Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
0 votes
1 answer
10 views

Is it possible to hide the recognized devices in “WHERE YOU’RE LOGGED IN” section on facebook?

I am logged in to my husband’s facebook account. Is it possible that I can hide my device on his phone so that he won’t notice that I am logged in there? In the “Where you’re logged in” section, there ...
RH Hub's user avatar
  • 1
0 votes
1 answer
80 views

Hotel Gives Itself 10 Stars On Booking.com - How Did They Do That? [closed]

I had booked this hotel via booking.com. I was a bit surprised that almost all of their reviews were 10 stars with no commentary. When I was there, I used their WiFi, and used the booking app via it. ...
JohnBig's user avatar
  • 101
-1 votes
0 answers
51 views

need secure environment for external contractor to work on our code

I am looking to setup a server for a contractor (joe) for software work. So that he can work on our software but cannot copy or share the code and files. This seems to me to be a very standard use ...
DeeHawk's user avatar
  • 99
2 votes
0 answers
100 views

Repeated passwordless login links from linkedin

In the past few weeks I've seen periodic attempts of someone logging in to my linkedin accounts. They appear to use some sort of one time login link feature that linkedin has, which allows ...
Ccm's user avatar
  • 153
0 votes
1 answer
43 views

Are Thunderbird email accounts kept private between them?

I have my personal accounts that I have setup on Thunderbird. I have also setup my work account which uses GMail via OAuth2. My question is, do these accounts share data of any kind between them or ...
pgmank's user avatar
  • 435
31 votes
2 answers
5k views

What is the point of entering numbers in the two-factor authentication app?

Nowadays, 2FA apps usually require you to insert a number which you are presented with when trying to authenticate. For example, the following screenshot is from Microsoft Authenticator: This is ...
hb20007's user avatar
  • 417
1 vote
1 answer
332 views

Do we really need refresh tokens?

I have read a number of posts of many people expressing their confusion around the extra security gained from using an access token and a refresh token to control access to a resource API. Picking up ...
ASP's user avatar
  • 119
0 votes
0 answers
67 views

How 2FA with Biometrics improve security?

Where I work, this is the passwordless registration/login flow for our Mobile App A user registers with a username and a phone number. An SMS OTP is sent to the phone number to verify it. Initial ...
Sentenzalb's user avatar
0 votes
1 answer
81 views

Any tips for organization-wide 2FA enforcement?

I'm hoping to lead my organization (around 15 people, all remote) in overhauling our security practices, and part of that is making sure each team member is using 2FA on the platforms/tools that offer ...
Matt Herrero's user avatar
1 vote
0 answers
66 views

What is a term for ineffective security measures that don't prevent any realistic attack? [closed]

Is there a term for when you a particular system design might prove to have some advantages, but doesn't actually qualitatively change the potential attacks on the system and thus ends up as redundant,...
tau's user avatar
  • 417
-1 votes
1 answer
83 views

Attempt to setup my gmail as recovery mail by random people

I am just curious if anyone experienced the following and have any insight to add to this. Once in a while, I notice some random person attempting to setup my gmail account as their "recovery&...
Arul Selvan's user avatar
-1 votes
1 answer
57 views

Digital Signatures as an Alternative to TOTP Backup Codes

It seems pretty common for websites to issue a bunch of backup codes for MFA that the user saves somewhere. Instead, why don't they provide the user with the private key for a digital signature and ...
SameOldNick's user avatar
0 votes
0 answers
110 views

Is this a safe setup to prevent email account hack?

I would like to protect a Gmail account from being hacked. Suppose I use the following approach for login/authentication: Username, Password 2FA via security stick the stick is in a place that is not ...
fkarger's user avatar
  • 21
1 vote
1 answer
153 views

How to protect a local server if someone has physical access to it?

I've gone through a related question on how to protect data in case of unauthorized physical access to a server, where the consensus seemed to be that preventing data access when someone has physical ...
Lucas's user avatar
  • 111
0 votes
1 answer
66 views

How to securely use service account credentials in an Android App

I have an Android application distributed to my users through an .apk file. That app collects some data, and my goal is to upload that data to a cloud service, like BigQuery. To achieve this, I am ...
Jorge's user avatar
  • 1
2 votes
1 answer
178 views

How does google know my iPhone device name?

I have just signed into google using my browser, and google two step authentication has just started. When signing into google on my browser, it informed me that an authentication had been sent to my ...
Richard's user avatar
  • 21
1 vote
1 answer
46 views

How to prevent AD object information export by a LDAP Export tool from workgroup computer

I have a question regarding Active Directory Security. I can export Active Directory Object information by any 3rd party LDAP Export tool from any workgroup computer which is connected in my network. ...
Md. Rubiat Haque's user avatar
1 vote
2 answers
128 views

Do predictable bank account numbers pose a vulnerability?

