Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
1,220
questions
3
votes
1answer
101 views
Dangers of using the web applications provided by password managers
The password manager bitwarden requires the user to log in to their account on their web site to allow them to enable 2FA, import passwords and manage other account related details, as that ...
2
votes
2answers
73 views
Password for embedded devices in automatic deployment
We are working with commercial embedded devices, where we install our software. Then, they are deployed in different client sites. The embedded devices have an Ethernet port and a console port for ...
55
votes
5answers
7k views
Is using bcrypt on existing SHA1 hashes good enough when switching password implementation?
I'm working on improving a CMS where the current implementation of storing password is just sha1(password). I explained to my boss that doing it that way is incredibly insecure, and told him that we ...
2
votes
2answers
134 views
What advantages do Secret Managers offer in terms of authentication [API usage]?
The problem I am seeing with secret managers (programs which serve as a store of secrets for other programs/APIs) is that at some level, a key or credentials must still be provided programmatically, ...
1
vote
1answer
192 views
Delete saved login credentials username and password
Scenario:
Alice uses my website on her own computer and sometimes also on a computer that Mallory also has access to. Alice likes using the password manager built in to the browser. She is aware that ...
0
votes
0answers
30 views
What characters should, and should I absolutely not use in generated passwords? [duplicate]
I'm currently setting up a KeePass database after switching over from another password manager, and it has the option to change the character set for generating a password.
This has a lot of options, ...
0
votes
0answers
42 views
What are the security implications of different permissions of /etc/shadow in different Linux distributions?
The file in which user password hashes are stored, /etc/shadow, is not readable to normal users on all OSes, but the details differ from distribution to distribution:
-rw-r----- 1 root shadow 1811 Feb ...
1
vote
0answers
69 views
Why do I receive so many password reset/welcome emails from services I'm not a customer of? [closed]
Over the years I've received the occasional password reset from a service I've never used (or even heard of sometimes). As far as I can tell, the emails are genuinely being generated and sent by the ...
0
votes
1answer
61 views
Does syncing local data to the cloud count as MFA?
Bitwarden uses TOTP as the multi-factor authenticator method for their password manager. Bitwarden stores and syncs your data so you need the master password + TOTP to get access to your account
...
0
votes
1answer
58 views
Is it safe to use 2FA within a password manager relative to using a separate app for 2FA? [duplicate]
Nowadays, many Password managers offer options for 2-Factor Authentication such as TOTP. I am really confused regarding this. Isn't the whole point of 2FA is to prove you have a second way of proving ...
1
vote
2answers
127 views
Security of master password in a derived password manager
I am aware of other questions asking similar things as this one, but I believe this design addresses many of the issues raised in those questions. I'm also not concerned with making sure there's no ...
7
votes
3answers
279 views
Why would password managers provide support for OTP codes? [duplicate]
Can anyone explain me what's this trend of providing passwords and OTP codes on the same service? What benefit or value are they trying to bring to the table?
We, as security professionals, have been ...
0
votes
1answer
189 views
how good is “Chrome Password Checkup” extension for checking passwords?
From what I read so far Google "Chrome Password Checkup" extension (https://chrome.google.com/webstore/detail/password-checkup/pncabnpcffmalkkjpajodfhijclecjno) checking the password that you use for ...
10
votes
1answer
1k views
Is BitWarden trusted?
I've been using BitWarden as my main password keeper, would like to ask if it's safe? I know that everything is not 100% safe but still want to know if they are worth it.
All my passwords are ...
2
votes
2answers
225 views
Attacks against unencrypted android phones?
So, I keep reading again and again that one should encrypt his android device.
But from an attacker's perspective, what can be done with an unencrypted phone? Can I extract all the files or possibly ...
7
votes
1answer
205 views
How does LastPass know that I used the same passphrase with another service?
So today I switched from Lastpass (chrome extension and iOS app) to bitwarden.
So far so good, it was really easy to export my lastpass data and import it in bitwarden however what I am wondering is ...
4
votes
0answers
106 views
Is asking the e-banking username/password from a 3rd party site compliant with 3dsecure and PSD2?
