Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
1,265
questions
2
votes
3
answers
3k
views
Is this a secure approach to store a master password?
I have come up with the following approach to remember master passwords (to use in software like KeePass, etc): Since it is annoying to type the master password every time we power up the PC, we store ...
- 123k
96
votes
10
answers
32k
views
If a provider sees the last 4 characters of my password, can they see it in full?
I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
0
votes
1
answer
859
views
What can I do to improve my Keepass XC setup?
I'm planning on using KeePass XC for the first time and am trying to create a setup that:
(1) would prevent hackers from stealing my passwords
(2) would prevent me from losing access to my ...
CommunityBot
- 1
0
votes
2
answers
43
views
Storing backup keys (2FA) for online accounts
So I spent the day looking for a good solution of storing the backup keys or the 2FA codes and can't seem to find a convenient way for me, many people have different takes on this, so far I found 2 ...
- 1,892
23
votes
5
answers
12k
views
Best practices for storing 2FA recovery codes
I’ve recently started using 2FA on a bunch of services and I’m not sure how to best store the recovery codes. I can think of 3 options:
In a secure note on LastPass
In a Dropbox folder
On a usb stick
...
- 101
2
votes
2
answers
47
views
Mitigating the performance impact of strong hashes with Basic HTTP authentication
I am trying to decide which work factor to use for our hashed passwords, and I am facing the following dilemma. Let me elaborate for a moment.
Basic HTTP authentication works as follows:
The user ...
- 3,395
0
votes
1
answer
286
views
iCloud Security Concern: browser session authentication storage after 2-factor?
Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie?
My concern is, if ...
CommunityBot
- 1
2
votes
2
answers
3k
views
Is it secure to have two password managers?
For various reasons I use both Keepass 2 and Lastpass. They have 90% the same password database. Is it secure to be using and maintaining both of them? Is it secure if they both use the same password (...
- 1
2
votes
1
answer
186
views
Dangers of using the web applications provided by password managers
The password manager bitwarden requires the user to log in to their account on their web site to allow them to enable 2FA, import passwords and manage other account related details, as that ...
CommunityBot
- 1
11
votes
4
answers
8k
views
Temporary passwords e-mailed out as plain text
Is this a security issue? Many big ecommerce platform companies use this feature. Where if you forgot your password, they e-mail you a temp password.
Could someone potentially figure out the ...
0
votes
1
answer
35
views
Creating Password from 2 different part
I’m looking for Term Or Some platform for managing Password Authentication with this way :
Password construct from 2 Part ,
First one is static and you can make it and second Part Generate From TOTP ...
CommunityBot
- 1
2
votes
3
answers
139
views
Manage passwords from my personal website
So I'm a complete novice in security practices, and an amateur web developer. I have a personal website connected to a personal DB. Currently there is nothing in this DB that would be useful to anyone ...
- 50.5k
0
votes
1
answer
78
views
Is it possible to design a system with two passwords?
Is it possible to design a system with two passwords prompts?
The system will have to prompt for two passwords
The system would have to validate first password before prompting for second password
...
- 50.5k
2
votes
2
answers
211
views
Password for embedded devices in automatic deployment
We are working with commercial embedded devices, where we install our software. Then, they are deployed in different client sites. The embedded devices have an Ethernet port and a console port for ...
CommunityBot
- 1
1
vote
2
answers
88
views
How Google protects and syncs the passwords?
I read this post but I want to know more details. I know that Google uses a Windows' function called CryptProtectData to encrypt user passwords on Windows and Google only stores the encrypted forms of ...
CommunityBot
- 1
1
vote
1
answer
252
views
Delete saved login credentials username and password
Scenario:
Alice uses my website on her own computer and sometimes also on a computer that Mallory also has access to. Alice likes using the password manager built in to the browser. She is aware that ...
CommunityBot
- 1
31
votes
2
answers
10k
views
Should I assign my various passwords to my keyboard's macro keys?
I had an idea to assign my keyboard's macro keys to various passwords so I can just hit the key and it will paste in (the passwords are long and random so I won't remember them). This is on a home ...