Let's say my significant other and I go to the bank to open our accounts and our account numbers end up 14682-4 and 14683-5. They are clearly sequential. Can this detail be used in any sort of attack?
Capi Etheriel's user avatar
0 votes
1 answer
108 views

token leak by copying cookie

Imagine this scenario: I have a website where the token is stored in cookies without any session validation. If I were to take this exact token and use it in another web browser, I would be logged ...
Jacson - ANLS's user avatar
0 votes
0 answers
55 views

Recommendations for admins who administer multiple environments

What's the recommendation for an organisation with admins who administer multiple environments? For example, we have the same administrator with privileged access to different Microsoft Entra Id ...
Jay 's user avatar
  • 71
1 vote
0 answers
75 views

Old work laptop, how to remove Computrace / LoJack [duplicate]

The old company I worked for is no longer around, I have put the laptop in a drawer and forgot about it. I wish to format the storage media and sell the whole laptop, as I could do make use of the the ...
Tele's user avatar
  • 21
0 votes
2 answers
104 views

Is there ever a good reason to share accounts to a computer?

I work for an organization that seems to have awful IT practices, especially when it comes to security. I noticed most people do not lock their computers when they are away from the desk. I asked why ...
FizzBop's user avatar
  • 13
2 votes
0 answers
175 views

Why are Yubico Yubikeys limited to 32 OATH accounts? [closed]

Is the 32 OATH QR code account limit on Yubikeys due to a storage constraint? Because the Yubikey 5 series has been out for a few years now it'd be amazing if there is a new version released soon with ...
AdamHurwitz's user avatar
0 votes
1 answer
270 views

Do you need to invalidate JWT token upon password change?

We've got an Angular app that calls APIs with JWT token authentication (so an auth token and a refresh token). Now at some point the user changes his password (while normally logged in, so not with a &...
Steven De Groote's user avatar
0 votes
1 answer
278 views

What does it mean to store secret keys as an "environment variable" as opposed to hardcoded in the source code?

I see why it is obviously bad to store a secret key and client ID in the source code for a web application. However, how do you go about the alternative? Surely, that information has to be stored ...
BigMistake's user avatar
0 votes
0 answers
35 views

Can the school see what I searched for on TikTok? [duplicate]

I was on my laptop at home using my network but I was on my school Google account I searched for TikTok and when I was on TikTok, I used TikTok's search function for some inappropriate things. I am ...
mary's user avatar
  • 1
0 votes
0 answers
58 views

Need a way to share credentials for different clientele

I am an independent technology consultant, and I am running into a worrying and recurring issue with my customers regarding sharing account information. Many solution we use I am able to be added as ...
user297809's user avatar
0 votes
1 answer
79 views

Is csrf protection required for extremely short lived cookies?

I have an app with token-based authentication (stateless). for specific endpoint that serves an pdf file, it was ideal for me to authenticate via cookie. so I creates a cookie with my access token, ...
ינון רחמים's user avatar
1 vote
1 answer
122 views

Is using the computer for MFA safe?

Recently, I discovered that MFA apps just calculate that codes based on a private key and the time clock, so it's easy to use tools like gnu pass to replace those apps with your computer. But what are ...
Vitor Figueredo Marques's user avatar
0 votes
0 answers
100 views

Two-Factor authentication bypass

I use two-factor authentication where possible, I was always under the impression that not only it prevents brute-force attacks, but makes it safer to use my accounts in untrusted environments. I ...
week's user avatar
  • 101
0 votes
0 answers
89 views

Securing an Admin Network for IT Administrators

I look forward to your suggestions. We are concerned with the question of how to best and most easily implement a secure admin network for our IT administrators. Our team consists of three groups - ...
Danti Uli's user avatar
0 votes
0 answers
119 views

What security feature is this exactly?

I noticed that web apps like Gmail, Microsoft, Roundcube etc. when logging in, times out. To be more specific - if I i.e. open up Gmail and enter the username or NOTHING AT ALL(!) and after two hours ...
Sir Muffington's user avatar
0 votes
0 answers
155 views

PLAID connection to Wise app, safety after the fact

PLAID is used by Wise app and I disconnected from the connected bank after the set up which was less than 24 hrs ago, changed password, then emailed PLAID and Wise to delete my personal information. ...
AMD's user avatar
  • 1
0 votes
1 answer
173 views

Microsoft 2FA triggered without password?

