Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

48 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
153 views

How to safely store the most recently used encryption password for subsequent reuse in an app?

Let's say I have a mobile app that can save photos inside password-protected AES-128 encrypted PDF files. For convenience, I want the user to be able to encrypt a file using the previously-used ...
4
votes
0answers
172 views

How to do client + server side hashing?

I don't want the password to be sent in clear text over the internet, even when using HTTPS the server admin can read the password if they somehow cache or log post requests. Now, what I have come ...
3
votes
0answers
155 views

Is BitWarden trusted?

I've been using BitWarden as my main password keeper, would like to ask if it's safe? I know that everything is not 100% safe but still want to know if they are worth it. All my passwords are ...
3
votes
1answer
439 views

password managers and FIDO

I've just been reading some posts about FIDO support (or the lack thereof) in password managers and want to check whether my understanding is correct. My understanding of FIDO (v1) is that the device ...
3
votes
0answers
102 views

Mechanisms of built-in password managers in browser

I am researching for auto-fill mechanisms in built-in web-browsers password managers. Using windows hosts file i am redirecting browser query to my web-server where i am storing the full copy of ...
2
votes
0answers
47 views

How do biometric password managers work?

Many password managers for mobile offer the option to unlock the password vault with a fingerprint instead of a password. If you never type in your master password, how is it possible to decrypt the ...
2
votes
0answers
143 views

Is using AES secure for password managers?

I'm developing an application that automates processes. The user connects to many accounts that the application uses then passwords are encrypted using AES. An example algorithm looks like this: ...
2
votes
0answers
242 views

For cloud-based password managers, is it safe to login using public WiFi?

For cloud-based password managers, is it safe to login when using public WiFi? To help get good answers to this question, let's define 3 terms: Cloud-based password managers = Password managers such ...
2
votes
1answer
86 views

What advantages do Secret Managers offer in terms of authentication [API usage]?

The problem I am seeing with secret managers (programs which serve as a store of secrets for other programs/APIs) is that at some level, a key or credentials must still be provided programmatically, ...
2
votes
0answers
90 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
2
votes
0answers
157 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
2
votes
0answers
116 views

Web app crypto scheme

For learning purposes I am trying to build a web application (Symfony2, PHP) that allows users to post content and have their own password vault, everything encrypted. Since I want to users to be able ...
2
votes
0answers
40 views

Syncing service passwords during offline installations

Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of ...
2
votes
0answers
475 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
0answers
40 views

Does a shared (but encrypted) private key for a group of users reduce the effectiveness of the encryption?

That is, is it generally considered more secure to save a single application-wide private key on the web server compared to storing (protected/encrypted) private keys in the database? More ...
1
vote
0answers
50 views

Store passwords local with plain text access on WinPE

I have an application that needs to store Network Credentials for a Network Drive/Share on the disk. The user shouldn't need to enter the password every time. The OS is WinPE, so he cannot map the ...
1
vote
0answers
45 views

Security of the native Password Autofill function in iOS 12

I have read Apple documents on the iOS 12 password autofill function for iPhones. But I could not find much information pertaining to where the passwords are stored and what vulnerabilities might ...
1
vote
0answers
70 views

Apple Keychain Security Risk Assessment

What security measures has Apple taken to minimize security risk with respect to the Apple Keychain password manager? I enjoy the capability of the password management across macOS and iOS devices, ...
1
vote
0answers
61 views

Why is unistd's getpass unsafe?

While reading about how to properly ask a user for a password in CLIs, this SO answer and this SSE answer recommend the usage of unistd's getpass. However, this function is being documented as ...
1
vote
0answers
45 views

Are character passwords on my iPad needed?

I have a 20 character password on my iPad. I've been wondering, do I REALLY need it to be that long? Should I switch to a 6 or even 4 digit numeral password? Or should I just shorten my password? ...
1
vote
0answers
97 views

How to store credentials using JKS

Suppose a security team specifies that credentials for an application (specifically, a database username/password) should be stored in a JKS whose password is provided to the application in a local ...
1
vote
0answers
480 views

What are KeePassXC Encryption Settings?

I'd like to know what is an extremely secure configuration with the given options for KeePassXC database: Encryption Algorithm: AES 256, Twofish 256, ChaCha20 256 Key Derivation Function: Argon2, AES-...
1
vote
0answers
39 views

Sharing individually encrypted elements between users of a system

I'm creating a file sharing system, in which the unique key of a file is one of the critical components to the retrieval of that file. For simplicity, lets say the unique keys are the file names. I'd ...
1
vote
1answer
369 views

System Encryption With Veracrypt/Truecrypt- What is the difference between Wipe Mode “None” and 3 pass, 1 pass etc?

First I wanted to make sure we're talking about using a Non-SSD Hard drive. I know SSD drives work differently. Here would be a good reference/guide on system encryption: https://www.howtogeek.com/...
1
vote
0answers
48 views

Is creating a derived password safe?

