Tag Info

New answers tagged

-1

Consider using built-in password vaults. For example, Windows 8 has a credential manager, Windows 7 has the Data Protection API, Apple has keychain, etc. Note that such features primarily protect against password theft by a user without different credentials than the owner (e.g., on multi-user systems). As you haven't explained your threat model, I'm ...


1

Assuming you own SMTP servers, I would set up firewalled local instances of Node.js or something like that on the same machines where SMTP is located and store passwords encrypted on those machines. Setup proper local access permissions on those servers. Then expose those instances for certain requests to certain IPs just to cover your main service. In ...


8

There are in fact infinitely many passwords which produce the same hash. That is actually more or less the definition of what it means to be a hash function: reducing a larger (potentially infinite) input space into a smaller finite output space. However, a "good" hash function will distribute the hash values among the input values in such a way that any ...


1

You don't say which DBMS you're using. If it's SQLServer, or anything else that can talk to your Active Directory, then Domain groups are the way to go. Given the group the [database] permissions it requires and add/remove Developers from the relevant group(s). Clean and simple and removes the need for local, Developer accounts in each database. As ...


1

I would recommend what I always recommend whenever a user name/password issue arises -- get out of the username/password business if possible. In your case the problem is that devs have passwords for the database, devs should be in a GROUP that has the appropriate permissions. Why have a password, when you can use something better?



Top 50 recent answers are included