Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
1,291
questions
6
votes
3
answers
729
views
Is it a bad idea to replace passwords with OTP?
As I understand things, given a user with proper password management (e.g. with a libre password manager like KeePassXC) the only realistic threat is having passwords leaked the following ways:
A: ...
- 199
0
votes
1
answer
93
views
Does a solution exist to permit account sharing without revealing the account password?
I'm looking for a process to replace the status quo of notepad and Excel. We've tested a market-leading password manager. An issue that comes up with this is that the secure sharing password facility ...
- 71
1
vote
1
answer
101
views
Web Application Sends Newly Registered Users Plaintext Password. Could you assume that passwords are not hashed in DB storage?
I was recently assessing a web application where during user registration the application would send a password reset link via email where the token portion of the URL was the following in base64:
<...
0
votes
1
answer
603
views
How do I properly secure my login using bcrypt in react and a python-flask backend?
I want to store the passwords of accounts hashed into a database that can be accessed through a python-flask application. When you would login, this python application is supposed to provide you with ...
- 3
0
votes
0
answers
113
views
Reuse IV for KDF and Encryption
So I am writing a password manager (mostly low value, application specific passwords) for a game. I need a way to store a password safely. Light reading suggests using a key derivation function (like ...
0
votes
0
answers
125
views
What are the advantages of password "leasing"
One the Hashicorp Vault basic feature is secret leasing. They state:
Leasing and Renewal: All secrets in Vault have a lease associated with them. At the end of the lease, Vault will automatically ...
- 101
2
votes
1
answer
145
views
Password Based Encryption with Social Login
I have a question about implementing user password-based encryption in a database injunction with the Social Login feature.
User private data in my database should be encrypted in order to provide ...
0
votes
1
answer
220
views
How to change the password hashing scheme in LDAP using an external library with slapd.d config
I am trying to change the password hashing scheme for LDAP. Hypothetically, let's assume it's pw-argon.so
I don't have slapd.conf I have the slapd.d directory where I can make changes dynamically to ...
1
vote
0
answers
66
views
Constraints on the password imposed by m209 on first password management
I was going through the paper Password Security: A Case History By Robert Morris and Ken Thompson on authentication. It has been mentioned in the First Scheme that the first encryption used m209, in ...
0
votes
1
answer
433
views
Storing OTP seeds in password manager [duplicate]
I am storing my passwords in a password manager (keepass). Also I am using keepass to set up one-time passwords for some accounts. Keepass is storing the seeds of the OTP's in its database.
If my ...
- 101
0
votes
1
answer
255
views
Should email password be encrypted in a django app when using TLS?
I have seen multiple videos/tutorials regarding how to setup the email system in Django.
It seems that they all assume as long as the password is stored in an environmental variable, no encryption is ...
- 101
1
vote
0
answers
91
views
I need to secure my access to SQL Server for application accounts, but no one can know the application passwords. How?
Here's our scenario. I have a NodeJS server running that connects to a Microsoft SQL Server using an application account (SQL Basic Auth). The Username and Password were stored in the configuration ...
- 111
0
votes
1
answer
722
views
VeraCrypt: Is it possible to change the master key?
The password in VeraCrypt is used to en-/decrypt a header, that contains a master key, that is used to en-/decrypt the data.
I know, that I can change the password, which will not change the master ...
- 1,633
0
votes
4
answers
264
views
Forget Me Not? Abandoning the Forgot Password Functionality
They say a chain is only as secure as its weakest link. When it comes to account security it seems to me that the Forgot My Password functionality is the weakest link in the security chain because it ...
- 141
1
vote
2
answers
578
views
Safe or Unsafe to Store Passwords in Chrome on MacOS?
I've seen conflicting opinions on this, more than the below, but i.e.
Unsafe: https://www.techrepublic.com/article/why-you-should-never-allow-your-web-browser-to-save-your-passwords/
Safe: https://...
- 356
0
votes
2
answers
103
views
Are there security concerns that might prevent database systems from providing password data types?
Software development environments seem to benefit when problems can be solved "higher up the chain".
For example, many web platform features that are now natively supported in both ...
- 422
4
votes
1
answer
396
views
How does Firefox protect Logins and Credit Card Data?
I have a question about how Firefox protects Login information (Website passwords) on the one hand and Credit Card data on the other. I noticed that there are two different approaches to how Login ...
