Skip to main content

Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
1 vote
0 answers
32 views

Where to store Refresh Token in custom Authentication

I am currently trying to build an authentication flow where the front end lives on one domain, say X.com and the backend lives on Y.com. I have implemented a refresh/access token system where when a ...
Kiran Manicka's user avatar
1 vote
0 answers
93 views

Bypass Microsoft Account 2FA

The Microsoft account can have multiple ways to prove who you are for 2FA (two-factor authentication). When you forget your 2FA security info you can initiate the account recovery process by clicking &...
MugTempest's user avatar
1 vote
0 answers
51 views

how to apply authentication/authorization on CLI tools

I am doing a security audit on a command line tool. The tool is java based and it runs on the server side, it collects some info and generate a report at the end of the run. This tool can run ...
anonymous's user avatar
1 vote
0 answers
19 views

In WHM/cPanel > Exim Config, how to prevent SendGrid API key from being breached?

Running a WHM/cPanel system on CentOS v7.9.2009 (STANDARD kvm) and cPanel Version 110.0.34. We use WHM Exim Config with SendGrid for email forwarding. In the last 3 months, our SendGrid account has ...
clodal's user avatar
  • 111
1 vote
1 answer
114 views

How effective is re-entering your password to enable high-risk functions on your account when autofill is always available?

Websites ask for passwords to ensure you are the account owner before you make changes to high-risk settings, but autofill works all the time, even when the browser is in Incognito mode. If someone ...
Yami Odymel's user avatar
1 vote
1 answer
65 views

Specific rate limit for changing security information

A few months ago, a popular YouTuber had their account hacked by a virus on his computer. Then, all of his security information was changed in under a minute. I remembered Google sent over 30 emails ...
blamm01's user avatar
  • 25
1 vote
1 answer
111 views

Refresh tokens for impersonating user credentials: how to implement them?

The web app I'm developing makes use of the concepts of "access token" and "refresh token", even though it uses its own auth scheme. In certain situations, the web app needs to get ...
Fabio A.'s user avatar
  • 125
7 votes
4 answers
4k views

Should order numbers be guessable?

We wrote a e-commerce system where we were asked to generate orders based on a format provided to us The format was extremely simple which was today's date with total number of orders in the database +...
KeithViking's user avatar
22 votes
3 answers
5k views

Is there a problem with having a combined login/register screen?

I am designing a new login/register process for a system and want to combine the 2 initial pages for register and login. This would be one page where the user would enter their email and press '...
Ollie's user avatar
  • 221
0 votes
1 answer
68 views

Best Practices for how to implement in-app user account switching

I am a developer responsible for mobile app and a couple of SPA web apps. Our customers are organizations ("tenants") with multiple users. Our authentication is built on OAuth2 (OpenID ...
mikejonesguy's user avatar
4 votes
2 answers
2k views

If my old device is infected, can my new device get viruses from my social media accounts?

Is it okay to log in my social media accounts (Facebook, Instagram, etc.) from my old phone that I believe is infected with viruses to my new phone? Can virus transfer because of that?
Jeszabami's user avatar
2 votes
0 answers
229 views

I linked an account with Plaid. If I change my username and password, will that mostly protect me in the event of a breach?

This is very similar to this question from 5 years ago, but I didn't see a clear answer: Is Plaid safe if I change the password after deposit? I've linked an account with Plaid. That account is 2FA ...
TyrannicalDuncery's user avatar
0 votes
0 answers
48 views

How to add accounts management to a legacy blackbox application?

I have a legacy non-commercial (in-house) application that is distributed over several workstations on a private VLAN. I have to make it conform to some cybersecurity standards, but can barely modify ...
lalebarde's user avatar
  • 617
3 votes
1 answer
94 views

Account recovery protocol when email is breached, or inaccessible?

I am creating a web application for individual accounts. The email address is also used as the user name. 2FA is setup for the user to optionally use. I've been trying to wrap my head around preparing ...
eaglei22's user avatar
  • 131
0 votes
1 answer
101 views

Is it possible to hide the recognized devices in “WHERE YOU’RE LOGGED IN” section on facebook? [closed]

I am logged in to my husband’s facebook account. Is it possible that I can hide my device on his phone so that he won’t notice that I am logged in there? In the “Where you’re logged in” section, there ...
RH Hub's user avatar
  • 1
2 votes
0 answers
591 views

Repeated passwordless login links from linkedin

In the past few weeks I've seen periodic attempts of someone logging in to my linkedin accounts. They appear to use some sort of one time login link feature that linkedin has, which allows ...
Ccm's user avatar
  • 143
0 votes
1 answer
114 views

Are Thunderbird email accounts kept private between them?

