Questions tagged [passwords]
A password is a secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.
109
questions
1
vote
0
answers
76
views
How to store an encrypted filesystem in a single file on disk on multiple platforms (maybe not portably), or alternatives
I'm in the very conceptual phase of designing an open source password manager that provides distributed Vaults that can be simultaneously accessed and managed from multiple devices with the promise of ...
- 111
1
vote
2
answers
206
views
How to best obfuscate a built-in key in an application?
We're building an application that needs to log into a website using built-in credentials. It's not optimal to say the least, but we're stuck with "knowing" the username and password ...
- 351
9
votes
8
answers
7k
views
Is Password Hashing Bad?
In software design and security, why would it not be a good idea for users to send you their passwords and it would be a better idea to delegate: use public-key auth or logging in with one of these: ...
- 331
0
votes
2
answers
239
views
Keeping user provided passwords to 3rd party services safe
I have a SaaS application in which users can connect their RDBMS (postgres, mysql etc) and query data from it. I'm wondering what's the best practice to keep their connection details safe. Currently, ...
- 125
-3
votes
1
answer
107
views
Any direct principles for writing a simple password generator
I need to write (in PHP, if that matters) my own password generator to generate simple passwords. Passwords that will be used by kids or elderly people only. That will generate passwords that are easy ...
- 2,386
0
votes
1
answer
86
views
Trying to implement a "password vault"-like solution for connection strings
I started to work on a 16 years old .net framework app that didnt receive any love for a decade and I have some time to "put it up to standards".
One of the things that ruffle my feathers is ...
- 3
3
votes
4
answers
2k
views
How to store a password so that it can be passed to another site/service which is expecting a plaintext input
I am developing a website and I would like to allow users to use XMPP for live chat. I would like users to have the option use an existing XMPP account if they wish and store their XMPP username and ...
- 43
0
votes
3
answers
202
views
Sysadmin password storing
I'm quite unexperienced in the sysadmin area. Now I'm facing the responsability of managing two (remote) servers. I'm working in an informal organization.
So I have passwords for the OS's users, ...
2
votes
4
answers
1k
views
How to compare passwords which is stored in DB in encrypted form in secure way?
Recently In an interview I was asked this question -
Question- If are storing passwords in encrypted format in DB and in future when user login into our website how will we perform authentication?
Me:...
- 147
-2
votes
1
answer
81
views
mask username and password in service file, or better approach
At work there is a given task where a python application is currently running on a server, this application is using a enviorment file, which has username and password information. The current ask is ...
- 107
-1
votes
1
answer
61
views
Protecting cryptocurrency private keys in a corporate environment
Now that Tesla has bought a large amount of BitCoin, other companies may follow suit. If my company wanted to do that, I was thinking about how it could be done.
I'm familiar with the way private ...
- 115
2
votes
1
answer
262
views
Is it a good design to have separate Hibernate entities for general user info and user password digest?
I'm developing an app with a user management system. There is a database table named user with the following columns:
| Column Name | Column Type |
|-----------------|-------------|
| userId ...
- 121
1
vote
2
answers
105
views
Should I check for non-existing users with correctly signed tokens?
I ran into an issue when developing where a user that did not exist, but had a correctly signed JWT, was logged in.
This happened when I absentmindedly logged in using a browser while running the test ...
- 140
1
vote
2
answers
699
views
How do password-protected pdf documents work?
I hope this is the right site for this question...
I tutor in my spare time, and recently I downloaded a past GCSE exam paper and was attempting to edit the pdf- to select just a few pages to send to ...
- 127
0
votes
1
answer
291
views
How to use auto-login for an API when building a desktop app?
I am currently building a small application which used a public API to get some information. The API doesn't support auto-login in any way (don't know if something like this even exists with APIs), ...
- 1
2
votes
1
answer
361
views
How to handle db password change in a live service
Suppose I have a REST application running on a remote server which connects to a mysql database. Now let's say the password of the db has to be changed. What are the right methods and practices that ...
- 129
0
votes
2
answers
494
views
How can I protect sensitive information inside a binary?
