The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
3answers
150 views

Email activation string with MD5'd random number and email secure?

For the registration on my PHP powered website, I require email confirmation. After a user registers, a string is generated with the following code and sent to their email address. $key = ...
0
votes
2answers
48 views

Should a user be able to change another user's role to match their own?

Lets say a web application has four user roles. Standard, Supervisor, Manager and Administrator. Should a manager be able to promote someone else to a Manager, or only to a supervisor? I realize in ...
4
votes
3answers
190 views

Are non-personal AD users a security risk?

After an IT audit of my company, the report said that our Active Directory contained too many non-personal user accounts. This caused a risk of misuse and unauthorized user access. I checked my ...
5
votes
2answers
369 views

Encrypt user data when they log in with Facebook, Gmail, etc

I made a login system. The user can login by: using a normal email / password (bcrypted). using a service like facebook, gmail, etc. So far so good. Now I want to store sensitive information (ftp ...
1
vote
0answers
63 views

secure authentication between subdomains hosted seperately

The web tools we are developing for a client require seamless interoperability with an existing user management sytem and commerce tools (the "mainsite"). The mainsite is built and maintained by a ...
9
votes
3answers
927 views

Best practices on securely storing access tokens

What would be the best practices for storing access tokens of another api for your users? In particular I'm developing an application with some friends that let's user log into Facebook to both ...
2
votes
1answer
241 views

Inputting user ID's in URL?

I am currently working on functionality that will allow users to reset their passwords. My question pertains to the security in putting user ID's (a.k.a the auto increment ID's from database) in the ...
-2
votes
1answer
374 views

What are some good user login/authentication libraries or protocols to use with Python on Google App Engine? [closed]

I've read elsewhere (http://forums.udacity.com/questions/6028436/bcrypt-not-suitable-for-pythongae) that bcrypt is not suitable for use on Google App Engine. What are some good ways to create a user ...
6
votes
2answers
433 views

Best Practices for verifying a users identity for helpdesk

I had a conversation today and someone challenged me as to why you would need to verify the identity of a user calling a service desk with anything other than their company email. Granted I know these ...
1
vote
2answers
467 views

Centralize Linux System Management

We currently maintain several linux servers and are looking to employ sub contractors. However, we wan't to keep tabs on who does what on each server. Other then creating sudo accounts on every ...
5
votes
1answer
769 views

Guest user on Mac Book Pro is suddenly on. Was I hacked?

Today I restarted my Mac book Pro and the guest user was on when has always been off before.
2
votes
1answer
180 views

Securely notify users about account changes

I am developing a web application (using PHP) and I am wondering what the best way is to notify users that someone updated their account information? The information that can be updated includes: ...
6
votes
2answers
177 views

Security precautions for shared iPads in a customer facing corporate environment

Most tablets, and iPads in particular, are typically single user devices. Scenario: A service business that interacts directly with customers in person and wants to use iPads while interacting with ...
6
votes
5answers
1k views

Preventing online voter fraud

As part of a promotional campaign, my company wants to launch a site where users (and potential users) of our product will be required to register and vote for certain choices. Depending on how ...
1
vote
3answers
130 views

What is required to ensure users' information being sent over my website is secure with the use of account log ins

I have inherited the responsibility of managing my company's website. There are some customers who are required to submit highly confidential information via the website using online forms. I have ...
6
votes
3answers
241 views

How to suspend a user from my website and prevent them from creating a second account?

I am an outsourcing person, not a programmer. My website is a shopping website (think eBay). My website will need a user suspension feature, in case a user violates the terms and conditions. The ...
3
votes
2answers
131 views

Secure Spring FrameworkUser Management

I got asked this question: "Any decent reusable / plug-able Spring user management systems (registration, change pwd, reset etc)? How do you guys do authz in Spring, including managing those roles ...