Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

Filter by
Sorted by
Tagged with
0
votes
0answers
47 views

Storing the master password in a keychain

I tend to avoid putting my master keychain password in the keychain itself (in OSX, for example), but sometimes with federation of accounts and things, it would be convenient to do so. Am I right to ...
2
votes
0answers
151 views

Is using AES secure for password managers?

I'm developing an application that automates processes. The user connects to many accounts that the application uses then passwords are encrypted using AES. An example algorithm looks like this: ...
7
votes
3answers
5k views

How can I create a service that automatically logs onto a third-party service without storing credentials in plain text?

I know that storing log-in credentials in plain text is one of the cardinal no-nos of security, but I'm working on something where I can't think of any other solution. My service connects to a user's ...
-9
votes
1answer
234 views

Does word store my passwords in plaintext? [closed]

I have a document which I wrote my passwords in and saved it to my disk, and I have been hearing a lot about programs storing passwords in plaintext Did word store my password I saved in plaintext??? ...
0
votes
3answers
158 views

Password generator and password limitations

I would like suggestions for a good strategy for dealing with web sites that have arcane rules about what must or must not appear in a password. My ideal are the sites that allow a good range of ...
31
votes
7answers
8k views

Why do we ask for a user's existing password when changing their password?

In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
3
votes
1answer
720 views

How secure is KeePass KDBX4 by default?

How secure is KeePass KDBX4 by default if someone obtain the .kdbx file and attempt to brute-force it without knowing any hint of the master password? With assumption : The password length is equal/...
10
votes
1answer
726 views

Firefox bug permits stealing encrypted passwords: How is this possible?

It's my understanding that passwords I save in Firefox's Password Manager are encrypted and that setting a Master Password encrypts the encryption key used in this process. The Google hit for "...
3
votes
1answer
1k views

I want to deploy from GitLab to AWS - so where exactly do I store my private key?

This seems like an odd and simple question, but I'm trying to get my head around the principle of "never check a private key into version control". I'm trying to build a startup of sorts, where ...
2
votes
1answer
191 views

Should a browser make its own password manager? [closed]

I'm trying to figure out if products such as Firefox's Lockwise are a superb idea or a terrible one. On the one hand, installing a third-party addon to your browser comes with inherent risks, so ...
7
votes
4answers
1k views

How do I convince others of the importance of password management?

I just got married, and my wife and I are in the midst of combining finances, etc. We set up a joint bank account and the first thing I do during the account setup phase is generate a 16-character ...
164
votes
5answers
9k views

Password management for kids - what's a good way to start?

Consider a young (primary-school age) child who is starting to collect passwords for online services. How can a parent (or equivalent) help them manage their passwords? An example to make things ...
50
votes
6answers
12k views

What are the cons of stateless password generators?

Does anybody have hands-on experience with stateless password generators (managers) like Getpass? It seems like it does most of the work of cloud password managers, but leans more to the security ...
5
votes
4answers
603 views

Forgot password best practice for mobile applications

There are known good practices for password reset functionality from OWASP and other resources. On the other hand, I believe most of us agree that security questions are not user friendly, they either ...
52
votes
4answers
20k views

How can I be sure Lastpass really can't access my passwords?

The recent, widely publicized security incident where millions of Linkedin were exposed reminded me to tighten up my password practices. I'm looking at several password managers now and I'm especially ...
1
vote
1answer
94 views

Would Hashing a Decryption Key Significantly Lower Security? [duplicate]

I'm using the Haskell Codec.Crypto.SimpleAES package to create a crude password manager. The password manager seems secure but it's unable to warn the user when the decryption key is invalid. If a ...
0
votes
0answers
47 views

How can I trust the data integrity of LastPass [duplicate]

So I recently downloaded LastPass and I'm beginning to wonder how they can ensure that my information is kept secure. Is anyone aware of what kind of encryption algorithm they use or how they ensure ...
0
votes
1answer
89 views

Does Azure Key-Vault encrypt the values before storing?

We are using key-vault for storing the secrets, will it give any added advantage if we encrypt the values before storing it in key-vault?
3
votes
3answers
282 views

Should a password generator validate its output against a dictionary?

If I were to design a password generator, is it best to leave it truly random or validate its output to avoid certain passwords? For example if my password generator was truly random, it's possible ...
1
vote
0answers
74 views

Apple Keychain Security Risk Assessment

What security measures has Apple taken to minimize security risk with respect to the Apple Keychain password manager? I enjoy the capability of the password management across macOS and iOS devices, ...
6
votes
1answer
1k views

Can a user's Apple Keychain be opened on a different computer?

Apple uses a nice keychain. This is used by, for example, Google's Chrome browser. Imagine a user copies all the keychain files. Would that user be able to unlock the keychain, if they knew the ...
23
votes
3answers
16k views

Is Firefox Password Manager less secure than LastPass?

After installing the LastPass password manager, I am presented with a login dialog including the option to "Disable Insecure Firefox Password Manager". (This option appears as long as the Firefox ...
1
vote
1answer
73 views

Having web client do requests with User's 3rd party API key?

I am trying to figure out the best way to do this. I have done some searching and all I have found is about storing API keys in a back end, nothing like my use-case where there is no back end. ...
2
votes
1answer
687 views

Opera browser: no master password?

I've recently moved from Firefox to Opera (for performance issues). I used to protect my passwords in Firefox with a Master Password. But Opera, so it appears, lacks such feature. I use Debian 9.7 ...
2
votes
1answer
117 views

Does knowledge of one or more passwords from my password manager help an attacker crack the master password?

