All Questions
Tagged with passwords web-application
151 questions
9
votes
5
answers
4k
views
Why don't we use HTML password inputfields for usernames and 2FA codes in the front-end of web applications?
When entering a username and password on a web application I have always wondered why the username often equals personal email address (which is often known or easy to guess or find). A random ...
- 7,056
0
votes
0
answers
220
views
Optimal way to securely store password on client with server invalidation but not knowledge
A number of similar questions have been asked about this general topic before (e.g. How to store user credentials in browser securely?), but I wanted to seek some clarification on a specific scenario.
...
- 121
1
vote
1
answer
140
views
Web app architecture- set a new password for a on-premises AD setup
I need to implement a web app for a self-service change password use case for on-premise Active Directory users,
which is accessible over the internet.
The service must allow the users to set a new ...
- 111
1
vote
0
answers
124
views
Why is not there encrypted way of sharing/showing data such as Password to the user (hidden from web app Source code)?
I wonder if there will be (or is) a way to hide data such as passwords from the HTML/DOM structure? As, password fields can hide from external person other than the main user with something like "...
- 11
1
vote
1
answer
155
views
How can I improve the application administrator's encryption keys security inside database
I am interested in the issue of establishing the security of data of users of a web application in the event of a database leak.
It was decided to use the following encryption chain:
User data is ...
2
votes
1
answer
2k
views
OWASP Pentest - "Sensitive data sent in clear text" [closed]
We have our web app / REST API getting tested by potential customer. In the report they came up with this issue:
Sensitive data like user credentials on login page, password reset,
change password ...
- 131
0
votes
1
answer
156
views
Password hashing for local servers
I'm running a local web server on my Raspberry Pi and want to have a login screen. My plan is to hash the password and store the result in a text file ( This is where I'm storing settings for the ...
14
votes
4
answers
4k
views
PBKDF2 usage will slow REST API down?
When implementing password hashing using PBKDF2 for authenticating access to a REST api,when we say that PBKDF2 is slow does it mean that it's going to take a lot of time to hash the password and ...
- 2,483
1
vote
2
answers
400
views
Worst case scenario for compromised private key in server certificate?
Assume that someone gains access to the password used for my key store containing my server certificate and it’s private key.
I guess without direct access to the server running my application the ...
- 111
2
votes
3
answers
768
views
Admin change user details / account information in admin interface
I'm creating this admin dashboard, and I have a question wich I have been stuck on for a while now.
And I'm starting to question what kind of data the admin should be able edit/view on the other ...
- 21
2
votes
2
answers
614
views
Use delay with a fixed total time to defend against timing attacks
Consider this common example used to demonstrate timing attacks:
async def sign_in(username, password):
user = await get_user_from_db(username)
if user is None:
return False # early return :(...
- 131
1
vote
2
answers
2k
views
How secure is an IP whitelist compared to other web service security mechanisms like a passphrase?
When securing a web server/web application/website, you often have the choice between choosing something like using a password for authentication/securing a service and creating an IP whitelist or ...
- 1,257
2
votes
2
answers
527
views
How does password-append OTP validation work?
Recently when I was changing some Amazon account settings, I've noticed that they provide an option to validate the OTP by appending it to the password. How would this work, if the password is one-way ...
- 205
21
votes
8
answers
9k
views
Is PGP for user authentication a good idea?
I am building a web site that provides user login. For that, I am currently researching good strategies for dealing with authentication.
How I'm doing it right now
My current concept is modeled ...
- 329
6
votes
2
answers
15k
views
How to store user credentials in browser securely?
I need help to authenticate users with user credentials.
We are using Angular 5 as a front-end & need to store the user's email and password if the user checks on Remember Me. Then autofill user ...
- 163
27
votes
2
answers
5k
views
How to avoid using System.String with Rfc2898DeriveBytes in C#
I am creating a .NET core webapp in C# that takes in a user password and hashes it to be stored on a server. I'm using Rfc2898DeriveBytes along with a randomly generated salt. I've read, however, that ...
- 373
252
votes
2
answers
42k
views
Can ads on a page read my password?
