The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

Filter by
Sorted by
Tagged with
5
votes
2answers
3k views

Is safe to store passwords in Android/iOS App own storage?

I'm creating an app that logins to a remote API that doesn't implement oauth2 or another similar mechanism, and I want to know if is reasonably safe to assume that password will be safe if is stored ...
6
votes
1answer
252 views

Is this vault-less password manager/generator design safe?

Counter The counter is appended to the site name and incremented if you need to get a new password for a site or if the generated password is insecure because it randomly matches something like "...
10
votes
8answers
4k views

Sequential password updates

Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse. What's to stop the user from changing the ...
94
votes
9answers
31k views

If a provider sees the last 4 characters of my password, can they see it in full?

I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
1
vote
0answers
375 views

What are KeePassXC Encryption Settings?

I'd like to know what is an extremely secure configuration with the given options for KeePassXC database: Encryption Algorithm: AES 256, Twofish 256, ChaCha20 256 Key Derivation Function: Argon2, AES-...
1
vote
2answers
150 views

Is a host OS more vulnerable to a hypervisor escape if the guest OS knows the root password to the host?

This is assuming that escaping the hypervisor is the only way the guest OS could compromise the host-- e.g. it's not networked, isn't sharing folders or the clipboard, etc. Does knowledge about the ...
21
votes
3answers
10k views

Is LastPass' locally stored One-Time-Password recovery a security problem?

If you forget your LastPass master password then LastPass provides the possibility to recover access to your vault using a One-Time-Password (OTP) which is stored locally but is initially disabled. ...
3
votes
2answers
1k views

Does PCI-DSS password guidance apply to service accounts?

A service account is a user account created for the sole purpose of running an application. For example, an online banking web site may have a single service account under which the code runs. ...
1
vote
0answers
35 views

Sharing individually encrypted elements between users of a system

I'm creating a file sharing system, in which the unique key of a file is one of the critical components to the retrieval of that file. For simplicity, lets say the unique keys are the file names. I'd ...
2
votes
1answer
215 views

Storing password reset token in DB - what are the implications?

In multiple systems I've built/supported I've seen user management do the following for password reset: generated a password reset token via some hashing method and email the link with token to user. ...
41
votes
5answers
11k views

Does the average user really need a password manager?

I'd describe myself as an average tech savvy computer user. I have many accounts in forums, shopping sites, etc where I recycle two moderately strong password with small variation. These are account ...
0
votes
1answer
77 views

How to securely store and use a password for certificate authority

Other than purely memorizing a password in your head, I'm wondering what the next best thing is for storing a password and using it in a very secure environment without internet connection like a ...
1
vote
3answers
4k views

Any hints for programming my own password manager? [closed]

I mostly want whatever help & suggestions you can give me about what I should avoid & what I should think about when making this. I'm a reasonable programmer & I want to make my own ...
50
votes
10answers
17k views

Is it OK that a sysadmin knows the password for a newcomer / act as a user (immediately after his/her recruiting)?

Somehow related to this other question. I am dealing with the following case: a medium-large company (with about 200 on-premises employees) is applying the following procedure for all the newly ...
6
votes
1answer
125 views

Password Managers: Which passwords to still remember?

Let’s say I use a password manager (like 1Password) on all my devices. In my personal opinion it makes sense to have some passwords in your head (you could still have them in the password manager, and ...
0
votes
1answer
108 views

Implementing SRP without storing the salt anywhere

I am attempting to use SRP to verify clients when they authenticate with a webserver, so that the password is never sent over the wire. Looking at the SRP procedure, when a client registers with the ...
0
votes
1answer
79 views

What's the purpose of the lock and unlock feature in password managers?

I'm afraid this could be a very stupid question, yet I cannot think of an explanation. Password managers (keepass, etc.) often have a button that lets you "lock" the database, so if you need a ...
0
votes
1answer
150 views

Choose a sentence, a number, and the name as password [duplicate]

I would like to have your point of view about something I found on internet. The goal here is to help people to use stronger passwords, it's not perfect, but I believe that asking people to use ...
3
votes
2answers
977 views

How long should a password reset token remain valid?

What is the recommended lifetime of a password reset token? Too short will degrade user experience and too long would compromise security. Microsoft identity default to one day but this very long.
3
votes
2answers
237 views

How to choose between password derivation or encryption?

Suppose you use a password manager having all possible features of modern password managers: encryption with a key derived from your master password, auto-filling, cloud or local storage, browser ...
11
votes
3answers
1k views

When changing a password using a WebPage, must the old password be entered on the same screen?

There is a convention to always prompt for the old password on the same page as the one where the old password is being changed as shown below. Is it acceptable from a security perspective to allow a ...
75
votes
10answers
12k views

What is worse for password strength, a poor password policy or no password policy at all?

Recently I saw the following screenshot on Twitter, describing a obviously terrible password policy: I wonder what is worse for the password strength. Having no password policy at all or a poor ...
1
vote
1answer
6k views

Keepass2 vs KeepassXC - KeePass-Http connector - Mono in Linux

please forgive beginner question. I have been using Xubuntu for several years now; this question is regarding password managers under Linux/Ubuntu. I have been using Keepass2 which is just such an ...
1
vote
1answer
54 views

Lastpass - Can I use my old master password to decrypt local data?

I am a user of Lastpass and I have some concern about the storage of local data. According to my knowledge about Lastpass, there is an encrypted local vault stored in my devices with the Lastpass app ...
0
votes
2answers
224 views

What is the standard practice to maintain a password for different websites? [duplicate]

I have come across many users who maintain a re-used password for each and every website, such as P@ssw0rd123 The problem with this approach is if someone breaches the protections of a particular ...
1
vote
4answers
800 views

Why does Google require re-authentication before being able to start the password change process?

