Questions tagged [password-management]

The functions performed by the person or processes responsible for security of passwords on a given system.

Filter by
Sorted by
Tagged with
1 vote
1 answer
141 views

How do sites detect credential sniffing, and what is the purpose of this attack?

I just got an email from the Unsplash service telling me that someone had logged into my account via credential sniffing: Five minutes later I get three more emails, each one notifying that a (...
7 votes
5 answers
395 views

Owner vs IT employee. Security and passwords

I own a company that has hired an IT employee. He has all passwords to servers, work stations and data. He is refusing to share or supply these passwords (Keys to the Kingdom) on the grounds of ...
  • 71
24 votes
7 answers
5k views

Are algorithmically-generated personal passwords a security risk?

We all know why password reuse is bad: eventually some site at which you have an account that did not properly hash+salt user passwords will get hacked, and your password will be published in a big ...
1 vote
1 answer
198 views

Concatenating secure and reused passwords

Would concatenating (i.e. joining together into one string of text) a secure (i.e. Diceware) password and other, much less random, passwords be a good idea? This new password would be used as master ...
1 vote
0 answers
250 views

Is there a way to create a fake password on Linux that would trigger a specific action?

Think of the worst possibility: Someone has your laptop and you are being coerced into giving them your password. Can my Linux (I'm thinking of Arch) system be configured in a way that when a specific ...
  • 111
1 vote
0 answers
156 views

How is Firefox importing credentials from other browsers without the need for the admin password?

Im currently looking into the security of different browser password storing mechanisms. My main focus lies on the new Chromium based Microsoft Edge browser. As far as I can see, Chromium based ...
  • 113
1 vote
1 answer
291 views

Can I use the same password for my Computer, Mobile and Password Manager?

I am considering using the same password for my Computer, Mobile and Password Manager. The premise of the "password reusing is bad" rule is that if one website leak the password then all of ...
  • 143
0 votes
1 answer
107 views

Are there remote exploits that are easier to perpetrate than installing a keylogger on a standard win10 laptop?

I'm trying to improve my wife's password hygiene, and have now finally got her to use different passwords for different sites. She now has trouble remembering to keep the book of them to hand. She ...
  • 163
0 votes
0 answers
268 views

Saving secrets (API-keys for external application) per user in database (PKI?)

I'm developing a web-app which communicates with an external email message application through its HTTP API. My web-app consists of a JS (Svelte) front-end and a Node.js back-end. Each user on my app ...
0 votes
0 answers
132 views

Storing Private Key Files on Android 10 as a User

Say I have a private key as a user of an existing application for SSH, password management, etc. As far as I know if it is in shared storage, any application with storage permissions can access it. If ...
  • 1
7 votes
4 answers
5k views

Storing Username and salt in separate table

You have a User table: UserID (auto-incrementing Integer) Password hash LastLogin All related tables are linked by the UserID. You also have a Username table: Username Salt IncorrectLoginCount ...
1 vote
2 answers
234 views

Encrypting a password with its own hash

I just found out that an e-commerce platform (similar to Shopify) I was planning on using allows me to see my password. I know I can't assume anything and I should (probably) just run away from it, ...
0 votes
0 answers
93 views

Review of the design of Credentials Manager app

I want to make a mobile app that will act as a Credentials Manager and store all my access information for websites, credit cards, secure notes, and so on on the server encrypted with REST API. The ...
  • 101
0 votes
0 answers
69 views

Providing shared access to a single machine without a shared account

In our factory we have a "Big Machine" which runs 24/7 and requires input and monitoring from different operators across various shifts. Every operator needs to be able to stop/start/control ...
  • 141
0 votes
1 answer
250 views

How to use password certificate in code securely

I have a piece of code that is using a certificate for authentication with a cloud service. The certificate is stored locally, and is protected by a password - thus what the developers did is to ...
0 votes
0 answers
48 views

Is storing passwords in encrypted container still bad practice? [duplicate]

Suppose I need to store a bunch of passwords: storing them in a txt or odt file inside an encrypted container, such as the ones produced by VeraCrypt, is bad practice? Would I put myself at risk? If ...
  • 101
1 vote
1 answer
856 views

Why limit password length?