- 123k
1
vote
0
answers
79
views
How to Securely Store Database Password in Java .properties File
I would like to store my DB password in Java .property file and encrypt it using Jasypt. But from what I see, it just moves the problem from hiding the DB Password to hiding the encryption password.
I ...
- 11
0
votes
1
answer
39
views
SCrypt's goal and the role its salt plays
Am I right in stating that SCrypt as an algorithm is useful where many passwords are stored in a database, but not against one specific encryption key derived from one password of one user?
For ...
CommunityBot
- 1
1
vote
1
answer
331
views
How bad is it to store credentials in clear text on disk and in memory?
Yeah, it depends. A good answer would provide some reflections on this. I have two concrete scenarios in mind, in two concrete (and I believe common) contexts. Context 1. At home, you’re the only one ...
CommunityBot
- 1
29
votes
7
answers
8k
views
Is it safe to store account credentials in an Excel sheet protected with a password?
Basically the title. For example, how bad is it to store passwords in an Excel sheet protected with a password, instead of storing passwords in Keypass or something else like Zoho Vault? Of course, ...
- 2,914
50
votes
13
answers
17k
views
Is there a good way to store credentials outside of a password manager?
A lot of the users in my company are using their agendas to write down their password and usernames, or Excel sheets with a protected password. I'm hesitant to install software for password management ...
- 197
1
vote
2
answers
242
views
Security of master password in a derived password manager
I am aware of other questions asking similar things as this one, but I believe this design addresses many of the issues raised in those questions. I'm also not concerned with making sure there's no ...
CommunityBot
- 1
1
vote
2
answers
355
views
Safe or Unsafe to Store Passwords in Chrome on MacOS?
I've seen conflicting opinions on this, more than the below, but i.e.
Unsafe: https://www.techrepublic.com/article/why-you-should-never-allow-your-web-browser-to-save-your-passwords/
Safe: https://...
CommunityBot
- 1
2
votes
1
answer
1k
views
Best Practice Storing Sensitive Information in Web Application
I am developing an application in php/MySql and looking for the best approach from a security standpoint. The application will use and store sensitive information. I realize there are risks to all ...
- 123k
615
votes
23
answers
149k
views
How does changing your password every 90 days increase security?
Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
- 103
2
votes
1
answer
1k
views
Bitwarden and gamecontrollerd on OsX Big Sur
Recently, I came across an issue concerning a daemon named gamecontrollerd in OsX Big Sur.
On my laptop I'm running ReiKey (from Objective-See), which aims at identifying possible Key Loggers that ...
CommunityBot
- 1
0
votes
1
answer
321
views
`pass` not asking for password anymore - gnome-keyring or gpg-agent related? How can I force password asking?
I cross-posted this on the manjaro forums and on server fault. So far no answer, so trying here.
I have gnome-keyring running for sure, not sure it's gnome-keyring or gpg-agent or ssh-agent related......
CommunityBot
- 1
0
votes
1
answer
109
views
How to change the password hashing scheme in LDAP using an external library with slapd.d config
I am trying to change the password hashing scheme for LDAP. Hypothetically, let's assume it's pw-argon.so
I don't have slapd.conf I have the slapd.d directory where I can make changes dynamically to ...
CommunityBot
- 1
0
votes
0
answers
99
views
Google says my password has been found in data breach. HIBP knows nothing about it. Which data breach was that?
I've been using Chrome to save and sync my passwords across devices (and lately I am trying to switch to Bitwarden). Google warned me recently about a password I have used across multiple sites that ...
- 101
3
votes
2
answers
4k
views
Storing passwords in Confluence vs a password manager
My SysOP team is using a page in Confluence for sharing the passwords of common accounts. I suggested them to use a password manager, but now thinking... is there any benefit?
The Confluence page is ...
- 1
0
votes
0
answers
27
views
Secure method of creating sudoer password through cloud-init
We have automated a lot of things for server startup via cloud-config, and I want confirmation about whether there is any security concern in the following.
users:
- name: myuser
groups: sudo
...
0
votes
2
answers
79
views
Construct a strong, (almost) unique password? [duplicate]
After reading Why use random characters in passwords? it seems to me that one can solve the problem of how to remember a zillion passwords while each one remains secure by constructing each password ...
