Questions tagged [passwords]

A password is a secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

Filter by
Sorted by
Tagged with
3
votes
4answers
2k views

How to store a password so that it can be passed to another site/service which is expecting a plaintext input

I am developing a website and I would like to allow users to use XMPP for live chat. I would like users to have the option use an existing XMPP account if they wish and store their XMPP username and ...
0
votes
3answers
147 views

Sysadmin password storing

I'm quite unexperienced in the sysadmin area. Now I'm facing the responsability of managing two (remote) servers. I'm working in an informal organization. So I have passwords for the OS's users, ...
2
votes
4answers
337 views

How to compare passwords which is stored in DB in encrypted form in secure way?

Recently In an interview I was asked this question - Question- If are storing passwords in encrypted format in DB and in future when user login into our website how will we perform authentication? Me:...
-2
votes
1answer
42 views

mask username and password in service file, or better approach

At work there is a given task where a python application is currently running on a server, this application is using a enviorment file, which has username and password information. The current ask is ...
-1
votes
1answer
53 views

Protecting cryptocurrency private keys in a corporate environment

Now that Tesla has bought a large amount of BitCoin, other companies may follow suit. If my company wanted to do that, I was thinking about how it could be done. I'm familiar with the way private ...
2
votes
1answer
98 views

Is it a good design to have separate Hibernate entities for general user info and user password digest?

I'm developing an app with a user management system. There is a database table named user with the following columns: | Column Name | Column Type | |-----------------|-------------| | userId ...
1
vote
2answers
100 views

Should I check for non-existing users with correctly signed tokens?

I ran into an issue when developing where a user that did not exist, but had a correctly signed JWT, was logged in. This happened when I absentmindedly logged in using a browser while running the test ...
1
vote
2answers
156 views

How do password-protected pdf documents work?

I hope this is the right site for this question... I tutor in my spare time, and recently I downloaded a past GCSE exam paper and was attempting to edit the pdf- to select just a few pages to send to ...
0
votes
1answer
122 views

How to use auto-login for an API when building a desktop app?

I am currently building a small application which used a public API to get some information. The API doesn't support auto-login in any way (don't know if something like this even exists with APIs), ...
2
votes
1answer
157 views

How to handle db password change in a live service

Suppose I have a REST application running on a remote server which connects to a mysql database. Now let's say the password of the db has to be changed. What are the right methods and practices that ...
0
votes
2answers
86 views

How can I protect sensitive information inside a binary?

I am currently developing an application with Qt/C++ which needs to access a Shopify store using the Admin API. In order to access the API, my application needs to know the following information: API ...
1
vote
3answers
299 views

hash-like algorithm to identify passwords which are "too similar" to previous ones from history

One common issue with secure passwords is that users tend to "cheat", one common cheating pattern we meet recently is the "password swap" antipattern where the user basically keeps using the same two ...
21
votes
9answers
8k views

Is this scenario an exception to the rule of never storing passwords in plaintext?

I am making a full-stack web application for a professor. At his request, the passwords and usernames are generated programmatically, and they cannot be changed or reset by the students. (If you ...
1
vote
1answer
249 views

Hashing from within the database or outside?

I am in the process of evolving architecture for an 'equity analysis system'. I will be using SQLServer as the database, but I am not going the .NET route and won't be using the built-in 'membership' ...
2
votes
1answer
116 views

Securly storing password with revertible encryption

A bit of context: I used the password recovery of a website I am using (the website of a big corporation). My password was immediately sent back to me via text message. I did not receive a ...
1
vote
1answer
431 views

Azure Key Vault vs Automation Account Variables for password storage

In Microsoft Azure one can store secret values like passwords in Azure Key Vault, but also as encrypted variables in Azure Automation (these ones are stored in an Azure-managed Key Vault behind the ...
1
vote
1answer
460 views

Client Side Hashing + Server Side Hashing

Suppose one wishes to implement an account system for their service/website. There have been cases with Instagram for example where passwords were accidentally stored in plain text due to ...
-1
votes
1answer
208 views

Pattern to encrypt / decrypt data to / from a server without entering the secret key each time?

The title maybe it's a little bit confusing but I am certain that what I want to achieve is a common pattern, even if I didn't found anything on internet. I'm developing a web app that store ...
0
votes
1answer
43 views

Save user credentials for use with multiple third-party websites

I've seen a few similar questions but nothing to address this exact issue... I'd like to have a mobile app that allows users to input username/password once and then be automatically logged in with ...
2
votes
1answer
136 views

Should usernames and passwords to external systems be documented?

This is basically an extension to my previous question. That time our internal discussions didn't end up anywhere and the whole issue was forgotten for the time being. Now we've touched upon it again,...
0
votes
3answers
176 views

Is there a secure way to check previous passwords purely on the client-side?

We have a requirement for a security audit that our password policy must disallow the re-use of a previous password from the last 4 used passwords. We can accomplish this fairly easily by making a ...
10
votes
5answers
1k views

If passwords are stored hashed, how would a computer know that your password is similar to the last one if you try resetting your password?

If passwords are stored hashed, how would a computer know that your password is similar to the last one if you try resetting your password? Wouldn't the two passwords be totally different since one is ...
0
votes
1answer
75 views

Password manager inside application

Firstly this is not about how to store password for access to the application itself. That is handled using .Net Identity. Authentication is handled using JWT. So it is a web application. The problem ...
0
votes
1answer
152 views

LDAP with Dovecot

I have a mail server setup with Postfix and Dovecot, and an application server setup with node.js. I have user credentials stored in my application server, and I want to use the same credentials for ...
3
votes
3answers
204 views

How to pass credentials to client

When installing application on client's server at the end of the project, how to give admin's password to client? (On paper, by word?) Client may not be very technical so script generating password ...
11
votes
1answer
475 views

During account creation, is it better to generate the password automatically and send it to the user, or to let the user create his own password?

