How can you securely manage programming passwords?

Password managers provide enhanced security by generating and storing strong unique hashed passwords for you. However, the main concern is the risk of putting all your passwords in one place (It's kinda like putting all of your money in a Mutual Fund). Once compromised, it's a security breach. Eg: LastPass and Blur suffered a breach before.

Password managers are constantly being updated with new features and security improvements. Make sure to keep your password manager up to date to ensure that your passwords are protected.

Storing passwords by encrypting them using strong cryptographic techniques helps storing and programming passwords in your product. Similarly using hashes instead of real passwords help the password security.

I would never store plain text passwords. Instead, I'd use strong cryptographic hashing algorithms like bcrypt, Argon2, or scrypt to securely hash passwords I would implement key derivation functions (KDFs) when hashing passwords. These functions make it computationally expensive for attackers to crack passwords. I'd avoid hardcoding passwords directly into the code or configuration files. To protect against brute-force attacks, I'd implement rate limiting and account lockout mechanisms. If there are multiple failed login attempts, I'd temporarily lock user accounts. I'd ensure that passwords are transmitted securely over the network by using HTTPS.

You should change your passwords every few months to help protect your accounts from being compromised. This one is related to the average dwell time of adversaries in the case of breach

- Don't store passwords in plain text. If your database is compromised, your passwords are too. Since most people use same passwords on all platforms, this is a security risk for your customers. - Don't just hash your passwords and store. Most people have common passwords (eg: qwertyuiop) and their hashes are already calculated and stored in Rainbow Tables, hackers can get the actual password from the hashes too. - Create a random salt, add that to your password and then hash it using good cryptographic techniques like SHA256 to save. In your DB, save the Salt, Hash and the Hashing Technique used. (SHA1 is already broken)

A great way to manage the required secrets across environments and teams is provided by secret management tools. I personally use Doppler and i'm very happy with it's developer experience. It's even integrable with tools like docker so developers can use it both locally and on production.

Passwords and secrets should also be periodically rotated as a way to lower the impact of breaches and avoid having malevolent actors in your systems for years

In todays landscape, Mfa should be mandatory for any user but we must acknowledge that not all factors have the same security. A sms factor for example is less safe than a app token.

In secure API access practices, beyond passwords, keys are occasionally employed as a means of authentication. However, it has come to attention that certain developers may inadvertently expose security vulnerabilities by returning the key provided in the request within the response itself. Such practices are highly discouraged and should be strictly avoided to maintain robust security standards. It is essential to exercise caution and implement best security practices to safeguard sensitive data and prevent potential exploits.