Currently, I have someone attempting to login to my microsoft account. Upon looking at my activity history I am now seeing almost a hundred failed sign in attempts with the reason being "...
cryptarus's user avatar
0 votes
1 answer
180 views

Random endpoint getting pinged constantly on my server [duplicate]

I've read bits around this, but I am curious should I be worried. I constantly am getting hit with random GET and POST requests from I guess just bots crawling the web trying to find vulnerabilities. ...
randomJSEngine's user avatar
0 votes
1 answer
2k views

Is this google security alert legit?

I got this security alert from Google lately, but I'm not sure if it is legit. Someone might have tried to scam me, because it says my E-Mail was linked to another as the recovery email. Either ...
Alpha-Craft's user avatar
0 votes
1 answer
149 views

I was hacked, I have the hacker's email [closed]

My Facebook was hacked, and it has no recovery options, however I accidentally got the hacker's email.
Martins Adrian's user avatar
0 votes
2 answers
226 views

Why is known_hosts automatically updated but authorized_keys is not?

Referring to this post. We learned about ssh today, and I know that you have to add your public key to the "authorized_keys" manually on the server, but the very first time you log into the ...
user129393192's user avatar
0 votes
1 answer
84 views

Is it possible for TikTok to access data from apps that are within the perimeter of a MDM?

I am employed by a security agency that recently implemented a policy prohibiting the use of TikTok on work phones. Instead of carrying two phones, I decided to use MDM to separate my work and ...
Hun3u5ek's user avatar
0 votes
1 answer
81 views

Public computers and services that require an account

I work at a Library Makerspace and we're in a discussion about patron security on the makerspace computers. We have a lot of patrons logging in to their personal accounts because it's (currently) the ...
Seph Reed's user avatar
  • 131
0 votes
0 answers
19 views

Should I back up my Google Authenticator codes to my Google Account? [duplicate]

I just opened the Google Authenticator app and it says: "Sign in to back up your codes to your Google Account". How is that secure? I mean, wouldn't doing that essentially defeat the purpose ...
ma11hew28's user avatar
  • 289
0 votes
3 answers
526 views

How can I be sure that my internet service provider is safe?

There is a new internet service provider in town that provides fiber internet--their internet is fast and it's proven. Almost everyone in our town switched to their internet. However, I am kind of ...
Ash Nam's user avatar
0 votes
1 answer
966 views

How can a device hide that is currently logged on Facebook

My friend logged into my Facebook account from his Android phone using the Facebook app, but when I try looking for the devices on the security page I only can see mine. It's like his device is hidden ...
Melio's user avatar
  • 9
0 votes
0 answers
43 views

Information shared by fortinet client vpn

I am using fortinet client vpn to access employer's computer. I'm worried if my employer can collect my browsing history ? What about the browsing history of few minutes before connecting the vpn ?
Yuqi's user avatar
  • 1
0 votes
2 answers
110 views

Best way to store remembered recently used accounts for web application

In a web application where you have to log in, we want to implement a feature that shows recently used accounts for the device. The login screen will display a list of the usernames of the accounts ...
user2190492's user avatar
-1 votes
1 answer
103 views

Signup on a Game by using other's email addresses [closed]

What if someone signs up on a game by using your email address without your permission? What if someone signs up using your email address illegally? I'm not talking about signing in and stealing ...
Noob Hunter's user avatar
1 vote
2 answers
105 views

Windows controlled folder access to secure Chrome cookies?

I've read about Linus Tech Tips hack, where a malware stole the browser cookies & was able to log in to Linus's channel. Is this preventable with Windows controlled folder access (preventing apps ...
Ninja Dev's user avatar
  • 111
2 votes
2 answers
184 views

Why is individual user security important to a company?

Companies universally seem to invest massive amounts of time and development resources into protecting users from security-related crimes. The trend seems to be increasing steadily over the past 15 ...
Jason C's user avatar
  • 273
0 votes
0 answers
30 views

Have an electronic and physical stalker with access to my computer when I am online [duplicate]

I have an ongoing electronic and physical stalking situation. Someone has hacked my computer and is able to at times see my activities such as sending email and shopping. They also took screenshots ...
New Neighbor's user avatar
1 vote
1 answer
119 views

Why is it a bad idea to accept passwords one character at a time for an authentication mechanism?

For the purpose of my studies, I am trying to answer the below scenario, in my opinion it is not a good idea, because it would leave the system open to brute-force attacks. A novel password scheme is ...
compLearner's user avatar

1
2 3 4 5
16