Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
1,298
questions
0
votes
2
answers
183
views
Whats the difference between secret and password managers?
Are there fundamental underlying differences in how secrets and passwords should be managed?
I'm curious of the technical/cryptographic differences between secret managers and password managers are. ...
CommunityBot
- 1
5
votes
3
answers
254
views
Using Proof of Work to slow down login attempts
For a while I've been pondering a user authentication protocol that aims to ensure that a client does some computational work before the server will attempt to authenticate the password.
The reason ...
1
vote
1
answer
89
views
What are the risks of reusing the same passphrase for FDE, user account, and password manager?
Consider a home user who runs Linux on a laptop with full-disk encryption and uses a cloud-based password manager. Assume the laptop is firewall-protected with no SSH access. It seems reasonable to ...
- 18.5k
1
vote
0
answers
28
views
How can I reduce the number of passphrases that I must memorize (password manager, FDE, user accounts)? [closed]
I'm attempting to reduce the number of passphrases that I must memorize. Currently I need a different passphrase for each of:
Password manager
FDE for my personal computer
User account for my ...
- 127k
2
votes
1
answer
1k
views
Bitwarden and gamecontrollerd on OsX Big Sur
Recently, I came across an issue concerning a daemon named gamecontrollerd in OsX Big Sur.
On my laptop I'm running ReiKey (from Objective-See), which aims at identifying possible Key Loggers that ...
CommunityBot
- 1
0
votes
1
answer
556
views
`pass` not asking for password anymore - gnome-keyring or gpg-agent related? How can I force password asking?
I cross-posted this on the manjaro forums and on server fault. So far no answer, so trying here.
I have gnome-keyring running for sure, not sure it's gnome-keyring or gpg-agent or ssh-agent related......
CommunityBot
- 1
1
vote
3
answers
228
views
Password managing apps seem to have access to my passwords
Keeper used to be free so I had stored most of passwords on that app a few years ago from a past device. When I tried to access the passwords after five years, the app had turned into a subscription ...
- 10.6k
0
votes
1
answer
243
views
How to change the password hashing scheme in LDAP using an external library with slapd.d config
I am trying to change the password hashing scheme for LDAP. Hypothetically, let's assume it's pw-argon.so
I don't have slapd.conf I have the slapd.d directory where I can make changes dynamically to ...
CommunityBot
- 1
0
votes
2
answers
166
views
Storing backup keys (2FA) for online accounts
So I spent the day looking for a good solution of storing the backup keys or the 2FA codes and can't seem to find a convenient way for me, many people have different takes on this, so far I found 2 ...
CommunityBot
- 1
1
vote
3
answers
96
views
Creating Password from 2 different part
I’m looking for Term Or Some platform for managing Password Authentication with this way :
Password construct from 2 Part ,
First one is static and you can make it and second Part Generate From TOTP ...
CommunityBot
- 1
0
votes
0
answers
49
views
Sending secret API Keys via email
I'm a customer of a big KYC provider and am using their API. The process to authenticate at the API requires a secret key that they are sending to me by email. If I want to revoke the key and get a ...
- 133
1
vote
1
answer
1k
views
What can I do to improve my Keepass XC setup?
I'm planning on using KeePass XC for the first time and am trying to create a setup that:
(1) would prevent hackers from stealing my passwords
(2) would prevent me from losing access to my ...
CommunityBot
- 1
14
votes
2
answers
4k
views
Reasoning behind banning '#' from the start of passwords? [duplicate]
Today, on an official government website, I came across the following password rules:
"Your password has to be at least 8 characters long. It can't have any blank spaces. It has to use characters ...
- 101
0
votes
1
answer
358
views
iCloud Security Concern: browser session authentication storage after 2-factor?
Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie?
My concern is, if ...
CommunityBot
- 1
1
vote
0
answers
32
views
How should an argon2 hash be stored? [duplicate]
Given the following argon2 hash
$argon2id$v=19$m=65536,t=32,p=8$mJmKA5qamzXOPJZYw4wCEUKY$COkMH0RckaZ/3bhYCdCQjLuzoLKxcAmk4TzmHRRgTQ8
How should the hash be stored in a database? From the answers of ...
- 11
2
votes
1
answer
259
views
Dangers of using the web applications provided by password managers
The password manager bitwarden requires the user to log in to their account on their web site to allow them to enable 2FA, import passwords and manage other account related details, as that ...
