Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

4
votes
2answers
225 views

Forgot password best practice for mobile applications

There are known good practices for password reset functionality from OWASP and other resources. On the other hand, I believe most of us agree that security questions are not user friendly, they either ...
0
votes
2answers
64 views

Should I back up automatic strong passwords of iCloud?

I’ve recently started to use iCloud’s automatic strong passwords. I feel like that if iCloud were down for some reason, the passwords would be lost. Considering it, should I back them up on other ...
2
votes
1answer
130 views

Opera browser: no master password?

I've recently moved from Firefox to Opera (for performance issues). I used to protect my passwords in Firefox with a Master Password. But Opera, so it appears, lacks such feature. I use Debian 9.7 ...
2
votes
1answer
858 views

I want to deploy from GitLab to AWS - so where exactly do I store my private key?

This seems like an odd and simple question, but I'm trying to get my head around the principle of "never check a private key into version control". I'm trying to build a startup of sorts, where ...
1
vote
1answer
64 views

What advantages do Secret Managers offer in terms of authentication [API usage]?

The problem I am seeing with secret managers (programs which serve as a store of secrets for other programs/APIs) is that at some level, a key or credentials must still be provided programmatically, ...
1
vote
1answer
216 views

System Encryption With Veracrypt/Truecrypt- What is the difference between Wipe Mode “None” and 3 pass, 1 pass etc?

First I wanted to make sure we're talking about using a Non-SSD Hard drive. I know SSD drives work differently. Here would be a good reference/guide on system encryption: https://www.howtogeek.com/...
1
vote
1answer
125 views

Delete saved login credentials username and password

Scenario: Alice uses my website on her own computer and sometimes also on a computer that Mallory also has access to. Alice likes using the password manager built in to the browser. She is aware that ...
0
votes
1answer
43 views

iCloud Security Concern: browser session authentication storage after 2-factor?

Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie? My concern is, if ...
-1
votes
1answer
129 views

What is optimal way to connect accounts to 2FA on phone?

I have Google Acc 0 (GAO) mostly for bank porpoises and some "official" services. This email basically "surname.name@google.com" and I put in my old C.V. and some other contact information. When I got ...
-2
votes
1answer
858 views

Storing SSH credentials, need to decrypt them later for connection by python script

I am developing an application where one can add SSH credentials for servers and then an automated python script can fetch those credentials to login to the server and perform certain automated tasks. ...
4
votes
0answers
149 views

How to safely store the most recently used encryption password for subsequent reuse in an app?

Let's say I have a mobile app that can save photos inside password-protected AES-128 encrypted PDF files. For convenience, I want the user to be able to encrypt a file using the previously-used ...
3
votes
0answers
95 views

Mechanisms of built-in password managers in browser

I am researching for auto-fill mechanisms in built-in web-browsers password managers. Using windows hosts file i am redirecting browser query to my web-server where i am storing the full copy of ...
3
votes
0answers
90 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
2
votes
0answers
35 views

Is Privileged Access Management secured without regular Patch Update?

It is well know Privileged Access Management (PAM) is a solution that helps organizations restrict privileged access within an existing Active Directory environment. Many big company use it to address ...
2
votes
0answers
251 views

password managers and FIDO

I've just been reading some posts about FIDO support (or the lack thereof) in password managers and want to check whether my understanding is correct. My understanding of FIDO (v1) is that the device ...
2
votes
0answers
74 views

Is there a benefit to changing a password everytime it is used?

I have a script that connects to Azure Key Vault obtains credentials, and then uses those to login to Azure. These credentials are only ever used by the scripts, and Key Vault is the only repository ...
2
votes
0answers
155 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
2
votes
0answers
114 views

Web app crypto scheme

For learning purposes I am trying to build a web application (Symfony2, PHP) that allows users to post content and have their own password vault, everything encrypted. Since I want to users to be able ...
2
votes
0answers
40 views

Syncing service passwords during offline installations

Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of ...
2
votes
0answers
447 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
0answers
89 views

For cloud-based password managers, is it safe to login using public WiFi?

For cloud-based password managers, is it safe to login when using public WiFi? To help get good answers to this question, let's define 3 terms: Cloud-based password managers = Password managers such ...
1
vote
0answers
48 views

How to store credentials using JKS

Suppose a security team specifies that credentials for an application (specifically, a database username/password) should be stored in a JKS whose password is provided to the application in a local ...
1
vote
0answers
34 views

Sharing individually encrypted elements between users of a system

I'm creating a file sharing system, in which the unique key of a file is one of the critical components to the retrieval of that file. For simplicity, lets say the unique keys are the file names. I'd ...
1
vote
0answers
46 views

Is creating a derived password safe?