I have my personal accounts that I have setup on Thunderbird. I have also setup my work account which uses GMail via OAuth2. My question is, do these accounts share data of any kind between them or ...
pgmank's user avatar
  • 435
31 votes
2 answers
5k views

What is the point of entering numbers in the two-factor authentication app?

Nowadays, 2FA apps usually require you to insert a number which you are presented with when trying to authenticate. For example, the following screenshot is from Microsoft Authenticator: This is ...
hb20007's user avatar
  • 569
1 vote
2 answers
963 views

Do we really need refresh tokens?

I have read a number of posts of many people expressing their confusion around the extra security gained from using an access token and a refresh token to control access to a resource API. Picking up ...
ASP's user avatar
  • 119
0 votes
0 answers
109 views

How 2FA with Biometrics improve security?

Where I work, this is the passwordless registration/login flow for our Mobile App A user registers with a username and a phone number. An SMS OTP is sent to the phone number to verify it. Initial ...
Sentenzalb's user avatar
0 votes
1 answer
112 views

Any tips for organization-wide 2FA enforcement?

I'm hoping to lead my organization (around 15 people, all remote) in overhauling our security practices, and part of that is making sure each team member is using 2FA on the platforms/tools that offer ...
Matt Herrero's user avatar
1 vote
0 answers
105 views

What is a term for ineffective security measures that don't prevent any realistic attack? [closed]

Is there a term for when you a particular system design might prove to have some advantages, but doesn't actually qualitatively change the potential attacks on the system and thus ends up as redundant,...
tau's user avatar
  • 417
1 vote
1 answer
899 views

Attempt to setup my gmail as recovery mail by random people

I am just curious if anyone experienced the following and have any insight to add to this. Once in a while, I notice some random person attempting to setup my gmail account as their "recovery&...
Arul Selvan's user avatar
-1 votes
1 answer
87 views

Digital Signatures as an Alternative to TOTP Backup Codes

It seems pretty common for websites to issue a bunch of backup codes for MFA that the user saves somewhere. Instead, why don't they provide the user with the private key for a digital signature and ...
SameOldNick's user avatar
0 votes
0 answers
137 views

Is this a safe setup to prevent email account hack?

I would like to protect a Gmail account from being hacked. Suppose I use the following approach for login/authentication: Username, Password 2FA via security stick the stick is in a place that is not ...
fkarger's user avatar
  • 21
1 vote
1 answer
223 views

How to protect a local server if someone has physical access to it?

I've gone through a related question on how to protect data in case of unauthorized physical access to a server, where the consensus seemed to be that preventing data access when someone has physical ...
Lucas's user avatar
  • 111
0 votes
1 answer
110 views

How to securely use service account credentials in an Android App

I have an Android application distributed to my users through an .apk file. That app collects some data, and my goal is to upload that data to a cloud service, like BigQuery. To achieve this, I am ...
Jorge's user avatar
  • 1
2 votes
1 answer
291 views

How does google know my iPhone device name?

I have just signed into google using my browser, and google two step authentication has just started. When signing into google on my browser, it informed me that an authentication had been sent to my ...
Richard's user avatar
  • 21
1 vote
1 answer
111 views

How to prevent AD object information export by a LDAP Export tool from workgroup computer

I have a question regarding Active Directory Security. I can export Active Directory Object information by any 3rd party LDAP Export tool from any workgroup computer which is connected in my network. ...
Md. Rubiat Haque's user avatar
1 vote
2 answers
161 views

Do predictable bank account numbers pose a vulnerability?

Let's say my significant other and I go to the bank to open our accounts and our account numbers end up 14682-4 and 14683-5. They are clearly sequential. Can this detail be used in any sort of attack?
Capi Etheriel's user avatar
0 votes
1 answer
157 views

token leak by copying cookie

Imagine this scenario: I have a website where the token is stored in cookies without any session validation. If I were to take this exact token and use it in another web browser, I would be logged ...
Jacson - ANLS's user avatar
0 votes
0 answers
81 views

Recommendations for admins who administer multiple environments

What's the recommendation for an organisation with admins who administer multiple environments? For example, we have the same administrator with privileged access to different Microsoft Entra Id ...
Jay 's user avatar
  • 71
1 vote
0 answers
95 views

Old work laptop, how to remove Computrace / LoJack [duplicate]

The old company I worked for is no longer around, I have put the laptop in a drawer and forgot about it. I wish to format the storage media and sell the whole laptop, as I could do make use of the the ...
Tele's user avatar
  • 21
1 vote
2 answers
146 views

Is there ever a good reason to share accounts to a computer?

