Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

Filter by
Sorted by
Tagged with
2
votes
1answer
532 views

Storing 2FA seeds in a password manager [duplicate]

Does it make sense to store the 2FA seeds (i.e: the codes used to generate a time based OTP) in my password manager? If my password manager has a strong password and 2FA using a third-party app, is ...
1
vote
0answers
391 views

Are Brave Browsers Sync encryption parameters secure enough?

I am considering switching over to Brave and maybe also use it's sync feature for settings, and maybe even passwords if it's good enough. I do use a password generator but out of laziness I happen to ...
23
votes
2answers
3k views

Why do password requirements exist while limiting the upper character count? [duplicate]

I do not quite understand why it is common practice to require a difficult to remember password with alphanumeric and special character requirements, while also having an upper limit of 32 characters. ...
1
vote
0answers
233 views

Securing BIP39 Phrases and Password Manager Master Password

I am looking for a review of the solution to store my Ledger Nano S BIP39 recovery phrase as well as my password manager usage. This solution is mostly based on this video. Few points that I think ...
2
votes
1answer
1k views

Bitwarden and gamecontrollerd on OsX Big Sur

Recently, I came across an issue concerning a daemon named gamecontrollerd in OsX Big Sur. On my laptop I'm running ReiKey (from Objective-See), which aims at identifying possible Key Loggers that ...
4
votes
1answer
548 views

Relative security of 'offline' vs 'online' password managers

I am a long-standing KeePass user, but I find its browser integration and Android apps a bit ropey, and certainly harder work than a cloud-based solution such as Lastpass or Bitwarden. I have been ...
0
votes
0answers
146 views

Is there a better method that this for storing a physical password? [duplicate]

This may be a little unnecessary, but taking into consideration: There are many ways to hack a computer There are many ways to hack a network There is always a possibility of an undetected malware on ...
2
votes
1answer
398 views

How can Bitwarden claim it cannot access your passwords if the vault password is the same as the web account password?

Bitwarden claims that it is more secure than traditional cloud password managers (such as Google) as it only stores the encrypted version of the passwords database. But for some reason the password ...
1
vote
3answers
295 views

1Password security weakness?

I was considering creating a 1Password families account because I liked the idea that 1Password never has the information needed to decrypt my passwords; however, when I created an account, I entered ...
6
votes
2answers
275 views

Can password managers read my secure data? If no, how does sharing work under the hood? [duplicate]

All the popular password managers on the market advertise that they have AES-256 grade security. In a nutshell, the user has the master key and the password manager has the cipher-text. So the ...
3
votes
0answers
91 views

Can Chrome extensions access other Chrome extensions' data?

Can the data in a password-manager Chrome extension be accessed by a different Chrome extension? For example, if one were to install a malicious extension, could that extension access the data (i.e., ...
0
votes
1answer
159 views

Simplify usage of KeePass or equivalent password managers while preserving security

Situation I'm using KeePass to manage my password together with a long complicated password. I need to access passwords quite often so it's a little cumbersome to have to enter the password each time. ...
19
votes
7answers
6k views

Don't one-time recovery codes for 2FA introduce a backdoor?

Although using multi-factor authentication is clearly a good move, I'm struggling with the 'one-time recovery codes' concept. It seems to me that if you choose to use them, what you're doing is ...
0
votes
2answers
413 views

What happens if you forget your 1Password password?

When using a service like 1Password, what happens if you forget or lose your master password? My guess is that you can simply reset your passwords on all the sites 1password remembered for you, but I ...
1
vote
1answer
113 views

How do sites detect credential sniffing, and what is the purpose of this attack?

I just got an email from the Unsplash service telling me that someone had logged into my account via credential sniffing: Five minutes later I get three more emails, each one notifying that a (...
7
votes
5answers
290 views

Owner vs IT employee. Security and passwords

I own a company that has hired an IT employee. He has all passwords to servers, work stations and data. He is refusing to share or supply these passwords (Keys to the Kingdom) on the grounds of ...
24
votes
7answers
5k views

Are algorithmically-generated personal passwords a security risk?

