Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

Filter by
Sorted by
Tagged with
2
votes
2answers
153 views

storing user's information without been able to access it

For a university project of mine I am making a password manager online and I want to be able to store user's passwords on my server without being able to access it myself. Here is what I intend to do: ...
0
votes
1answer
314 views

Is this method of hashing passwords good? Node.js [duplicate]

I am currently developing a login for my website, (using node.js and MySQL) and would like some feedback on the password hashing code. const crypto = require('crypto'); function RandomSaltString(...
19
votes
6answers
8k views

Which password policy is more secure: one password of length 9 vs. two passwords each of length 8?

What is more secure, having one password of length 9 (salted and hashed) or having two different passwords, each of length 8 (salted and hashed using two different salts)?
1
vote
1answer
132 views

Is it at all possible to store Windows Sticky Notes in a secure manner?

Example: Users want to use Sticky Notes for quick note taking. They don't like other options, they want Sticky Notes. However, Sticky Notes normally stores the information in a SQL db that can be ...
5
votes
2answers
1k views

Can a HSM be used to make password hashing stronger?

Say a database server has a HSM which is in use for encrypting (reversibly of course) credit card numbers. Is there any way a HSM could be used to add strength to a password hashing scheme? (Or are ...
0
votes
0answers
127 views

how good is “Chrome Password Checkup” extension for checking passwords?

From what I read so far Google "Chrome Password Checkup" extension (https://chrome.google.com/webstore/detail/password-checkup/pncabnpcffmalkkjpajodfhijclecjno) checking the password that you use for ...
2
votes
2answers
101 views

Committing encrypted passwords but not usernames

I’m arguing with a colleague about the security of storing encrypted password on GitHub. Our process is currently to commit a configuration file with environment variables including username and ...
1
vote
2answers
136 views

Is storing the bcrypt salt in isolated database a good idea?

I read many answers on the stackexchange about Bcrypt, Salt and Where exactly to place the salt. For hashes such as BCrypt it is trivial to extract salt from the hash. So, It doesn't matter really ...
4
votes
3answers
176 views

How to reset passwords without emailed reset link?

In an offline system what is the preferred method of resetting a user's password? Usually this would be handled with an emailed password reset link. However this system is offline, there is no access ...
2
votes
5answers
4k views

What if I develop my own hash algorithm to create strong passwords from easy ones?

I came up with this idea but I cant figure out if it's good or bad, maybe you can help. My goal is: I want to create extremely strong passwords for my main accounts (gmail, skype and so on). I want to ...
0
votes
3answers
185 views

How to store login information on the user's device

I'm developing an application that needs to store various pairs of username/password to automatically log in into third party services so that users don't have to insert them each time they open the ...
1
vote
3answers
405 views

Question mark not allowed in password

Recently I came up with a password requirement rules as follows: The password must be 8-16 characters contain at least one number contain at least one lower case letter contain at least one upper ...
3
votes
3answers
155 views

Login system using permanent “random” hashes in URLs

I am working with a company and have found the following: When a user registers, they make a "random" hash. This "random" hash often has collisions and has to be regenerated to keep the hash unique ...
1
vote
1answer
136 views

Why would a hacker bother with stealing your database password?

I read recently about whether you should store your database passwords in config files, environment variables, docker secrets, etc. But if somebody can steal it from those places, then s/he can ...
0
votes
0answers
55 views

Saving all secret keys, access data in heroku environ instead of config file?

I have a python/flask app and I use heroku to host it. I use some additional services, such as stripe, postgresql or emails. All these services have either secret keys or other access data, which ...
0
votes
0answers
43 views

Why doesn't Cox encrypt my password?

Cox does not encrypt my WiFi password on my account page. So anyone working for Cox has access to my WiFi password. How can I secure my WiFi password?
30
votes
3answers
19k views

Is it safe to store the database password in a PHP file?

My connection.php file stores the credentials to connect to the database: <?php $objConnect = mysql_connect("localhost","username","password"); mysql_select_db("selectDB", $objConnect); ?...
1
vote
0answers
71 views

How to store credentials using JKS

Suppose a security team specifies that credentials for an application (specifically, a database username/password) should be stored in a JKS whose password is provided to the application in a local ...
1
vote
1answer
153 views

Do I understand SHA-1 brute-forcing speeds correctly? (Firefox Password Manager)

I read that the Firefox Password Manager has a "bug" (or rather poor design) in that it uses only a single sha-1 hash iteration for the password (which makes it extremely easy to brute-force ...
0
votes
2answers
97 views

Advice on password vault software

Do you have any recommendation on any password manager, which is used primarily as a vault? I don't need any browser extension, any special functions, just a regular vault with ability to structure ...
2
votes
2answers
129 views

How should clients' passwords be managed?

How should clients' passwords be managed? By "clients" of course I mean people who you provide a service to, people who need you to work on their stuff (their websites, their servers, their emails, or ...
0
votes
1answer
418 views

Recommended length of password [duplicate]

Why are we recommended to have at least 8 characters, and not 6 or 7 etc.? and the different set of character?. I only know that the longer the password is, the harder it is for brute force attack to ...
0
votes
1answer
62 views

Password managers, how do they get the credentials when you press enter?

I was wondering how password managers (most of the at least) automatically prompt to save my username and password credentials after inserting them into any site. I mean I am not first putting them ...
39
votes
4answers
8k views

Avast AV could read Firefox saved passwords

My friend uses Firefox's built-in password manager feature to save passwords for sites. Later, after installing Avast Free Antivirus there was a feature called Passwords on the Avast UI. When accessed ...
2
votes
1answer
1k views

What issues are there with Google's “Suggest Password” feature in Chrome?

