Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

78 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
189 views

How to safely store the most recently used encryption password for subsequent reuse in an app?

Let's say I have a mobile app that can save photos inside password-protected AES-128 encrypted PDF files. For convenience, I want the user to be able to encrypt a file using the previously-used ...
4
votes
0answers
142 views

Is asking the e-banking username/password from a 3rd party site compliant with 3dsecure and PSD2?

Recently I tried to make an online purchase in one of the biggest e-commerce sites in Greece. During checkout, and after providing debit card details, it asked me to provide the username/password (not ...
4
votes
0answers
168 views

How vulnerable are password managers in the real world?

I'm a senior undergraduate majoring in computer science. I recently took a computer security class where instead of exams we had a final project that could be anything related to computer security. So ...
4
votes
0answers
272 views

How to do client + server side hashing?

I don't want the password to be sent in clear text over the internet, even when using HTTPS the server admin can read the password if they somehow cache or log post requests. Now, what I have come ...
3
votes
0answers
96 views

Can Chrome extensions access other Chrome extensions' data?

Can the data in a password-manager Chrome extension be accessed by a different Chrome extension? For example, if one were to install a malicious extension, could that extension access the data (i.e., ...
3
votes
0answers
635 views

How secure is pass compared to Keepass?

Is pass a real alternative to Keepass in terms of security? While Keepass has its own built-in encryption, pass relies on GPG to secure your passwords. GPG is obviously recognized as providing ...
3
votes
0answers
137 views

Mechanisms of built-in password managers in browser

I am researching for auto-fill mechanisms in built-in web-browsers password managers. Using windows hosts file i am redirecting browser query to my web-server where i am storing the full copy of ...
2
votes
1answer
166 views

Dangers of using the web applications provided by password managers

The password manager bitwarden requires the user to log in to their account on their web site to allow them to enable 2FA, import passwords and manage other account related details, as that ...
2
votes
2answers
182 views

Password for embedded devices in automatic deployment

We are working with commercial embedded devices, where we install our software. Then, they are deployed in different client sites. The embedded devices have an Ethernet port and a console port for ...
2
votes
1answer
1k views

Bitwarden and gamecontrollerd on OsX Big Sur

Recently, I came across an issue concerning a daemon named gamecontrollerd in OsX Big Sur. On my laptop I'm running ReiKey (from Objective-See), which aims at identifying possible Key Loggers that ...
2
votes
0answers
242 views

Is storing an encrypted 2FA backup on Bitwarden (a password manager) a good idea?

I am at the moment using Bitwarden and a separate 2FA app. I am trying to figure out a way to be able to securely recover my access to credentials and 2FA in case my phone/laptop/other electronic ...
2
votes
0answers
162 views

Is it possible to use Argon2id hashes with PAM?

I was wondering if it's possible to implement more secure KDF like bcrypt, scrypt, pbkdf2 and argon2id in PAM authentication. Ideally I would like to have their hashes instead of SHA-512 ones directly ...
2
votes
0answers
87 views

How do biometric password managers work?

Many password managers for mobile offer the option to unlock the password vault with a fingerprint instead of a password. If you never type in your master password, how is it possible to decrypt the ...
2
votes
0answers
213 views

Is using AES secure for password managers?

I'm developing an application that automates processes. The user connects to many accounts that the application uses then passwords are encrypted using AES. An example algorithm looks like this: ...
2
votes
0answers
400 views

For cloud-based password managers, is it safe to login using public WiFi?

For cloud-based password managers, is it safe to login when using public WiFi? To help get good answers to this question, let's define 3 terms: Cloud-based password managers = Password managers such ...
2
votes
0answers
81 views

Sharing individually encrypted elements between users of a system

I'm creating a file sharing system, in which the unique key of a file is one of the critical components to the retrieval of that file. For simplicity, lets say the unique keys are the file names. I'd ...
2
votes
0answers
123 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
2
votes
0answers
192 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
2
votes
0answers
154 views

Web app crypto scheme

For learning purposes I am trying to build a web application (Symfony2, PHP) that allows users to post content and have their own password vault, everything encrypted. Since I want to users to be able ...
2
votes
0answers
76 views

Syncing service passwords during offline installations

Due to very paranoid customer requirements, we have to install several Windows services on two different systems that should run under a shared service account. Each system should each have a copy of ...
2
votes
0answers
524 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
0answers
54 views

Constraints on the password imposed by m209 on first password management

I was going through the paper Password Security: A Case History By Robert Morris and Ken Thompson on authentication. It has been mentioned in the First Scheme that the first encryption used m209, in ...
1
vote
0answers
84 views

I need to secure my access to SQL Server for application accounts, but no one can know the application passwords. How?

Here's our scenario. I have a NodeJS server running that connects to a Microsoft SQL Server using an application account (SQL Basic Auth). The Username and Password were stored in the configuration ...
1
vote
2answers
252 views

Safe or Unsafe to Store Passwords in Chrome on MacOS?

I've seen conflicting opinions on this, more than the below, but i.e. Unsafe: https://www.techrepublic.com/article/why-you-should-never-allow-your-web-browser-to-save-your-passwords/ Safe: https://...
1
vote
1answer
235 views

How bad is it to store credentials in clear text on disk and in memory?

Yeah, it depends. A good answer would provide some reflections on this. I have two concrete scenarios in mind, in two concrete (and I believe common) contexts. Context 1. At home, you’re the only one ...
1
vote
0answers
97 views

How should I store a password used by a service written in .NET

I have a Windows service that accesses a database connection. Since users rarely use Windows authentication, I encrypt the connection string. For development I have the password hard-coded, but I know ...
1
vote
0answers
142 views

What are the security risks to NFC based YubiKeys?

