Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

100 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5 votes
0 answers
657 views

Can Chrome extensions access other Chrome extensions' data?

Can the data in a password-manager Chrome extension be accessed by a different Chrome extension? For example, if one were to install a malicious extension, could that extension access the data (i.e., ...
Andrew's user avatar
  • 51
5 votes
0 answers
223 views

How to safely store the most recently used encryption password for subsequent reuse in an app?

Let's say I have a mobile app that can save photos inside password-protected AES-128 encrypted PDF files. For convenience, I want the user to be able to encrypt a file using the previously-used ...
samgak's user avatar
  • 2,068
4 votes
0 answers
239 views

How does Google Chrome's "Warn you if passwords are exposed in a data breach" feature work?

This feature is enabled by default. It says the usernames and passwords would be encrypted before sending to google. But google would know the encryption keys it used and to compare it with leaked ...
eee's user avatar
  • 41
4 votes
1 answer
348 views

Dangers of using the web applications provided by password managers

The password manager bitwarden requires the user to log in to their account on their web site to allow them to enable 2FA, import passwords and manage other account related details, as that ...
Facundo's user avatar
  • 71
4 votes
0 answers
182 views

Is asking the e-banking username/password from a 3rd party site compliant with 3dsecure and PSD2?

Recently I tried to make an online purchase in one of the biggest e-commerce sites in Greece. During checkout, and after providing debit card details, it asked me to provide the username/password (not ...
Jannis Ioannou's user avatar
4 votes
0 answers
1k views

How secure is pass compared to Keepass?

Is pass a real alternative to Keepass in terms of security? While Keepass has its own built-in encryption, pass relies on GPG to secure your passwords. GPG is obviously recognized as providing ...
Artimithe55's user avatar
4 votes
0 answers
208 views

How vulnerable are password managers in the real world?

I'm a senior undergraduate majoring in computer science. I recently took a computer security class where instead of exams we had a final project that could be anything related to computer security. So ...
martinpetrov1568's user avatar
4 votes
0 answers
496 views

How to do client + server side hashing?

I don't want the password to be sent in clear text over the internet, even when using HTTPS the server admin can read the password if they somehow cache or log post requests. Now, what I have come ...
noob-cryptor's user avatar
3 votes
0 answers
1k views

How to Securely Store Database Password in Java .properties File

I would like to store my DB password in Java .property file and encrypt it using Jasypt. But from what I see, it just moves the problem from hiding the DB Password to hiding the encryption password. I ...
Waristea's user avatar
3 votes
2 answers
544 views

Password for embedded devices in automatic deployment

We are working with commercial embedded devices, where we install our software. Then, they are deployed in different client sites. The embedded devices have an Ethernet port and a console port for ...
fa__'s user avatar
  • 131
3 votes
0 answers
163 views

Mechanisms of built-in password managers in browser

I am researching for auto-fill mechanisms in built-in web-browsers password managers. Using windows hosts file i am redirecting browser query to my web-server where i am storing the full copy of ...
Giuseppe Baldinini's user avatar
2 votes
0 answers
335 views

Storing app specific PINs on mobile devices for local authentication

Are there any best practices for storing app specific PINs (e.g. 6 digit PIN that isn't part of the device lock screen) on mobile devices (Android/iOS)? I know several banking and authenticator apps ...
user1118764's user avatar
2 votes
2 answers
574 views

How Google protects and syncs the passwords?

I read this post but I want to know more details. I know that Google uses a Windows' function called CryptProtectData to encrypt user passwords on Windows and Google only stores the encrypted forms of ...
John's user avatar
  • 21
2 votes
0 answers
418 views

What are the security risks to NFC based YubiKeys?

What are the risks of using NFC on a YubiKey versus just a hard connector? I imagine it would be possible to sniff some data off of these security keys? How real is the risk of sniffing and what could ...
Adam Thompson's user avatar
2 votes
1 answer
1k views

Bitwarden and gamecontrollerd on OsX Big Sur

Recently, I came across an issue concerning a daemon named gamecontrollerd in OsX Big Sur. On my laptop I'm running ReiKey (from Objective-See), which aims at identifying possible Key Loggers that ...
FancyPants's user avatar
2 votes
2 answers
393 views

Security of master password in a derived password manager

I am aware of other questions asking similar things as this one, but I believe this design addresses many of the issues raised in those questions. I'm also not concerned with making sure there's no ...
JamesH's user avatar
  • 21
2 votes
0 answers
393 views

Is storing an encrypted 2FA backup on Bitwarden (a password manager) a good idea?

