Questions tagged [password-management]
The functions performed by the person or processes responsible for security of passwords on a given system.
1,254
questions
6
votes
2answers
558 views
How does a shared vault in password managers such as 1Password work?
The password manager 1Password has a feature where multiple accounts in a group ("family") can share login information with each other.
From my understanding, a password manager is never ...
11
votes
3answers
4k views
Safe storage for multiple passwords for multiple accounts
I've had this difficulty for a while, and I hope to get some feedback or referral to the sites where this problem may be discussed.
Nowadays all of us have multiple accounts, both personal and work-...
4
votes
0answers
166 views
How vulnerable are password managers in the real world?
I'm a senior undergraduate majoring in computer science. I recently took a computer security class where instead of exams we had a final project that could be anything related to computer security.
So ...
0
votes
4answers
280 views
Password is visible in online sign up form
I am about to sign up for an online school, which is an accredited statewide online school, and notice that the password they want me to enter is fully visible on the form. Should I be concern about ...
1
vote
2answers
527 views
Can a Keypass file theoretically be cracked offline?
So you create a .kbdx file, protected by a password.
AFAIK in asymmetric key schemes and in WPA-AES brute-forcing consists of:
Trying a random password on the private key / on the router
If it doesn'...
1
vote
1answer
110 views
Storing the password to a vault in the vault itself?
Is there an additional risk associated with storing the master password to a vault inside the vault itself?
I would assume not, since in order to decrypt the vault you must already have that password. ...
27
votes
7answers
6k views
Where should I store a username during a password reset?
I am new to web development and am trying to implement a password reset feature according to the OWASP cheat sheets: Forgot Password Cheat Sheet
The cheat sheet advises not to send the username as a ...
2
votes
2answers
116 views
Are there any known attacks (technical or social) against enterprises where password resets are scheduled on fixed (known) intervals?
A company I know of has a password policy that requires employees to change passwords (on AD server) every 90 days. The vast majority of its new hires start on the 1st of the month. Thus, several ...
0
votes
1answer
112 views
Having a backdoor password for each user to allow impersonation
For some context, I want my api to be able to 'impersonate' (or connect as) a user on my ldap database as most of the api's access controls are on the ldap database and tied to the user you are ...
0
votes
0answers
87 views
Dedicated device for online investing and other security measures
I like to invest money online. I invest in both cryptocurrencies as well as regular stocks. As my bankroll grows (let's say 20k+ in the near future), I feel like I need to start taking more serious ...
2
votes
2answers
309 views
Attacks against unencrypted android phones?
So, I keep reading again and again that one should encrypt his android device.
But from an attacker's perspective, what can be done with an unencrypted phone? Can I extract all the files or possibly ...
7
votes
5answers
4k views
Specific character based policy for passwords
I'm wondering, would it be clearer to declare a company wide requirement with regard to password theoretical entropy, rather than the usual "at least one big letter, and a small latter, and special ...
0
votes
1answer
121 views
How to detect passwords in wiki pages?
Is it possible to use any automated scanning tool in order to detect stored passwords in our internal wiki pages?
2
votes
2answers
207 views
Are password managers still effective on a cloud PC (virtual machine)?
I have recently started using a cloud gaming service. It provides me with control of a 'remote PC' (actually a virtual machine running in their data centre) accessed through an app or VNC console. The ...
0
votes
1answer
242 views
`pass` not asking for password anymore - gnome-keyring or gpg-agent related? How can I force password asking?
I cross-posted this on the manjaro forums and on server fault. So far no answer, so trying here.
I have gnome-keyring running for sure, not sure it's gnome-keyring or gpg-agent or ssh-agent related......
0
votes
1answer
85 views
Credential theft by browser conferencing software?
While using the webex conference software, I noticed
that simply pressing a "share content" button allows me to share my full screen.
There was no security confirmation from my webbrowser (chrome):
I ...
0
votes
1answer
165 views
What vulnerabilities would this type of "password manager" have?
