The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
0
votes
1answer
69 views

If no one knows a password, is there a reason to change it?

Scenario: A high level access account on a single machine, where the account is created by the system/application with a secure password, without exposing the password to a human or to any other ...
0
votes
0answers
26 views

Is User Account Login Related to BitLocker Encryption Key

When I enabled BitLocker on my system-drive, I wasn't asked to select an unlock-method. I didn't have to enter any new passwords/keys. I only selected a few options for the encryption, and the process ...
0
votes
0answers
38 views

How to get public key of a not secure webpage? [on hold]

I need to get the public key of JWS of a non-secure website. Actually, the site is running on a VM. I tried 16085 and 11047103. But couldn't get the key
0
votes
1answer
73 views

Crack a single http cookie and gain access to a random user's account! [duplicate]

I was looking for lots of information about cookies recently. What attracted me the most was the fact that cookies come in all forms and can be hijacked through arp poisining and spoofing on the local ...
-5
votes
0answers
58 views

how to dictionary attack my own password? help [closed]

soooo... today I forgot my gmail password actually found out when I needed to log in to confirm something I really need it like its my only other acc apart from my school email that I can use for ...
0
votes
0answers
46 views

Sony Access Log (Playstation Network) does not exists

Yesterday my wife receive some emails from Sony confirming her purchases on Playstation Network. The only problem is: she was with my side watching Netflix on the smart Tv. The purchased items is a ...
0
votes
1answer
41 views

Quantify security strength from entropy and lifetime

Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
1
vote
1answer
50 views

operating system requiring two or more users to access admin account

Suppose I'm designing a system where I want to make sure that no single user who goes rogue can commit a malicious action. (I'm ducking the question of how two or more users could collude.) And I ...
1
vote
1answer
97 views

What can a hacker do if I publish my email id and password but have 2FA on all of my accounts?

I have 2FA on ALL of my accounts. But my password was leaked in 7 breaches. Unfortunately I have used the same password for most of the accounts. Is it possible for him/her to bypass the 2FA?
2
votes
1answer
36 views

Known methods/techniques for thwarting credential phising attacks

Is the solution to preventing credential phising attacks is really only 'educating' people about it? For the sake of this question, let us assume that I have a web application that takes a username ...
0
votes
1answer
60 views

Is storing a JWT secret as docker env variable acceptable?

I understand how JWTs work and that with my secret anyone can issue new tokens. I control the server that my node website runs on and am considering different options for hosting the key. In code - ...
1
vote
0answers
48 views

Suspicious Android app - install on its own - no uninstall option - name in Japanese [closed]

I recently saw the app below in my phone. Have disabled it immediately when I saw it. Have no idea: what it is why it's in my phone how long it's been there and how to uninstall it (there's no ...
0
votes
0answers
24 views

Security risk of using a budgeting app connected to bank accounts [duplicate]

I've been tracking my budget the old way for a few years now by using excel spread sheets that have my checking account ledger, and monthly expenses broken down to categories. But I have noticed more ...
1
vote
0answers
67 views

I'm looking for an email provider like this [closed]

I am looking for email providers with the following conditions for privacy. email providers that: Are free. Do not require JavaScript or other credentials for registration. Provide an onion service. ...
3
votes
1answer
113 views

How to know if a web page is valid and not a man in the middle fake page?

Recently, the facebook page changed on my computer (on others from the same router, I get the regular page). I checked the ssl certificate, and it seems to be authentic, however, as the page does not ...
5
votes
4answers
278 views

Is revealing a PC account user name bad?

Typical computers with modern operating systems require log-on accounts with a user name and a password. Is it dangerous to reveal the user name of the log-on account to the public? My research: I ...
18
votes
3answers
6k views

Stolen MacBook: should I worry about my data?

