Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
0
votes
0answers
55 views

Accounts hacked. Eventually showing a different device

I recently made a new Facebook account from my android phone [ver. 6.0.1] and when I checked active sessions, instead of my android device a, Linux desktop was displayed. Then I checked my Gmail and I ...
-1
votes
0answers
51 views

Suddenly Gmail won't recognize my device and demands mobile number [closed]

Google demands my mobile# to log in into my Gmail account on the same devices I used 1 million times before. I don't want to give them my or anybody else's number. Phone numbers are linked to bank, ...
3
votes
2answers
117 views

Protecting an invitation to join the system

I'm having a debate with a coworker right now about how to design an invitation system. The idea is that the mobile app will be able to send an invitation link to, say, a Whatsapp group, and people ...
0
votes
0answers
102 views

Is asking user TOTP among other details secure?

I have started to work on the Forgotten password feature on my website. Based on OWASP Forgot Password cheatsheet, the user should provide enough information to confirm that it is really them. The ...
0
votes
1answer
26 views

Deactivate MFA protected accounts

Does it still make sense with multi factor protected accounts to deactivate them after a certain period of inactivity? I'd say yes because the user himself probably doesn't remember that an account ...
0
votes
0answers
60 views

how did they get my credit card

I recently went on to the Dr Squatch website to buy some soap that I've been seeing in all of those Youtube video ads. What happened really freaked me out. The website asked for my email, and I ...
0
votes
2answers
69 views

Logging SSH commands on Linux - is custom kernel the only way?

I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user. Even after making changes to instantly log the command and ...
0
votes
0answers
40 views

Is storing passwords in encrypted container still bad practice? [duplicate]

Suppose I need to store a bunch of passwords: storing them in a txt or odt file inside an encrypted container, such as the ones produced by VeraCrypt, is bad practice? Would I put myself at risk? If ...
0
votes
1answer
91 views

Is it safe to send verification code in the subject of the email?

I am wondering if it's safe to send the signup, reset password, 6 digit verification code in the subject of the email. Example: "Welcome to the Application, Your verification code is XXXXXX" ...
0
votes
0answers
24 views

Security concerns regarding user self-service MFA reset

Let's say I have an IAM system with a typical MFA feature: TOTP with recovery codes. When users don't have access to their TOTP apps, they can use recovery codes to log in. The IAM system has an admin ...
0
votes
1answer
61 views

Can my school look at my search history through Google Chrome if I am logged in through my school account? [duplicate]

I am doing online school at the moment and I am wondering if my school tracks and looks at everything I search just through my school Gmail account. I am on my own network and pc which has never been ...
0
votes
0answers
30 views

Secure authentication for sites which allow user to modify js/html

We have a site builder, allows users to add/modify JS/HTML/CSS. Is it possible to provide a global authentication for it? I mean users login once but can interact with all sites as their own names. ...
1
vote
0answers
58 views

Grace period for users after re-enabling account disabled by PCI-DSS 8.1.4?

We have an automated system to disable user accounts that have seen no logins for 90 days. We also have a process of re-enabling such accounts (at the behest of the affected users), and this process ...
1
vote
3answers
72 views

Admin change user details / account information in admin interface

I'm creating this admin dashboard, and I have a question wich I have been stuck on for a while now. And I'm starting to question what kind of data the admin should be able edit/view on the other ...
1
vote
2answers
120 views

Is my email, pc or something else hacked?

Recently I registered iCloud account with my gmail account. Now I received fake email from "iCloud" on mail.com email address which I use frequently for registering accounts on various sites....
0
votes
0answers
58 views

Gsuite compromised - changing DNS MX records to prevent attackers

We have lost access to Gsuite admin portal as the account has been compromised by phishing emails. Upon trying to recover the account, we can verify SMS sent to the number but the recovery email ...
-4
votes
1answer
69 views

Is it possible to hack a StackOverflow account? [closed]

Is it possible that a StackOverflow account can be hacked without the owner knowing? If a StackOverflow account is hacked, is any other information (like social media passwords) exposed other than ...
1
vote
0answers
60 views

Is storing an encrypted 2FA backup on Bitwarden (a password manager) a good idea?

