Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
0 votes
0 answers
39 views

Does adding a user to sudo improve security? [duplicate]

I always use the root user for everything, but I've heard several times that I should disable the root login and use a secondary user (with sudo) instead. If I use my public key to authenticate and ...
user avatar
0 votes
0 answers
12 views

Leaving half open or full open connection having SYN cookie

Suppose an attacker collects a large number of initial sequence numbers sent by the server. Can the attacker cause the server to create many fully open connections by sending ACKs with those initial ...
user avatar
0 votes
0 answers
9 views

Creating half open or full open connection in presence of SYN cookie

Suppose an attacker knows that a target host uses SYN cookies. Can the attacker create half-open or fully open connections by simply sending an ACK packet to the target? Why or why not?
user avatar
0 votes
0 answers
60 views

Using someone else's SSL certificate [duplicate]

As far as I know, the SSL certificate is public and anyone can read it. Is it possible in this case, for example, when someone, having copied the SSL certificate of my bank for himself, will be able ...
user avatar
  • 9
0 votes
0 answers
25 views

Passing the session ID of an unauthenticated user to a valid session using Burp

I am passing the Cookie header of a valid authenticated, high privileged user to the unauthenticated or low privileged user using Autorize (Burp Extension). So ideally, the Autorize says the requests ...
user avatar
0 votes
0 answers
24 views

Rails API Session Security and CSRF

I am doing an api with Rails(api-only). Security is so importand for me. I got 2 question. 1-) I am keeping user's id in session[:authID], is it safe to use like this? 2-) Do i need CSRF protection ...
user avatar
  • 1
0 votes
1 answer
58 views

Voice input as security measures for system authentication

Can voice input as password could be a useful security measure aa a alternative for strong password (Keyboard characters complex), biometric (face, thumb, signature etc)? The voice inputted as a ...
user avatar
1 vote
0 answers
25 views

Obfuscate account availability during creation or not?

My partner and I are arguing about our auth system. They believe that obfuscating the existence of another account (by showing a generic error) is preferable to surfacing an error warning about ...
user avatar
0 votes
0 answers
25 views

Just got "Find My Device located this device" notification - but I didn't try to locate it and I'm login only at that Android device and my closed PC

This is weird - I've checked my Google account and I'm only logged in at my Android device, my PC (which was closed at the time of the msg.), and Chromecast device. Couldn't find anywhere any ...
user avatar
0 votes
0 answers
49 views

Outlook - Windows Security Pop Up Never Goes Away. Potential Compromise?

I have a user who has reported that they are getting a Windows Security pop up from Outlook that keeps showing up even after clicking Cancel and signing out/in shown below Luckily, the user didn't ...
user avatar
  • 133
0 votes
1 answer
24 views

Prevent client access being the same as admin access in web application

My colleagues and I are developing a public web application with client and admin access. I'm concerned about security, being the application public. I would like to add every layer, as long as it's ...
user avatar
0 votes
0 answers
62 views

Windows hello pin removal/crack

Is there a workaround to the Windows 10 Hello PIN security login policy? The PIN is the only credential needed to log in, no password is set, checked with samdump2. I inherited this computer from a ...
user avatar
  • 1
0 votes
1 answer
92 views

Can Google see the screen when using Chrome Remote Desktop?

I was wondering if Google can see my computer screen while I'm using Chrome Remote Desktop. Let's assume there's my main PC named A and my other PC named B. PC B will have the Chrome extension ...
user avatar
  • 1
0 votes
0 answers
10 views

Site-specific account vs "single sign-on" for personal accounts?

The title of this question is a bit hard to word concisely, partially due to my own lack of terminology. What I am trying to ask is, when signing up for a service in a personal capacity (say Airbnb) ...
user avatar
  • 101
0 votes
1 answer
110 views

Doesn't 2FA increase the vulnerability of an account?

You create an account on an online service X with login=your email + password. Compare these 2 situations: No 2FA enabled. The only risk is if your email is compromised: the "I lost my password&...
user avatar
  • 3
0 votes
1 answer
28 views

Will Lastpass ignore old 2FA tokens from the Yubikey? (tokens leaked accidentally)

Somestimes I press on my yubikey accidentally and it writes the token on the screen and even sends automatically to the person I'm talking to on some chat, because it presses enter. This happened ...
user avatar
0 votes
0 answers
35 views

Should I let administrator account bypass IP ACL?