CommunityBot
- 1
3
votes
2
answers
371
views
Password for embedded devices in automatic deployment
We are working with commercial embedded devices, where we install our software. Then, they are deployed in different client sites. The embedded devices have an Ethernet port and a console port for ...
CommunityBot
- 1
1
vote
2
answers
302
views
How Google protects and syncs the passwords?
I read this post but I want to know more details. I know that Google uses a Windows' function called CryptProtectData to encrypt user passwords on Windows and Google only stores the encrypted forms of ...
CommunityBot
- 1
0
votes
2
answers
83
views
How to reuse PIN codes in the most secure way?
I've made a list of the services/devices that require a PIN code. Shockingly, it's over 10, which I find impossible to remember, so I need a strategy to reuse the codes.
What could be a strategy for ...
0
votes
0
answers
156
views
Google Password I didn't create
I opened Google, and a popup occurred briefly before I reflexively closed it. I then realized it had said something about a new password saved to the Google Password Manager, I think - which is weird,...
- 1
1
vote
1
answer
272
views
Delete saved login credentials username and password
Scenario:
Alice uses my website on her own computer and sometimes also on a computer that Mallory also has access to. Alice likes using the password manager built in to the browser. She is aware that ...
CommunityBot
- 1
30
votes
4
answers
8k
views
Security of LastPass together with YubiKey
I'm looking at password manager solutions and came across LastPass. I see that they also support two-factor authentication using YubiKeys. How secure is this combination for password management? What ...
- 127k
1
vote
1
answer
98
views
SCrypt's goal and the role its salt plays
Am I right in stating that SCrypt as an algorithm is useful where many passwords are stored in a database, but not against one specific encryption key derived from one password of one user?
For ...
CommunityBot
- 1
0
votes
0
answers
29
views
What is the best way to protect passwords? [duplicate]
I noticed that I don't use many different passwords for all my stuff, which is very insecure. However, it is also difficult to remember really secure, long passwords which are different for every ...
- 127k
0
votes
2
answers
166
views
Dealing with password vault recovery after a catastrophic failure as a home user
I had a dinner with some friends today, and I mentioned that I use 1Password combined with Dropbox to manage my password. One of them then remarked something which I actually hadn't considered: ...
CommunityBot
- 1
3
votes
2
answers
6k
views
Make password using special characters
Is it a great idea to make passwords with special characters from your language? (If you have it)
BTW it´s not allowed on every website.
Is it a way to make it a bit harder for hackers to crack your ...
- 127k
20
votes
3
answers
9k
views
Is it secure to store a two factor authentication seed in a password manager?
I wonder whether it is really secure to store the Two Factor Authentication seed code (e.g. the secret key for TOTP) within a password manager together with the user and password for the service.
If ...
- 3,947
0
votes
3
answers
224
views
Understanding Password Manager Chicken and Egg problem
I read that Password Managers are a more secure option than remembering passwords. I am currently evaluating Passwords Managers with cloud synchronization and there is something that really confused ...
- 6,460
2
votes
2
answers
303
views
Security of master password in a derived password manager
I am aware of other questions asking similar things as this one, but I believe this design addresses many of the issues raised in those questions. I'm also not concerned with making sure there's no ...
CommunityBot
- 1
54
votes
8
answers
6k
views
You're an IT consultant. Should you discourage a client from telling you their password?
I'm an IT consultant. One client has known me for a few years. He wants me to do some work on his kids' laptop again. I'll need to log into his kids' Windows user account. (I'm guessing that multiple ...
31
votes
3
answers
11k
views
Should I assign my various passwords to my keyboard's macro keys?
I had an idea to assign my keyboard's macro keys to various passwords so I can just hit the key and it will paste in (the passwords are long and random so I won't remember them). This is on a home ...
- 1
0
votes
2
answers
80
views
Digital legacy: safe to save password manager login info in Gmail draft?
Google accounts have a "Digital Legacy" feature, where accounts that go inactive for a long period (3 months, 6 months, etc.) and do not respond to alerts will eventually trigger Inactive ...
- 3,256
23
votes
2
answers
4k
views
Why is 1Password sign-in to new device secure without MFA?
I'm trying to understand why it's not necessary with MFA in 1Password when signing in to a new device.