Disclaimer: I have minimal web-dev/security knowledge so please answer as if talking to a "layman."
I've heard that web-advertisements need to be able to run their own JavaScript so that they can ...
- 1,045
1
vote
1
answer
1k
views
What's the risk if I accidently type my password into a username field in a website? [duplicate]
On websites that separate the screens where username and password are entered, such as GMail, it is possible that the users type the password in the username field because the username is sometimes ...
- 111
61
votes
3
answers
9k
views
Website returning plaintext password [duplicate]
I have recently logged into a website. When I clicked on the "Update Profile" page, you are displayed with a list of text boxes for all the user fields, e.g. name, email, phone number etc.
There is ...
- 612
-1
votes
3
answers
267
views
Is this a secure way to protect passwords when they must be in plaintext?
I am building a web app which will use my school's online grade reporting system. Students will sign in to my app using their credentials for the grade website. However, it does not provide an API, ...
- 1
2
votes
2
answers
4k
views
Is LocalStorage in web browsers safe enough to store passwords?
I currently have a system I'm building where users can enter an email address and password into my login page, and if they click the signup button after doing that, it stores that data in LocalStorage,...
- 171
1
vote
2
answers
913
views
Is problem with string length in token (read password) randomization a security flaw? Is there any impact for the same?
this application sends a password to user's email when user click on forgot password on login page. However, the password is not the same in length always something it will be a 25+ string and ...
user200698
0
votes
3
answers
1k
views
Can a password change via CSRF lead to account takeover?
If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF ...
- 1,438
1
vote
3
answers
882
views
Hash pepper in web application possible?
I have read a few articles and several question on here about hashing correctly.
While hashing, adding salt and especially pepper is primarily a server side use case, I am interested in the ...
user202855
0
votes
0
answers
47
views
Web app: using two hashing schemes for CPU-friendly password validation & secure storage [duplicate]
Consider a web application that:
uses HTTP Basic Auth over HTTPS, and therefore needs to validate a password (an API Key) on every request
and needs to handle a substantial load
has very few distinct ...
- 101
1
vote
0
answers
170
views
How to correctly store the users credentials [closed]
I am writing an application that requires a username/password for the first time.
I was wondering if the concept code below is a valid and secure way to store user passwords in the database. I hope ...
- 11
3
votes
2
answers
2k
views
Users can change their password with the same password
What are the security implications of an web application that allows users to change their passwords with the current (exactly the same) password?
- 1,900
0
votes
1
answer
176
views
Is it desirable to obtain a brand ssl certificate for a password generator?
I need an advice. I have created a password generator, which creates strong passwords on local PC (its a Progressive Web App).
But there is one problem: most site visitors are distrustful to the ...
33
votes
9
answers
25k
views
How to secure passwords over HTTP?
Say my password is abc. I want to send it to the server over HTTP.
I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
- 465
0
votes
1
answer
181
views
Is any plaintext stored as a password hash an effective way to lock out an account?
I'm building a web app with Flask and I have user accounts that store their passwords in a MySQL String column using werkzeug.security's generate_password_hash() method. I wanted to create a Community ...
- 297
1
vote
3
answers
508
views
Why keep track of user password changes in web application?
For some reason, it has become a common security* practice for websites to keep track of password changes. Sites like Google can even tell you how long ago you changed your password. Aside from just ...
- 111
155
votes
3
answers
21k
views
If my password was able to be printed on a form sent home from my child's school, does it imply insecure password storage policies?
I have a user account for each of my children in our district website, which oversees registration, grades, identification, etc.
I was recently sent home a form from both of my children's classrooms ...
- 1,247
1
vote
4
answers
377
views
Why is it unsafe to send a user their password via SSL encrypted communication rather than always sending a reset link?
I can understand why you wouldn't want to email someone their password, but on an SSL encrypted web page, I dont understand why websites always require you to reset the password when you'd probably ...
- 775
2
votes
3
answers
469
views
If I typed username and password, but wrongly clicked another button to go to another page instead of the login button, is there any security risk?
For example, suppose I already typed username and password at this Facebook page:
https://m.facebook.com
But I wrongly clicked 'Create New Account' instead of Log In. My question is, does it ...