- 153
0
votes
1
answer
143
views
Creating a unique password for each device/unit of the same product
We are currently working on an IoT product & having a hard time coming up with a strategy to create a unique password for each device/unit.
I do understand that password based on a function of { ...
1
vote
1
answer
180
views
Protection against different attack vectors, password manager
I'm a software dev working on an open-sourced password manager(dev lib, gui and cli) for educational and eventually usefulness purposes. There doesn't seem to be all that much information regarding ...
- 11
0
votes
0
answers
240
views
Where to store passwords needed by linux processes?
I am working with C++ processes on a linux (CentOS 8) environment. These processes should be able to access an encrypted file on the system.
Where should I store the password for this encrypted file?
...
- 65
1
vote
3
answers
273
views
Using Password Managers to store multiple factors, would this reduce security? [duplicate]
Assume I have a password manager that stores the credentials for a login to a 3rd party service. In this credentials the username, password and a TOTP-seed is stored and the current TOTP-token is ...
- 707
0
votes
0
answers
45
views
Why would I need a password manager when I use 2FA? [duplicate]
I have come across many questions concerning what security benefit 2FA provide a password manager. (e.g. this question)
On the other hand, if I already use 2FA, why would I need a password manager? ...
- 1
3
votes
1
answer
576
views
How bad is it to store credentials in clear text on disk and in memory?
Yeah, it depends. A good answer would provide some reflections on this. I have two concrete scenarios in mind, in two concrete (and I believe common) contexts. Context 1. At home, you’re the only one ...
- 183
1
vote
0
answers
164
views
How should I store a password used by a service written in .NET
I have a Windows service that accesses a database connection. Since users rarely use Windows authentication, I encrypt the connection string. For development I have the password hard-coded, but I know ...
- 11
2
votes
0
answers
189
views
Why does the CIS benchmark consider the presence of passwd- a (high) risk [closed]
I've just seen a "high-risk security alert" for the presence of /etc/passwd- (note the trailing '-') on RHEL 8 servers, and don't understand the issue. Apparently the issue originates with ...
- 139
0
votes
1
answer
116
views
Password hashing for local servers
I'm running a local web server on my Raspberry Pi and want to have a login screen. My plan is to hash the password and store the result in a text file ( This is where I'm storing settings for the ...
4
votes
1
answer
447
views
Security risks of OAuth vs a password manager
Of the following two approaches, which is "more secure", under which circumstances, and why? In other words, please compare the security risks of these two approaches:
Log in to an OAuth ...
- 201
1
vote
0
answers
308
views
What are the security risks to NFC based YubiKeys?
What are the risks of using NFC on a YubiKey versus just a hard connector?
I imagine it would be possible to sniff some data off of these security keys? How real is the risk of sniffing and what could ...
- 113
0
votes
0
answers
35
views
What characters should, and should I absolutely not use in generated passwords? [duplicate]
I'm currently setting up a KeePass database after switching over from another password manager, and it has the option to change the character set for generating a password.
This has a lot of options, ...
- 1
1
vote
0
answers
113
views
Why do I receive so many password reset/welcome emails from services I'm not a customer of? [closed]
Over the years I've received the occasional password reset from a service I've never used (or even heard of sometimes). As far as I can tell, the emails are genuinely being generated and sent by the ...
- 111
0
votes
1
answer
126
views
Does syncing local data to the cloud count as MFA?
Bitwarden uses TOTP as the multi-factor authenticator method for their password manager. Bitwarden stores and syncs your data so you need the master password + TOTP to get access to your account
...
- 819
1
vote
1
answer
824
views
Is it safe to use 2FA within a password manager relative to using a separate app for 2FA? [duplicate]
Nowadays, many Password managers offer options for 2-Factor Authentication such as TOTP. I am really confused regarding this. Isn't the whole point of 2FA is to prove you have a second way of proving ...
- 2,672
2
votes
1
answer
232
views
Dangers of using the web applications provided by password managers
The password manager bitwarden requires the user to log in to their account on their web site to allow them to enable 2FA, import passwords and manage other account related details, as that ...
- 51
3
votes
2
answers
330
views
Password for embedded devices in automatic deployment
We are working with commercial embedded devices, where we install our software. Then, they are deployed in different client sites. The embedded devices have an Ethernet port and a console port for ...