This was the case that triggered my curiosity:
I created a 1Password account
I downloaded the ...
- 6,460
2
votes
1
answer
240
views
Is CVE-2023-24055 applicable to other password managers using the same format as the original KeePass?
CVE-2023-24055 is a known vulnerability that enables an attacker to recover plaintext user credentials from the KeePass application.
However, due to the original KeePass being Windows-specific, I've ...
- 1,061
24
votes
6
answers
5k
views
Does Rehashing a weak hash with a strong algorithm make it strong?
Imagine the following situation. We're making a web application which should be really safe
Now the accounts/users are not directly added by us but they receive a letter with a logincode. We get a ...
- 101
1
vote
2
answers
113
views
DNS hijacking/poisoning effect on URL/URI and password manager autotype/autofill
A benefit to password managers, at least some of them, is that they can look at the URL and only use autotype/autofill when on the correct site, which can help prevent pharming since if instead of ...
- 6,460
0
votes
1
answer
209
views
What threats can the use of a TPM by a password manager mitigate?
This question is about the use of a TPM by a password manager used by an end-user on a PC to store and use passwords to log in to web sites and other things that are protected only by a password.
...
- 6,501
98
votes
10
answers
32k
views
If a provider sees the last 4 characters of my password, can they see it in full?
I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
- 868
1
vote
0
answers
110
views
How do password manager developers protect their app store accounts?
Basically every password manager (like LastPass, 1Password, ...) has its Android & iOS app and browser extensions for Chrome, Safari, Firefox etc., to automatically fill in usernames and passwords....
- 127k
1
vote
3
answers
212
views
Why do I need to provide authentication when accessing a browser's built-in password manager?
Why do I have to provide authentication when I want to read a password stored in my own web browser while I have to do nothing to read the same password on a site's login page?
Is my conclusion ...
- 1,061
2
votes
1
answer
155
views
Why would garbage collection be a problem in password managers?
I was reading an infosec user's take on the LastPass data breach and noted something odd in his commentary on another password manager system (emphasis mine)
I have not done a thorough code review, ...
- 127k
5
votes
2
answers
871
views
How Are Google Chrome Synced Passwords Encrypted If I Can Reset the Password to My Account
Services like Dashlane and Bitwarden are unable to decrypt your passwords without your Master Password.
So, how does Chrome do it when they also state that your passwords are encrypted using your ...
- 136
0
votes
2
answers
148
views
Is it possible to design a system with two passwords?
Is it possible to design a system with two passwords prompts?
The system will have to prompt for two passwords
The system would have to validate first password before prompting for second password
...
0
votes
1
answer
72
views
My Bank Enforces A 6 Character Limit On Passwords. Is This Bad? [duplicate]
A bank I (previously) used in Australia forced users to comply with a 6-character limit on every password. Specifically, the rules were:
6 characters exactly, including at least 1 number and letter
...
- 1,559
51
votes
5
answers
6k
views
Should a bank be able to shorten your password without your involvement?
The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore.
He called his advisor, who ...
- 105
0
votes
0
answers
38
views
Benefit of only having MFA challenge on the very first login
I'm trying to select a suitable password store for a team - one of my main requirements is that users be authenticated via a removable key file rather than simply a master password.
I have been using ...
- 127k
3
votes
1
answer
627
views
How bad is it to store credentials in clear text on disk and in memory?
Yeah, it depends. A good answer would provide some reflections on this. I have two concrete scenarios in mind, in two concrete (and I believe common) contexts. Context 1. At home, you’re the only one ...
CommunityBot
- 1
52
votes
7
answers
14k
views
What are the cons of stateless password generators?
Does anybody have hands-on experience with stateless password generators (managers) like Getpass?
It seems like it does most of the work of cloud password managers, but leans more to the security ...
- 14.6k
3
votes
2
answers
152
views
How do I remember passwords for environments where Password Manager is not available?
I am a big fan of 1Password. And I try to save my passwords in 1Password as much as possible.
However, there are environments where 1Password cannot be used. That is the password to protect 1Password ...
- 1,559
33
votes
6
answers
16k
views
Is it safe to store account credentials in an Excel sheet protected with a password?
Basically the title. For example, how bad is it to store passwords in an Excel sheet protected with a password, instead of storing passwords in Keypass or something else like Zoho Vault? Of course, ...
- 13