I use a keepass password manager with a master password of more than 100 bits. I keep the password file in cloud storage. If an attacker has my password file, it should be difficult for them to ...
0
votes
1answer
50 views

DB Service accounts: is it possible to avoid storing a password somewhere

Is it possible to avoid having to store DB passwords applications/service accounts needing access to the DB? I would like to avoid the risk of a system admin obtaining the password and then accessing ...
31
votes
12answers
13k views

How do I check that users don't write down their passwords?

I have a password policy which states that users must not write and store their passwords down in plaintext. How can I ensure that they haven't done so by writing their password in emails, scripts, ...
-1
votes
1answer
156 views

Virgin air-gapped devices and password management [closed]

For password management: "Practical" means it works in practice, and "secure" means protected against compromise and actually works. How do we get the highest P + S value? I am convinced that all ...
4
votes
3answers
369 views

Password hashing algorithms suitable for IoT devices?

What password hashing algorithms and other cryptographic hashes (e.g. scrypt, bcrypt, PBKDF2, MD5, SHA-256) are suitable for resource-constrained IoT devices for the consumer-oriented smart home ...
50
votes
9answers
10k views

Can users make use of a password manager when banks tell them never to write passwords down?

Consider a user who wants to use a password manager for their banking passwords. Advice from banks usually says they should never write down their password. The user would be concerned about going ...
23
votes
5answers
26k views

How does a key file increase the security of a password manager?

Password managers like KeePass often have an option to use a key file in addition to a master password. I don't understand how this increases security. (Note: KeePass also allows using a key file ...
1
vote
1answer
86 views

Banking app logon - multiple fingerprints on a device vs 2 passwords known by 1 person

Yesterday I logged on to my banking app via my iPhone. The normal procedure was to enter information that consisted of: The answer to a security question. This had to be entered in full and was the ...
4
votes
2answers
877 views

Pros and cons of this password reset scheme?

I handle the process of password resets at the institution where I work. Currently, we require users to make up questions and answers (three minimum and five maximum); the questions cannot repeat, nor ...
71
votes
9answers
15k views

What's the safest way to inform a new user of their password on an invite-only website?

I'm developing a web site where people will have accounts. However, unlike most web sites, user do not register, rather they are invited by the site admins. The site admins will create a new user ...
13
votes
1answer
2k views

How to get a 'million rounds of PKCS#8 + PBKDF2' with OpenSSL?

I posted this question Is a passphrase-protected SSH private key susceptible to a dictionary attack? a few days back. An excerpt from the final answer: With PKCS#8 + PBKDF2 and one million rounds ...
8
votes
5answers
1k views

What would be a good way to send sensitive information to users that are not very tech-savvy?

As web developers we need to supply sensitive data to the clients. Clients are usually not very good with computers. They can send an email, pick up a phone call or open a webpage. But won't be able ...
1
vote
0answers
81 views

Why is unistd's getpass unsafe?

While reading about how to properly ask a user for a password in CLIs, this SO answer and this SSE answer recommend the usage of unistd's getpass. However, this function is being documented as ...
7
votes
2answers
3k views

Keepass client on Android (reliable one) [closed]

I need some advice to choose a Keepass client on Android phone which can synchronize using Dropbox. As i keep all my passwords in one place, I would like to keep it safe. Is KeepassDroid client safe ...
1
vote
0answers
45 views

Are character passwords on my iPad needed?

I have a 20 character password on my iPad. I've been wondering, do I REALLY need it to be that long? Should I switch to a 6 or even 4 digit numeral password? Or should I just shorten my password? ...
1
vote
3answers
1k views

What security benefit does 2FA provide a password manager?

It's no secret that many popular password managers (1Password, Dashlane, LastPass, KeePass, and many others) support some form of two-factor authentication. This is often implemented via TOTP or other ...
29
votes
8answers
3k views

Best way to administer all my passwords

I am trying to figure out what the best solution is to store different types of passwords: Personal passwords (my personal email, my company's email, all the services I use to buy things like ...
22
votes
8answers
11k views

On two-step login forms, why is it the login name and not the password that's asked first?

There are several login forms (e.g. Google's) on the internet where you first enter your login name and then, once that's submitted, you get to enter your password. One of the advantages of this is, ...
2
votes
1answer
50 views

Is Privileged Access Management secured without regular Patch Update?

It is well know Privileged Access Management (PAM) is a solution that helps organizations restrict privileged access within an existing Active Directory environment. Many big company use it to address ...
17
votes
1answer
18k views

Best practices for storing credentials used by code

Currently, I've many scripts that need to log in as superuser to automate many tasks. (For example, creating tables in databases, creating other users, etc.) Instead of having the credentials (...
1
vote
1answer
133 views

Is it secure to store a cryptographic key in a class member variable?

Consider an application that runs locally on a Windows PC. The application uses a local folder for reading/storing encrypted data (i.e. images). A user logs in (authenticated from a local encrypted DB)...
2
votes
0answers
476 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
3answers
587 views

What are the serious weaknesses in this free password management system?

I want to protect my passwords for free and store them on a machine that might get stolen but have the passwords very securely backed-up in the cloud, again for free, and minimize the total lifetime ...
4
votes
3answers
573 views

How can a company tell if my password is similar to the previous 5 passwords?

Closely related (but not a duplicate): Company can tell if new and old passwords are too similar. Is there a security problem? Also closely related (but not a duplicate): How can a system enforce a ...
4
votes
4answers
983 views

How secure is this method of password generation?

Introduction: I used to use the same password for everything (it was at least a really random password with fake words). Then I found out that I should have different passwords for different sites ...
86
votes
12answers
21k views

What to do about websites that store plain text passwords

I recently received an email from a popular graduate job website (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...

1 2
3
4 5
24