Questions tagged [passwords]

A password is a secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

Filter by
Sorted by
Tagged with
2
votes
1answer
125 views

How to handle db password change in a live service

Suppose I have a REST application running on a remote server which connects to a mysql database. Now let's say the password of the db has to be changed. What are the right methods and practices that ...
0
votes
2answers
76 views

How can I protect sensitive information inside a binary?

I am currently developing an application with Qt/C++ which needs to access a Shopify store using the Admin API. In order to access the API, my application needs to know the following information: API ...
1
vote
3answers
167 views

hash-like algorithm to identify passwords which are “too similar” to previous ones from history

One common issue with secure passwords is that users tend to "cheat", one common cheating pattern we meet recently is the "password swap" antipattern where the user basically keeps using the same two ...
21
votes
9answers
8k views

Is this scenario an exception to the rule of never storing passwords in plaintext?

I am making a full-stack web application for a professor. At his request, the passwords and usernames are generated programmatically, and they cannot be changed or reset by the students. (If you ...
1
vote
1answer
123 views

Hashing from within the database or outside?

I am in the process of evolving architecture for an 'equity analysis system'. I will be using SQLServer as the database, but I am not going the .NET route and won't be using the built-in 'membership' ...
2
votes
1answer
112 views

Securly storing password with revertible encryption

A bit of context: I used the password recovery of a website I am using (the website of a big corporation). My password was immediately sent back to me via text message. I did not receive a ...
1
vote
1answer
222 views

Azure Key Vault vs Automation Account Variables for password storage

In Microsoft Azure one can store secret values like passwords in Azure Key Vault, but also as encrypted variables in Azure Automation (these ones are stored in an Azure-managed Key Vault behind the ...
1
vote
1answer
207 views

Client Side Hashing + Server Side Hashing

Suppose one wishes to implement an account system for their service/website. There have been cases with Instagram for example where passwords were accidentally stored in plain text due to ...
-1
votes
1answer
101 views

Pattern to encrypt / decrypt data to / from a server without entering the secret key each time?

The title maybe it's a little bit confusing but I am certain that what I want to achieve is a common pattern, even if I didn't found anything on internet. I'm developing a web app that store ...
0
votes
1answer
40 views

Save user credentials for use with multiple third-party websites

I've seen a few similar questions but nothing to address this exact issue... I'd like to have a mobile app that allows users to input username/password once and then be automatically logged in with ...
1
vote
1answer
112 views

Should usernames and passwords to external systems be documented?

This is basically an extension to my previous question. That time our internal discussions didn't end up anywhere and the whole issue was forgotten for the time being. Now we've touched upon it again,...
0
votes
3answers
165 views

Is there a secure way to check previous passwords purely on the client-side?

We have a requirement for a security audit that our password policy must disallow the re-use of a previous password from the last 4 used passwords. We can accomplish this fairly easily by making a ...
11
votes
5answers
897 views

If passwords are stored hashed, how would a computer know that your password is similar to the last one if you try resetting your password?

If passwords are stored hashed, how would a computer know that your password is similar to the last one if you try resetting your password? Wouldn't the two passwords be totally different since one is ...
0
votes
1answer
71 views

Password manager inside application

Firstly this is not about how to store password for access to the application itself. That is handled using .Net Identity. Authentication is handled using JWT. So it is a web application. The problem ...
0
votes
1answer
114 views

LDAP with Dovecot

I have a mail server setup with Postfix and Dovecot, and an application server setup with node.js. I have user credentials stored in my application server, and I want to use the same credentials for ...
3
votes
3answers
146 views

How to pass credentials to client

When installing application on client's server at the end of the project, how to give admin's password to client? (On paper, by word?) Client may not be very technical so script generating password ...
11
votes
1answer
467 views

During account creation, is it better to generate the password automatically and send it to the user, or to let the user create his own password?

This question came up today while discussing with a colleague about the 'create account' page for the website we're working on. My colleague's opinion is that we should make the registration as quick ...
1
vote
3answers
178 views

Possible way to handle multiple reset password email

It's a C#, ASP.NET MVC Project and here is the problem: User can enter their email address in the reset password text field and click on the Reset Password button. Each time the user clicks on the ...
10
votes
1answer
276 views

Integration tests in OSS projects - how to handle 3rd parties with authentication?

One of my (open source) hobby projects is a backup tool which makes offline backups of repositories from GitHub, Bitbucket etc. It calls the hosters' API to get a list of repositories, and then it ...
-1
votes
1answer
146 views

Complete statelessness, how to save password on client in secure way

Thinking about statelessness I wonder how I can overcome the issue of saving the user's password on the client side in a secure but also comfy way. I assume the client always sends credentials to the ...
4
votes
3answers
1k views

Saving Passwords for autologin

I know I should encrypt the password whenever I save passwords for security. But I don't know how should I encrypt password that when I save for autologin. If the password was just for checking user,...
-1
votes
1answer
130 views

Combinations of a password

I am trying to encrypt a password for my school project. Here is the process: Let's assume that I have a string p (n characters long) which contains the password. The program reverses the string and ...
5
votes
2answers
11k views

Will quantum computers be able to easily crack passwords?

I've recently read a number of (layman's) articles on quantum mechanics and quantum computing, and keep seeing examples along the lines of "Quantum computing can crack passwords quickly by trying all ...
3
votes
5answers
504 views

Is it stupid to not save the last two characters of a password hash

As any good password storing developer I have user unique salts that I use to generate password hashes. ie I store a uniquesalt and SHA1(salt + password + "applicationuniquestring") in the database ...
0
votes
2answers
2k views

Best way to hash passwords in PHP?