This question is inspired by Is there any security risk in not setting a maximum password length?. Specifically the accepted answer https://security.stackexchange.com/a/238033/9640 says limits are ...
  • 1,570
1 vote
1 answer
212 views

Securely storing a master key client-side

My company is currently evaluating a product which comes with a browser-extension-based password manager. The password manager is peripheral to their core product, but is the only way to use it. We're ...
2 votes
2 answers
282 views

Security of master password in a derived password manager

I am aware of other questions asking similar things as this one, but I believe this design addresses many of the issues raised in those questions. I'm also not concerned with making sure there's no ...
  • 21
2 votes
0 answers
312 views

Is storing an encrypted 2FA backup on Bitwarden (a password manager) a good idea?

I am at the moment using Bitwarden and a separate 2FA app. I am trying to figure out a way to be able to securely recover my access to credentials and 2FA in case my phone/laptop/other electronic ...
1 vote
1 answer
703 views

MySQL password rotation: Using a single user to change other user passwords

I'm currently working on setting up a password rotation strategy for an AWS Aurora/MySQL based application. My plan was to use a strategy like this... Application usernames/passwords stored in AWS ...
0 votes
1 answer
86 views

Protect password from apache user by making file executable-only

I (will) have a binary executable file. It's only permission is user-execute. It cannot be read by user, group, or world. The owner of the file is the Apache user. I don't want the apache user to be ...
  • 105
5 votes
2 answers
733 views

How Are Google Chrome Synced Passwords Encrypted If I Can Reset the Password to My Account

Services like Dashlane and Bitwarden are unable to decrypt your passwords without your Master Password. So, how does Chrome do it when they also state that your passwords are encrypted using your ...
  • 53
4 votes
0 answers
892 views

How secure is pass compared to Keepass?

Is pass a real alternative to Keepass in terms of security? While Keepass has its own built-in encryption, pass relies on GPG to secure your passwords. GPG is obviously recognized as providing ...
0 votes
2 answers
675 views

Encrypting a salted password hash with RSA before storing in a database [duplicate]

Why is it a bad idea to encrypt a salted password hash with RSA (or maybe other public-key algorithm) before storing it?
  • 105
0 votes
1 answer
369 views

Where and how to store admin account credentials for enterprise systems?

To my understanding, password-protected spreadsheets are not best practice for storing admin creds, whether it's a company of 5 people or a company of 50,000 people. In such a case, what are some best ...
17 votes
2 answers
12k views

How safe is it to store your passwords in a modern browser?

There's a few questions here along these same lines already, but they're nearly a decade old. I'd like to know if things have changed, especially now that Chrome has become more aggressive about ...
0 votes
1 answer
273 views

Is using Argon2 with a public random on client side a good idea to protect passwords in transit?

Not sure if things belongs in Crypto SE or here but anyway: I'm building an app and I'm trying to decide whatever is secure to protect user passwords in transit, in addition to TLS we already have. In ...
2 votes
0 answers
244 views

Is it possible to use Argon2id hashes with PAM?

I was wondering if it's possible to implement more secure KDF like bcrypt, scrypt, pbkdf2 and argon2id in PAM authentication. Ideally I would like to have their hashes instead of SHA-512 ones directly ...
  • 63
3 votes
4 answers
259 views

How do I minimize the number of passwords leaked when a PC gets compromized?

For customer support reasons, we need to store passwords to some of our customers' systems (with their explicit, written permission, of course), as well as, obviously, passwords to some of our own ...
  • 2,944
0 votes
0 answers
105 views

Does hashing client-side increase attack surface (assuming TLS and serverside salt+hash)? [duplicate]

This question asks whether one should hash on the client or the server. I want to know if there is any reason, aside from having to maybe handle one extra hashing library (if it's not already in your ...
100 votes
12 answers
16k views

How do very big companies manage their most important passwords / keys?

Third-party password managers such as 1password, etc. are useful for people, businesses, etc. to store passwords. But I bet Facebook, Google, Twitter and other super big tech companies don't use such ...
  • 951
0 votes
1 answer
737 views

Using GPG as password manager

I want to use GPG as a master password storage (encrypt and push to online storage). This would require encrypted file being able to be decrypted on multiple machines. Two computers comp1 and comp2 ...
  • 147
8 votes
2 answers
1k views

How does a shared vault in password managers such as 1Password work?

