Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

5
votes
3answers
634 views

How does Comcast know my WiFi password?

How does Comcast know my WiFi password? I generated it via KeePass and entered it into my Arris router/cable modem myself, and I bought the router used from a friend. When I went to the account web ...
24
votes
1answer
7k views

False 'Security alert' from Google - every login generates mails from 'no-reply@accounts.google.com'

Every time I log in to Google with the same MacBook I get this email: New device signed in to example@gmail.com Your Google Account was just signed in to from a new Mac device. You're getting ...
-2
votes
0answers
28 views

kaspersky in windows [on hold]

If I have kaspersky Internet Security installed on Windows and activate the code which is a valid code I purchased from the original company, then I changed the windows and there was 3 months ...
1
vote
1answer
53 views

Will SIM‐like PIN on website as second password increase security

On SIM cards, which are used in mobile telephony, PIN (and PUK) is used. Unlike a password, they are locked after some incorrect attempts to prevent brute force attack. If wrong PIN is entered 3 times,...
0
votes
0answers
17 views

Security risks in confirming the username instead of confirming the username and password combination [duplicate]

Most of the login pages like Google, Outlook and Yahoo! confirm the username first and then ask for a password instead of confirming the username and password combination altogether. Isn't it less ...
0
votes
2answers
54 views

Can a password change via CSRF lead to account takeover?

If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF ...
1
vote
2answers
61 views

SendGrid Github Account Credentials Scanning

Some time ago a developer in my team accidentally published some code to his GitHub repository containing ENV_VARS that belonged to our company's SendGrid account. Fortunately I noticed this as soon ...
1
vote
1answer
83 views

How can I create a hidden Administrator account in a public computer?

After my journey for finding a way to create a truly private user account in a public computer (the setup I'm trying to do this on is detailed in this other question) ended in an epic fail I'm now ...
1
vote
1answer
55 views

Why should I use jwt in Refresh Token? [duplicate]

I use Refresh Token to handling expired Access Token, and in log out, I can remove Refresh Token from the database. Refresh Token must never expire (not sure) because the user can check "remember me". ...
0
votes
1answer
77 views

How can Opera browser access my sessions on Google Chrome?

I just installed Opera browser v60 (i.e. Reborn 3) on Windows 10. I noticed that it has automatically (without my consent and permission) taken all my bookmarks in Google Chrome and added to the ...
0
votes
1answer
50 views

Authentication System Usernames [duplicate]

For a reason I can't fathom, people seem to subscribe to the opinion that a secret username isn't more secure than a public one. I find this opinion completely ludicrous and would like to know why ...
1
vote
0answers
26 views

Allow Guest User in Azure Access to SQL Server (DEV, Read/Write) [migrated]

I'm a bit new to Azure AD. I have some software development offshored and have already created a guest account in Azure for the developer. I've create an account in SQL Server (Manually via the ...
1
vote
0answers
76 views

Android storage permission

There are a number of apps which ask for storage permission in Android. However it is unclear exactly what parts of storage are they able to access with this permission. As an example, would an app ...
1
vote
0answers
70 views

Authentication: E-mailing security codes vs clickable links

I've noticed a trend in how big companies (Amazon, Skype, and a few others I don't remember in particular) handle e-mail authentication. Rather than e-mailing clickable links with some single-use ...
7
votes
1answer
180 views

Is it possible to “reverse engineer” identicons?

As shown in this question, default user avatars (like mine) are identicons and are generated with the user's email (where provided) or the user's IP address (where the email is not provided). Given ...
0
votes
3answers
110 views

Are email systems like Countermail safe?