I am currently developing an application with Qt/C++ which needs to access a Shopify store using the Admin API. In order to access the API, my application needs to know the following information:
API ...
- 1,257
1
vote
3
answers
717
views
hash-like algorithm to identify passwords which are "too similar" to previous ones from history
One common issue with secure passwords is that users tend to "cheat", one common cheating pattern we meet recently is the "password swap" antipattern where the user basically keeps using the same two ...
- 121
20
votes
9
answers
8k
views
Is this scenario an exception to the rule of never storing passwords in plaintext?
I am making a full-stack web application for a professor. At his request, the passwords and usernames are generated programmatically, and they cannot be changed or reset by the students. (If you ...
- 359
1
vote
1
answer
572
views
Hashing from within the database or outside?
I am in the process of evolving architecture for an 'equity analysis system'. I will be using SQLServer as the database, but I am not going the .NET route and won't be using the built-in 'membership' ...
2
votes
1
answer
123
views
Securly storing password with revertible encryption
A bit of context:
I used the password recovery of a website I am using (the website of a big corporation). My password was immediately sent back to me via text message. I did not receive a ...
- 33
2
votes
1
answer
803
views
Azure Key Vault vs Automation Account Variables for password storage
In Microsoft Azure one can store secret values like passwords in Azure Key Vault, but also as encrypted variables in Azure Automation (these ones are stored in an Azure-managed Key Vault behind the ...
- 29
2
votes
1
answer
827
views
Client Side Hashing + Server Side Hashing
Suppose one plans to implement authentication for their web app. There have been cases, like with Instagram, where passwords were accidentally stored in plain text due to logs.
While we'd hope to ...
- 141
-1
votes
1
answer
292
views
Pattern to encrypt / decrypt data to / from a server without entering the secret key each time?
The title maybe it's a little bit confusing but I am certain that what I want to achieve is a common pattern, even if I didn't found anything on internet.
I'm developing a web app that store ...
0
votes
1
answer
50
views
Save user credentials for use with multiple third-party websites
I've seen a few similar questions but nothing to address this exact issue... I'd like to have a mobile app that allows users to input username/password once and then be automatically logged in with ...
- 103
2
votes
1
answer
181
views
Should usernames and passwords to external systems be documented?
This is basically an extension to my previous question. That time our internal discussions didn't end up anywhere and the whole issue was forgotten for the time being.
Now we've touched upon it again,...
- 5,320
0
votes
3
answers
221
views
Is there a secure way to check previous passwords purely on the client-side?
We have a requirement for a security audit that our password policy must disallow the re-use of a previous password from the last 4 used passwords.
We can accomplish this fairly easily by making a ...
- 131
10
votes
5
answers
1k
views
If passwords are stored hashed, how would a computer know that your password is similar to the last one if you try resetting your password?
If passwords are stored hashed, how would a computer know that your password is similar to the last one if you try resetting your password? Wouldn't the two passwords be totally different since one is ...
- 125
0
votes
1
answer
98
views
Password manager inside application
Firstly this is not about how to store password for access to the application itself. That is handled using .Net Identity. Authentication is handled using JWT. So it is a web application.
The problem ...
- 2,566
0
votes
1
answer
190
views
LDAP with Dovecot
I have a mail server setup with Postfix and Dovecot, and an application server setup with node.js. I have user credentials stored in my application server, and I want to use the same credentials for ...
- 429
3
votes
3
answers
291
views
How to pass credentials to client
When installing application on client's server at the end of the project, how to give admin's password to client? (On paper, by word?) Client may not be very technical so script generating password ...
- 95
11
votes
1
answer
486
views
During account creation, is it better to generate the password automatically and send it to the user, or to let the user create his own password?
This question came up today while discussing with a colleague about the 'create account' page for the website we're working on.
My colleague's opinion is that we should make the registration as quick ...
- 229
1
vote
3
answers
444
views
Possible way to handle multiple reset password email
It's a C#, ASP.NET MVC Project and here is the problem:
User can enter their email address in the reset password text field and click on the Reset Password button. Each time the user clicks on the ...
