IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [credential-reuse]

Credential reuse is the practice of users to reuse the same credentials (e.g. password) for multiple systems.

9 questions
43
votes
4 answers

What are the differences between credential stuffing and password spraying?

Wikipedia describes credential stuffing as a type of cyberattack where stolen account credentials typically consisting of lists of usernames and/or email addresses and the corresponding passwords (often from a data breach) are used to gain …
Motivated
  • 1,493
  • 1
  • 14
  • 25
29
votes
12 answers

Reusing passwords that can possibly never be cracked

Reusing passwords pose as a terrible risk for users because in the event of a data breach, with the passwords not being stored securely enough, this means that, by default, all other services that they use this password for are also compromised.…
user173331
3
votes
1 answer

Can I use HashiCorp Vault to restrict access to credentials based on CIDR ranges?

This seems like a pretty simple use case, but it would depend on some pretty recently added functionality which I might not understand yet: A python script gets populated by configuration management on a few monitoring servers within a specific IP…
Nathan Basanese
  • 640
  • 1
  • 9
  • 20
1
vote
1 answer

Does a password-derived public key authentication improve security over pure password-based authentication?

Despite best efforts it is pretty clear that most users reuse their credentials, especially for what they consider non-critical sites such as forums. While TFA does mitigate the potential damage of this a bit (aside from its other benefits of…
Tobias Kienzler
  • 7,578
  • 10
  • 43
  • 66
1
vote
0 answers

How to cache auth credentials to speed up authentication

I'm developing some REST API that requires a HTTP basic auth to access. The APIs are written in Django, and the auth is based on Django auth middleware that is: it checks against the DB, the username and password. The password is stored with the…
EsseTi
  • 643
  • 1
  • 5
  • 8
1
vote
0 answers

Storing password or access token in standalone Java app

I have a simple Java app that use Eclipse JGit to pull remote repositories into the app to analyze and provide the user with code metric details on their projects. This app is supposed to be able to pull a repository at any time, so I would like to…
Edward McNealy
  • 11
  • 1
1
vote
2 answers

Should users be allowed to reuse/recyle the same login credentials across a network for different systems?

Should users be allowed to reuse/recycle the same login credentials across a network for different systems? Should this be disallowed/discouraged, or are the security implications minimal? If it's frowned upon, should the usernames and passwords be…
user389823
  • 625
  • 6
  • 11
0
votes
0 answers

Shared credentials logins between separate websites and trust issues

Brand A has multiple, separate websites - these websites reference each other as part of the brand family, but do not have a shared single sign on system. Instead, each website has their own login and account creation page - on which, there is the…
Moo
  • 542
  • 3
  • 6
0
votes
2 answers

Password reuse for similar accounts

Assume I have two Github accounts, one for regular use and one for testing purposes. Or two PGP keys, one for pass and the other for encrypted email communication, and my backup scheme is exactly the same for both keys. Now assume I use a single…
e18r
  • 153
  • 7