use passwords to log in to web sites and other things that are protected only by a password. ...
98 votes
10 answers
32k views

If a provider sees the last 4 characters of my password, can they see it in full?

I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
1 vote
0 answers
110 views

How do password manager developers protect their app store accounts?

Basically every password manager (like LastPass, 1Password, ...) has its Android & iOS app and browser extensions for Chrome, Safari, Firefox etc., to automatically fill in usernames and passwords....
1 vote
3 answers
212 views

Why do I need to provide authentication when accessing a browser's built-in password manager?

Why do I have to provide authentication when I want to read a password stored in my own web browser while I have to do nothing to read the same password on a site's login page? Is my conclusion ...
2 votes
1 answer
155 views

Why would garbage collection be a problem in password managers?

I was reading an infosec user's take on the LastPass data breach and noted something odd in his commentary on another password manager system (emphasis mine) I have not done a thorough code review, ...
5 votes
2 answers
871 views

How Are Google Chrome Synced Passwords Encrypted If I Can Reset the Password to My Account

Services like Dashlane and Bitwarden are unable to decrypt your passwords without your Master Password. So, how does Chrome do it when they also state that your passwords are encrypted using your ...
0 votes
2 answers
148 views

Is it possible to design a system with two passwords?

Is it possible to design a system with two passwords prompts? The system will have to prompt for two passwords The system would have to validate first password before prompting for second password ...
0 votes
1 answer
72 views

My Bank Enforces A 6 Character Limit On Passwords. Is This Bad? [duplicate]

A bank I (previously) used in Australia forced users to comply with a 6-character limit on every password. Specifically, the rules were: 6 characters exactly, including at least 1 number and letter ...
51 votes
5 answers
6k views

Should a bank be able to shorten your password without your involvement?

The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore. He called his advisor, who ...
0 votes
0 answers
38 views

Benefit of only having MFA challenge on the very first login

I'm trying to select a suitable password store for a team - one of my main requirements is that users be authenticated via a removable key file rather than simply a master password. I have been using ...
3 votes
1 answer
627 views

How bad is it to store credentials in clear text on disk and in memory?

Yeah, it depends. A good answer would provide some reflections on this. I have two concrete scenarios in mind, in two concrete (and I believe common) contexts. Context 1. At home, you’re the only one ...
52 votes
7 answers
14k views

What are the cons of stateless password generators?

Does anybody have hands-on experience with stateless password generators (managers) like Getpass? It seems like it does most of the work of cloud password managers, but leans more to the security ...
3 votes
2 answers
152 views

How do I remember passwords for environments where Password Manager is not available?

I am a big fan of 1Password. And I try to save my passwords in 1Password as much as possible. However, there are environments where 1Password cannot be used. That is the password to protect 1Password ...
33 votes
6 answers
16k views

Is it safe to store account credentials in an Excel sheet protected with a password?

Basically the title. For example, how bad is it to store passwords in an Excel sheet protected with a password, instead of storing passwords in Keypass or something else like Zoho Vault? Of course, ...

1
2 3 4 5
26