Let's say there is a system that can set IP ACL for security. If administrator can't bypass IP ACL, account may by locked up when machine or network IP changed But if administrator can bypass IP ACL, ...
user avatar
6 votes
2 answers
259 views

Friend's Instagram account repeatedly hacked despite changing all information and enabling 2FA

My friends Instagram account has repeatedly been hacked. Someone is gaining access to her account, proceeding to change all the security information to lock her out. Then posts scam ads on her account....
user avatar
29 votes
7 answers
8k views

Is it safe to store account credentials in an Excel sheet protected with a password?

Basically the title. For example, how bad is it to store passwords in an Excel sheet protected with a password, instead of storing passwords in Keypass or something else like Zoho Vault? Of course, ...
user avatar
  • 393
1 vote
1 answer
68 views

How to set up a restricted account for reverse SSH port forwarding in a safe way?

I have a server (M: Main) that I trust very much (I have it home, locked, with an alarm, etc), to which I can SSH from the internet. I also have a number of "remote servers" and "IoT ...
user avatar
  • 255
40 votes
8 answers
6k views

Can the manufacturer remotely turn off my device?

In connection with recent events, I, as an ordinary citizen of Russia, wonder - can smartphone manufacturers (Google, Apple, Huawei, etc.) or any another (such as Microsoft, Cisco etc) remotely turn ...
user avatar
  • 1,015
0 votes
0 answers
35 views

AWS IAM Access Issue

We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is just erring or ...
user avatar
0 votes
0 answers
12 views

How to verify the reliability of the request (impersonation)?

I'm using JWT for authentication and I use HTTPS. For every request that is made to the server has a header with bearer Token which has an access token. To retrieve my user info Page I have coded my ...
user avatar
0 votes
1 answer
56 views

How to send JWT Access token with requests without being sniffed?

I'm trying to create a mobile app which helps to connect with my mobile app. While going through authentication I used JWT. While authenticating it, it returns access token and refresh token to the ...
user avatar
1 vote
2 answers
62 views

Non-repudiation of customer data

For our web application we are maintaining some data, pertaining to our subscribers, on our server. Some of this data is sensitive and we would like to implement some "security measures" ...
user avatar
  • 111
0 votes
0 answers
19 views

Android Keychain: How to restrict the system-wide credentials based on the app developer or manufacturer only?

As I have been reading about the Android Keychain API, I have been particularly concerned about whether or not Android provides a way to restrict the keys installed as part of Keychain API to certain ...
user avatar
1 vote
0 answers
71 views

Is it necessary to have keep these 4 accounts separate from password manager?

Microsoft Authenticator requires an: Outlook account Verification account iCloud account The first two are required to set up the authenticator on a new device, the latter stores all the data to be ...
user avatar
  • 9
0 votes
0 answers
103 views

Can my school see what I searched for while logged in?

I'm on my laptop at home and I wasn't logged into any Google account but I was on my school's Microsoft account. Can the school still see my searches?
user avatar
  • 1
1 vote
3 answers
195 views

Is there really any benefit in having a separate local admin account

I have been thinking of implementing a new practice where local admin privileges are disabled entirely from all endpoints. For users who need to elevate privileges, they will have a separate admin ...
user avatar
0 votes
0 answers
45 views

Google Password I didn't create

I opened Google, and a popup occurred briefly before I reflexively closed it. I then realized it had said something about a new password saved to the Google Password Manager, I think - which is weird,...
user avatar
  • 111
0 votes
0 answers
53 views

Red Hat Password Security Settings(/etc/pam.d/system-auth, /etc/login.defs)

I'm doing Red Hat (RHEL 6.5) security settings. If I set up the two files as shown below, is there no security effect on each other? /etc/pam.d/system-auth password requisite pam_cracklib.so retry=3 ...
user avatar
1 vote
0 answers
69 views

Your opinion on my encryption security concept for my mobile app using Firebase and an external backend server? [closed]

I'm brainstorming a good architecture that allows me to store user generated data from my mobile app securely on my backend server, without forcing the user to remember an encryption password. The ...
user avatar
19 votes
3 answers
3k views

Should I visit a website of a popular company if the browser warns of a potential security risk?

I have faced this situation several times. Some websites are presented as a potential security risk. Should I continue to browse such a webpage? I am attaching one example, just an example. Actually I ...
user avatar
  • 291
0 votes
1 answer
46 views

Basic explanation for why I'm getting different IP addresses when querying for users IP W/without VPN?