I've switched to PHP 7.0 very recently and I was wondering that if password_hash was better than making your own salt and using the crypt function. I have three examples of code and I don't know which ...
7
votes
1answer
226 views

Why is it more unsafe to store your password in the URL of a git repo?

As a comment on a response to this question, someone says: It is not advisable to put the password in the URL for this file is saved on the .git/config . Is not safe, it is better to use ssh key ...
2
votes
2answers
120 views

How can I tell if a web sign up form actually encrypts my password?

Recently I signed up for new account for a service provider's web site. I entered the usual the name, email , password (strong) , repeat password and I was signed up. Great everything works well. A ...
0
votes
3answers
113 views

Preventing information leakage while returning an error message

Say my website contains 2 functions: Allow a user to change their own password Allow an administrator to change a user's password (the user must change again before they login) Now let's say that ...
-1
votes
1answer
104 views

Is the mechanism used in Passwordless module widely used? [closed]

I came across Passwordless which uses email/SMS to allow the user to login. Is this mechanism widely used? What are the advantages/disadvantages of using such mechanism? I'm asking because I haven't ...
0
votes
2answers
97 views

How can I effectively design password authentication for encryption in my project?

I'm working on a small personal project that involves a user entering a password that would then allow them to view a text file that would otherwise be encrypted. I'm having trouble wrapping my head ...
3
votes
3answers
1k views

Modern recommendations for password recovery

I'm going to implements password recovery in my authentication. I haven't put this together in a while and wondering if there is anything I ought to be aware of. My idea at the moment is: User ...
0
votes
2answers
1k views

Handling delay in entry of OTP for log in validation

There's an application, which accepts a user id and password to login. Validation of the id and password is processed by another system. Now after password validation, the application generates a One ...
34
votes
6answers
44k views

Putting a password in a REST API call

Suppose I have a REST API that is also used to set/reset passwords. Let's also suppose that this works over a HTTPS connections. Is there any good reason not to put that password in the call path, let'...
0
votes
1answer
73 views

Creating service to distribute passwords to architecture

We have big legacy code working for big corporation connecting to multiple remote/local databases. The configuration files with IP, name and password for connecting to different databases are now ...
2
votes
2answers
3k views

matching usernames with their password

We are working on a simple login/registration form. Our login script checks to see if the username and password exist in the same row of the database. If it does exist, we bring the user to a welcome ...
1
vote
2answers
359 views

Why are Strings in StringPool considered insecure?

Passwords are recommended to be stored in char[] instead of String, as Strings are stored in StringPool. Read more here As per this question Strings in StringPool are not available directly. To ...
1
vote
2answers
185 views

How to store passwords which need to be re-read

I have a utility which runs at certain intervals. My customer now wishes for it to send an email when the task is completed. They want to be able to control the email address, meaning, they want to ...
3
votes
1answer
269 views

If passwords are stored hashed, does that mean that theoretically there exists another password that could be used to log in? [duplicate]

From what I understand, in most sites, passwords are stored as a hash; not in their original form. This means that if the database is hacked into, the attacker will see the (nearly) useless hashes ...
0
votes
2answers
196 views

Resetting vs. re-sending forgotten passwords

When a user forgets their password, is it better practice to reset the password and email that to the user or just to email the current password to the user's email address.
3
votes
1answer
3k views

What's the best practise for storing web server credentials for your web app deployment?

I was looking at the Oracle documentation for the weblogic maven plugin. In it, they store the weblogic user name and password for accessing in the pom.xml. Just wondering, isn't this a terrible ...
6
votes
3answers
317 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...
-1
votes
1answer
4k views

Can someone please explain reverse look up tables? [closed]

Im finding it difficult to understand reverse look up tables and how it works, and the concept of hash chains. This is apart of a computer security model i am taking. So i understand that brute force, ...
1
vote
1answer
113 views

How to store sensitive information (e.g. clients' credentials) accessibly for everybody inside?

I just discovered that we store sensitive information on our SharePoint. Since it's accessible by a password alone (and we all know that others click for the password/user name to be automatically pre-...
1
vote
2answers
157 views

Administrator Rights for a set of code

I am developing a program for Windows 7 Enterprise Edition that will be used in a corporate environment. The application will automatically fix certain errors as soon as the user selects the ...
1
vote
2answers
465 views

Is hashing of just “username + password” as safe as salted hashing

I want to hash "user + password". [EDIT: prehashing "user" would be an improvement, so my question is also for hashing "hash(user) + password". If cross-site same user is a problem then the hashing ...
4
votes
1answer
6k views

Difference between reverse lookup tables and rainbow tables

Using Reverse Lookup Tables, you create a lookup table consisting of the password hash of user accounts. Then you use another table which consists of hashes with guessed passwords. Then you compare ...
2
votes
1answer
580 views

Kerberos for key management?

We have half-implemented proper key management at our dev shop. We have a SOAP web service (the key management web service) that can be used to retrieve passwords for other systems. So for instance, I ...
2
votes
1answer
405 views

Password reset process

So I'm working on my first password reset mechanism. I'm going with what I understand to be a fairly common procedure: User clicks "Forgot Password" User is prompted for email address If the entered ...
3
votes
2answers
3k views

Strategy for storing passwords/credentials in the context of continuous delivery [closed]

It is common sense not to store passwords/credentials into SCM. I would like to know then what would be a good strategy for storing passwords/credentials in the context of continuous delivery. Where ...
8
votes
1answer
469 views

When allowing a user to change passwords, should I generate a new salt?

In my database, I have a column for the hashed password and the salt. My application allows users to change their password. Should I use the same salt for the password, or should I generate a new ...