- 131
10
votes
3
answers
2k
views
Why would password managers provide support for OTP codes? [duplicate]
Can anyone explain me what's this trend of providing passwords and OTP codes on the same service? What benefit or value are they trying to bring to the table?
We, as security professionals, have been ...
user15194
6
votes
1
answer
358
views
How does LastPass know that I used the same passphrase with another service?
So today I switched from Lastpass (chrome extension and iOS app) to bitwarden.
So far so good, it was really easy to export my lastpass data and import it in bitwarden however what I am wondering is ...
- 163
1
vote
2
answers
595
views
Hashing bcrypt password hash for use as a password reset token
There is an existing user database that has the following columns:
userId (v4 uuid)
created timestamp
bcrypt password hash
email
I must add a password reset functionality and I cannot add any new ...
- 113
4
votes
0
answers
153
views
Is asking the e-banking username/password from a 3rd party site compliant with 3dsecure and PSD2?
Recently I tried to make an online purchase in one of the biggest e-commerce sites in Greece.
During checkout, and after providing debit card details, it asked me to provide the username/password (not ...
0
votes
1
answer
221
views
How Forgot Password Works?
For my website I need to add "forgot password" functionality. As I searched on the internet there are too much vulnerabilities you may encounter in case of wrong implementing this ...
- 3
0
votes
1
answer
633
views
Is using SHA256 to create 256bit secret key from bcrypt good ok?
I am trying to Use AES to store passwords for a password manager. For authentication I am already using bcrypt. As AES uses 256 bit Key can I use SHA256 to generate 256 bit key from hashed value of ...
2
votes
1
answer
960
views
Storing 2FA seeds in a password manager [duplicate]
Does it make sense to store the 2FA seeds (i.e: the codes used to generate a time based OTP) in my password manager?
If my password manager has a strong password and 2FA using a third-party app, is ...
- 819
1
vote
0
answers
547
views
Are Brave Browsers Sync encryption parameters secure enough?
I am considering switching over to Brave and maybe also use it's sync feature for settings, and maybe even passwords if it's good enough. I do use a password generator but out of laziness I happen to ...
- 125
23
votes
2
answers
4k
views
Why do password requirements exist while limiting the upper character count? [duplicate]
I do not quite understand why it is common practice to require a difficult to remember password with alphanumeric and special character requirements, while also having an upper limit of 32 characters. ...
- 357
1
vote
0
answers
305
views
Securing BIP39 Phrases and Password Manager Master Password
I am looking for a review of the solution to store my Ledger Nano S BIP39 recovery phrase as well as my password manager usage.
This solution is mostly based on this video.
Few points that I think ...
- 111
2
votes
1
answer
1k
views
Bitwarden and gamecontrollerd on OsX Big Sur
Recently, I came across an issue concerning a daemon named gamecontrollerd in OsX Big Sur.
On my laptop I'm running ReiKey (from Objective-See), which aims at identifying possible Key Loggers that ...
- 21
4
votes
1
answer
857
views
Relative security of 'offline' vs 'online' password managers
I am a long-standing KeePass user, but I find its browser integration and Android apps a bit ropey, and certainly harder work than a cloud-based solution such as Lastpass or Bitwarden. I have been ...
- 41
0
votes
0
answers
197
views
Is there a better method that this for storing a physical password? [duplicate]
This may be a little unnecessary, but taking into consideration:
There are many ways to hack a computer
There are many ways to hack a network
There is always a possibility of an undetected malware on ...
2
votes
1
answer
681
views
How can Bitwarden claim it cannot access your passwords if the vault password is the same as the web account password?
Bitwarden claims that it is more secure than traditional cloud password managers (such as Google) as it only stores the encrypted version of the passwords database. But for some reason the password ...
- 1,046
1
vote
3
answers
419
views
1Password security weakness?
I was considering creating a 1Password families account because I liked the idea that 1Password never has the information needed to decrypt my passwords; however, when I created an account, I entered ...
- 143
6
votes
2
answers
317
views
Can password managers read my secure data? If no, how does sharing work under the hood? [duplicate]
All the popular password managers on the market advertise that they have AES-256 grade security. In a nutshell, the user has the master key and the password manager has the cipher-text. So the ...
- 163