I am at the moment using Bitwarden and a separate 2FA app. I am trying to figure out a way to be able to securely recover my access to credentials and 2FA in case my phone/laptop/other electronic ...
netsec_newbie's user avatar
2 votes
0 answers
400 views

Is it possible to use Argon2id hashes with PAM?

I was wondering if it's possible to implement more secure KDF like bcrypt, scrypt, pbkdf2 and argon2id in PAM authentication. Ideally I would like to have their hashes instead of SHA-512 ones directly ...
Polizi8's user avatar
  • 163
2 votes
0 answers
120 views

How do biometric password managers work?

Many password managers for mobile offer the option to unlock the password vault with a fingerprint instead of a password. If you never type in your master password, how is it possible to decrypt the ...
jan's user avatar
  • 503
2 votes
0 answers
246 views

Is using AES secure for password managers?

I'm developing an application that automates processes. The user connects to many accounts that the application uses then passwords are encrypted using AES. An example algorithm looks like this: ...
Aleksander Niedźwiedź's user avatar
2 votes
0 answers
589 views

For cloud-based password managers, is it safe to login using public WiFi?

For cloud-based password managers, is it safe to login when using public WiFi? To help get good answers to this question, let's define 3 terms: Cloud-based password managers = Password managers such ...
End Anti-Semitic Hate's user avatar
2 votes
0 answers
569 views

How to store credentials using JKS

Suppose a security team specifies that credentials for an application (specifically, a database username/password) should be stored in a JKS whose password is provided to the application in a local ...
Bohemian's user avatar
  • 121
2 votes
0 answers
3k views

What are KeePassXC Encryption Settings?

I'd like to know what is an extremely secure configuration with the given options for KeePassXC database: Encryption Algorithm: AES 256, Twofish 256, ChaCha20 256 Key Derivation Function: Argon2, AES-...
KeePassXCFan's user avatar
2 votes
0 answers
111 views

Sharing individually encrypted elements between users of a system

I'm creating a file sharing system, in which the unique key of a file is one of the critical components to the retrieval of that file. For simplicity, lets say the unique keys are the file names. I'd ...
David Goldbarsht's user avatar
2 votes
0 answers
153 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
makerofthings7's user avatar
2 votes
0 answers
217 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
JinPangPang's user avatar
  • 1,951
2 votes
0 answers
181 views

Web app crypto scheme

For learning purposes I am trying to build a web application (Symfony2, PHP) that allows users to post content and have their own password vault, everything encrypted. Since I want to users to be able ...
Grimmjow's user avatar
  • 666
2 votes
0 answers
97 views

Syncing service passwords during offline installations

Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of ...
UtopiaLtd's user avatar
  • 121
2 votes
0 answers
554 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
shesek's user avatar
  • 121
1 vote
1 answer
105 views

Secure Offline Login and Data Encryption with PBKDF2 and AES-256

I'm working on a project that requires offline functionality, including offline login and secure data manipulation. I'd appreciate feedback on my chosen approach and best practices for secure design. ...
almog bar-el's user avatar
1 vote
0 answers
97 views

Local development credential manager and best practices

I've long since been storing credentials to databases and services in local configuration files during development. Sometimes these need to be to production systems, which makes this a security issue. ...
John's user avatar
  • 149
1 vote
1 answer
115 views

Is there any benefit to use different salt for different encryption algorithms for same user

There is two different passwords for a single user. I'm hashing both for future validation. I'm currently using a single unique salt for the user, but each is hashed with a different algorithms (...
user526498's user avatar
1 vote
0 answers
82 views

How could the contents of multiple LastPass vaults be compromised?

According to this newly published article: Now, it appears that the LastPass hack has led cybercriminals to steal over $35 million in cryptocurrencies. ... Nick Bax, director of analytics at ...
End Anti-Semitic Hate's user avatar
1 vote
0 answers
118 views

Is it bad practice to store passwords in a JWE? If so, why?

First of all, I know that passwords generally do not have to be stored in a JWT or JWS since the token in itself can be used to authenticate. My circumstances are very specific though. In my program, ...
JoffLobster's user avatar
1 vote
0 answers
114 views

Recovering Lost Brave Browser Usernames and Passwords

I recently changed my password for my local Windows 10 account and found out that my usernames/passwords in Brave's password manager are no longer visible. Unfortunately, I executed Brave after the ...
arn's user avatar
  • 11
1 vote
1 answer
390 views

Is a leaked encrypted password more secure than a leaked hash?