- 535
2
votes
0
answers
171
views
User has been authenticated. Now what?
I'm trying to create a user authentication system for an application. I can't use a built in library for that such as ASP.NET Identity, but I can use any simple methods in .net.
Not wanting to ...
- 793
105
votes
2
answers
20k
views
Is a redirect showing the password in plain text a security vulnerability?
A couple of days ago, I attempted to log into the website of a well-known SaaS provider. I used a password manager on my browser (so user/pass were correct) and the NoScript plugin which had limited ...
- 1,021
0
votes
2
answers
331
views
What can be done with MySQL password
Let's say there's a simple website hosted on the web, based on Flask + MySQL. The website's functionality is secure and does not allow arbitrary queries to be run against the database.
However, let's ...
- 103
41
votes
3
answers
19k
views
Is it safe to check password against the HIBP Pwned Passwords API during account registration?
User registers account on a web app. Passwords are salted and hashed.
But is it safe to check the password against the HIBP Pwned Passwords API, before salting and hashing it? Of course the app uses ...
- 533
0
votes
2
answers
240
views
Storing password to use later
I have a deployment system with a user interface that is accessible over the Internet. I want to make it more secure by re rolling the password periodically over the API. Is there a safe way I can ...
- 103
0
votes
1
answer
6k
views
If I use SSL, do I need to hash the password before sending it to the server? [duplicate]
I am setting up a website to help people with certain niche interests find each other. It is being done purely as a voluntary project, there is no money involved (on either side), nor is there much ...
- 715
4
votes
1
answer
237
views
Will 2FA protect me if there is a password breach?
Long story short, I'm not particularly concerned about an attacker stealing my password when I log in to a website. I don't usually log in on untrusted networks, and when I do I make a point of double-...
- 1,766
1
vote
2
answers
180
views
Issues with resetting password guess count?
Prologue. Imagine a website with a login. You have an account, enter your e-mail address and a password. Error. Password incorrect. You try two other passwords. Both incorrect and now your account is ...
- 133
1
vote
1
answer
470
views
Alternative to storing passwords when dealing with integrations that only allow username/password authentication? [duplicate]
I'm working on an integration with an external service that requires per-user authentication, like Facebook for example, but unlike Facebook only allows username+password for this authentication. My ...
3
votes
2
answers
2k
views
Storing passwords of third party services (web app)
I have a web app that includes third party websites in iframes. The 3rd party websites require user to be logged in them. Option A is to require the user to login to each website individually via ...
- 211
22
votes
3
answers
6k
views
Using SHA-256 to preprocess password before bcrypt?
I would like to allow users of my web application to have long passwords, if they so wish. Today I became aware of bcrypt's password length limitation (72 characters, the rest truncated).
Would it be ...
- 425
1
vote
0
answers
132
views
Is it possible to integrate 302 based auth with 401 based auth?
I'm looking at securing endpoints with a technique similar to HAWK which returns a 401 authentication with OAuth which uses 302 based redirection
How can I combine two different authentication ...
- 51.1k
2
votes
1
answer
330
views
Storing Passwords On Server Config
I have a web-application. My web-app needs access to certain other applications such as MySQL.
In order for my web-app to access MySQL, I need to provide it a username / password. What are best ...
- 123
12
votes
2
answers
4k
views
Is it safe to expose bcrypt password hashes?
I'm building a web app that needs to support user-switching offline and am wondering if it is safe to expose bcrypt hashes to authenticate users.
The basic flow:
Primary users logs in while web app ...
- 221
15
votes
3
answers
3k
views
Are HTTP brute-force password-guessing attacks common nowadays?
Are brute-force attacks against online accounts (gmail, facebook, instagram) something that really happens? I don't mean something like cracking password hashes or DDoS, but real brute-force attacks (...
- 535
9
votes
3
answers
3k
views
Accessing document using a 6 letter token
We are building a web app where users can insert 6 letters/digits (A_Z, 0-9) into a form to access a document. Every document has a randomly assigned access code like this: 1ABH5F.
When the user ...
- 201