I need to store really sensitive data in a client-hosted database. Since there's no way I can protect this database (because I don't own it), my idea was to encrypt it by using the user's password, so ...
1
vote
0answers
138 views

Keep email password secure for Node JS automatic email system

I have a Node JS app running on a cloud server. Part of the app requires validating users' emails, and this validation is done in the standard way: send email to user, user presses link, update ...
1
vote
0answers
79 views

Offline password storage

One day I got really ambitious (or paranoid) and decided I could manage my own website passwords, as opposed to having Chrome to do it for me. My "solution" isn't very user friendly, and I'm back to ...
1
vote
0answers
248 views

Weighing options for personal HSM?

I'm trying to weigh my options for a personal HSM. I wish to store both passwords and private PGP keys. I've been doing my research but I'm not a security expert and am feeling slightly overwhelmed; ...
1
vote
0answers
231 views

What can/should I do about gross lack of IT security at another company?

I used to login into a certain website a couple of years ago. Recently I've got an email suggesting that I should renew my membership, and that email included my old password. That's right, my old ...
1
vote
0answers
764 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
1
vote
0answers
139 views

Store 2-legged one-time password's key securely

I have a system with a OTP authentication and I need a method to encrypt the main "secret algorithm". In my system each OTP has a pair named "solution" and it is also changing like the OTP. I need to ...
1
vote
0answers
92 views

Is there an extension/command line for OSX Chromium to save website passwords in LOCALSTORAGE instead of the system's keychain?

My situation: I want to use a portable-app implementation of Chromium running on a removable drive, so I never leave any passwords stored on the kaychain of any computer I use. Portable Chromium is ...
0
votes
0answers
27 views

SSLVPN client saving encrypted password in local xml file, is that secure?

Simply copy the specific xml file to another client's correspond path, I can login to the remote network automatically. If that is a vulnerability, what severity rate will you give to it? High, medium,...
0
votes
0answers
86 views

Browser passwords used on multiple domains?

I have 100 domains with authentication backed by the same LDAP database. There is a single-sign on, but it's not implemented with OAuth. That is to say, per user, each domain accepts the same user/...
0
votes
0answers
30 views

Authenticated scan strategy for large enterprise network

I have been tasked with using Qualys Vulnerability Scanner in order to perform scans within a large enterprise network. Within this network there are Windows machines and Linux machines. CyberArk has ...
0
votes
0answers
88 views

how good is “Chrome Password Checkup” extension for checking passwords?

From what I read so far Google "Chrome Password Checkup" extension (https://chrome.google.com/webstore/detail/password-checkup/pncabnpcffmalkkjpajodfhijclecjno) checking the password that you use for ...
0
votes
0answers
34 views

Saving all secret keys, access data in heroku environ instead of config file?

I have a python/flask app and I use heroku to host it. I use some additional services, such as stripe, postgresql or emails. All these services have either secret keys or other access data, which ...
0
votes
0answers
43 views

Why doesn't Cox encrypt my password?

Cox does not encrypt my WiFi password on my account page. So anyone working for Cox has access to my WiFi password. How can I secure my WiFi password?
0
votes
0answers
240 views

What are KeePassXC Encryption Settings?

I'd like to know what is an extremely secure configuration with the given options for KeePassXC database: Encryption Algorithm: AES 256, Twofish 256, ChaCha20 256 Key Derivation Function: Argon2, AES-...
0
votes
0answers
34 views

Credentials visible to ps (process analyzer)

I use the pass password manager on linux. I can use it to script shell commands that involve credentials without those creds showing up in my command-line history, e.g. foo-cli --password=$(pass show ...
0
votes
0answers
24 views

DB Service accounts: is it possible to avoid storing a password somewhere

Is it possible to avoid having to store DB passwords applications/service accounts needing access to the DB? I would like to avoid the risk of a system admin obtaining the password and then accessing ...
0
votes
0answers
161 views

Secure password transfer from stdout to another window

I am currently trying to build a little, secure password manager. As of now, I've implemented the encryption. Each website has its own file and each file has a number of fields (Most commonly username ...