I am at the moment using Bitwarden and a separate 2FA app. I am trying to figure out a way to be able to securely recover my access to credentials and 2FA in case my phone/laptop/other electronic ...
0
votes
2answers
51 views

Store cookies for multiple sites on remote server and connect from multiple clients

Would it be secure to: Store all my website cookies (stack sites, webhost, github, web-based email, etc) on a remote server (using an customized open-source VPN or something) Login to the server with ...
0
votes
0answers
28 views

How does Instagram know my location even if I use VPN and have no sim card? [duplicate]

I'm using this Instagram account only on my 2nd phone which has no sim card and airplane mode always on. I use VPN 100% of the time when connecting to the internet. The account isn't linked with any ...
0
votes
0answers
39 views

How secure is the apple cross device copy and paste feature? [duplicate]

I can copy and paste between my iPhone and MacBook Pro it's a great feature that I find myself using frequently. I am frequently copy and pasting from my password manager to log in to different sites....
6
votes
1answer
188 views

How safe is it to store your passwords in a modern browser?

There's a few questions here along these same lines already, but they're nearly a decade old. I'd like to know if things have changed, especially now that Chrome has become more aggressive about ...
0
votes
2answers
127 views

Replace hashing function with asymmetric cryptography when password authentication

I would like to know if the following ideas are feasible: Hash function is one-way function. Generate public key from private key is irreversible(asymmetric cryptography). User password entry -> ...
0
votes
0answers
51 views

Android: How safe is PBKDF2 with a 4 digit pin?

Our Product Manager wants a 4 digit pin for login in our app, obviously for UX reasons, so user don't have to remember their password each time when they login. A refresh token can be retrieved from ...
0
votes
1answer
37 views

How to store Personal Access Token securely on shared machine

We have a shared machine in the office, used for demo'ing our product. I want to be able to fetch the latest code from Github. We have 2FA enabled, so I can't use my login password for https ...
1
vote
0answers
94 views

Different certificate issuers on same site based on browser

When I try to access some web site on firefox I get this: The cut out rectangle is COMPANY-NAME-ROOT-CA and that issuer (COMPANY-NAME-ROOT-CA) was also added as trusted on some peoples PC. But when I ...
4
votes
2answers
238 views

I woke up and my email has been signed up to hundreds of online services. How can I fix this?

I woke up this morning to over 900 emails of several online services asking to confirm I’ve made an account. Last month my email had been compromised and they managed to get into my eBay and Amazon ...
2
votes
1answer
42 views

What all security do i need to check to secure my application? [closed]

For an application with login and logout functionalities and browsing based upon authentication , what all do i need to secure it ? I am basically very new to security and googling is leading to more ...
1
vote
0answers
42 views

In the context of emails, what can be digitally signed and what should be digitally signed in the sub context of deal documents?

I was once a customer of a certain developer who sold a SaaS bookkeeping software which allowed sending deal documents (invoice, receipt, etc) to a customer, from the software's very own email server, ...
10
votes
3answers
5k views

How safe is opening any website on new browser tab?

When I do online shopping where I use my credit card information to purchase, I clear the browser cache, cookies and only open that single site. After I am done, I again clear the cache, cookies and ...
1
vote
0answers
41 views

Is it a bad practice to store my user's ObjectId in a JWT in the sub claim?

Is it a bad practice to store my user's ObjectId in a JWT in the sub claim? I could create an alternate UUID field in the user database and use this instead, but I wondered if I should? I use this sub ...
24
votes
4answers
3k views

On my website's account creation form, how to avoid leaking the information that an email address already has an account? [duplicate]

It seems common practice, when denying access to a user because of an incorrect email / password combination, to not specify which of the username or password was incorrect. This avoids leaking the ...
18
votes
2answers
5k views

Why does Windows not always force me to confirm my password when changing it?