This question came up today while discussing with a colleague about the 'create account' page for the website we're working on. My colleague's opinion is that we should make the registration as quick ...
1
vote
3answers
280 views

Possible way to handle multiple reset password email

It's a C#, ASP.NET MVC Project and here is the problem: User can enter their email address in the reset password text field and click on the Reset Password button. Each time the user clicks on the ...
10
votes
1answer
310 views

Integration tests in OSS projects - how to handle 3rd parties with authentication?

One of my (open source) hobby projects is a backup tool which makes offline backups of repositories from GitHub, Bitbucket etc. It calls the hosters' API to get a list of repositories, and then it ...
-1
votes
1answer
179 views

Complete statelessness, how to save password on client in secure way

Thinking about statelessness I wonder how I can overcome the issue of saving the user's password on the client side in a secure but also comfy way. I assume the client always sends credentials to the ...
4
votes
3answers
1k views

Saving Passwords for autologin

I know I should encrypt the password whenever I save passwords for security. But I don't know how should I encrypt password that when I save for autologin. If the password was just for checking user,...
-1
votes
1answer
140 views

Combinations of a password

I am trying to encrypt a password for my school project. Here is the process: Let's assume that I have a string p (n characters long) which contains the password. The program reverses the string and ...
5
votes
2answers
16k views

Will quantum computers be able to easily crack passwords?

I've recently read a number of (layman's) articles on quantum mechanics and quantum computing, and keep seeing examples along the lines of "Quantum computing can crack passwords quickly by trying all ...
3
votes
5answers
513 views

Is it stupid to not save the last two characters of a password hash

As any good password storing developer I have user unique salts that I use to generate password hashes. ie I store a uniquesalt and SHA1(salt + password + "applicationuniquestring") in the database ...
0
votes
2answers
2k views

Best way to hash passwords in PHP?

I've switched to PHP 7.0 very recently and I was wondering that if password_hash was better than making your own salt and using the crypt function. I have three examples of code and I don't know which ...
7
votes
1answer
229 views

Why is it more unsafe to store your password in the URL of a git repo?

As a comment on a response to this question, someone says: It is not advisable to put the password in the URL for this file is saved on the .git/config . Is not safe, it is better to use ssh key ...
2
votes
2answers
122 views

How can I tell if a web sign up form actually encrypts my password?

Recently I signed up for new account for a service provider's web site. I entered the usual the name, email , password (strong) , repeat password and I was signed up. Great everything works well. A ...
0
votes
3answers
118 views

Preventing information leakage while returning an error message

Say my website contains 2 functions: Allow a user to change their own password Allow an administrator to change a user's password (the user must change again before they login) Now let's say that ...
-1
votes
1answer
109 views

Is the mechanism used in Passwordless module widely used? [closed]

I came across Passwordless which uses email/SMS to allow the user to login. Is this mechanism widely used? What are the advantages/disadvantages of using such mechanism? I'm asking because I haven't ...
0
votes
2answers
97 views

How can I effectively design password authentication for encryption in my project?

I'm working on a small personal project that involves a user entering a password that would then allow them to view a text file that would otherwise be encrypted. I'm having trouble wrapping my head ...
3
votes
3answers
2k views

Modern recommendations for password recovery

I'm going to implements password recovery in my authentication. I haven't put this together in a while and wondering if there is anything I ought to be aware of. My idea at the moment is: User ...
0
votes
2answers
2k views

Handling delay in entry of OTP for log in validation

There's an application, which accepts a user id and password to login. Validation of the id and password is processed by another system. Now after password validation, the application generates a One ...
35
votes
6answers
49k views

Putting a password in a REST API call

Suppose I have a REST API that is also used to set/reset passwords. Let's also suppose that this works over a HTTPS connections. Is there any good reason not to put that password in the call path, let'...
0
votes
1answer
76 views

Creating service to distribute passwords to architecture

We have big legacy code working for big corporation connecting to multiple remote/local databases. The configuration files with IP, name and password for connecting to different databases are now ...
2
votes
2answers
3k views

matching usernames with their password

We are working on a simple login/registration form. Our login script checks to see if the username and password exist in the same row of the database. If it does exist, we bring the user to a welcome ...
1
vote
2answers
474 views

Why are Strings in StringPool considered insecure?

Passwords are recommended to be stored in char[] instead of String, as Strings are stored in StringPool. Read more here As per this question Strings in StringPool are not available directly. To ...
1
vote
2answers
190 views

How to store passwords which need to be re-read

I have a utility which runs at certain intervals. My customer now wishes for it to send an email when the task is completed. They want to be able to control the email address, meaning, they want to ...
3
votes
1answer
273 views

If passwords are stored hashed, does that mean that theoretically there exists another password that could be used to log in? [duplicate]

From what I understand, in most sites, passwords are stored as a hash; not in their original form. This means that if the database is hacked into, the attacker will see the (nearly) useless hashes ...
0
votes
2answers
197 views

Resetting vs. re-sending forgotten passwords

When a user forgets their password, is it better practice to reset the password and email that to the user or just to email the current password to the user's email address.
4
votes
1answer
3k views

What's the best practise for storing web server credentials for your web app deployment?

I was looking at the Oracle documentation for the weblogic maven plugin. In it, they store the weblogic user name and password for accessing in the pom.xml. Just wondering, isn't this a terrible ...
6
votes
3answers
401 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...