Recently I tried to make an online purchase in one of the biggest e-commerce sites in Greece.
During checkout, and after providing debit card details, it asked me to provide the username/password (not ...
1
vote
2answers
53 views
Hashing bcrypt password hash for use as a password reset token
There is an existing user database that has the following columns:
userId (v4 uuid)
created timestamp
bcrypt password hash
email
I must add a password reset functionality and I cannot add any new ...
0
votes
1answer
107 views
How Forgot Password Works?
For my website I need to add "forgot password" functionality. As I searched on the internet there are too much vulnerabilities you may encounter in case of wrong implementing this ...
0
votes
1answer
100 views
Is using SHA256 to create 256bit secret key from bcrypt good ok?
I am trying to Use AES to store passwords for a password manager. For authentication I am already using bcrypt. As AES uses 256 bit Key can I use SHA256 to generate 256 bit key from hashed value of ...
1
vote
1answer
75 views
Securely storing a master key client-side
My company is currently evaluating a product which comes with a browser-extension-based password manager. The password manager is peripheral to their core product, but is the only way to use it. We're ...
2
votes
1answer
207 views
Storing 2FA seeds in a password manager [duplicate]
Does it make sense to store the 2FA seeds (i.e: the codes used to generate a time based OTP) in my password manager?
If my password manager has a strong password and 2FA using a third-party app, is ...
1
vote
0answers
168 views
Are Brave Browsers Sync encryption parameters secure enough?
I am considering switching over to Brave and maybe also use it's sync feature for settings, and maybe even passwords if it's good enough. I do use a password generator but out of laziness I happen to ...
4
votes
3answers
4k views
Prevention of user's passwords being stored as plain text in bash history
Say I want to find the password of a linux user sudoer account. Assume he uses a strong password. Assume I have physical access to the machine. I can get hold of his passwd and shadow file and brute-...
0
votes
1answer
116 views
Firefox: What would be more secure/private: storing session cookies or saving password in the browser?
I am wondering, assuming the latest version of Firefox, which of the following options would be more preferable security-wise (e.g. assess and/or password to user account will be stolen) and which one ...
22
votes
2answers
3k views
Why do password requirements exist while limiting the upper character count? [duplicate]
I do not quite understand why it is common practice to require a difficult to remember password with alphanumeric and special character requirements, while also having an upper limit of 32 characters. ...
1
vote
0answers
141 views
Securing BIP39 Phrases and Password Manager Master Password
I am looking for a review of the solution to store my Ledger Nano S BIP39 recovery phrase as well as my password manager usage.
This solution is mostly based on this video.
Few points that I think ...
0
votes
1answer
394 views
What can I do to improve my Keepass XC setup?
I'm planning on using KeePass XC for the first time and am trying to create a setup that:
(1) would prevent hackers from stealing my passwords
(2) would prevent me from losing access to my ...
2
votes
0answers
511 views
Bitwarden and gamecontrollerd on OsX Big Sur
Recently, I came across an issue concerning a daemon named gamecontrollerd in OsX Big Sur.
On my laptop I'm running ReiKey (from Objective-See), which aims at identifying possible Key Loggers that ...
27
votes
3answers
18k views
Is Firefox Password Manager less secure than LastPass?
After installing the LastPass password manager, I am presented with a login dialog including the option to "Disable Insecure Firefox Password Manager".
(This option appears as long as the Firefox ...
4
votes
1answer
241 views
Relative security of 'offline' vs 'online' password managers
I am a long-standing KeePass user, but I find its browser integration and Android apps a bit ropey, and certainly harder work than a cloud-based solution such as Lastpass or Bitwarden. I have been ...
0
votes
0answers
59 views
Is there a better method that this for storing a physical password? [duplicate]
This may be a little unnecessary, but taking into consideration:
There are many ways to hack a computer
There are many ways to hack a network
There is always a possibility of an undetected malware on ...
0
votes
1answer
158 views
iCloud Security Concern: browser session authentication storage after 2-factor?
Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie?
My concern is, if ...
