Skip to main content
259 votes
Accepted

Do I need to encrypt connections inside a corporate network?

Yes encrypt, it is easy. Plus according to a 2014 Software Engineering Institute study 1 in 4 hacks was from someone inside the company with an average damage 50% higher than an external threat actor. ...
Joe M's user avatar
  • 3,012
144 votes

Why is storing passwords in version control a bad idea?

The way I see it, not storing passwords in Git (or other version control) is a convention. I suppose one could decide not to enforce it with various results, but here's why this is generally frowned ...
d33tah's user avatar
  • 6,574
112 votes
Accepted

Is it good or bad practice to allow a user to change their username?

Many people have looked at the reasons not to allow name changes from both a security and a community standpoint. However, there are plenty of legitimate reasons to allow username changes, even if the ...
fluffy's user avatar
  • 1,352
110 votes

Do I need to encrypt connections inside a corporate network?

What are the real world chances that someone would steal his identity? Running a MITM attack on an HTTP connection when on the same LAN is basically trivial. ARP is not designed to be secure. Some ...
le3th4x0rbot's user avatar
  • 3,249
95 votes

Why is storing passwords in version control a bad idea?

First, the non-security reason: Password Change Workflow Passwords change independently of a software application code. If a DBA changes a database password, does it make sense for developers to ...
Brandon's user avatar
  • 961
79 votes
Accepted

The most secure way to handle someone forgetting to verify their account?

What I see most commonly is allowing the authentication and signing the user in, but locking meaningful features away until the email is verified. You should bubble up an error reminding the user to ...
Buffalo5ix's user avatar
  • 2,716
44 votes

Reasons to place a time limit on entering login credentials?

This seems like a solution geared toward backend session management. I'm speculating anonymous users don't initiate any sort of session, but a session gets instantiated once you hit the login page. ...
Ivan's user avatar
  • 6,338
41 votes

Do I need to encrypt connections inside a corporate network?

Yes, you have to encrypt your connections. Let's take a scenario where you believe your network is physically secured (with required physical security and other required security measure) and no ...
Sayan's user avatar
  • 2,031
39 votes

Enabling a user to revert a hacked change in their email

Your scheme completely defeats the purpose of changing the e-mail address. When a user wants to change their address, there's a good chance they're doing it because they no longer control the old ...
Ja1024's user avatar
  • 10.1k
34 votes

Is it good or bad practice to allow a user to change their username?

I would say as long as they are not able to change their unique identifier. I.e. they can change the name they show up as, but that name is tied back to an unchanging user ID number (this will make ...
K.B.'s user avatar
  • 667
29 votes

Do I need to encrypt connections inside a corporate network?

Risk of Repudiation In addition to all the fine answers about employees as a threat and visitors as a threat, I think you have to consider that the mere fact that the traffic is unencrypted is of ...
AllInOne's user avatar
  • 467
26 votes

Logging in as another user - Security Issue

It's a bug in their web site, and such bugs are fairly common. They're usually something like the result of an incorrectly copied session cookie, a corrupted cache, or other programming bug. In order,...
John Deters's user avatar
  • 34.3k
25 votes

Why is storing passwords in version control a bad idea?

It's always important to keep in mind that suggestions do have to be tailored to fit your use-case. Security safeguards taken by, say, the NSA to protect all the zero-days they keep around for a ...
Conor Mancone's user avatar
16 votes

Reasons to place a time limit on entering login credentials?

It could be that they are have issued a verification token of sorts to the form that they postback to the server as part of the login, which times out after a period of time. Not saying whether its a ...
ISMSDEV's user avatar
  • 3,280
15 votes

Enabling a user to revert a hacked change in their email

Maybe you work for a big company like Facebook where the number of users is so huge that you have to automate the process of recovery. But I assume you are not working for such a company and that the ...
Kate's user avatar
  • 8,415
14 votes

Do I need to encrypt connections inside a corporate network?

Some companies, especially larger ones that have been around long enough to develop bad habits, have roughly the following fallacious security model: The network is safe as long as nobody else ...
multithr3at3d's user avatar
14 votes

Do I need to encrypt connections inside a corporate network?

In 2018, the answer depends on your threat and risk analysis results. Which, of course, you have performed, identified the likely scenarios, rated them and made a business decision based on the impact ...
Tom's user avatar
  • 10.5k
13 votes

Why is storing passwords in version control a bad idea?

Keeping secrets (passwords, certificates, keys) separate from source code makes it possible to manage source and secrets according to different policies. Like, all engineers can read the source code, ...
user1763251's user avatar
12 votes
Accepted

How to handle emails as usernames under GDPR?

IANAL, but GDPR does not make encryption mandatory for personal data. Read this article to understand the complexity around encryption and GDPR better. In the GDPR encryption is explicitly ...
Niels van Reijmersdal's user avatar
12 votes

Why is storing passwords in version control a bad idea?

This convention, like many other security "best practices" is a handy way of making sure that things don't go wrong because of bad habits or routine. If you always remember that your sensitive ...
Tom's user avatar
  • 10.5k
9 votes

How to securely store credentials in a bash variables?

Storing credentials in plain text is always a tricky case, it depends on case-by-case. The main rule is: never store the password inside the script. If the script will run only manually (someone ...
Ricardo Reimao's user avatar
9 votes
Accepted

Are SOCKS5 credentials safe during authentication on proxy server

Neither traffic nor credentials are encrypted in the SOCKS5 protocol. From RFC 1929: This document describes a subnegotiation that provides authentication services to the SOCKS protocol. Since the ...
forest's user avatar
  • 66.9k
9 votes

Do I need to encrypt connections inside a corporate network?

Yes, you do need to encrypt inside your "secure" corp network. Any network penetration will lead to snooping traffic, and anything not encrypted is easy pickings for the attacker. Credentials, ...
JesseM's user avatar
  • 1,952
8 votes
Accepted

How to read password from Windows credentials?

The Credential Manager stored passwords are managed by the Data Protection API and protected by DPAPI "master keys": The DPAPI keys used for encrypting the user's RSA keys are stored under %...
Royce Williams's user avatar
8 votes

How secure is the Windows Credential Manager?

I heard that it's quite easy for someone to access these credentials once they've gained access to your computer, is it so? It is not so. Passwords stored in your credential vault are (ultimately) ...
Ian Boyd's user avatar
  • 2,324
8 votes

Is it good or bad practice to allow a user to change their username?

As mentioned, allowing users to easily change usernames (let's call it "display name" to disambiguate) makes it easier for users to dodge the consequences of harassing or scamming other users. If your ...
Mike Ounsworth's user avatar
8 votes

Is it good or bad practice to allow a user to change their username?

We currently use your suggestion regarding individuals that reach out to us requesting a change, but it isn't as scalable due to the manual work and requires us to ask for answers to their security ...
maaartinus's user avatar
8 votes

Is it good or bad practice to allow a user to change their username?

I'm a little surprised that this hasn't been brought up. But I would assume that the reason many sites do not allow you to change your username is because it presents an issue if a user's account ...
Kit's user avatar
  • 181
8 votes
Accepted

Firefox not deleting HTTP Basic authentication credentials although being instructed to do so

Firefox (Firefox 68.0, under Linux) doesn't store this info in Cookies and Site Data but in History. You need to go to Preferences->Privacy & Security and under the History section, click on ...
nimda's user avatar
  • 96

Only top scored, non community-wiki answers of a minimum length are eligible