Skip to main content

Questions tagged [passwords]

A password is a secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

Filter by
Sorted by
Tagged with
2 votes
1 answer
875 views

Azure Key Vault vs Automation Account Variables for password storage

In Microsoft Azure one can store secret values like passwords in Azure Key Vault, but also as encrypted variables in Azure Automation (these ones are stored in an Azure-managed Key Vault behind the ...
0 votes
2 answers
315 views

Keeping user provided passwords to 3rd party services safe

I have a SaaS application in which users can connect their RDBMS (postgres, mysql etc) and query data from it. I'm wondering what's the best practice to keep their connection details safe. Currently, ...
0 votes
2 answers
168 views

How best to securely store a password for automated access (no user interaction)?

I'm facing the classic chicken/egg problem of where to store the keys to the kingdom. I'm building an application for retail distribution that will rely on receiving a cadence of regularly-issued Let'...
1 vote
0 answers
109 views

How to store an encrypted filesystem in a single file on disk on multiple platforms (maybe not portably), or alternatives

I'm in the very conceptual phase of designing an open source password manager that provides distributed Vaults that can be simultaneously accessed and managed from multiple devices with the promise of ...
1 vote
2 answers
240 views

How to best obfuscate a built-in key in an application?

We're building an application that needs to log into a website using built-in credentials. It's not optimal to say the least, but we're stuck with "knowing" the username and password ...
21 votes
9 answers
832 views

Citations for inadvisability of globally unique password

I am having a disagreement with a client about the user authentication process for a system. The nub of it is that they want each user to have a globally unique password (i.e. no two users can have ...
9 votes
8 answers
7k views

Is Password Hashing Bad?

In software design and security, why would it not be a good idea for users to send you their passwords and it would be a better idea to delegate: use public-key auth or logging in with one of these: ...
7 votes
5 answers
5k views

What type of Password Reset/Forgot Password (verification) mechanism would you recommend

I am looking for ways to verify the user in order to reset their passwords. 2 commonly used ones: Email verification Secret question I wonder which will you recommend? I am trying to avoid having to ...
2 votes
1 answer
865 views

Client Side Hashing + Server Side Hashing

Suppose one plans to implement authentication for their web app. There have been cases, like with Instagram, where passwords were accidentally stored in plain text due to logs. While we'd hope to ...
-3 votes
1 answer
129 views

Any direct principles for writing a simple password generator

I need to write (in PHP, if that matters) my own password generator to generate simple passwords. Passwords that will be used by kids or elderly people only. That will generate passwords that are easy ...
0 votes
1 answer
98 views

Trying to implement a "password vault"-like solution for connection strings

I started to work on a 16 years old .net framework app that didnt receive any love for a decade and I have some time to "put it up to standards". One of the things that ruffle my feathers is ...
2 votes
1 answer
272 views

Is it a good design to have separate Hibernate entities for general user info and user password digest?

I'm developing an app with a user management system. There is a database table named user with the following columns: | Column Name | Column Type | |-----------------|-------------| | userId ...
0 votes
1 answer
199 views

LDAP with Dovecot

I have a mail server setup with Postfix and Dovecot, and an application server setup with node.js. I have user credentials stored in my application server, and I want to use the same credentials for ...
7 votes
6 answers
994 views

How to refuse to give an access to passwords to a customer without being unprofessional or rude?

Let's say you're creating a website for a customer. This website has its own registration (either combined with OpenID or not). The customer asks you to be able to see the passwords the users are ...
3 votes
4 answers
2k views

How to store a password so that it can be passed to another site/service which is expecting a plaintext input

I am developing a website and I would like to allow users to use XMPP for live chat. I would like users to have the option use an existing XMPP account if they wish and store their XMPP username and ...
0 votes
1 answer
351 views

How to use auto-login for an API when building a desktop app?

