Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
1,109
questions
20
votes
7answers
7k views
Logging in a user after password reset via link
Lets say password reset functionality flow is the following:
User submits email address used for his account.
An email is sent to that email address with a link with a password reset hash.
Upon ...
11
votes
5answers
5k views
How YubiKey Challenge-Response works “locally”?
I have got a YubiKey NEO recently (and a bit disappointed that you can only have two activated second factor authentication methods out of all the listed).
In password managers those support YubiKey, ...
0
votes
1answer
66 views
How should we apply the salt to the password? [duplicate]
According to Wikipedia:
A rainbow table is ineffective against one-way hashes that include large salts. For example, consider a password hash that is generated using the following function (where "|...
1
vote
1answer
75 views
Is encrypting the FireFox folder with EFS protecting saved passwords in case of someone accessing the hard drive?
What I want to do:
Use the "save password" feature in FireFox (on Windows 10) without using FireFox's master password feature.
What I'm afraid of:
Someone stealing my laptop or getting access to my ...
1
vote
2answers
121 views
Should I back up automatic strong passwords of iCloud?
I’ve recently started to use iCloud’s automatic strong passwords. I feel like that if iCloud were down for some reason, the passwords would be lost. Considering it, should I back them up on other ...
10
votes
3answers
8k views
How to store passwords securely in my server?
Disclaimer: I know I should use bcrypt to securely store user's passwords. Please, keep reading.
I want to store credentials for several email services for each user. So if I log in with my username ...
3
votes
1answer
384 views
password managers and FIDO
I've just been reading some posts about FIDO support (or the lack thereof) in password managers and want to check whether my understanding is correct.
My understanding of FIDO (v1) is that the device ...
0
votes
0answers
21 views
Can an employee be sued for gross negligence by reusing personal passwords at work? [migrated]
An employee is using some easy guessable reused passwords well known to Have I Been Pwned.
OUCH.
Something bad happens.
Can an employee be sued?
Option A: An organization does not have password ...
1
vote
1answer
112 views
Is there any security concern if I kept password hash on client side?
I have a mobile application that needs to be able to work when the phone is offline. In order to prevent misuse by others when they have a short physical access to the phone the requirement is to ...
0
votes
1answer
113 views
Security concept for password management
At the moment, I am struggling on a question to which I have not found a good answer so far.
I wan't to create a password manager, which will be used by a lot of people.
Used languages: PHP / ...
61
votes
17answers
15k views
Alternative to sending password over mail?
Recently I've started working as a contractor for a company, which requires me to often log in to different b2b services.
The way I receive the login data is usually over email in plain text. My gut ...
3
votes
2answers
112 views
How strong is a password consisting of words arbitrarily chosen from the dictionary?
Diceware wants us to actually randomly pick n words from a given set of m=65 words.
Assume a user does not actually use a dice. Instead they take a physical dictionary of m words and "randomly" picks ...
3
votes
1answer
108 views
Best practices to manage password for embedded Linux devices
Should we generate a strong password offline, keep it closely guarded secret, and use the same one across all copies of the device? The boot drive is eMMC flash soldered on the PCB, hard to read ...
25
votes
7answers
22k views
Should I use FileZilla?
Recently, an increasing number of people have started advising moving away from FileZilla. However, the only reason I can see for this is that FileZilla stores the connection information in a ...
0
votes
0answers
36 views
Is Argon2 secure to use? [duplicate]
Now that it's been 5 years since Argon2 has been released, is Argon2 secure for public use? (E.g. normal password hashing)
Also, what are the secure parameters for Argon2?
1
vote
1answer
114 views
Safest place for small business to store passwords
Where is the safest place for a small business to store its passwords for servers, web domain credentials, etc.?
100
votes
3answers
18k views
Why is Sojdlg123aljg a common password?
I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
2
votes
1answer
76 views
What advantages do Secret Managers offer in terms of authentication [API usage]?
The problem I am seeing with secret managers (programs which serve as a store of secrets for other programs/APIs) is that at some level, a key or credentials must still be provided programmatically, ...
3
votes
3answers
160 views
Is a Whirlpool hash with random salt secure enough?
I copied the title from another question, but it wasn't answered there and my case is a bit different.
I have inherited an old website to maintain. I noticed that the password hashing is not up to ...
0
votes
1answer
53 views
iCloud Security Concern: browser session authentication storage after 2-factor?
Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie?
My concern is, if ...
0
votes
0answers
43 views
Storing the master password in a keychain
I tend to avoid putting my master keychain password in the keychain itself (in OSX, for example), but sometimes with federation of accounts and things, it would be convenient to do so.
Am I right to ...
2
votes
0answers
136 views
Is using AES secure for password managers?
I'm developing an application that automates processes. The user connects to many accounts that the application uses then passwords are encrypted using AES. An example algorithm looks like this:
...
6
votes
3answers
4k views
How can I create a service that automatically logs onto a third-party service without storing credentials in plain text?
I know that storing log-in credentials in plain text is one of the cardinal no-nos of security, but I'm working on something where I can't think of any other solution.
My service connects to a user's ...
-9
votes
1answer
184 views
Does word store my passwords in plaintext? [closed]
I have a document which I wrote my passwords in and saved it to my disk, and I have been hearing a lot about programs storing passwords in plaintext
Did word store my password I saved in plaintext???
...
0
votes
3answers
126 views
Password generator and password limitations
I would like suggestions for a good strategy for dealing with web sites that have arcane rules about what must or must not appear in a password.
My ideal are the sites that allow a good range of ...
28
votes
7answers
7k views
Why do we ask for a user's existing password when changing their password?
In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
3
votes
1answer
303 views
How secure is KeePass KDBX4 by default?