2
votes
1answer
153 views
How can Bitwarden claim it cannot access your passwords if the vault password is the same as the web account password?
Bitwarden claims that it is more secure than traditional cloud password managers (such as Google) as it only stores the encrypted version of the passwords database. But for some reason the password ...
0
votes
2answers
144 views
1Password security weakness?
I was considering creating a 1Password families account because I liked the idea that 1Password never has the information needed to decrypt my passwords; however, when I created an account, I entered ...
105
votes
8answers
53k views
Is it safe to send clear usernames/passwords on a https connection to authenticate users?
I'm setting up a home HTTP server which can send and receive JSON data to/from different clients (Android and iPhone apps).
I'd like to allow access only to certain users and I'm considering using a ...
6
votes
2answers
228 views
Can password managers read my secure data? If no, how does sharing work under the hood? [duplicate]
All the popular password managers on the market advertise that they have AES-256 grade security. In a nutshell, the user has the master key and the password manager has the cipher-text. So the ...
1
vote
1answer
81 views
Concatenating secure and reused passwords
Would concatenating (i.e. joining together into one string of text) a secure (i.e. Diceware) password and other, much less random, passwords be a good idea? This new password would be used as master ...
3
votes
0answers
47 views
Can Chrome extensions access other Chrome extensions' data?
Can the data in a password-manager Chrome extension be accessed by a different Chrome extension? For example, if one were to install a malicious extension, could that extension access the data (i.e., ...
0
votes
0answers
43 views
Is there anyway to recover wrong KeePass 2 password tries?
I often have trouble logging into KeePass 2 (now 2.46). I would really like once logged to know what it thinks I typed for incorrect passwords. Is it possible to find out?
0
votes
1answer
59 views
Simplify usage of KeePass or equivalent password managers while preserving security
Situation
I'm using KeePass to manage my password together with a long complicated password. I need to access passwords quite often so it's a little cumbersome to have to enter the password each time. ...
19
votes
7answers
6k views
Don't one-time recovery codes for 2FA introduce a backdoor?
Although using multi-factor authentication is clearly a good move, I'm struggling with the 'one-time recovery codes' concept. It seems to me that if you choose to use them, what you're doing is ...
0
votes
2answers
139 views
What happens if you forget your 1Password password?
When using a service like 1Password, what happens if you forget or lose your master password?
My guess is that you can simply reset your passwords on all the sites 1password remembered for you, but I ...
9
votes
5answers
12k views
Is Firefox's Lockwise secure?
I have lot's of passwords saved in Firefox Password Manager, now called Lockwise. I recently installed Opera Browser on my machine. It somehow managed to import all the history-data and form fields, ...
7
votes
4answers
1k views
How do I convince others of the importance of password management?
I just got married, and my wife and I are in the midst of combining finances, etc.
We set up a joint bank account and the first thing I do during the account setup phase is generate a 16-character ...
0
votes
1answer
716 views
What is the plaintext password of 'hash part 1' in the shadow file?
on immersivelabs lab Password Hashes II
https://dca.immersivelabs.online/labs/password-hashes-ii/
there is a question:
What is the plaintext password of 'hash part 1' in the shadow file?
shadow.txt ...
7
votes
5answers
246 views
Owner vs IT employee. Security and passwords
I own a company that has hired an IT employee. He has all passwords to servers, work stations and data. He is refusing to share or supply these passwords (Keys to the Kingdom) on the grounds of ...
1
vote
1answer
61 views
How do sites detect credential sniffing, and what is the purpose of this attack?
I just got an email from the Unsplash service telling me that someone had logged into my account via credential sniffing:
Five minutes later I get three more emails, each one notifying that a (...
24
votes
7answers
5k views
Are algorithmically-generated personal passwords a security risk?
We all know why password reuse is bad: eventually some site at which you have an account that did not properly hash+salt user passwords will get hacked, and your password will be published in a big ...
0
votes
1answer
122 views
What vulnerabilities would this type of “password manager” have?
When I was searching for a password manager to use I stumbled upon the concept of Master Password which instead of encrypting and saving your passwords, generates them by using your master password ...