What are the risks of using NFC on a YubiKey versus just a hard connector? I imagine it would be possible to sniff some data off of these security keys? How real is the risk of sniffing and what could ...
1
vote
0answers
399 views

Are Brave Browsers Sync encryption parameters secure enough?

I am considering switching over to Brave and maybe also use it's sync feature for settings, and maybe even passwords if it's good enough. I do use a password generator but out of laziness I happen to ...
1
vote
0answers
237 views

Securing BIP39 Phrases and Password Manager Master Password

I am looking for a review of the solution to store my Ledger Nano S BIP39 recovery phrase as well as my password manager usage. This solution is mostly based on this video. Few points that I think ...
1
vote
0answers
168 views

Is there a way to create a fake password on Linux that would trigger a specific action?

Think of the worst possibility: Someone has your laptop and you are being coerced into giving them your password. Can my Linux (I'm thinking of Arch) system be configured in a way that when a specific ...
1
vote
2answers
216 views

Security of master password in a derived password manager

I am aware of other questions asking similar things as this one, but I believe this design addresses many of the issues raised in those questions. I'm also not concerned with making sure there's no ...
1
vote
0answers
257 views

Does a shared (but encrypted) private key for a group of users reduce the effectiveness of the encryption?

That is, is it generally considered more secure to save a single application-wide private key on the web server compared to storing (protected/encrypted) private keys in the database? More ...
1
vote
0answers
108 views

Store passwords local with plain text access on WinPE

I have an application that needs to store Network Credentials for a Network Drive/Share on the disk. The user shouldn't need to enter the password every time. The OS is WinPE, so he cannot map the ...
1
vote
0answers
90 views

Security of the native Password Autofill function in iOS 12

I have read Apple documents on the iOS 12 password autofill function for iPhones. But I could not find much information pertaining to where the passwords are stored and what vulnerabilities might ...
1
vote
0answers
126 views

Apple Keychain Security Risk Assessment

What security measures has Apple taken to minimize security risk with respect to the Apple Keychain password manager? I enjoy the capability of the password management across macOS and iOS devices, ...
1
vote
0answers
166 views

Why is unistd's getpass unsafe?

While reading about how to properly ask a user for a password in CLIs, this SO answer and this SSE answer recommend the usage of unistd's getpass. However, this function is being documented as ...
1
vote
0answers
74 views

Are character passwords on my iPad needed?

I have a 20 character password on my iPad. I've been wondering, do I REALLY need it to be that long? Should I switch to a 6 or even 4 digit numeral password? Or should I just shorten my password? ...
1
vote
0answers
259 views

How to store credentials using JKS

Suppose a security team specifies that credentials for an application (specifically, a database username/password) should be stored in a JKS whose password is provided to the application in a local ...
1
vote
0answers
1k views

What are KeePassXC Encryption Settings?

I'd like to know what is an extremely secure configuration with the given options for KeePassXC database: Encryption Algorithm: AES 256, Twofish 256, ChaCha20 256 Key Derivation Function: Argon2, AES-...
1
vote
0answers
79 views

Is creating a derived password safe?

I need to store really sensitive data in a client-hosted database. Since there's no way I can protect this database (because I don't own it), my idea was to encrypt it by using the user's password, so ...
1
vote
1answer
238 views

Delete saved login credentials username and password

Scenario: Alice uses my website on her own computer and sometimes also on a computer that Mallory also has access to. Alice likes using the password manager built in to the browser. She is aware that ...
1
vote
0answers
292 views

Keep email password secure for Node JS automatic email system

I have a Node JS app running on a cloud server. Part of the app requires validating users' emails, and this validation is done in the standard way: send email to user, user presses link, update ...
1
vote
0answers
127 views

Offline password storage

One day I got really ambitious (or paranoid) and decided I could manage my own website passwords, as opposed to having Chrome to do it for me. My "solution" isn't very user friendly, and I'm back to ...
1
vote
0answers
466 views

Weighing options for personal HSM?

I'm trying to weigh my options for a personal HSM. I wish to store both passwords and private PGP keys. I've been doing my research but I'm not a security expert and am feeling slightly overwhelmed; ...
1
vote
0answers
282 views

What can/should I do about gross lack of IT security at another company?

I used to login into a certain website a couple of years ago. Recently I've got an email suggesting that I should renew my membership, and that email included my old password. That's right, my old ...
1
vote
0answers
926 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
1
vote
0answers
172 views

Store 2-legged one-time password's key securely

I have a system with a OTP authentication and I need a method to encrypt the main "secret algorithm". In my system each OTP has a pair named "solution" and it is also changing like the OTP. I need to ...
1
vote
0answers
125 views

Is there an extension/command line for OSX Chromium to save website passwords in LOCALSTORAGE instead of the system's keychain?

My situation: I want to use a portable-app implementation of Chromium running on a removable drive, so I never leave any passwords stored on the kaychain of any computer I use. Portable Chromium is ...
0
votes
0answers
5 views

Secure method of creating sudoer password through cloud-init

We have automated a lot of things for server startup via cloud-config, and I want confirmation about whether there is any security concern in the following. users: - name: myuser groups: sudo ...
0
votes
0answers
32 views

Google Password I didn't create

I opened Google, and a popup occurred briefly before I reflexively closed it. I then realized it had said something about a new password saved to the Google Password Manager, I think - which is weird,...