How secure is KeePass KDBX4 by default if someone obtain the .kdbx file and attempt to brute-force it without knowing any hint of the master password?
With assumption :
The password length is equal/...
10
votes
1answer
536 views
Firefox bug permits stealing encrypted passwords: How is this possible?
It's my understanding that passwords I save in Firefox's Password Manager are encrypted and that setting a Master Password encrypts the encryption key used in this process. The Google hit for "Does ...
2
votes
1answer
1k views
I want to deploy from GitLab to AWS - so where exactly do I store my private key?
This seems like an odd and simple question, but I'm trying to get my head around the principle of "never check a private key into version control".
I'm trying to build a startup of sorts, where ...
2
votes
1answer
146 views
Should a browser make its own password manager? [closed]
I'm trying to figure out if products such as Firefox's Lockwise are a superb idea or a terrible one.
On the one hand, installing a third-party addon to your browser comes with inherent risks, so ...
1
vote
1answer
135 views
Delete saved login credentials username and password
Scenario:
Alice uses my website on her own computer and sometimes also on a computer that Mallory also has access to. Alice likes using the password manager built in to the browser. She is aware that ...
7
votes
4answers
929 views
How do I convince others of the importance of password management?
I just got married, and my wife and I are in the midst of combining finances, etc.
We set up a joint bank account and the first thing I do during the account setup phase is generate a 16-character ...
1
vote
1answer
293 views
System Encryption With Veracrypt/Truecrypt- What is the difference between Wipe Mode “None” and 3 pass, 1 pass etc?
First I wanted to make sure we're talking about using a Non-SSD Hard drive. I know SSD drives work differently.
Here would be a good reference/guide on system encryption:
https://www.howtogeek.com/...
166
votes
5answers
8k views
Password management for kids - what's a good way to start?
Consider a young (primary-school age) child who is starting to collect passwords for online services. How can a parent (or equivalent) help them manage their passwords?
An example to make things ...
45
votes
6answers
11k views
What are the cons of stateless password generators?
Does anybody have hands-on experience with stateless password generators (managers) like Getpass?
It seems like it does most of the work of cloud password managers, but leans more to the security ...
5
votes
4answers
410 views
Forgot password best practice for mobile applications
There are known good practices for password reset functionality from OWASP and other resources. On the other hand, I believe most of us agree that security questions are not user friendly, they either ...
52
votes
4answers
20k views
How can I be sure Lastpass really can't access my passwords?
The recent, widely publicized security incident where millions of Linkedin were exposed reminded me to tighten up my password practices. I'm looking at several password managers now and I'm especially ...
1
vote
1answer
90 views
Would Hashing a Decryption Key Significantly Lower Security? [duplicate]
I'm using the Haskell Codec.Crypto.SimpleAES package to create a crude password manager. The password manager seems secure but it's unable to warn the user when the decryption key is invalid. If a ...
0
votes
0answers
45 views
How can I trust the data integrity of LastPass [duplicate]
So I recently downloaded LastPass and I'm beginning to wonder how they can ensure that my information is kept secure. Is anyone aware of what kind of encryption algorithm they use or how they ensure ...
0
votes
1answer
78 views
Does Azure Key-Vault encrypt the values before storing?
We are using key-vault for storing the secrets, will it give any added advantage if we encrypt the values before storing it in key-vault?
3
votes
3answers
276 views
Should a password generator validate its output against a dictionary?
If I were to design a password generator, is it best to leave it truly random or validate its output to avoid certain passwords?
For example if my password generator was truly random, it's possible ...
1
vote
0answers
60 views
Apple Keychain Security Risk Assessment
What security measures has Apple taken to minimize security risk with respect to the Apple Keychain password manager?
I enjoy the capability of the password management across macOS and iOS devices, ...
6
votes
1answer
1k views
Can a user's Apple Keychain be opened on a different computer?
Apple uses a nice keychain. This is used by, for example, Google's Chrome browser.
Imagine a user copies all the keychain files.
Would that user be able to unlock the keychain, if they knew the ...
23
votes
3answers
14k views
Is Firefox Password Manager less secure than LastPass?
After installing the LastPass password manager, I am presented with a login dialog including the option to "Disable Insecure Firefox Password Manager".
(This option appears as long as the Firefox ...
1
vote
1answer
40 views
Having web client do requests with User's 3rd party API key?
I am trying to figure out the best way to do this. I have done some searching and all I have found is about storing API keys in a back end, nothing like my use-case where there is no back end.
...
2
votes
1answer
312 views
Opera browser: no master password?
I've recently moved from Firefox to Opera (for performance issues).
I used to protect my passwords in Firefox with a Master Password. But Opera, so it appears, lacks such feature.
I use Debian 9.7 ...
2
votes
1answer
106 views
Does knowledge of one or more passwords from my password manager help an attacker crack the master password?
I use a keepass password manager with a master password of more than 100 bits. I keep the password file in cloud storage. If an attacker has my password file, it should be difficult for them to ...
0
votes
1answer
50 views
DB Service accounts: is it possible to avoid storing a password somewhere
Is it possible to avoid having to store DB passwords applications/service accounts needing access to the DB? I would like to avoid the risk of a system admin obtaining the password and then accessing ...
31
votes
12answers
12k views
How do I check that users don't write down their passwords?
I have a password policy which states that users must not write and store their passwords down in plaintext. How can I ensure that they haven't done so by writing their password in emails, scripts, ...
-1
votes
1answer
119 views
Virgin air-gapped devices and password management [closed]
For password management:
"Practical" means it works in practice, and "secure" means protected against compromise and actually works. How do we get the highest P + S value?
I am convinced that all ...