I work for an organization that seems to have awful IT practices, especially when it comes to security. I noticed most people do not lock their computers when they are away from the desk. I asked why ...
FizzBop's user avatar
  • 23
2 votes
0 answers
278 views

Why are Yubico Yubikeys limited to 32 OATH accounts? [closed]

Is the 32 OATH QR code account limit on Yubikeys due to a storage constraint? Because the Yubikey 5 series has been out for a few years now it'd be amazing if there is a new version released soon with ...
AdamHurwitz's user avatar
0 votes
1 answer
495 views

Do you need to invalidate JWT token upon password change?

We've got an Angular app that calls APIs with JWT token authentication (so an auth token and a refresh token). Now at some point the user changes his password (while normally logged in, so not with a &...
Steven De Groote's user avatar
0 votes
1 answer
431 views

What does it mean to store secret keys as an "environment variable" as opposed to hardcoded in the source code?

I see why it is obviously bad to store a secret key and client ID in the source code for a web application. However, how do you go about the alternative? Surely, that information has to be stored ...
BigMistake's user avatar
0 votes
0 answers
40 views

Can the school see what I searched for on TikTok? [duplicate]

I was on my laptop at home using my network but I was on my school Google account I searched for TikTok and when I was on TikTok, I used TikTok's search function for some inappropriate things. I am ...
mary's user avatar
  • 1
0 votes
0 answers
93 views

Need a way to share credentials for different clientele

I am an independent technology consultant, and I am running into a worrying and recurring issue with my customers regarding sharing account information. Many solution we use I am able to be added as ...
user297809's user avatar
0 votes
1 answer
104 views

Is csrf protection required for extremely short lived cookies?

I have an app with token-based authentication (stateless). for specific endpoint that serves an pdf file, it was ideal for me to authenticate via cookie. so I creates a cookie with my access token, ...
ינון רחמים's user avatar
1 vote
1 answer
154 views

Is using the computer for MFA safe?

Recently, I discovered that MFA apps just calculate that codes based on a private key and the time clock, so it's easy to use tools like gnu pass to replace those apps with your computer. But what are ...
Vitor Figueredo Marques's user avatar
0 votes
0 answers
140 views

Two-Factor authentication bypass

I use two-factor authentication where possible, I was always under the impression that not only it prevents brute-force attacks, but makes it safer to use my accounts in untrusted environments. I ...
week's user avatar
  • 101
0 votes
0 answers
116 views

Securing an Admin Network for IT Administrators

I look forward to your suggestions. We are concerned with the question of how to best and most easily implement a secure admin network for our IT administrators. Our team consists of three groups - ...
Danti Uli's user avatar
0 votes
0 answers
144 views

What security feature is this exactly?

I noticed that web apps like Gmail, Microsoft, Roundcube etc. when logging in, times out. To be more specific - if I i.e. open up Gmail and enter the username or NOTHING AT ALL(!) and after two hours ...
Sir Muffington's user avatar
0 votes
1 answer
269 views

Microsoft 2FA triggered without password?

Currently, I have someone attempting to login to my microsoft account. Upon looking at my activity history I am now seeing almost a hundred failed sign in attempts with the reason being "...
cryptarus's user avatar
0 votes
1 answer
298 views

Random endpoint getting pinged constantly on my server [duplicate]

I've read bits around this, but I am curious should I be worried. I constantly am getting hit with random GET and POST requests from I guess just bots crawling the web trying to find vulnerabilities. ...
randomJSEngine's user avatar
0 votes
1 answer
3k views

Is this google security alert legit?

I got this security alert from Google lately, but I'm not sure if it is legit. Someone might have tried to scam me, because it says my E-Mail was linked to another as the recovery email. Either ...
Alpha-Craft's user avatar
1 vote
1 answer
176 views

I was hacked, I have the hacker's email [closed]

My Facebook was hacked, and it has no recovery options, however I accidentally got the hacker's email.
Martins Adrian's user avatar
0 votes
2 answers
355 views

Why is known_hosts automatically updated but authorized_keys is not?

Referring to this post. We learned about ssh today, and I know that you have to add your public key to the "authorized_keys" manually on the server, but the very first time you log into the ...
user129393192's user avatar
0 votes
1 answer
136 views

Is it possible for TikTok to access data from apps that are within the perimeter of a MDM?

I am employed by a security agency that recently implemented a policy prohibiting the use of TikTok on work phones. Instead of carrying two phones, I decided to use MDM to separate my work and ...
Hun3u5ek's user avatar

1
2 3 4 5
16