I am aware of some of the main competitors in this space, including: Lavabit, Countermail, Fastmail, Proton. But, I don't have enough knowledge to differentiate them. Along the same line, I don't ...
2
votes
1answer
112 views

Should I be worried by an email which said my account was under attack? [duplicate]

So, today I received an email in my Gmail account which landed automatically in the spam folder. This was the email content: Hi! As you may have noticed, I sent you an email from your account. ...
1
vote
1answer
52 views

SAML Security Question

I have a SaaS app (App), and it has established SAML trust relationships with two of our clients, Acme and Foo. Acme users log in to App through an IdP-initiated flow. Foo users also log in to App ...
2
votes
3answers
165 views

Is it possible to create a truly private user account in a public computer?

In my college computer that runs Windows 7 Professional SP1 I have an administrator account. I have full access to the entire computer and the files of every other account that's signed up. The ...
-2
votes
1answer
122 views

What’s the best way to report an IP address from Romania?

I recently received an email from a company sending me a security code that I didn’t ask for. It showed me the IP address that the request came from and it shows that it is in Romania but I live in ...
0
votes
1answer
83 views

Application design to avoid XSS & CSRF attacks

I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
1
vote
0answers
37 views

Are there any reliable and updated sources or feeds for password dumps? [closed]

I am looking for any reliable, up-to-date sources (which may be RSS feeds, websites, or anything else OSINT-based) which contain password dumps and their relative links. I am looking particularly for ...
0
votes
2answers
94 views

Account Recovery: Displaying username without verification

I'm not a security guy, so bear with me. As discussed in other topics, usernames in and of themselves are valid forms of verification, and there's nothing particularly sensitive or secure about ...
1
vote
1answer
66 views

Could it be possible to diminish the damage of having one's VPS inspected by the host?

I'm planning to run/have some quite sensitive data on a VPS, however, knowing well that the host could at any time access the data (rare but as long as it could happen in theory, I would very much ...
0
votes
2answers
72 views

Private Google account at work

I have an old private tablet at work with my private Google account on it .It's connected to our WiFi, where i logged in with my personal working code. Never use it much as I just play some music on ...
5
votes
2answers
205 views

How to convince users that security is a good thing?

So I took over as senior IT manager at a small company a couple months ago. Up to now, there was no "IT department" as such, just another guy who "did computers". To this point: things are running off ...
1
vote
2answers
50 views

Saving unhashed first name and last name on a non-encrypted database on phone

Using react-native, we save the first name and last name in Redux, which is a non-encrypted database within the app. I have been tasked to secure this data. Either encrypt these two fields or save ...
1
vote
0answers
67 views

Wiping a smartphone/laptop for travel purposes

What is the best way to prepare your laptop and smartphone for travel? I envision having an encrypted back up stored at home; then factory resetting the smartphones/laptops for travel and installing ...
51
votes
2answers
12k views

Is this Paypal Github SDK reference really a dangerous site?

I'm working on integrating a payment system with paypal in C#, and I installed the official paypal nuget package. Then I went to the paypal github site. And linked to this below site (SDK Reference). ...
0
votes
1answer
60 views

Windows event log - Security - Audit failure

Every one hour or so I have this event in my Event viewer -> Windows logs -> Security log. I understand the consent.exe is Windows' UAC control, what i wan't to know is why and what is trying ...
2
votes
0answers
73 views

Gmail (Dot) Phishing Attack From Avalanche Botnet

I'm a full-stack web developer working in a small startup and have been wearing many hats as a result. I am by no means a cyber or information security expert. I'm looking for a general evaluation of ...
1
vote
1answer
56 views

Is it at all possible to store Windows Sticky Notes in a secure manner?

Example: Users want to use Sticky Notes for quick note taking. They don't like other options, they want Sticky Notes. However, Sticky Notes normally stores the information in a SQL db that can be ...
2
votes
2answers
250 views

What to do about company that sent my password information in plaintext?

