Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
1,287
questions
1
vote
1
answer
141
views
How do sites detect credential sniffing, and what is the purpose of this attack?
I just got an email from the Unsplash service telling me that someone had logged into my account via credential sniffing:
Five minutes later I get three more emails, each one notifying that a (...
- 979
7
votes
5
answers
395
views
Owner vs IT employee. Security and passwords
I own a company that has hired an IT employee. He has all passwords to servers, work stations and data. He is refusing to share or supply these passwords (Keys to the Kingdom) on the grounds of ...
- 71
24
votes
7
answers
5k
views
Are algorithmically-generated personal passwords a security risk?
We all know why password reuse is bad: eventually some site at which you have an account that did not properly hash+salt user passwords will get hacked, and your password will be published in a big ...
- 359
1
vote
1
answer
198
views
Concatenating secure and reused passwords
Would concatenating (i.e. joining together into one string of text) a secure (i.e. Diceware) password and other, much less random, passwords be a good idea? This new password would be used as master ...
- 163
1
vote
0
answers
250
views
Is there a way to create a fake password on Linux that would trigger a specific action?
Think of the worst possibility: Someone has your laptop and you are being coerced into giving them your password.
Can my Linux (I'm thinking of Arch) system be configured in a way that when a specific ...
- 111
1
vote
0
answers
156
views
How is Firefox importing credentials from other browsers without the need for the admin password?
Im currently looking into the security of different browser password storing mechanisms. My main focus lies on the new Chromium based Microsoft Edge browser.
As far as I can see, Chromium based ...
- 113
1
vote
1
answer
291
views
Can I use the same password for my Computer, Mobile and Password Manager?
I am considering using the same password for my Computer, Mobile and Password Manager.
The premise of the "password reusing is bad" rule is that if one website leak the password then all of ...
- 143
0
votes
1
answer
107
views
Are there remote exploits that are easier to perpetrate than installing a keylogger on a standard win10 laptop?
I'm trying to improve my wife's password hygiene, and have now finally got her to use different passwords for different sites. She now has trouble remembering to keep the book of them to hand. She ...
- 163
0
votes
0
answers
268
views
Saving secrets (API-keys for external application) per user in database (PKI?)
I'm developing a web-app which communicates with an external email message application through its HTTP API. My web-app consists of a JS (Svelte) front-end and a Node.js back-end.
Each user on my app ...
0
votes
0
answers
132
views
Storing Private Key Files on Android 10 as a User
Say I have a private key as a user of an existing application for SSH, password management, etc.
As far as I know if it is in shared storage, any application with storage permissions can access it.
If ...
- 1
7
votes
4
answers
5k
views
Storing Username and salt in separate table
You have a User table:
UserID (auto-incrementing Integer)
Password hash
LastLogin
All related tables are linked by the UserID.
You also have a Username table:
Username
Salt
IncorrectLoginCount
...
- 73
1
vote
2
answers
234
views
Encrypting a password with its own hash
I just found out that an e-commerce platform (similar to Shopify) I was planning on using allows me to see my password. I know I can't assume anything and I should (probably) just run away from it, ...
0
votes
0
answers
93
views
Review of the design of Credentials Manager app
I want to make a mobile app that will act as a Credentials Manager and store all my access information for websites, credit cards, secure notes, and so on on the server encrypted with REST API.
The ...
- 101
0
votes
0
answers
69
views
Providing shared access to a single machine without a shared account
In our factory we have a "Big Machine" which runs 24/7 and requires input and monitoring from different operators across various shifts. Every operator needs to be able to stop/start/control ...
- 141
0
votes
1
answer
250
views
How to use password certificate in code securely
I have a piece of code that is using a certificate for authentication with a cloud service.
The certificate is stored locally, and is protected by a password - thus what the developers did is to ...
- 39
0
votes
0
answers
48
views
Is storing passwords in encrypted container still bad practice? [duplicate]
Suppose I need to store a bunch of passwords: storing them in a txt or odt file inside an encrypted container, such as the ones produced by VeraCrypt, is bad practice? Would I put myself at risk?
If ...
- 101
1
vote
1
answer
856
views
Why limit password length?
This question is inspired by Is there any security risk in not setting a maximum password length?.
