“构筑移动互联网应用安全防线全国行”活动正式
百度 加强群众举报线索受理工作，拓宽反映渠道。
The functions performed by the person or processes responsible for security of passwords on a given system.
18 questions from the last 365 days
5
votes
2
answers
671
views
How do you independently verify that credentials have been rotated?
PCI compliance requires us to rotate passwords, but mainly seems to allow us to attest to the fact that we rotated the passwords based on trust that the work we say we're doing is getting done.
But as ...
- 211
0
votes
1
answer
93
views
Is an offline password database with a key a reasonable way to hand over credentials?
Suppose I got tasked with setting an infrastructure for an organization that shared one password for everything from Wi-Fi, to that file share on a computer with missing side panel where everything is,...
- 101
3
votes
5
answers
2k
views
What is the drawback of always generating passphrases for the user?
The arguably weakest link in any password protected service is the human mind which still chooses easy to guess passwords, despite it fulfilling "general security practices" such as S4f3P@$$...
- 139
1
vote
0
answers
49
views
Are secrets from automatically unlocked keychain in Ubuntu 24.04 Seahorse accessible for any application?
I am familiarizing with Ubuntu 24.04 and Seahorse. I recently connected to a password-protected network drive, and the password is now stored in my "login" keyring, which is encrypted with ...
- 11
11
votes
2
answers
5k
views
Why aren't passwords also hashed on client side on desktop applications?
My understanding of the standard best practice way to handle passwords is:
Establish a secure encrypted connection between client and server.
Client sends password in plaintext over this encrypted ...
- 113
14
votes
3
answers
4k
views
Security implications to removing delay on empty passwords?
Login prompts on many systems (like Ubuntu) have a delay if an incorrect password is used. I understand this is to inhibit brute force attacks. Would there be any security implications to having no ...
- 241
8
votes
3
answers
3k
views
Password change frequency for technical accounts
It has become clear that asking users to regularly change their passwords does not improve security, and has thus been forbidden e.g. by NIST and BSI.
Does this advice also apply for technical ...
- 677
0
votes
1
answer
136
views
Reasonable model for Storing credentials for use in scripts
I was reading question 180243 which states that using a password vault is the best option for credential storage.
However this is rather cumbersome to setup. For a lower security use case (so no PII ...
1
vote
2
answers
210
views
Why is using a password manager considered a good practice? [duplicate]
I don't understand why people recommend password managers. If my password that I reuse for websites a,b,c gets acquired somehow, then my credentials for websites a,b,c are compromised. On the other ...
- 222
2
votes
1
answer
446
views
What's the best method of securing keys/passwords used by a PowerShell script that runs when no user is logged in, using only one server, for free?
I have a server set up to run a PowerShell script every 15 minutes. This script needs to make API requests with keys and passwords. The script runs even when no user is logged in, so encryption based ...
user258111
0
votes
1
answer
127
views
Encryption password in program, to secure its centrally-stored settings?
I was thinking of implementing this in software, starting with one password, with each new release being derived from that initial password.
(trying to find the name of this technique, I think it's ...
- 113
0
votes
1
answer
156
views
Why is "not storing data protection keys" not a popular choice?
In the NIST SP 800-132, they specified two ways to use the data protection key (DPK) that is derived from a password. One of them is to use the DPK to encrypt data, and then, if I am not mistaken, ...
- 13
1
vote
2
answers
194
views
Are router admin-panel passwords hashed? Do they need to be?
Are router admin-panel passwords hashed? Do they need to be?
Am I right to think that that the only way an attacker could extract a router password (hashed or not) from the router is have physical ...
- 4,765
19
votes
7
answers
6k
views
Is it secure to block passwords that are too similar to other employees' old passwords?
At my work, they don’t like different employees having ‘partially matching passwords.’
I had never thought anything of it before, but just now I realised what this means (or might mean.)
When I ...
- 4,765
1
vote
2
answers
1k
views
Whats the safest way to store 2fa/mfa secret key in database?
I try to implement a secure user login in my .net application. The first password is hashed with argon2id. The salt and the hashed password is stored in a database. SSL encryption and HttpOnly Cookie ...
- 369