Unfortunately, someone stole my laptop (a MacBook) and I did not realize that for 48 hours. Now, this was a work laptop and my company's security team is going to wipe the laptop remotely as soon as ...
2
votes
1answer
227 views

How do attacks on password locked accounts work?

A lot of questions here are about the safety of passwords e.g a Login Password to an account on site X. But how can attackers get in the account when they have to guess the passwords? I know there is ...
0
votes
0answers
70 views

How secure is passwordless and keyless SSH login on 127.0.0.1 only, over a secure authenticated tunnel?

I want to use CA signed SSH keys (that would be rotated frequently and have short expiry, ideally centrally managed, all that great stuff). Unfortunately, most of windows GUI tools, such as WinSCP or ...
0
votes
2answers
71 views

Is a web app vulnerable if it only uses session token in cookie to authenticate a user

I am new to bug hunting and i came across this website, so i came across this bug or atleast what i think is a bug so help me understand and tell me if i should consider it a vulnerability. The ...
1
vote
0answers
73 views

How to prevent phone number being searched online? [closed]

Recently, read an article about phone number being used to hack into one's account. NYTIMES-Phone hacking What needs to be done to prevent my phone number being searched? (Return invalid hyperlinks ...
0
votes
1answer
279 views

Why would I 'have been pwned' on a website that I never had an account on? [duplicate]

I was recently sent a notification by https://haveibeenpwned.com/ that one of my email addresses has been found in a breach, in particular in a breach of https://www.chegg.com. I am positive I never ...
1
vote
1answer
55 views

Why CORS is still securing an open api where all requests have a wildcard (*)?

In case of an open API, the only possible value for Access-Control-Allow-Origin is a wildcard (*), since you can't have a list of allowed domains. Still, this seems not to bug developpers and appears ...
0
votes
2answers
79 views

Is there any security reason for re-directing to the main/mobile page after login?

Scenario: User searches for something and gets a link to a sub-page on a site, proceeds to go there, but is asked to sign-up/login - they do so, only then once they are logged in, they are redirected ...
1
vote
1answer
93 views

Can not logout when the network is unreachable [duplicate]

I had checked youtube.com and stackoverflow.com. And found both of them can not log out if the network is unreachable. I think this is a security risk, right? Please image a situation below: I ...
510
votes
3answers
83k views

Why can I log in to my Facebook account with a misspelled email/password?

I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were ...
0
votes
2answers
74 views

What are the security practice or case studies for account lockouts?

We have a platform where users can sign up for free using their email addresses (they can also associate social media account). Other than the name, email and social account there no other personal ...
1
vote
1answer
83 views

AD user recreation, security issue

I have some users that prefer to create a new user account instead of resetting the password (or investigating why there is an issue with the account). Then delete the old account. I've personally ...
1
vote
5answers
216 views

Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN

I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
2
votes
1answer
48 views

How do I migrate my private key from one device to another in instant messaging app?

I was thinking about end-to-end encryption for my chat application, but I am struggling to understand how do I migrate my private keys from one device to another. One option I thought is to store ...
1
vote
1answer
92 views

Exchange sensitive information through public chat

Is there a way to exchange phone numbers/email addresses through public chats with a person without giving them or other communication information away to all the other people in the public chat? ...
0
votes
2answers
244 views

Could clicking a Grabify link to my Facebook page get me hacked?

My newest boyfriend sent me a Grabify link on Messenger. Without thinking (probably because of trusting him), I clicked the link (yeah, I'm an idiot, lol). The link has routed to my Facebook account. ...
0
votes
0answers
45 views

Is a trusted device, on a public network, still vulnerable to a man in the middle attack? [duplicate]

For example, if I am using my personal laptop on a public wifi, and type in the website I want to go to that includes HTTPS, (lets assume https://www.google.com/gmail/) can I reasonably trust that I'm ...
29
votes
6answers
5k views

The most secure way to handle someone forgetting to verify their account?

Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account. Suppose they forget to verify it, and later try to login. Should the error ...
1
vote
1answer
40 views

Having web client do requests with User's 3rd party API key?

I am trying to figure out the best way to do this. I have done some searching and all I have found is about storing API keys in a back end, nothing like my use-case where there is no back end. ...
2
votes
1answer
227 views

Is it insecure to not let a user choose their own username, and base the username on a known pattern?

I have recently changed banks and my new bank has a benefit scheme (discounts etc.) that has its own website and different login details to my online banking (I think the benefits system is ...
0
votes
1answer
97 views

Can 2FA keys be duplicated?

I want to order a 2FA key (like yubikey) online and I want to know if someone could make a duplicate of whatever key I order during shipping. I don't want to discuss if someone could access my package....
-5
votes
1answer
148 views

Is there some hidden worm attached with whatsapp messages that state forward this messgae to 20 people? [closed]

NOTE: I am New contributor, if the question needs some improvement please tell in comment before down voting! Usually I see messages on whatsapp and sometime on some other forums stating that forward ...
3
votes
0answers
121 views

Add another layer of security in accounts except phone number

I recently came across articles where an attacker contacted a telecom company and got them to change the sim card registered with the target's phone number. After doing so, he was able to reset the ...
0
votes
1answer
47 views

Why do we need token authentication?

If I'm creating an authorization service for my application, why can't I just hash the password and save the the username and hashed password in my User table? Why should I use a token authentication ...
1
vote
1answer
145 views

Do non-administrator Windows accounts need strong passwords?

I have always used long passphrases for my own Windows user accounts. But I know some people who use moderately common passwords (we'll say they're in the top 1,000 most used passwords, but not in the ...
1
vote
1answer
66 views

Banking app logon - multiple fingerprints on a device vs 2 passwords known by 1 person

Yesterday I logged on to my banking app via my iPhone. The normal procedure was to enter information that consisted of: The answer to a security question. This had to be entered in full and was the ...
0
votes
1answer
63 views

Block SMTP Connection That Doesn't Have Credentials

I am able to do the following and connect successfully without any type of credentials: telnet <IP Address> 25 When I am in I can verfiy emails, send emails, etc. I feel like this is a ...
0
votes
2answers
84 views

Is there another way than session hijacking to access user account through XSS?

If I have discovered an XSS vulnerability, is there another way of gaining access to an account without session hijacking? Mainly because on most of the sites I test, the HttpOnly and Secure flags are ...
41
votes
1answer
5k views

Why do I need two parameters in an HTTP parameter pollution attack?

I'm reading about HTTP parameter pollution and I'm confused about one thing. If there is an endpoint like this, https://security.stackexchange.com/editpost/?postuid=19348 and you tried a HPP attack, ...
1
vote
2answers
114 views

Buying keycodes online safely/anonymously

I lost a cd key for a very old game and need to replace it with a new one. I can't find anymore physical copies to buy, but I found cd keys for them are offered on sites like Ebay which could replace ...
2
votes
1answer
79 views

When using a shared / public VPN, can others on the same IP address log into your accounts?

I know browsers use cookies so that, for example, if I log into Facebook on a public computer and forget to log out, the next person who opens up a new browser can go into my account. Does this work ...
2
votes
3answers
323 views

Is using weak login credentials always bad?

I am currently using 9 digit numbers to authenticate writers on two apps. In the first app, this unlocks editing tools for use in making content rich dhtml documents which are stored on the local ...
2
votes
0answers
109 views

Hacked iCloud account: how can I protect my iPhone security?

My iCloud account has been hacked. I access links sent by hackers that compromise my iCloud account. The hackers don't have physically access to my phone, the compromised links are sent by them ...
0
votes
2answers
105 views

Can wireshark capture the exact payload and end point of API used by my Mobile APP?

I was just wondering if someone having total control over his/her network, is running my mobile app. Also wireshark is capturing all requests made using the network. My app is calling API endpoint ...