Encryption tech is obviously intended to secure things that we want to be private over an insecure medium. When I log into a site for example, my password is transmitted over HTTPS, hashed by the ...
joshperry's user avatar
  • 381
1 vote
0 answers
179 views

How do password manager developers protect their app store accounts?

Basically every password manager (like LastPass, 1Password, ...) has its Android & iOS app and browser extensions for Chrome, Safari, Firefox etc., to automatically fill in usernames and passwords....
David Scherfgen's user avatar
1 vote
0 answers
281 views

Does having authenticator app/OTP generator built into Password Manager defeat its purpose?

For example the KeepassOTP plugin is one of a few plugins for Keepass, that allows users to view their OTP code from within the password manager itself. Does this defeat the purpose of having a OTP as ...
northerner's user avatar
1 vote
0 answers
190 views

Amnesia and death proof master password

I have been thinking about how to store my master passwords (password manager, email and device passwords) for quite a while and I just haven't been able to come up with a satisfying solution yet. I ...
Americat's user avatar
1 vote
3 answers
217 views

Creating Password from 2 different part

I’m looking for Term Or Some platform for managing Password Authentication with this way : Password construct from 2 Part , First one is static and you can make it and second Part Generate From TOTP ...
learner's user avatar
  • 11
1 vote
0 answers
398 views

Using pass cli for background (cron) jobs securely

Q: how to securely use pass tool to for scheduled jobs? One of the tools to store and manage passwords on a unix machine is pass, which is a layer on top of gpg. Any password that I create is ...
Husain's user avatar
  • 11
1 vote
0 answers
94 views

Constraints on the password imposed by m209 on first password management

I was going through the paper Password Security: A Case History By Robert Morris and Ken Thompson on authentication. It has been mentioned in the First Scheme that the first encryption used m209, in ...
Kannan Ramamoorthy's user avatar
1 vote
0 answers
123 views

I need to secure my access to SQL Server for application accounts, but no one can know the application passwords. How?

Here's our scenario. I have a NodeJS server running that connects to a Microsoft SQL Server using an application account (SQL Basic Auth). The Username and Password were stored in the configuration ...
SpaceCowboy74's user avatar
1 vote
0 answers
393 views

How should I store a password used by a service written in .NET

I have a Windows service that accesses a database connection. Since users rarely use Windows authentication, I encrypt the connection string. For development I have the password hard-coded, but I know ...
Tim's user avatar
  • 11
1 vote
0 answers
698 views

Are Brave Browsers Sync encryption parameters secure enough?

I am considering switching over to Brave and maybe also use it's sync feature for settings, and maybe even passwords if it's good enough. I do use a password generator but out of laziness I happen to ...
jaaq's user avatar
  • 125
1 vote
0 answers
373 views

Securing BIP39 Phrases and Password Manager Master Password

I am looking for a review of the solution to store my Ledger Nano S BIP39 recovery phrase as well as my password manager usage. This solution is mostly based on this video. Few points that I think ...
Andrey's user avatar
  • 111
1 vote
0 answers
348 views

Is there a way to create a fake password on Linux that would trigger a specific action?

Think of the worst possibility: Someone has your laptop and you are being coerced into giving them your password. Can my Linux (I'm thinking of Arch) system be configured in a way that when a specific ...
yyyyyyyan's user avatar
  • 111
1 vote
0 answers
235 views

How is Firefox importing credentials from other browsers without the need for the admin password?

Im currently looking into the security of different browser password storing mechanisms. My main focus lies on the new Chromium based Microsoft Edge browser. As far as I can see, Chromium based ...
Senkaku's user avatar
  • 113
1 vote
0 answers
158 views

Dedicated device for online investing and other security measures

I like to invest money online. I invest in both cryptocurrencies as well as regular stocks. As my bankroll grows (let's say 20k+ in the near future), I feel like I need to start taking more serious ...
Philip Sherpa's user avatar
1 vote
0 answers
389 views

Auto fill with bitwarden security question?

Hi guys, I just started using bitwarden as a password manager and stumbled across a very confusing feature... When I enable the password autofill feature (I know it's called auto fill..but still...) ...
Oliver's user avatar
  • 35