I am currently building a small application which used a public API to get some information. The API doesn't support auto-login in any way (don't know if something like this even exists with APIs), ...
77 votes
15 answers
30k views

Why should passwords be encrypted if they are being stored in a secure database?

I have a web service. Right now, I have passwords stored in plain text in a MySQL table on my server. I know this isn't the best practice, and that is why I am working on it. Why should passwords be ...
0 votes
3 answers
205 views

Sysadmin password storing

I'm quite unexperienced in the sysadmin area. Now I'm facing the responsability of managing two (remote) servers. I'm working in an informal organization. So I have passwords for the OS's users, ...
2 votes
4 answers
2k views

How to compare passwords which is stored in DB in encrypted form in secure way?

Recently In an interview I was asked this question - Question- If are storing passwords in encrypted format in DB and in future when user login into our website how will we perform authentication? Me:...
-2 votes
1 answer
101 views

mask username and password in service file, or better approach

At work there is a given task where a python application is currently running on a server, this application is using a enviorment file, which has username and password information. The current ask is ...
-1 votes
1 answer
66 views

Protecting cryptocurrency private keys in a corporate environment

Now that Tesla has bought a large amount of BitCoin, other companies may follow suit. If my company wanted to do that, I was thinking about how it could be done. I'm familiar with the way private ...
1 vote
2 answers
107 views

Should I check for non-existing users with correctly signed tokens?

I ran into an issue when developing where a user that did not exist, but had a correctly signed JWT, was logged in. This happened when I absentmindedly logged in using a browser while running the test ...
1 vote
2 answers
985 views

How do password-protected pdf documents work?

I hope this is the right site for this question... I tutor in my spare time, and recently I downloaded a past GCSE exam paper and was attempting to edit the pdf- to select just a few pages to send to ...
2 votes
1 answer
450 views

How to handle db password change in a live service

Suppose I have a REST application running on a remote server which connects to a mysql database. Now let's say the password of the db has to be changed. What are the right methods and practices that ...
1 vote
2 answers
814 views

How can I protect sensitive information inside a binary?

I am currently developing an application with Qt/C++ which needs to access a Shopify store using the Admin API. In order to access the API, my application needs to know the following information: API ...
-1 votes
1 answer
315 views

Pattern to encrypt / decrypt data to / from a server without entering the secret key each time?

The title maybe it's a little bit confusing but I am certain that what I want to achieve is a common pattern, even if I didn't found anything on internet. I'm developing a web app that store ...
1 vote
3 answers
879 views

hash-like algorithm to identify passwords which are "too similar" to previous ones from history

One common issue with secure passwords is that users tend to "cheat", one common cheating pattern we meet recently is the "password swap" antipattern where the user basically keeps using the same two ...
43 votes
11 answers
4k views

Are there any valid reasons for disallowing characters and limiting the length of passwords?

I've come across quite a few sites that either limit the length they allow passwords to be and/or disallow certain characters. That's limiting to me as I want to widen and lengthen the search space of ...
0 votes
1 answer
50 views

Save user credentials for use with multiple third-party websites

I've seen a few similar questions but nothing to address this exact issue... I'd like to have a mobile app that allows users to input username/password once and then be automatically logged in with ...
20 votes
9 answers
8k views

Is this scenario an exception to the rule of never storing passwords in plaintext?

I am making a full-stack web application for a professor. At his request, the passwords and usernames are generated programmatically, and they cannot be changed or reset by the students. (If you ...
1 vote
1 answer
700 views

Hashing from within the database or outside?

I am in the process of evolving architecture for an 'equity analysis system'. I will be using SQLServer as the database, but I am not going the .NET route and won't be using the built-in 'membership' ...
2 votes
1 answer
126 views

Securly storing password with revertible encryption

A bit of context: I used the password recovery of a website I am using (the website of a big corporation). My password was immediately sent back to me via text message. I did not receive a ...
11 votes
3 answers
11k views

How does a web browser save passwords?