I'm trying to work out some basic knowledge of rate-limiting for my server security so I know how it works. Seems pretty simple as there are different algorithms as well as IP limiting methods. This ...
user avatar
  • 117
0 votes
2 answers
115 views

Someone accessed my phone application in Android 10 and dialled some codes to do some transactions while I was using the Tor browser [closed]

I was accessing some sites with the Tor browser. I got the URLs from some site and was hitting them one by one just to explore. Suddenly pages stopped responding but the internet was working fine. ...
user avatar
0 votes
2 answers
523 views

Unknown numbers sending videos on WhatsApp. What should I do?

A number with ISD code +92 sent a video via WhatsApp. No text, only a video. About 20 days later, another number with same ISD sent another video. Should I open the video? OR Should I Report and Block?...
user avatar
1 vote
0 answers
76 views

Clarification on log4j Service Requirements [duplicate]

We're currently trying to prioritize our mitigations for CVE-2021-44228. The obvious priority is to deal with any Internet facing java (apache?) applications that use a vulnerable log4j library and\or ...
user avatar
0 votes
0 answers
88 views

My email listed in a breach on sites I do not recognize ever sign into. What happen?

I use Firefox Monitor to keep me updated if my email ever turn up on breaches or data dumps. It curates breaches data from many sources and cross reference our email to check if our email turn up on ...
user avatar
  • 111
36 votes
8 answers
12k views

Why use random characters in passwords?

I've seen some similar questions but maybe not exactly what I'm asking. Also I can't say that I've followed all the technical jargon in previous posts and am really after more of an intuitive ...
user avatar
0 votes
1 answer
139 views

Is there any risk installing and using WeChat in phone or computer [closed]

Is there any legitimate concerns of using WeChat in phone or computer? Is it possible they expose message data to others or for their own use? Also, will the installation of the official WeChat app ...
user avatar
0 votes
1 answer
94 views

Does Microsoft scan the contents of documents uploaded to onedrives personal vault?

Specifically do they, but not "Can they" only because I'm fully aware that they are, and always have been, capable of intruding on any/all personal/sensitive data that isn't encrypted on a ...
user avatar
  • 1
0 votes
1 answer
71 views

O365 MFA: Challenge (Approve or Deny) sign on - dangerous?

I have been searching resources online about proper MFA/2FA (with O365 specifically) considerations. How is the MFA push challenge notification to Approve or Deny a sign-on not dangerous? I have yet ...
user avatar
  • 1
0 votes
1 answer
123 views

Why not use a long life session ID for auto-login instead of a persistent cookie with a token?

On the PHP website it is stated that "Developers must not use long life session IDs for auto-login because it increases the risk of stolen sessions.". Instead it is recommended to use a ...
user avatar
  • 1
1 vote
2 answers
275 views

Virtual Yubikey [closed]

If reports are to be believed, Google and others are starting to force 2FA on user accounts starting late ~2021: https://www.theverge.com/2021/10/5/22710421/google-security-2fa-inactive-account-...
user avatar
  • 27
0 votes
1 answer
84 views

Using SSO for a cryptocurrency app

Let us say you have an app where the users will be required to deposit cryptocurrency. Is it safe to let users sign in with third-party authentication? For example "sign in with Google" or &...
user avatar
  • 133
1 vote
1 answer
126 views

Why do services generate multiple 2FA backup codes?

In case you lose access to your two-factor authentication (2FA) codes, you are only required to enter one of the backup codes. So why do services like Google generate multiple codes if it doesn't ...
user avatar
  • 113
18 votes
2 answers
3k views

Will this Account Lockout mechanism increase the severity of a information leakage vulnerability that leaks usernames?

I found an information leakage vulnerability on a company website and I found that the information includes all the usernames of the users. I also observed that the application uses a lockout ...
user avatar
0 votes
2 answers
102 views

Low-privilege account and sudo permissions

Ok, so one common security practice is creating a low privilege account to work from when not installing tools and making system changes. This question is more towards penetration testing platforms. ...
user avatar
0 votes
1 answer
64 views

Active Directory Security Advice/Insight For Intranet Application

I have been tasked with coming up with the authentication/authorization for an enterprise intranet web application. The requirements I were given were: Must authenticate against Active Directory All ...
user avatar
  • 101
0 votes
0 answers
82 views

Problem regarding secret messages on Facebook

A few days back,I downloaded the Facebook download your data and found a place in messages where it is shown that I have sent and received secret messages. But I am sure that I have never sent or ...
user avatar
  • 1

1
2 3 4 5
14