Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

Filter by
Sorted by
Tagged with
1
vote
0answers
44 views

Are character passwords on my iPad needed?

I have a 20 character password on my iPad. I've been wondering, do I REALLY need it to be that long? Should I switch to a 6 or even 4 digit numeral password? Or should I just shorten my password? ...
1
vote
3answers
262 views

What security benefit does 2FA provide a password manager?

It's no secret that many popular password managers (1Password, Dashlane, LastPass, KeePass, and many others) support some form of two-factor authentication. This is often implemented via TOTP or other ...
29
votes
8answers
3k views

Best way to administer all my passwords

I am trying to figure out what the best solution is to store different types of passwords: Personal passwords (my personal email, my company's email, all the services I use to buy things like ...
23
votes
8answers
10k views

On two-step login forms, why is it the login name and not the password that's asked first?

There are several login forms (e.g. Google's) on the internet where you first enter your login name and then, once that's submitted, you get to enter your password. One of the advantages of this is, ...
2
votes
1answer
40 views

Is Privileged Access Management secured without regular Patch Update?

It is well know Privileged Access Management (PAM) is a solution that helps organizations restrict privileged access within an existing Active Directory environment. Many big company use it to address ...
10
votes
1answer
9k views

Best practices for storing credentials used by code

Currently, I've many scripts that need to log in as superuser to automate many tasks. (For example, creating tables in databases, creating other users, etc.) Instead of having the credentials (...
1
vote
1answer
128 views

Is it secure to store a cryptographic key in a class member variable?

Consider an application that runs locally on a Windows PC. The application uses a local folder for reading/storing encrypted data (i.e. images). A user logs in (authenticated from a local encrypted DB)...
2
votes
0answers
470 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
3answers
566 views

What are the serious weaknesses in this free password management system?

I want to protect my passwords for free and store them on a machine that might get stolen but have the passwords very securely backed-up in the cloud, again for free, and minimize the total lifetime ...
4
votes
3answers
422 views

How can a company tell if my password is similar to the previous 5 passwords?

Closely related (but not a duplicate): Company can tell if new and old passwords are too similar. Is there a security problem? Also closely related (but not a duplicate): How can a system enforce a ...
4
votes
4answers
932 views

How secure is this method of password generation?

Introduction: I used to use the same password for everything (it was at least a really random password with fake words). Then I found out that I should have different passwords for different sites ...
84
votes
12answers
20k views

What to do about websites that store plain text passwords

I recently received an email from a popular graduate job website (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
1
vote
1answer
230 views

Store passwords in a text file… is it really much worse than a password manager?

My idea: Storing my passwords in a text file kept on Dropbox and accessed through a python script to quickly retrieve the password for the site I want to access. My motives: I want to be platform-...
1
vote
3answers
124 views

Security concerns around sharing secret on a website

I need to share credentials with users. These credentials are created when the user wants them, but cannot be chosen by the user specifically (AAD credentials). I want to share the same with the user ...
0
votes
0answers
33 views

SSLVPN client saving encrypted password in local xml file, is that secure?

Simply copy the specific xml file to another client's correspond path, I can login to the remote network automatically. If that is a vulnerability, what severity rate will you give to it? High, medium,...
7
votes
3answers
13k views

Where to store Java keystore password?

We are going to have a Java Key Store which will store certificates & public/private keys. This keystore will be protected with the password. However, access to the keystore is only from the ...
2
votes
0answers
182 views

For cloud-based password managers, is it safe to login using public WiFi?

For cloud-based password managers, is it safe to login when using public WiFi? To help get good answers to this question, let's define 3 terms: Cloud-based password managers = Password managers such ...
2
votes
4answers
575 views

Why is it not standard practice to run password-based KDF's client-side?

In most protocols I have encountered in which a passphrase is used for authentication it is stored not in plaintext, but a PBKDF digest of it instead. This is obviously good. However what does not ...
2
votes
3answers
406 views

How to decide whether to password protect key files in addition to full disk encryption

It is customary to protect certain critical files with a password. For example: PGP keys, VPN keys, password managers, etc. The practice dates back to before full disk encryption being common. These ...
1
vote
3answers
232 views

Is it advisable to create a system that stores passwords?

Please bear with me, I'm a total newbie about security. I work in a company whose main goal is to maximize profits and use free stuff as much as possible. It's effect is that we use tons of freeware ...
28
votes
2answers
4k views

Does password expiry provide any benefit at all (when using randomly generated passwords)?

I have been seeing a shift in password policy, this has been going on for a while (Article from 2017) but I have only just picked up on this. In my organization we expire the user passwords every 90 ...
4
votes
1answer
228 views

Is it safe to share an encrypted GPG private key?

I use the pass password manager, and I am trying to come up with a convenient way to bootstrap new machines with access to the git repository. I also have a GPG smartcard (Yubikey) with a different ...
1
vote
1answer
80 views

Setting passwords for domain users, not expiring them, and not allowing them to be changed by users

We are in a mid-sized enterprise environment and are looking at forcing specific passwords for all users. I've found nothing recent or relevant about this. Justification: The main reason is to ...
2
votes
1answer
301 views

Password Reset URL strategy

Designing a new flow for a "forgot your password" feature we are developing, i came across a challenging question regarding the URL and the commitment that has to be made between frontend and backend ...
51
votes
11answers
6k views

Is there a method of generating site-specific passwords which can be executed in my own head?