We all know why password reuse is bad: eventually some site at which you have an account that did not properly hash+salt user passwords will get hacked, and your password will be published in a big ...
1
vote
1answer
144 views

Concatenating secure and reused passwords

Would concatenating (i.e. joining together into one string of text) a secure (i.e. Diceware) password and other, much less random, passwords be a good idea? This new password would be used as master ...
1
vote
0answers
165 views

Is there a way to create a fake password on Linux that would trigger a specific action?

Think of the worst possibility: Someone has your laptop and you are being coerced into giving them your password. Can my Linux (I'm thinking of Arch) system be configured in a way that when a specific ...
0
votes
0answers
110 views

How is Firefox importing credentials from other browsers without the need for the admin password?

Im currently looking into the security of different browser password storing mechanisms. My main focus lies on the new Chromium based Microsoft Edge browser. As far as I can see, Chromium based ...
1
vote
1answer
161 views

Can I use the same password for my Computer, Mobile and Password Manager?

I am considering using the same password for my Computer, Mobile and Password Manager. The premise of the "password reusing is bad" rule is that if one website leak the password then all of ...
0
votes
1answer
97 views

Are there remote exploits that are easier to perpetrate than installing a keylogger on a standard win10 laptop?

I'm trying to improve my wife's password hygiene, and have now finally got her to use different passwords for different sites. She now has trouble remembering to keep the book of them to hand. She ...
0
votes
0answers
156 views

Saving secrets (API-keys for external application) per user in database (PKI?)

I'm developing a web-app which communicates with an external email message application through its HTTP API. My web-app consists of a JS (Svelte) front-end and a Node.js back-end. Each user on my app ...
0
votes
0answers
79 views

Storing Private Key Files on Android 10 as a User

Say I have a private key as a user of an existing application for SSH, password management, etc. As far as I know if it is in shared storage, any application with storage permissions can access it. If ...
7
votes
4answers
4k views

Storing Username and salt in separate table

You have a User table: UserID (auto-incrementing Integer) Password hash LastLogin All related tables are linked by the UserID. You also have a Username table: Username Salt IncorrectLoginCount ...
0
votes
1answer
1k views

What is the plaintext password of 'hash part 1' in the shadow file?

on immersivelabs lab Password Hashes II https://dca.immersivelabs.online/labs/password-hashes-ii/ there is a question: What is the plaintext password of 'hash part 1' in the shadow file? shadow.txt ...
1
vote
2answers
216 views

Encrypting a password with its own hash

I just found out that an e-commerce platform (similar to Shopify) I was planning on using allows me to see my password. I know I can't assume anything and I should (probably) just run away from it, ...
0
votes
0answers
81 views

Review of the design of Credentials Manager app

I want to make a mobile app that will act as a Credentials Manager and store all my access information for websites, credit cards, secure notes, and so on on the server encrypted with REST API. The ...
0
votes
0answers
63 views

Providing shared access to a single machine without a shared account

In our factory we have a "Big Machine" which runs 24/7 and requires input and monitoring from different operators across various shifts. Every operator needs to be able to stop/start/control ...
0
votes
1answer
134 views

How to use password certificate in code securely

I have a piece of code that is using a certificate for authentication with a cloud service. The certificate is stored locally, and is protected by a password - thus what the developers did is to ...
0
votes
0answers
44 views

Is storing passwords in encrypted container still bad practice? [duplicate]

Suppose I need to store a bunch of passwords: storing them in a txt or odt file inside an encrypted container, such as the ones produced by VeraCrypt, is bad practice? Would I put myself at risk? If ...
1
vote
1answer
409 views

Why limit password length?

This question is inspired by Is there any security risk in not setting a maximum password length?. Specifically the accepted answer https://security.stackexchange.com/a/238033/9640 says limits are ...
1
vote
1answer
145 views

Securely storing a master key client-side

My company is currently evaluating a product which comes with a browser-extension-based password manager. The password manager is peripheral to their core product, but is the only way to use it. We're ...
1
vote
2answers
213 views

Security of master password in a derived password manager

I am aware of other questions asking similar things as this one, but I believe this design addresses many of the issues raised in those questions. I'm also not concerned with making sure there's no ...
2
votes
0answers
240 views

Is storing an encrypted 2FA backup on Bitwarden (a password manager) a good idea?

