Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

Filter by
Sorted by
Tagged with
2
votes
2answers
266 views

Is it a good idea to upload your gnupg files to github?

I have a GNUPG file that i use to store all my passwords locally(Dont know if it is a good idea). The question is, is it safe to push the GNUPG file to github so i can access it from anywhere?
39
votes
14answers
14k views

How can I make a strong password that's easy to remember? Is the 4 Word method safe? [duplicate]

I have heard of the method of using 4 random dictionary words, it gives you lots of characters and is easy to remember. But that seems to be open to dictionary attacks, especially if the attacker has ...
0
votes
1answer
100 views

Reuse an email address with a leaked password

I just found that the password of a very old email address was leaked. I did not use this email address for a long time cause I lost its password. But now that the password is out, I'm thinking of ...
2
votes
2answers
600 views

Breaking .kdb (KeePass 1.x) file

During a penetration testing lab, I have obtained access to a .kdb file of a KeePass 1.25 (password management). Therefore I tried to find a way to obtain the file key file or key and after ...
0
votes
2answers
200 views

Why do most ip camera manufacturers set an easy default password?

A good chunk of ip cameras come with an easy default password which is the same for all models. It usually is something like admin, 1234, root ... The basic customer doesn't know that millions of ip ...
38
votes
9answers
19k views

Why don't people hash and salt usernames before storing them

Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext. What I ...
3
votes
1answer
673 views

Password manager: should key file be stored on a different device than password db file (even if master pw used)?

Does it defeat the purpose of a key file to store it in the same location as the password database? What if a master password is needed also? For example I save my .kdbx to dropbox as a means to ...
1
vote
3answers
589 views

Is it possible to hack into secured wifi and download with bit torrent from my IP address?

Is it possible to hack into secured wifi and download using BitTorrent from my IP address? I live in Denmark- if that makes any difference. We changed to a new WIFI service provider a few years back (...
1
vote
0answers
47 views

Is creating a derived password safe?

I need to store really sensitive data in a client-hosted database. Since there's no way I can protect this database (because I don't own it), my idea was to encrypt it by using the user's password, so ...
58
votes
5answers
12k views

Is it common practice to log rejected passwords?

While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
-2
votes
2answers
106 views

Best way to store passwords across devices? [duplicate]

KeePass is not good. It would work perfectly if all I wanted my passwords for were accounts on my computer, but if I needed to log in to Netflix on my TV, or my Facebook at a friend's house, I'm out ...
1
vote
0answers
234 views

Hardware-based password manager with per-password verification [closed]

I'm looking for a device to perform hardware password management very similarly to the Trezor, shown here, commonly used as a wallet for cryptocurrencies. Unfortunately, the Trezor only stores a ...
4
votes
2answers
565 views

How can I be sure my Keepass client is secure?

I've been fiddling with a locally encrypted disk image for years and I think it's finally time to use a password manager. Keepass is what I want to go with but I'm not a fan of the UI of the official ...
4
votes
5answers
651 views

What is the most secure way to store the password on a physical medium (paper, etc)? [duplicate]

Let's assume that I have to store the password on a material medium (paper, etc). What is the most secure way to do that? I mean a way of storing the password that does not needs any electronic tools ...
1
vote
2answers
119 views

Best practice on Windows domains: To have a separate admin account or not?

On Linux, we enforce least privilege through sudo. This gives the best of both worlds: Passwords and accounts are for a person, as they should be, not a role. But we lower risk and exposure by only ...
1
vote
2answers
118 views

Securing Database Credential in a Field deployed Raspberry Pi

A raspberry pi is deployed in a public area. I am not so concerned about the physical theft of the raspberry pi: I am concerned that the device is stolen, the SD card will be read and the AWS ...
0
votes
2answers
149 views

Password manager database and keyfile

I'm trying to store passwords more securely in my department. I was thinking about using Keepass, giving each of my colleagues a personal password database and require a simple password (they won't ...
2
votes
1answer
283 views

How do password managers implement secure browser integration? [closed]

Some password managers can automatically fill passwords in user's browser. But for this auto-fill to be secure, they have to make sure they are putting password in the correct input field, plus, the ...
15
votes
5answers
8k views

How many rounds of hashing is enough for a password manager?

I'm currently writing my own little password manager that stores the key in a SHA256 hash, with salt. I create the hash by doing the following: def sha256_rounds(raw, rounds=100001): obj = ...
9
votes
4answers
240 views

Who will notice a data breach more likely, me or an online password manager?

Assuming somebody has managed to get your encrypted password database. If the encryption and the password are strong I assume it will be almost impossible to crack the encryption in a lifetime, but ...
8
votes
3answers
13k views

Creating username policies and best practices

I have found a tonne of information on password policy all over the Internet and several best practices checklists. However from a username point of view I could not find much. I thought it would be ...
12
votes
1answer
2k views

Comparison between Firefox password manager and chrome password manager

As a follow up to Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?, I would like to know how firefox's password manager compares, if you have a master password and ...
3
votes
4answers
3k views

Random password vs null password?