Specifically the accepted answer https://security.stackexchange.com/a/238033/9640 says limits are ...
- 1,570
1
vote
1
answer
212
views
Securely storing a master key client-side
My company is currently evaluating a product which comes with a browser-extension-based password manager. The password manager is peripheral to their core product, but is the only way to use it. We're ...
- 11
2
votes
2
answers
282
views
Security of master password in a derived password manager
I am aware of other questions asking similar things as this one, but I believe this design addresses many of the issues raised in those questions. I'm also not concerned with making sure there's no ...
- 21
2
votes
0
answers
312
views
Is storing an encrypted 2FA backup on Bitwarden (a password manager) a good idea?
I am at the moment using Bitwarden and a separate 2FA app.
I am trying to figure out a way to be able to securely recover my access to credentials and 2FA in case my phone/laptop/other electronic ...
1
vote
1
answer
703
views
MySQL password rotation: Using a single user to change other user passwords
I'm currently working on setting up a password rotation strategy for an AWS Aurora/MySQL based application.
My plan was to use a strategy like this...
Application usernames/passwords stored in AWS ...
- 905
0
votes
1
answer
86
views
Protect password from apache user by making file executable-only
I (will) have a binary executable file. It's only permission is user-execute. It cannot be read by user, group, or world. The owner of the file is the Apache user. I don't want the apache user to be ...
- 105
5
votes
2
answers
733
views
How Are Google Chrome Synced Passwords Encrypted If I Can Reset the Password to My Account
Services like Dashlane and Bitwarden are unable to decrypt your passwords without your Master Password.
So, how does Chrome do it when they also state that your passwords are encrypted using your ...
- 53
4
votes
0
answers
892
views
How secure is pass compared to Keepass?
Is pass a real alternative to Keepass in terms of security?
While Keepass has its own built-in encryption, pass relies on GPG to secure your passwords. GPG is obviously recognized as providing ...
- 229
0
votes
2
answers
675
views
Encrypting a salted password hash with RSA before storing in a database [duplicate]
Why is it a bad idea to encrypt a salted password hash with RSA (or maybe other public-key algorithm) before storing it?
- 105
0
votes
1
answer
369
views
Where and how to store admin account credentials for enterprise systems?
To my understanding, password-protected spreadsheets are not best practice for storing admin creds, whether it's a company of 5 people or a company of 50,000 people. In such a case, what are some best ...
- 123
17
votes
2
answers
12k
views
How safe is it to store your passwords in a modern browser?
There's a few questions here along these same lines already, but they're nearly a decade old. I'd like to know if things have changed, especially now that Chrome has become more aggressive about ...
- 948
0
votes
1
answer
273
views
Is using Argon2 with a public random on client side a good idea to protect passwords in transit?
Not sure if things belongs in Crypto SE or here but anyway:
I'm building an app and I'm trying to decide whatever is secure to protect user passwords in transit, in addition to TLS we already have.
In ...
- 103
2
votes
0
answers
244
views
Is it possible to use Argon2id hashes with PAM?
I was wondering if it's possible to implement more secure KDF like bcrypt, scrypt, pbkdf2 and argon2id in PAM authentication.
Ideally I would like to have their hashes instead of SHA-512 ones directly ...
- 63
3
votes
4
answers
259
views
How do I minimize the number of passwords leaked when a PC gets compromized?
For customer support reasons, we need to store passwords to some of our customers' systems (with their explicit, written permission, of course), as well as, obviously, passwords to some of our own ...
- 2,944
0
votes
0
answers
105
views
Does hashing client-side increase attack surface (assuming TLS and serverside salt+hash)? [duplicate]
This question asks whether one should hash on the client or the server. I want to know if there is any reason, aside from having to maybe handle one extra hashing library (if it's not already in your ...
- 101
100
votes
12
answers
16k
views
How do very big companies manage their most important passwords / keys?
Third-party password managers such as 1password, etc. are useful for people, businesses, etc. to store passwords. But I bet Facebook, Google, Twitter and other super big tech companies don't use such ...
- 951
0
votes
1
answer
737
views
Using GPG as password manager
I want to use GPG as a master password storage (encrypt and push to online storage). This would require encrypted file being able to be decrypted on multiple machines.