I am at the moment using Bitwarden and a separate 2FA app. I am trying to figure out a way to be able to securely recover my access to credentials and 2FA in case my phone/laptop/other electronic ...
1
vote
1answer
411 views

MySQL password rotation: Using a single user to change other user passwords

I'm currently working on setting up a password rotation strategy for an AWS Aurora/MySQL based application. My plan was to use a strategy like this... Application usernames/passwords stored in AWS ...
0
votes
1answer
79 views

Protect password from apache user by making file executable-only

I (will) have a binary executable file. It's only permission is user-execute. It cannot be read by user, group, or world. The owner of the file is the Apache user. I don't want the apache user to be ...
4
votes
1answer
425 views

How Are Google Chrome Synced Passwords Encrypted If I Can Reset the Password to My Account

Services like Dashlane and Bitwarden are unable to decrypt your passwords without your Master Password. So, how does Chrome do it when they also state that your passwords are encrypted using your ...
3
votes
0answers
626 views

How secure is pass compared to Keepass?

Is pass a real alternative to Keepass in terms of security? While Keepass has its own built-in encryption, pass relies on GPG to secure your passwords. GPG is obviously recognized as providing ...
0
votes
2answers
405 views

Encrypting a salted password hash with RSA before storing in a database [duplicate]

Why is it a bad idea to encrypt a salted password hash with RSA (or maybe other public-key algorithm) before storing it?
0
votes
1answer
168 views

Where and how to store admin account credentials for enterprise systems?

To my understanding, password-protected spreadsheets are not best practice for storing admin creds, whether it's a company of 5 people or a company of 50,000 people. In such a case, what are some best ...
14
votes
2answers
9k views

How safe is it to store your passwords in a modern browser?

There's a few questions here along these same lines already, but they're nearly a decade old. I'd like to know if things have changed, especially now that Chrome has become more aggressive about ...
0
votes
1answer
182 views

Is using Argon2 with a public random on client side a good idea to protect passwords in transit?

Not sure if things belongs in Crypto SE or here but anyway: I'm building an app and I'm trying to decide whatever is secure to protect user passwords in transit, in addition to TLS we already have. In ...
2
votes
0answers
158 views

Is it possible to use Argon2id hashes with PAM?

I was wondering if it's possible to implement more secure KDF like bcrypt, scrypt, pbkdf2 and argon2id in PAM authentication. Ideally I would like to have their hashes instead of SHA-512 ones directly ...
3
votes
4answers
250 views

How do I minimize the number of passwords leaked when a PC gets compromized?

For customer support reasons, we need to store passwords to some of our customers' systems (with their explicit, written permission, of course), as well as, obviously, passwords to some of our own ...
0
votes
0answers
93 views

Does hashing client-side increase attack surface (assuming TLS and serverside salt+hash)? [duplicate]

This question asks whether one should hash on the client or the server. I want to know if there is any reason, aside from having to maybe handle one extra hashing library (if it's not already in your ...
98
votes
12answers
15k views

How do very big companies manage their most important passwords / keys?

Third-party password managers such as 1password, etc. are useful for people, businesses, etc. to store passwords. But I bet Facebook, Google, Twitter and other super big tech companies don't use such ...
0
votes
1answer
427 views

Using GPG as password manager

I want to use GPG as a master password storage (encrypt and push to online storage). This would require encrypted file being able to be decrypted on multiple machines. Two computers comp1 and comp2 ...
6
votes
2answers
557 views

How does a shared vault in password managers such as 1Password work?

The password manager 1Password has a feature where multiple accounts in a group ("family") can share login information with each other. From my understanding, a password manager is never ...
11
votes
3answers
4k views

Safe storage for multiple passwords for multiple accounts

I've had this difficulty for a while, and I hope to get some feedback or referral to the sites where this problem may be discussed. Nowadays all of us have multiple accounts, both personal and work-...

1
2
3 4 5
26