I have for a long time used a fairly insecure method of having a series of different passwords - where I would use the same password on many sites. I would change between one of the series of ...
4
votes
4answers
434 views

Does a password manager's master password significantly improve security?

I use the KeePass password manager, which allows me to change the key derivation/encryption settings. I'm tempted to take time to choose very strong settings and an enormous passphrase. But does it ...
0
votes
1answer
113 views

How to prevent replay attacks without exposing stored password security?

A common way to prevent replay attacks when logging in is for the server to present a challenge (chall) and request a response in the form hash(chall+secret) where the secret is already known by the ...
1
vote
0answers
74 views

Collection #1: Do we know the source of the leaks? [closed]

With Collection #1 yet another large data set of email addresses and passwords was found out there. I happens that one of my frequently used email addresses shows up as 'pwned' when checked against ...
0
votes
1answer
402 views

An idea for a universal password management standard [closed]

Introduction For a long time I have struggled with (the idea of) password management. Remembering unique strong passwords is impossible when one has more than a handful, which only leaves the option ...
-2
votes
3answers
190 views

Why do services that use 2-factor authentication still ask you to provide a password?

The idea of 2 factor authentication is that if you can prove that you have both a password and a device, you are trusted to be who you say you are. My question is, why does the service still ask you ...
1
vote
4answers
2k views

Why one time passwords using nested hash chain are not used?

I am wondering, why web sites do not use one-time passwords generated by hash chain. By that I mean that a client chooses a secret and after being salted, he applies some secure hash function F() on ...
25
votes
1answer
752 views

Is a password manager better than an encrypted file for storing passwords?

For any passwords other than websites I log into regularly (such as Gmail, Facebook, etc.), I use apg to generate a random 20 character password. I then add that password and a username or email ...
3
votes
1answer
108 views

Is it a common practice to give a user an unmodifiable password?

I created an online account on a website, they do not ask me for a password but just an email address, then, after acknowledging "terms of service" I was already logged-in. Then I received an email ...
3
votes
1answer
122 views

How should I share the key of the AES algorithm in each client?

My doubt would be the following: How should each client know the encryption key? Using the AES algorithm. (or the best way): Save it in a file encrypted by password? Save it in a DB? Send it over ...
2
votes
1answer
326 views

Should users need to complete a CAPTCHA upon changing their password in their account settings?

On Last.fm, I need to complete a CAPTCHA in order to change my password. I want to change my password because haveibeenpwned lists my account as appearing in the last.fm breach. However, the CAPTCHA ...
2
votes
1answer
425 views

Is there a well-researched and user-friendly solution to the password problem? [closed]

The Password Problem has been spoken on many times, but most places I've seen offer terrible solutions such as modifying a dictionary word, changing your password requirements to include special ...
0
votes
1answer
101 views

Does having in-browser password managers further the risks of successful CSRF attacks?

When successful CSRF attacks are executed they have the ability to access credentials and other information between the victim and the site. Are the sites username and password that are stored in the ...
36
votes
5answers
7k views

Password manager: safer on laptop or on smartphone?

I want to recommend a password manager to my non-tech friends and family and help them set it up and use it. One of the decisions I have to make is whether I recommend one that works on laptops or one ...
6
votes
3answers
3k views

Is it secure to store a two factor authentication seed in a password manager?

I wonder whether it is really secure to store the Two Factor Authentication seed code (e.g. the secret key for TOTP) within a password manager together with the user and password for the service. If ...
9
votes
2answers
2k views

Does Chrome's password manager store plaintext passwords in their databases?

Chrome's password manager allows for users to view their saved passwords on passwords.google.com. The saved passwords can be viewed on different devices as long as the user logs into their Google ...
2
votes
4answers
265 views

Mitigating the problem of single point of failure introduced by password managers

I understand the purpose of password managers and the fact that there seem to be a trade-off to accept, but well, I find that trade-off to be unacceptable and I wonder if there's a way to avoid it. A ...
5
votes
2answers
2k views

Is safe to store passwords in Android/iOS App own storage?

I'm creating an app that logins to a remote API that doesn't implement oauth2 or another similar mechanism, and I want to know if is reasonably safe to assume that password will be safe if is stored ...
6
votes
1answer
251 views

Is this vault-less password manager/generator design safe?

Counter The counter is appended to the site name and incremented if you need to get a new password for a site or if the generated password is insecure because it randomly matches something like "...
10
votes
8answers
4k views

Sequential password updates

Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse. What's to stop the user from changing the ...
94
votes
9answers
31k views

If a provider sees the last 4 characters of my password, can they see it in full?

I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
1
vote
0answers
346 views

What are KeePassXC Encryption Settings?

I'd like to know what is an extremely secure configuration with the given options for KeePassXC database: Encryption Algorithm: AES 256, Twofish 256, ChaCha20 256 Key Derivation Function: Argon2, AES-...
1
vote
2answers
150 views

Is a host OS more vulnerable to a hypervisor escape if the guest OS knows the root password to the host?

This is assuming that escaping the hypervisor is the only way the guest OS could compromise the host-- e.g. it's not networked, isn't sharing folders or the clipboard, etc. Does knowledge about the ...
21
votes
3answers
10k views

Is LastPass' locally stored One-Time-Password recovery a security problem?

If you forget your LastPass master password then LastPass provides the possibility to recover access to your vault using a One-Time-Password (OTP) which is stored locally but is initially disabled. ...
3
votes
2answers
1k views

Does PCI-DSS password guidance apply to service accounts?

A service account is a user account created for the sole purpose of running an application. For example, an online banking web site may have a single service account under which the code runs. ...
1
vote
0answers
35 views

Sharing individually encrypted elements between users of a system

I'm creating a file sharing system, in which the unique key of a file is one of the critical components to the retrieval of that file. For simplicity, lets say the unique keys are the file names. I'd ...