How do current web browsers (or mobile mail clients and any software in general) save user passwords? All answers about storing passwords say we should store only hashes, not the password themselves. ...
2 votes
1 answer
218 views

Should usernames and passwords to external systems be documented?

This is basically an extension to my previous question. That time our internal discussions didn't end up anywhere and the whole issue was forgotten for the time being. Now we've touched upon it again,...
0 votes
3 answers
237 views

Is there a secure way to check previous passwords purely on the client-side?

We have a requirement for a security audit that our password policy must disallow the re-use of a previous password from the last 4 used passwords. We can accomplish this fairly easily by making a ...
11 votes
5 answers
2k views

If passwords are stored hashed, how would a computer know that your password is similar to the last one if you try resetting your password?

If passwords are stored hashed, how would a computer know that your password is similar to the last one if you try resetting your password? Wouldn't the two passwords be totally different since one is ...
0 votes
1 answer
104 views

Password manager inside application

Firstly this is not about how to store password for access to the application itself. That is handled using .Net Identity. Authentication is handled using JWT. So it is a web application. The problem ...
35 votes
6 answers
7k views

Updating password hashing without forcing a new password for existing users

You maintain an existing application with an established user base. Over time it is decided that the current password hashing technique is outdated and needs to be upgraded. Furthermore, for UX ...
3 votes
3 answers
298 views

How to pass credentials to client

When installing application on client's server at the end of the project, how to give admin's password to client? (On paper, by word?) Client may not be very technical so script generating password ...
3 votes
4 answers
2k views

Security through obscurity and storing unencrypted passwords

What exactly does "Security through obscurity" means in the context of stroing unencrypted passwords? I'm using a small program (I won't name it, to not enlarge enough large shame on its author) that ...
11 votes
1 answer
489 views

During account creation, is it better to generate the password automatically and send it to the user, or to let the user create his own password?

This question came up today while discussing with a colleague about the 'create account' page for the website we're working on. My colleague's opinion is that we should make the registration as quick ...
34 votes
14 answers
2k views

What if the client needs the ability to retrieve passwords?

I've currently inherited an application at work and to my dismay, I have realized that the user passwords stored in the database are encrypted using an in house encryption function, which also ...
3 votes
5 answers
526 views

Is it stupid to not save the last two characters of a password hash

As any good password storing developer I have user unique salts that I use to generate password hashes. ie I store a uniquesalt and SHA1(salt + password + "applicationuniquestring") in the database ...
11 votes
1 answer
346 views

Integration tests in OSS projects - how to handle 3rd parties with authentication?

One of my (open source) hobby projects is a backup tool which makes offline backups of repositories from GitHub, Bitbucket etc. It calls the hosters' API to get a list of repositories, and then it ...
0 votes
2 answers
203 views

Resetting vs. re-sending forgotten passwords

When a user forgets their password, is it better practice to reset the password and email that to the user or just to email the current password to the user's email address.
1 vote
3 answers
525 views

Possible way to handle multiple reset password email

It's a C#, ASP.NET MVC Project and here is the problem: User can enter their email address in the reset password text field and click on the Reset Password button. Each time the user clicks on the ...
-1 votes
1 answer
208 views

Complete statelessness, how to save password on client in secure way

Thinking about statelessness I wonder how I can overcome the issue of saving the user's password on the client side in a secure but also comfy way. I assume the client always sends credentials to the ...
4 votes
3 answers
2k views

Saving Passwords for autologin

I know I should encrypt the password whenever I save passwords for security. But I don't know how should I encrypt password that when I save for autologin. If the password was just for checking user,...
18 votes
5 answers
7k views

"Forgot Password" - How to handle this?

I read this answer and found a comment insisting not to send password by email: passwords should not be able to be retrieved by email, I hate that. It means my password is stored in plain text ...
2 votes
1 answer
744 views

Password reset process

So I'm working on my first password reset mechanism. I'm going with what I understand to be a fairly common procedure: User clicks "Forgot Password" User is prompted for email address If the entered ...