When a user wants to change the password for an account most web applications present a form where the user needs to enter the new password and the old password. So far I thought that I understood the ...
1
vote
1answer
490 views

What are security advantages of pass in comparison to KeepassXC (GUI App)?

At the moment I use KeepassXC on macOS. Before I used KeepassX, which discontinued their development. I am considering switching to command line client pass - the standard unix password manager, ...
3
votes
1answer
188 views

Best way to save username/password programatically

I have a requirement to programmatically save a username and password on the local workstation and retrieve them back. What would be the most secure way of doing this? I have used DPAPI in the ...
11
votes
4answers
4k views

Should user's password strength be assessed at client or at server side?

Now most of big website like Google mail, Twitter, Facebook have a feature that assesses password strength (check number of digit, alphabet, special characters, or check the similarity over already ...
15
votes
5answers
7k views

Is KeePass a good defense against keyloggers?

KeePass is a program in which you can store your password and copy and paste them into websites. Does anyone know if it is safe against key logging software? Does key logging software pick up what you ...
1
vote
3answers
1k views

Passwords: store encrypted, view in plain text

I've already asked that question at stackoverflow but i was informed it is a bit too broad and relies more in here instead. So let me just copy and paste what i asked there: I have a security related ...
2
votes
1answer
1k views

How does the “emergency access” feature of LastPass work?

How does the "emergency access" feature of LastPass work? I can't find detailed information about the used cryptographic methods. How can I be sure that LastPass is not keeping a copy of my master-...
4
votes
5answers
294 views

Should admin users confirm their password before changing a user password?

In a hypothetical website, there are two types of users, admin users and normal users. Normal users can change their own password, and in keeping with best practices are required to provide their ...
1
vote
1answer
84 views

Do hacks of mainstream web applications tend to happen more from random attackers brute forcing or from targeted heuristic attacks?

I'm writing up advice for selecting a master password for a password manager, and I'm wondering if there is available data about the likelihood of different attacks that result in a cracked password. ...
27
votes
2answers
15k views

How big should salt be?

I will be using scrypt to store passwords in my application. As such, I'll be using SHA-256 and Salsa20 crypto primitives (with PBKDF2). Having that in mind, how big salt should I use? Should it be ...
3
votes
1answer
78 views

gnupg keys and pass database - Protecting both from unauthorised access and loss

My target is to use pass to store a lot of passwords and be able to access those passwords from wherever I need them, possibly using just a single pass-thing (password, passphrase, my voice, my ...
1
vote
1answer
80 views

Is the tomb's keyfile necessary when creating a password tomb with tomb-pass?

Pass tomb's documentation states Usage: pass tomb [-n] [-t time] [-f] [-p subfolder] gpg-id... Create and initialise a new password tomb Use gpg-id for encryption of both tomb and passwords ...
5
votes
5answers
3k views

How to store passwords in a text file in USB securely?

I am planning on creating a text file to store my passwords, so I only need to remember 1 password (at the moment, I have about 20 long/complex passwords in my mind, and am worried that I might forget ...
1
vote
2answers
252 views

What is Byzantine password system?

How safe are password managers like LastPass? One comment there asks: Does anyone know of any Byzantine password systems? E.g. 3 or 5 online systems, where breaking any single system would not ...
1
vote
4answers
485 views

Dealing with users who reuse bad passwords

What is the best (or good) practise to deal with users, who are determined to reuse their old password, whether it be good or bad? Or simply use a bad password? Scenario: A user wants to create an ...
0
votes
1answer
62 views

What are the possible security issues (breach/losing access) with sharing passwords manually?

I am thinking of forming a team in either LastPass or 1Password. LastPass is free if I don't intend to use it to share my passwords. I am wondering, why would I need to form a team? If I want to ...
2
votes
1answer
319 views

How does Trusona avoid MITM and Social Engineering attacks?

Trusona is a QR code login system, touted by the FBI and Frank Abagnale. It seems similar to Steve Gibson's Secure QR Login, SQRL and a frequent criticism of SQRL is that it is susceptible to Man In ...
0
votes
4answers
1k views

How do large companies and wealthy individuals secure their information?

I've recently had some success and traffic increase with an online business I own and due to that someone has hacked my domain email and twitter accounts. My bank password is the same and I just ...
-2
votes
2answers
374 views

What are most dangerous vulnerabilities of users of password management? [closed]

Are there any examples where something goes wrong. For example, say people misused password managers and got hacked or take some loss? If so how? Basically, I sort of know the typical vulnerabilities ...
30
votes
11answers
9k views

Password Management within an Organisation

Within an organisation there are many passwords such as those for root accounts on servers, hosting accounts, router logins and other such things, that need to be kept track of. I know in some ...
0
votes
1answer
302 views

What's the best way to store the passwords? [closed]

What is the best way of storing my passwords? Which storage is considered the safest one? How safe/unsafe is to store passwords in the local MySQL database?
1
vote
3answers
217 views

What happens if 1password or allpass are gone?

I am going to use one of them for my password management. The thing is, what about if one day, the password management company is hacked or destroyed. What would be my recourse?
10
votes
4answers
2k views

Why should we prevent users from saving their passwords in their password manager?

I understand there are a few other controls, like 2FA, for making transactions in many bank account websites, while only users required for username and password to access the account. I noticed ...
0
votes
1answer
138 views

Are there security issues in not supporting TOTP 2FA for 1Password? [closed]

1Password sort of supports 2FA. We have a master password and an additional secret. But why don't they support TOTP for 2FA? I just want to make really sure that unless I approve, no other devices ...
3
votes
1answer
211 views

What happens to a pass vault when the GPG key expires?

Say I were to use the Linux tool pass as my password manager and the corresponding GPG key were to expire. Would I still be able to get in?