When I was searching for a password manager to use I stumbled upon the concept of Master Password which instead of encrypting and saving your passwords, generates them by using your master password ...
-1
votes
2answers
265 views
What use are password dumps to hackers?
On a theoretical point of view, I get that it's bad to have my password exposed via a password dump because that means somebody could log into my accounts. In practice, how do hackers use those dumps, ...
40
votes
4answers
9k views
Are password managers more secure than a slightly different password for each website?
Let's say I use a 5 word password composed of 4 words plus the name of the website I'm accessing. For example for GitHub, it would be something like "correct battery horse staple github".
How is that ...
3
votes
1answer
132 views
Is it safe to share a LastPass master account?
I just found out my company started using LastPass Enterprise for service accounts. (databases and web applications that our whole team needs access to) I immediately switched my team over to it ...
1
vote
2answers
195 views
Confusion about the way password managers work
I've been reading about password managers recently out of personal interest, however since I don't have any experience in the area of information security, I found myself confused about two aspects ...
0
votes
1answer
126 views
iPad stolen with LastPass, Should I be worried?
Unfortunately my iPad was recently stolen and I had LastPass installed on it. Both the iPad and the app are protected with TouchID and passcodes. However, LastPass keeps an encrypted offline cache of ...
0
votes
0answers
283 views
Auto fill with bitwarden security question?
Hi guys,
I just started using bitwarden as a password manager and stumbled across a very confusing feature...
When I enable the password autofill feature (I know it's called auto fill..but still...) ...
2
votes
2answers
217 views
What wrong with this system to proactively check if customers' passwords have been found in a breach?
Let's say that during account creation, I already prohibit passwords known to be reused from breaches of other sites, like if it's in the Have I Been Pwned list. But breaches happen all the time, so ...
0
votes
1answer
370 views
How to decrypt password manager vault without the password manager client? [closed]
I've started looking into password managers these days and have come to trust the general concept. They provide convenience and very good general security if used right.
However there is one point ...
0
votes
1answer
740 views
What can I do to improve my Keepass XC setup?
I'm planning on using KeePass XC for the first time and am trying to create a setup that:
(1) would prevent hackers from stealing my passwords
(2) would prevent me from losing access to my ...
0
votes
1answer
3k views
BCrypt vs PBKDF2-SHA256
I read that LastPass uses PBKDF2-SHA256 for storing the Master Password hash, I wonder how this compares to BCrypt and why did they chose this, as SHA256 is a quick hash (probably compensated by PKDF2?...
3
votes
1answer
130 views
What advantages does it have if a password manager locks the DB automatically on locking the computer? Disadvantages of turning it off?
When I unlock my PC the password manager (any type) needs the password again to unlock it's DB containing passwords. I was wondering what the benefit is in that, as my computer is locked anyway.
...
0
votes
2answers
231 views
Firefox: What would be more secure/private: storing session cookies or saving password in the browser?
I am wondering, assuming the latest version of Firefox, which of the following options would be more preferable security-wise (e.g. assess and/or password to user account will be stolen) and which one ...
0
votes
0answers
22 views
Does hashing client-side increase security when dealing with an untrustworthy server? [duplicate]
Does hashing once on clientside and once on server-side increase security when dealing with an untrustworthy server?
For example when dealing with open source projects where users can self-host their ...
0
votes
0answers
38 views
Which is better practice: digital password manager or a physical book of passwords? [duplicate]
These days, it's not uncommon to have dozens and dozens of passwords for various sites and services. If you're using different passwords for each service it can be basically impossible to hold all the ...
1
vote
0answers
255 views
Does a shared (but encrypted) private key for a group of users reduce the effectiveness of the encryption?
That is, is it generally considered more secure to save a single application-wide private key on the web server compared to storing (protected/encrypted) private keys in the database?
More ...
1
vote
0answers
106 views
Store passwords local with plain text access on WinPE
I have an application that needs to store Network Credentials for a Network Drive/Share on the disk. The user shouldn't need to enter the password every time.
The OS is WinPE, so he cannot map the ...