We are migrating some users to a new database from a legacy app's database and have written a script to pull the users and all their data from an existing database. As the user's passwords are hashed ...
0
votes
0answers
38 views

Credentials visible to ps (process analyzer)

I use the pass password manager on linux. I can use it to script shell commands that involve credentials without those creds showing up in my command-line history, e.g. foo-cli --password=$(pass show ...
570
votes
23answers
136k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
3
votes
4answers
5k views

Hardware-Based Password Manager

Folks, I'm trying to improve my password management, and I have a vision in mind for a solution. However, I'm having a problem putting it all together or finding a product(s) that fits. First I ...
1
vote
3answers
386 views

Managing db credentials for web applications

Is there an alternative to properties files for managing DB (and other service) connection credentials for a group of web applications? Couldn't you use something similar to a service registry? For ...
1
vote
1answer
132 views

Concerns regarding a password manager web app [closed]

I've written a password manager in JavaScript. It works in a browser. Try it out Are there any fundamental issues with the concept of a web based password manager? Should I be concerned if hashes ...
3
votes
2answers
234 views

Is there a cryptographic disadvantage to applying bcrypt to an already hashed password

I originally asked this on stackoverflow, but due to lack of traction and a recommendation by a user there I have asked it here too. Imagine a scenario where a client application is sending a ...
2
votes
2answers
90 views

Is it OK to use a part of an e-mail as a master password of my password management?

I only memorized my e-mail's password. Every other passwords I use are stored on a password manager. I used to hide a long random string in a fake e-mail in my inbox as my password manager's master ...
3
votes
2answers
2k views

What is at risk if I do not validate Confirm Password on server side and only perform this validation on client side?

While changing password, in my application I am performing only JS validation for password and confirm password field values. It is recommended to have server side validations. But confirm password ...
3
votes
2answers
138 views

How should large organisations manage credentials?

How should large companies store credentials for important systems, such as root access to an integral machine (e.g. high-traffic web server), or social media accounts?
18
votes
2answers
4k views

How Often Should I Change my Passwords

I am using a password manager, and have optimized all my passwords so they are complex, long, and unique. I am wondering if there are any guidelines as to if I should still change my passwords from ...
0
votes
0answers
46 views

Why are there password length limitations when the password is stored correctly? [duplicate]

I often (almost always) see that the password i choose in a service is limited (to 16, 30, whatever characters). Are there any reasons for such a limit, provided that it is stored correctly? In such ...
2
votes
1answer
93 views

Secure Key Storage

We have a security solution that is deployed on premise to companies with big technical infrastructures. We do real time vulnerability/configuration assessment of all critical assets in the network. ...
-2
votes
1answer
1k views

Storing SSH credentials, need to decrypt them later for connection by python script

I am developing an application where one can add SSH credentials for servers and then an automated python script can fetch those credentials to login to the server and perform certain automated tasks. ...
0
votes
2answers
143 views

How do large corporations manage accesses guarding? [closed]

I work in a financial institution and we're planning a protocol about access guarding. After a lot of discussion we brake into the question: how to ensure that the accesses (users, passwords, tokens......
4
votes
2answers
919 views

iPhone - logging out user when app goes into background

Our (financial/banking) mobile app requires user to enter username/password in order to get data via webservice calls. Once user is logged in, credentials are stored in global variable until user logs ...
59
votes
12answers
4k views

How do you log in from an unsecured computer?

Suppose that you are on a cybercafe, at a friend's home or at your work office, and you need to log in on a site, but you feel that the the computer can not be trusted (e.g. your friend isn't tech-...
3
votes
4answers
380 views

How to make sure that a password manager is not malicious?

Should I disable automatic updates of password management software, such as KeePass? Is there a way to block the software's server from accessing the internet? What if someone in the company adds a ...
0
votes
2answers
103 views

Isn't password storage designed to not un-mask passwords?

Twitter revealed that its passwords got unmasked in internal logs. But correct me if I am wrong, passwords are never unmasked, right? E.g. if the plaintext is "password", it is stored as "#masked". ...
31
votes
9answers
7k views

What considerations do I need to keep in mind when enforcing passphrases?

According to XKCD: Password Strength, if the password consists of “four random common words”, it will be secure and memorable. I want to make a web application and make users create their passwords ...
0
votes
1answer
113 views

Should we use different usernames for each website, to achieve better anonymity?

I have big problems trying to remember different usernames for each site. Chrome remembers only passwords, so I should install a password manager, however it's crazy you have to do that in order to do ...
3
votes
5answers
11k views

How secure is a password protected file?

I have a password-protected excel file that stores other personal passwords. Obviously there have been a number of ways to crack the password. community.spiceworks.com Where do you guys store ...
2
votes
3answers
190 views

Why shouldn't my client just send the user's username and password with every request?

I have a PHP server and an Android/iOS client, and SSL is used for all communication. The PHP server is a JSON API with 2 public functions (register, login) and many private functions (which require ...
1
vote
3answers
4k views

How to decrypt a password for recovery with php [duplicate]

I have a website that people can sign up for and sign in to. I would like to implement a password recovery system that sends you the decrypted password. When the user signs up, the password is salted ...
1
vote
1answer
167 views

Security on passwords stored by Firefox vs password manager

I am wondering about the safety of my passwords stored in FF > 57. I guess passwords stored in a Keepass database file are safe against cracking, as much as possible given its AES algorithm. Are ...
0
votes
1answer
89 views

Security on passwords stored by Firefox, against add-ons

I am wondering how safe are my passwords stored in the passwords manager built into Mozilla Firefox. Currently I am using Firefox Quantum 59.0.2 64-bit under Ubuntu 16.04 in one machine. I guess ...
91
votes
7answers
95k views

Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?

Justin Schuh defended Google's reasoning in the wake of this post detailing the "discovery" (sic) that passwords saved in the Chrome password manager can be viewed in plaintext. Let me just directly ...
1
vote
1answer
212 views

How to share “secure” account credential with my spouse?

Not sure if this is the right place to ask, but here goes: My spouse and I have 20-ish or so accounts (retirement, investment, banks, insurances, tax, etc.) where I would we both would like to have ...