I need to store really sensitive data in a client-hosted database. Since there's no way I can protect this database (because I don't own it), my idea was to encrypt it by using the user's password, so ...
1
vote
1answer
153 views

Delete saved login credentials username and password

Scenario: Alice uses my website on her own computer and sometimes also on a computer that Mallory also has access to. Alice likes using the password manager built in to the browser. She is aware that ...
1
vote
0answers
163 views

Keep email password secure for Node JS automatic email system

I have a Node JS app running on a cloud server. Part of the app requires validating users' emails, and this validation is done in the standard way: send email to user, user presses link, update ...
1
vote
0answers
86 views

Offline password storage

One day I got really ambitious (or paranoid) and decided I could manage my own website passwords, as opposed to having Chrome to do it for me. My "solution" isn't very user friendly, and I'm back to ...
1
vote
0answers
309 views

Weighing options for personal HSM?

I'm trying to weigh my options for a personal HSM. I wish to store both passwords and private PGP keys. I've been doing my research but I'm not a security expert and am feeling slightly overwhelmed; ...
1
vote
0answers
250 views

What can/should I do about gross lack of IT security at another company?

I used to login into a certain website a couple of years ago. Recently I've got an email suggesting that I should renew my membership, and that email included my old password. That's right, my old ...
1
vote
0answers
860 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
1
vote
0answers
141 views

Store 2-legged one-time password's key securely

I have a system with a OTP authentication and I need a method to encrypt the main "secret algorithm". In my system each OTP has a pair named "solution" and it is also changing like the OTP. I need to ...
1
vote
0answers
92 views

Is there an extension/command line for OSX Chromium to save website passwords in LOCALSTORAGE instead of the system's keychain?

My situation: I want to use a portable-app implementation of Chromium running on a removable drive, so I never leave any passwords stored on the kaychain of any computer I use. Portable Chromium is ...
0
votes
0answers
66 views

GPG — Synchronisation between machine and “No secret key” problem

I am running "pass: the standard unix password manager" v1.7.3 on Fedora 31. I create a password for "mysite" via $ pass generate mysite It creates an entry in my .password-store folder: mysite....
0
votes
0answers
35 views

Handing login information to the customer

We have a software system with several different users (let's say 10) and a single super user. A super user is a regular user with the privileges needed for managing other user accounts. This is a ...
0
votes
0answers
45 views

Storing the master password in a keychain

I tend to avoid putting my master keychain password in the keychain itself (in OSX, for example), but sometimes with federation of accounts and things, it would be convenient to do so. Am I right to ...
0
votes
0answers
35 views

SSLVPN client saving encrypted password in local xml file, is that secure?

Simply copy the specific xml file to another client's correspond path, I can login to the remote network automatically. If that is a vulnerability, what severity rate will you give to it? High, medium,...
0
votes
0answers
90 views

Browser passwords used on multiple domains?

I have 100 domains with authentication backed by the same LDAP database. There is a single-sign on, but it's not implemented with OAuth. That is to say, per user, each domain accepts the same user/...
0
votes
0answers
49 views

Authenticated scan strategy for large enterprise network

I have been tasked with using Qualys Vulnerability Scanner in order to perform scans within a large enterprise network. Within this network there are Windows machines and Linux machines. CyberArk has ...
0
votes
0answers
147 views

how good is “Chrome Password Checkup” extension for checking passwords?

From what I read so far Google "Chrome Password Checkup" extension (https://chrome.google.com/webstore/detail/password-checkup/pncabnpcffmalkkjpajodfhijclecjno) checking the password that you use for ...
0
votes
0answers
61 views

Saving all secret keys, access data in heroku environ instead of config file?

I have a python/flask app and I use heroku to host it. I use some additional services, such as stripe, postgresql or emails. All these services have either secret keys or other access data, which ...
0
votes
0answers
43 views

Why doesn't Cox encrypt my password?

Cox does not encrypt my WiFi password on my account page. So anyone working for Cox has access to my WiFi password. How can I secure my WiFi password?
0
votes
1answer
70 views

iCloud Security Concern: browser session authentication storage after 2-factor?

Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie? My concern is, if ...
0
votes
0answers
42 views

Credentials visible to ps (process analyzer)

I use the pass password manager on linux. I can use it to script shell commands that involve credentials without those creds showing up in my command-line history, e.g. foo-cli --password=$(pass show ...
0
votes
0answers
169 views

Secure password transfer from stdout to another window

I am currently trying to build a little, secure password manager. As of now, I've implemented the encryption. Each website has its own file and each file has a number of fields (Most commonly username ...
-1
votes
0answers
31 views

Logging into IOS applications Secure?

The IOS App Store has very high standards in regards to what goes on their App Store. Do applications like Gmail, Outlook, banking Apps, and LastPass send your password securely when logging into ...
-1
votes
1answer
135 views

What is optimal way to connect accounts to 2FA on phone?

I have Google Acc 0 (GAO) mostly for bank porpoises and some "official" services. This email basically "surname.name@google.com" and I put in my old C.V. and some other contact information. When I got ...
-2
votes
1answer
1k views

Storing SSH credentials, need to decrypt them later for connection by python script

I am developing an application where one can add SSH credentials for servers and then an automated python script can fetch those credentials to login to the server and perform certain automated tasks. ...