- 121
11
votes
1
answer
343
views
Integration tests in OSS projects - how to handle 3rd parties with authentication?
One of my (open source) hobby projects is a backup tool which makes offline backups of repositories from GitHub, Bitbucket etc.
It calls the hosters' API to get a list of repositories, and then it ...
- 1,863
-1
votes
1
answer
204
views
Complete statelessness, how to save password on client in secure way
Thinking about statelessness I wonder how I can overcome the issue of saving the user's password on the client side in a secure but also comfy way.
I assume the client always sends credentials to the ...
- 139
4
votes
3
answers
2k
views
Saving Passwords for autologin
I know I should encrypt the password whenever I save passwords for security.
But I don't know how should I encrypt password that when I save for autologin.
If the password was just for checking user,...
- 51
-1
votes
1
answer
154
views
Combinations of a password
I am trying to encrypt a password for my school project. Here is the process:
Let's assume that I have a string p (n characters long) which contains the password.
The program reverses the string and ...
- 21
9
votes
2
answers
18k
views
Will quantum computers be able to easily crack passwords?
I've recently read a number of (layman's) articles on quantum mechanics and quantum computing, and keep seeing examples along the lines of "Quantum computing can crack passwords quickly by trying all ...
- 425
3
votes
5
answers
523
views
Is it stupid to not save the last two characters of a password hash
As any good password storing developer I have user unique salts that I use to generate password hashes. ie I store a uniquesalt and SHA1(salt + password + "applicationuniquestring") in the database ...
- 162
0
votes
2
answers
2k
views
Best way to hash passwords in PHP?
I've switched to PHP 7.0 very recently and I was wondering that if password_hash was better than making your own salt and using the crypt function. I have three examples of code and I don't know which ...
- 1
7
votes
1
answer
245
views
Why is it more unsafe to store your password in the URL of a git repo?
As a comment on a response to this question, someone says:
It is not advisable to put the password in the URL for this file is saved on the .git/config . Is not safe, it is better to use ssh key
...
- 457
2
votes
2
answers
129
views
How can I tell if a web sign up form actually encrypts my password?
Recently I signed up for new account for a service provider's web site.
I entered the usual the name, email , password (strong) , repeat password and I was signed up. Great everything works well.
A ...
- 21
0
votes
3
answers
124
views
Preventing information leakage while returning an error message
Say my website contains 2 functions:
Allow a user to change their own password
Allow an administrator to change a user's password (the user must change again before they login)
Now let's say that ...
- 167
-1
votes
1
answer
112
views
Is the mechanism used in Passwordless module widely used? [closed]
I came across Passwordless which uses email/SMS to allow the user to login. Is this mechanism widely used? What are the advantages/disadvantages of using such mechanism? I'm asking because I haven't ...
- 1,161
0
votes
2
answers
102
views
How can I effectively design password authentication for encryption in my project?
I'm working on a small personal project that involves a user entering a password that would then allow them to view a text file that would otherwise be encrypted.
I'm having trouble wrapping my head ...
3
votes
3
answers
2k
views
Modern recommendations for password recovery
I'm going to implements password recovery in my authentication. I haven't put this together in a while and wondering if there is anything I ought to be aware of.
My idea at the moment is:
User ...
- 795
0
votes
2
answers
2k
views
Handling delay in entry of OTP for log in validation
There's an application, which accepts a user id and password to login. Validation of the id and password is processed by another system. Now after password validation, the application generates a One ...
36
votes
6
answers
55k
views
Putting a password in a REST API call
Suppose I have a REST API that is also used to set/reset passwords. Let's also suppose that this works over a HTTPS connections. Is there any good reason not to put that password in the call path, let'...
- 779
0
votes
1
answer
86
views
Creating service to distribute passwords to architecture
We have big legacy code working for big corporation connecting to multiple remote/local databases.
The configuration files with IP, name and password for connecting to different databases are now ...
- 135
2
votes
2
answers
4k
views
matching usernames with their password
We are working on a simple login/registration form. Our login script checks to see if the username and password exist in the same row of the database. If it does exist, we bring the user to a welcome ...
- 133