The password manager 1Password has a feature where multiple accounts in a group ("family") can share login information with each other. From my understanding, a password manager is never ...
11 votes
3 answers
4k views

Safe storage for multiple passwords for multiple accounts

I've had this difficulty for a while, and I hope to get some feedback or referral to the sites where this problem may be discussed. Nowadays all of us have multiple accounts, both personal and work-...
  • 107
4 votes
0 answers
183 views

How vulnerable are password managers in the real world?

I'm a senior undergraduate majoring in computer science. I recently took a computer security class where instead of exams we had a final project that could be anything related to computer security. So ...
0 votes
4 answers
316 views

Password is visible in online sign up form

I am about to sign up for an online school, which is an accredited statewide online school, and notice that the password they want me to enter is fully visible on the form. Should I be concern about ...
  • 113
1 vote
2 answers
729 views

Can a Keypass file theoretically be cracked offline?

So you create a .kbdx file, protected by a password. AFAIK in asymmetric key schemes and in WPA-AES brute-forcing consists of: Trying a random password on the private key / on the router If it doesn'...
  • 1,907
1 vote
1 answer
128 views

Storing the password to a vault in the vault itself?

Is there an additional risk associated with storing the master password to a vault inside the vault itself? I would assume not, since in order to decrypt the vault you must already have that password. ...
  • 450
27 votes
7 answers
6k views

Where should I store a username during a password reset?

I am new to web development and am trying to implement a password reset feature according to the OWASP cheat sheets: Forgot Password Cheat Sheet The cheat sheet advises not to send the username as a ...
  • 388
2 votes
2 answers
124 views

Are there any known attacks (technical or social) against enterprises where password resets are scheduled on fixed (known) intervals?

A company I know of has a password policy that requires employees to change passwords (on AD server) every 90 days. The vast majority of its new hires start on the 1st of the month. Thus, several ...
0 votes
1 answer
143 views

Having a backdoor password for each user to allow impersonation

For some context, I want my api to be able to 'impersonate' (or connect as) a user on my ldap database as most of the api's access controls are on the ldap database and tied to the user you are ...
  • 43
0 votes
0 answers
104 views

Dedicated device for online investing and other security measures

I like to invest money online. I invest in both cryptocurrencies as well as regular stocks. As my bankroll grows (let's say 20k+ in the near future), I feel like I need to start taking more serious ...
2 votes
2 answers
390 views

Attacks against unencrypted android phones?

So, I keep reading again and again that one should encrypt his android device. But from an attacker's perspective, what can be done with an unencrypted phone? Can I extract all the files or possibly ...
7 votes
5 answers
4k views

Specific character based policy for passwords

I'm wondering, would it be clearer to declare a company wide requirement with regard to password theoretical entropy, rather than the usual "at least one big letter, and a small latter, and special ...
  • 689
0 votes
1 answer
171 views

How to detect passwords in wiki pages?

Is it possible to use any automated scanning tool in order to detect stored passwords in our internal wiki pages?
  • 157
1 vote
2 answers
290 views

Are password managers still effective on a cloud PC (virtual machine)?

I have recently started using a cloud gaming service. It provides me with control of a 'remote PC' (actually a virtual machine running in their data centre) accessed through an app or VNC console. The ...
  • 162
0 votes
1 answer
470 views

`pass` not asking for password anymore - gnome-keyring or gpg-agent related? How can I force password asking?

I cross-posted this on the manjaro forums and on server fault. So far no answer, so trying here. I have gnome-keyring running for sure, not sure it's gnome-keyring or gpg-agent or ssh-agent related......
0 votes
1 answer
93 views

Credential theft by browser conferencing software?

While using the webex conference software, I noticed that simply pressing a "share content" button allows me to share my full screen. There was no security confirmation from my webbrowser (chrome): I ...
  • 103
0 votes
1 answer
185 views

What vulnerabilities would this type of "password manager" have?

When I was searching for a password manager to use I stumbled upon the concept of Master Password which instead of encrypting and saving your passwords, generates them by using your master password ...
user avatar

1 2
3
4 5
26