Two computers comp1 and comp2 ...
- 147
8
votes
2
answers
1k
views
How does a shared vault in password managers such as 1Password work?
The password manager 1Password has a feature where multiple accounts in a group ("family") can share login information with each other.
From my understanding, a password manager is never ...
- 83
11
votes
3
answers
4k
views
Safe storage for multiple passwords for multiple accounts
I've had this difficulty for a while, and I hope to get some feedback or referral to the sites where this problem may be discussed.
Nowadays all of us have multiple accounts, both personal and work-...
- 107
4
votes
0
answers
183
views
How vulnerable are password managers in the real world?
I'm a senior undergraduate majoring in computer science. I recently took a computer security class where instead of exams we had a final project that could be anything related to computer security.
So ...
0
votes
4
answers
316
views
Password is visible in online sign up form
I am about to sign up for an online school, which is an accredited statewide online school, and notice that the password they want me to enter is fully visible on the form. Should I be concern about ...
- 113
1
vote
2
answers
729
views
Can a Keypass file theoretically be cracked offline?
So you create a .kbdx file, protected by a password.
AFAIK in asymmetric key schemes and in WPA-AES brute-forcing consists of:
Trying a random password on the private key / on the router
If it doesn'...
- 1,907
1
vote
1
answer
128
views
Storing the password to a vault in the vault itself?
Is there an additional risk associated with storing the master password to a vault inside the vault itself?
I would assume not, since in order to decrypt the vault you must already have that password. ...
- 450
27
votes
7
answers
6k
views
Where should I store a username during a password reset?
I am new to web development and am trying to implement a password reset feature according to the OWASP cheat sheets: Forgot Password Cheat Sheet
The cheat sheet advises not to send the username as a ...
- 388
2
votes
2
answers
124
views
Are there any known attacks (technical or social) against enterprises where password resets are scheduled on fixed (known) intervals?
A company I know of has a password policy that requires employees to change passwords (on AD server) every 90 days. The vast majority of its new hires start on the 1st of the month. Thus, several ...
- 21
0
votes
1
answer
143
views
Having a backdoor password for each user to allow impersonation
For some context, I want my api to be able to 'impersonate' (or connect as) a user on my ldap database as most of the api's access controls are on the ldap database and tied to the user you are ...
- 43
0
votes
0
answers
104
views
Dedicated device for online investing and other security measures
I like to invest money online. I invest in both cryptocurrencies as well as regular stocks. As my bankroll grows (let's say 20k+ in the near future), I feel like I need to start taking more serious ...
2
votes
2
answers
390
views
Attacks against unencrypted android phones?
So, I keep reading again and again that one should encrypt his android device.
But from an attacker's perspective, what can be done with an unencrypted phone? Can I extract all the files or possibly ...
7
votes
5
answers
4k
views
Specific character based policy for passwords
I'm wondering, would it be clearer to declare a company wide requirement with regard to password theoretical entropy, rather than the usual "at least one big letter, and a small latter, and special ...
- 689
0
votes
1
answer
171
views
How to detect passwords in wiki pages?
Is it possible to use any automated scanning tool in order to detect stored passwords in our internal wiki pages?
- 157
1
vote
2
answers
290
views
Are password managers still effective on a cloud PC (virtual machine)?
I have recently started using a cloud gaming service. It provides me with control of a 'remote PC' (actually a virtual machine running in their data centre) accessed through an app or VNC console. The ...
- 162
0
votes
1
answer
470
views
`pass` not asking for password anymore - gnome-keyring or gpg-agent related? How can I force password asking?
I cross-posted this on the manjaro forums and on server fault. So far no answer, so trying here.
I have gnome-keyring running for sure, not sure it's gnome-keyring or gpg-agent or ssh-agent related......
- 437
0
votes
1
answer
93
views
Credential theft by browser conferencing software?
While using the webex conference software, I noticed
that simply pressing a "share content" button allows me to share my full screen.
There was no security confirmation from my webbrowser (chrome):
I ...
- 103
0
votes
1
answer
185
views
What vulnerabilities would this type of "password manager" have?
When I was searching for a password manager to use I stumbled upon the concept of Master Password which instead of encrypting and saving your passwords, generates them by using your master password ...
user233399