5

The preferred way to go is to generate a presigned POST request (your backend server asks for it with your own admin credentials). Then from client-side you upload using this pre-signed POST. It's effectively a way to have temporary credentials, but much more easy & secure to deploy as it can be restricted to the exact file you need to have uploaded. ...


3

Many forms of restricted usability exist to protect developers from negative perceptions resulting from widespread misuse. It's a numbers game. If RunAs was less restricted, related security failures would be the fault of the script authors (IMHO), but the industry might believe that the underlying software was insecure. If a junior admin got in trouble for ...


3

I know you quickly dismissed Apples own Keychain but I'd like to make a case for it and help guide you in the right direction of how you can use it via terminal. It’s protected by 256-bit AES encryption. It's backed up on cloud servers. You can use it to store secure notes. Locally the keychains are stored in ~/Library/Keychains/ and /Library/Keychains and ...


2

Since you're using Linux, you can do this using iptables. It's possible to block specific UIDs from making specific requests. See https://unix.stackexchange.com/questions/104830/block-specific-application-with-iptables, or https://www.cyberciti.biz/tips/block-outgoing-network-access-for-a-single-user-from-my-server-using-iptables.html (the latter is quite ...


2

The accepted answer (clearing "Active Logins" from "Clear History...") has the disadvantage that it clears all active logins, including from other sites on other browser tabs. An alternative, at least with Firefox, is to reload the page by specifying a different (or invalid) login. This can be done by adding it in front of the URL: http://...


2

I heard that it's quite easy for someone to access these credentials once they've gained access to your computer, is it so? It is not so. Passwords stored in your credential vault are (ultimately) encrypted with your Windows password. In order to access the encrypted credentials, they need to know your password. if someone knows your LastPass password, ...


2

It's not exactly efficient and my gut feeling is it may increase attack surface. General browsing on generic sites means the potential for vulnerabilities to be exploited firstly on the website to serve malicious content and secondly by your client to be exploited. With your setup, it would mean exploiting Firefox to run privileged code that exploits an ...


2

Have you tried AWS Secrets Manager (or Parameter Store). It's built for exactly this purpose. Create a separate IAM Role for the backup process, and grant the required EC2 instance that IAM role. Then modify your script to call Secrets Manager to obtain the credentials and and don't store those credentials anyway except in the memory of the running process. ...


2

If you are afraid an attacker might login to one of your accounts, it is best to ensure that all accounts have strong and unique passwords (e.g by using a password manager) and have 2 factor authentication enabled. This way, if the attacker gets a hold of your password, he can not log in as he does not have the 2FA device. As for your website, make sure you ...


2

If you connect to the server via TLS, then all your communication, including your credentials, will be encrypted. Once the server has received them, the server will decrypt your credentials, then hash them, and then compare that hash to what is stored on the server. If it matches, you will receive some authentication token to indicate you are authenticated. ...


1

Will security officers (CSO) in companies in general accept this or not for a 3rd party solution installed on prem? Nobody CSO can tell you how another CSO will answer that question. Personally, as an Active Directory admin I successfully advised against implementing dozens of applications already, that provide LDAP or local authentication already. At ...


1

Judging from the information that you have been provided with, the question relates to LFI (local file inclusion). Apparently the credentails are stored on the filesystem (/userdata/passwords/). The question seems to be unrelated to the topic that you have been researching, which is SQL injection. The latter would only be an option if the credentials were ...


1

In typical setups, clients will always encrypt the plaintext password (usually relying on TLS or something similar) and then send it onto the server. In some cases, application level encryption may be employed, but rarely is a password hashed client side. Modern implementations, salt the passwords before hashing them. Hence server need the plaintext ...


1

If you ever need access to your users' plain-text credentials, then your system is fundamentally broken from a security perspective. Passing over this, to make momentary use of plain text credentials, the process is like this: You store the credentials properly encrypted as you normally would, and inaccessible to anyone including yourself. Then, The user ...


Only top voted, non community-wiki answers of a minimum length are eligible