I make monthly payments to a website/company who insecurely stores my information. These are in the form of loan payments, so I don't know if I can change who I pay to. I asked for login assistance ...
0
votes
0answers
23 views

Using OTAC as authentication to account recovery schemes

I develop a mobile application that is authenticated to a service utilizing a Challenge-Response scheme. During the registration a Device Key asymmetric key is generated and signed using a User Key ...
1
vote
1answer
18 views

Extending on-premise security to a virtual machine used in Home Office environment

The environment Our company has a reasonable (from the point of view of a regular employee) security policy consisting of, among other things: Sophos suite covering both local antivirus solution and ...
2
votes
0answers
96 views

Hacked Raspberry-pi server

My internet provider doesn't let me open my ports, it's an optional service, and even when they finally said over the phone that I was allowed to open the ports I was still not able to. So I was ...
2
votes
1answer
78 views

Concerning The OWASP Security Guidelines As They Apply To Site Registration / Could honeypotting work?

I'm tossing an idea around in my mind. I want to bounce it off the community to see if this holds any water. First - the OWASP guidelines never specify any method of action when you're dealing with ...
0
votes
0answers
30 views

Saving all secret keys, access data in heroku environ instead of config file?

I have a python/flask app and I use heroku to host it. I use some additional services, such as stripe, postgresql or emails. All these services have either secret keys or other access data, which ...
1
vote
1answer
53 views

Account identified only by name, surname and date of birth

I am working in QA field and we have a project about a famous booking website. I have discovered that if I create an account with the same name, surname and date of birth of an already registered ...
1
vote
2answers
61 views

Where would I go to use a reliably secure encrypted internet connection?

Lately, I’ve been paying $100 a month for Fios. I’m thinking of canceling this service because I rarely use my internet at home, since I’m at school most of the time and my college offers internet (...
1
vote
1answer
552 views

'Critical security alert for your linked Google Account ' but I don't recognize the account

I received an email entitled : 'Critical security alert for your linked Google Account' .. The body says: Someone knows the password to your linked Google Account ----------@gmail.com ...
0
votes
1answer
111 views

BitLocker Recovery Key and Microsoft Account Password

I have a Windows 10 Pro machine; the administrator (and only) account is a Microsoft account. I am trying to set up BitLocker to ensure maximum security and safety, even from Microsoft. I understand ...
0
votes
1answer
49 views

Gmail Contact List Safety

How can I know that my Gmail is spoofed or sending spams to other people I sent email to them before? I don't have clear signs of that especially my contact list is empty but I'm afraid this may ...
0
votes
1answer
40 views

What would be the best way to evaulate the database management systems? [closed]

I am an Information security analyst, looking for creative, non traditional, and unapproved ways to query/evaluate DBMS applications that includes SQL Server and PostgreSQL. Goal here is to protect ...
1
vote
2answers
109 views

Why is it unsafe to use a password that exists online?

I recently saw a post asking why something that appeared to be a random string of characters was a bad password. One of the answers was that it already exists on a website so you can Google it by just ...
3
votes
3answers
134 views

When websites use SMS as part of a password reset scheme, why do they ask for the user's phone number?

I've noticed if you do a password reset on iCloud, for example, it prompts you for your phone number before sending the SMS. Since many people already know your phone number, or it may be listed ...
2
votes
1answer
44 views

What is the impact of leaving disabled root key on AWS instance?

I have a user which, when asked to create an IAM root user account, left the now disabled root key on the instance. When asked to remove the root key, he said it's disabled now so what's the ...
73
votes
8answers
14k views

Is displaying remaining password retry count a security risk?

Some websites display a remaining password retry count when I input wrong passwords more than twice. For example, displaying that there are 3 retries remaining until locking out my account. Is this ...
0
votes
1answer
42 views

How do JavaScript (and mobile) APIs keep user data clean?

Let's say we're running Google Analytics, and we're tracking user specific data (or displaying contents based on that data, such as most recently viewed pages) -- we add a pixel, and then we pass the ...
3
votes
2answers
106 views

Should I inform the previous email account that it is no longer the main email address of my user?

I'm building a website where you can register with an email account. In your account private section you can find a form where you can change the email address to use when logging in. I wanted this ...