1
vote
1answer
165 views
Is having multiple correct passwords for a single username a security problem?
This question occurred to me when using online banking. My wife and I have a joint account. The username to login to internet banking is just our account number, so it is the same for both of us. ...
3
votes
1answer
147 views
How do applications such as password managers check leaked credentials and how can I get more results?
I have been using LastPass for a while and I have just seen an option to generate an exposure report. By its output, I assume it checks various sources containing credentials dumps from hacked web ...
1
vote
2answers
394 views
How do I securely store credentials and key files on my mac?
There must be a handy way to securely store, say, GCP key.json somewhere on my machine and access it whenever I'm deploying stuff. Backup to cloud is a must. The Apple's Keychain access seems ...
12
votes
1answer
2k views
Is BitWarden trusted?
I've been using BitWarden as my main password keeper, would like to ask if it's safe? I know that everything is not 100% safe but still want to know if they are worth it.
All my passwords are ...
1
vote
1answer
89 views
What is a login flow method to prevent account jacking when your website has Email/Password sign in AND Google Sign in?
For example, my website has Email/Password login and the "sign in with Google" button. If a user creates an account with their email and a password, then decides to sign in using the "sign in with ...
2
votes
1answer
386 views
Is better to have as password a sentence or first letter of the sentence?
Which is better master KeePass password to prevent any type of bruteforce between theses two type of password :
Complete sentence invented by user like : I like cheeseburger,
tomatoes and fries ! :)
...
3
votes
1answer
201 views
Is it okay for websites to send passwords as plain text if they hash them when they are stored? [duplicate]
I was logging into a website and checking out the network requests, and in the network tab I saw the following:
method: "Login"
params: {username: "username", password: "password1234"}
With my ...
0
votes
1answer
217 views
Is my keepass great? How can I improve it?
Here is my keepass setup:
Cloud
Gmail 1 Google Drive: holds database
Gmail 2 Google Drive: holds key file
Hard Drive
Computer: holds database (leave at home)
USB 1: holds database (always have ...
27
votes
4answers
4k views
Secure Implementation of Password Database
Disclaimer I am not a security professional, just a programmer trying to do my best. Additionally, this is my first post to this community so I appologise if this question is too broad.
The ...
31
votes
1answer
10k views
Should I assign my various passwords to my keyboard's macro keys?
I had an idea to assign my keyboard's macro keys to various passwords so I can just hit the key and it will paste in (the passwords are long and random so I won't remember them). This is on a home ...
4
votes
0answers
269 views
How to do client + server side hashing?
I don't want the password to be sent in clear text over the internet, even when using HTTPS the server admin can read the password if they somehow cache or log post requests.
Now, what I have come ...
2
votes
0answers
85 views
How do biometric password managers work?
Many password managers for mobile offer the option to unlock the password vault with a fingerprint instead of a password. If you never type in your master password, how is it possible to decrypt the ...
3
votes
1answer
211 views
Password seal by paper or by password manager?
At my current company, the IT Risk team decided to ensure root passwords of about 90 systems by the following conventional method:
The length of each password must be 16 characters, where they input ...
10
votes
4answers
5k views
How can I check password strength client-side?
I have a website and my users will be using their selected password to encrypt their RSA private key using JavaScript client-side. How should I be making sure they are using a strong password without ...
10
votes
5answers
17k views
Is Firefox's Lockwise secure?
I have lot's of passwords saved in Firefox Password Manager, now called Lockwise. I recently installed Opera Browser on my machine. It somehow managed to import all the history-data and form fields, ...
1
vote
0answers
106 views
Hosting password compromised [closed]
Last Monday I received two emails from my hoster:
10h42: Connection notification
10h42: Confirm your notification
I didn't login that day, so I knew something was wrong. I immediately logged in, ...
0
votes
1answer
138 views
Remote extraction of passwords from browser password managers
I'm writing an essay about "Browser Password Managers". As part of this I have to write about vulnerabilities and exploits. I stumbled across the following scientific paper from 2013: "Password ...