I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
9
votes
2answers
482 views

Is there any recommended approach for “upgrading” MD5 hashes to something secure? [duplicate]

I'm currently dealing with a couple of user accounts containing MD5 hashed passwords. These accounts got migrated from an old system into our current system which uses PBKDF2 for password hashing. I ...
1
vote
1answer
97 views

Can my open Firefox Sync session be used to circumvent a Master Password?

In short I'm wondering what's stopping someone with access to my computer account to exploit an open Firefox Sync session to view my synced passwords, even if a Master Password has been set. On this ...
63
votes
12answers
21k views

Storing passwords in access-restricted Google spreadsheets?

I saw someone's interesting practice to store sensitive information. He is saving all his thousand logins (including banks and email) in a access-restricted Google spread sheet, stored on his Google ...
8
votes
2answers
268 views

Why use one-time codes for two-factor authentication backups?

I am building an web application that uses two-factor authentication. While implementing the recovery feature, I see that most companies (eg Apple, Facebook, Github) provide a set of ~15 backup codes,...
0
votes
0answers
89 views

Browser passwords used on multiple domains?

I have 100 domains with authentication backed by the same LDAP database. There is a single-sign on, but it's not implemented with OAuth. That is to say, per user, each domain accepts the same user/...
0
votes
4answers
204 views

Finding a future-proof password manager

Currently, I am a Windows 10 user who uses Chrome's default password manager and let it autofill in passwords for me. Apparently, if I were to accidentally execute malware or give someone momentary ...
3
votes
2answers
946 views

Privileged access management vs named accounts

What are the relative merits / deficiencies of a Privileged Access Management (PAM) service compared with a strict policy of named users (no account sharing)? By PAM, I'm specifically referring to ...
49
votes
4answers
10k views

Password manager vs remembering passwords

I have always thought that you are not supposed to use a password manager but to keep your passwords in your head, but lately I have thought about the pros and cons of having a password manager. Some ...
0
votes
0answers
18 views

What are some secure methods to share pre-created password? [duplicate]

I am working on something that requires me to create and share AAD(Azure Active Directory) credentials with clients. To give some context, Azure automatically creates a secret and then that secret has ...
1
vote
1answer
281 views

How secure is pgAdmin to save database password?

When we are creating a new connection with pgAdmin, we are presented with an option to save the password into our computer, so we won't have to retype it every time we want to connect with the ...
0
votes
1answer
61 views

Password storage which avoids privileged insider attack

What are the standard password authentication protocols in client-server setting where authentication happens at the remote server? Is there any password/pin verification protocol which reveals zero ...
60
votes
16answers
14k views

Alternative to sending password over mail?

Recently I've started working as a contractor for a company, which requires me to often log in to different b2b services. The way I receive the login data is usually over email in plain text. My gut ...
0
votes
0answers
37 views

Authenticated scan strategy for large enterprise network

I have been tasked with using Qualys Vulnerability Scanner in order to perform scans within a large enterprise network. Within this network there are Windows machines and Linux machines. CyberArk has ...
50
votes
10answers
16k views

Confused about using a password that “would take centuries to break”

I am talking about this password - 23##24$$25%%26 and the similar ones consisting of special characters appearing in a pattern, which the users these days use a lot. At work (finance company), I was ...
5
votes
1answer
146 views

Do ciphers and encoding schemes make passwords more secure?

I recently came across a tech professional advising a user to take some plaintext of their choice, run it through one of these ciphers, convert it to Base64, and then use the result as their master ...
172
votes
10answers
115k views

How safe are password managers like LastPass?

I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long. How safe are password ...
3
votes
2answers
261 views

Best practices for sharing or managing passwords between teams

Consider this scenario. A small company with several small teams (2-3 members). Each team manages their own passwords for their systems. Now, in the case when the whole team perishes in an accident, ...
45
votes
13answers
12k views

Is there a good way to store credentials outside of a password manager?

A lot of the users in my company are using their agendas to write down their password and usernames, or Excel sheets with a protected password. I'm hesitant to install software for password management ...
1
vote
3answers
209 views

How to keep track of passwords and avoiding password-reuse

I have lurked for a time on security websites and similar. I came to wonder, with the number of passwords we have (or websites that need a password) how to manage this. Since I have well over 400 ...
1
vote
0answers
23 views

Rememberable Password Formula [duplicate]

I was reading the comments under this answer and saw this comment Your answer to the question is basically to use a password formula, and there is already an answer that covers that option. Your ...
20
votes
2answers
2k views

Store Credit Card Information in Password Manager?

For convenience purposes I manage my passwords with the password manager Bitwarden on my personal computer and smartphone with autofill function (but with asking for the master password or fingerprint ...
1
vote
2answers
85 views

Should a system require a password confirmation for accounts managed by an administrator?

Suppose you have a user account management subsystem with a web UI. You can change user account passwords in regular masked input password fields in HTML POST forms. I'm wondering, is it fine if such ...
1
vote
2answers
118 views

Deriving 2 keys from user password - one for login - one for encryption? [duplicate]

Context We have a browser-based client-server application. The client registers with email and password. The password is enforced to some guidelines. Problem The User needs an encrypted vault on ...
104
votes
6answers
24k views

School performs periodic password audits. Is my password compromised?

My university sent me an email informing me that, during a "periodic check", my password was found to be "easily discoverable and at risk of compromise". As I understand it, there shouldn't be a way ...
36
votes
7answers
12k views

What are the security risks of logging the hash of rejected passwords?

According to Is it common practice to log rejected passwords?, I know logging rejected plain text password is a bad idea, but how about if I store the hashed form of rejected passwords? I want to have ...