- 123k
0
votes
0
answers
45
views
Google Password I didn't create
I opened Google, and a popup occurred briefly before I reflexively closed it. I then realized it had said something about a new password saved to the Google Password Manager, I think - which is weird,...
- 111
1
vote
3
answers
171
views
Password manager vs Gmail
Is there any security issue if I use for example my Gmail account to store passwords from another resources instead of using any password manager like a KeePass?
If my password for Gmail account is ...
- 6,462
0
votes
2
answers
256
views
Firefox: What would be more secure/private: storing session cookies or saving password in the browser?
I am wondering, assuming the latest version of Firefox, which of the following options would be more preferable security-wise (e.g. assess and/or password to user account will be stolen) and which one ...
- 25.5k
3
votes
3
answers
1k
views
Is a Whirlpool hash with random salt secure enough?
I copied the title from another question, but it wasn't answered there and my case is a bit different.
I have inherited an old website to maintain. I noticed that the password hashing is not up to ...
- 2,235
1
vote
1
answer
2k
views
What are security advantages of pass in comparison to KeepassXC (GUI App)?
At the moment I use KeepassXC on macOS. Before I used KeepassX, which discontinued their development.
I am considering switching to command line client pass - the standard unix password manager, ...
- 216
24
votes
6
answers
27k
views
SSH password vs. key authentication
I've usually been told that public key authentication is strongly preferred over password authentication for SSH. However our previous admin was against public keys and only issued passwords and took ...
- 127
5
votes
3
answers
374
views
Is it a bad idea to replace passwords with OTP?
As I understand things, given a user with proper password management (e.g. with a libre password manager like KeePassXC) the only realistic threat is having passwords leaked the following ways:
A: ...
0
votes
1
answer
82
views
Passing password back from server to client? [duplicate]
I've never seen any example of this and I'm just curious why? Why is it not okay just to pass it through HTTPs + encoded in a JWT? I will not be storing the password anywhere on the client side, I ...
- 266
0
votes
0
answers
53
views
Using pass cli for background (cron) jobs securely
Q: how to securely use pass tool to for scheduled jobs?
One of the tools to store and manage passwords on a unix machine is pass, which is a layer on top of gpg. Any password that I create is ...
- 1
4
votes
2
answers
227
views
What algorithm does 1Password use for encryption, AES-GCM-256 or AES-CBC-256?
I would like to know what encryption 1Password uses.
On the About the 1Password security model page, it says:
Your 1Password data is kept safe by AES-GCM-256 authenticated encryption. The data you ...
- 312
0
votes
0
answers
68
views
password manager and key management
I would love to gather some information on how to program my own password manager properly as I'm pretty new to security. Currently, I'm using pythons cryptography module and a sqlite database.
The ...
- 123k
5
votes
1
answer
196
views
Design of a web based password vault
I'm designing a password vault that's accessible to clients through an existing web application. The clients are small, (and mostly non-technical) businesses that aren't using password managers, but ...
- 19.3k
0
votes
0
answers
16
views
Application to archive a file with multiple passwords [duplicate]
Is there an application to create an archive (e.g. 7z, zip, rar, etc) that can be accessed with multiple valid passwords?
For example the password protected archive "example.7z" can be ...
- 1
3
votes
2
answers
134
views
Do password autofill extensions securely validate the site they are autofilling?
I had a situation where I clicked an email link send to me by a financial institution. The link first sent me to their login page where my chrome password extension automatically filled in my username ...
- 131
3
votes
2
answers
145
views
How to best separate password "tiers" or not at all?
While using a password+ manager is a know must for sensible security, one nuisance (from an UX point of view) I encounter is that there are different password "tiers". Pretty obviously my e....
- 131k
17
votes
6
answers
10k
views
How YubiKey Challenge-Response works "locally"?
I have got a YubiKey NEO recently (and a bit disappointed that you can only have two activated second factor authentication methods out of all the listed).
In password managers those support YubiKey, ...
- 376
0
votes
1
answer
91
views
Does a solution exist to permit account sharing without revealing the account password?
I'm looking for a process to replace the status quo of notepad and Excel. We've tested a market-leading password manager. An issue that comes up with this is that the secure sharing password facility ...
- 123k