If I can change my password with cmd net user example * without needing to confirm my old password, why, when I change my password in the usual way (via settings or control panel), do I need to ...
0
votes
1answer
61 views

Securing application server for a single user

I'm building some simple dashboard app for myself, but I want to have them on multiple devices - hence the server and front end. As I will be the only user who will access the application server, what ...
2
votes
1answer
45 views

Implications re security practices of full account access granted to third parties

I'm working with a company (say, Acme) that does some ongoing data collection and processing for me. The data in question is private but not all that sensitive. Part of Acme's service has password-...
0
votes
4answers
197 views

Password is visible in online sign up form

I am about to sign up for an online school, which is an accredited statewide online school, and notice that the password they want me to enter is fully visible on the form. Should I be concern about ...
0
votes
2answers
94 views

Android phone's lockscreen PIN disappeared?

I own a ZTE Axon 7 (model 2017G) that I purchased secondhand from a reputable vendor in Germany ca. 3 years ago. The phone has been working well, and I updated the OS to Android 8.0. manually earlier ...
0
votes
1answer
54 views

How to guarantee only my client application can request a nonce?

I have a web site and a service in a server. I'm developing the "Register User" and "Login" components. I've searched on the internet and I've found two protocols to login user ...
70
votes
8answers
10k views

What is the suggested best practice for changing a user's email address?

I recently jumped onto the hypetrain for an unnamed email service and am currently on my way to update all my accounts on various websites to get most of my (future) data off Google's Gmail. During ...
2
votes
1answer
102 views

Authenticate limited client devices from server without login process

I have limited client devices and one server. I want to create a client-server secure connection while app installation but don't want human-interaction between devices and server like registration or ...
1
vote
2answers
74 views

What does it mean to get an email from someone with a different actual sender?

I got a strange email and I just want to confirm my suspicions. For background, I have my own email server which I set up using iRedMail on a VPS. I have an acquaintance who most likely has me on ...
0
votes
1answer
233 views

How might this Amazon account hack occur?

My mother recently had her Amazon account (buyer, not seller) hacked. She is not a security expert but does work in database management, so she is definitely not computer illiterate. I am also not a ...
3
votes
1answer
61 views

Getting numerous HEAD requests by Java user agents to resources that require authentication to view within a web application. Should I block them?

I have recently started using Cloudflare's firewall in front of a web application. This app has a limited user base of selected applicants and they must log in to view anything. There is no public ...
1
vote
1answer
75 views

Properly granting restrictive administrative privileges to developers on a production server [closed]

I am a business owner with a strong technical background, say a programmer, though not an advanced system administrator. I've bought a VPS server where I want to host several applications and webpages....
0
votes
1answer
77 views

Why to use username and password instead of just a long password? [duplicate]

Why do most websites use the pair of username and password as we can just use a long password like a token to identify a user? A simple example: On the server, we create a JSON file with user data ...
2
votes
1answer
45 views

Protecting an account after staying logged in in a public place

I had forgotten to log out of my personal T-Mobile web account on my computer at work today. When I came home, I remembered, so I logged on to my account at home (different computer, different network,...
0
votes
1answer
79 views

What do these credit security alerts mean?

A bank where I have an auto loan has a credit reporting feature. The feature shows that I have several "Dark Web Alerts" for "Compromised Email Address". The alerts list the breached sites, for ...
0
votes
0answers
43 views

Dedicated device for online investing and other security measures

I like to invest money online. I invest in both cryptocurrencies as well as regular stocks. As my bankroll grows (let's say 20k+ in the near future), I feel like I need to start taking more serious ...
1
vote
1answer
82 views

Recycled phone numbers [closed]

I just wanted to ask because I am in a situation now, where I have been locked out of my Instagram due to my mobile phone provider deactivating my Simcard. I have contacted Instagram support sending ...
5
votes
1answer
119 views

Giving different passwords to the app servers to access the same database. Pros and Cons?

Let's say we have one db server. three app servers with full database access. Which scenario is the best? Each app server connects to that one database with different passwords. Example: app srv 1 ...

1
2 3 4 5
12