Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

9
votes
7answers
2k views

Is displaying remaining password retry count a security risk?

Some websites display a remaining password retry count when I input wrong passwords more than twice. For example, displaying that there are 3 retries remaining until locking out my account. Is this ...
0
votes
1answer
33 views

How do JavaScript (and mobile) APIs keep user data clean?

Let's say we're running Google Analytics, and we're tracking user specific data (or displaying contents based on that data, such as most recently viewed pages) -- we add a pixel, and then we pass the ...
3
votes
2answers
88 views

Should I inform the previous email account that it is no longer the main email address of my user?

I'm building a website where you can register with an email account. In your account private section you can find a form where you can change the email address to use when logging in. I wanted this ...
0
votes
0answers
34 views

Does Google store the number you used to create the account? [on hold]

Let's say someone used a phone number to create a Google account (verifying your Google account). Can law enforcement officers or attackers extract the number? The motivation of my question comes ...
4
votes
2answers
148 views

2 factor authentication, fob management

I love the idea of 2 factor authentication but how can I make sure I'm not caught in the wind without such keys? I thought about switching to a fob for services that support it. Is there a fob that I ...
2
votes
1answer
59 views

Facebook security algorithm: Locked out of my own account after resetting password

I created a secondary Facebook account months ago from Argentina. Now I logged back in, and noticed countless logins from RUSSIA and the account is clearly being used by some Russian dude. I logged ...
0
votes
2answers
25 views

media uploads and social sites group privacy etc

On sites like Facebook etc. you have the ability to create "private" photo albums that are only shared with selected friends, similarly in Messenger you can upload an image just to a specific chat. ...
1
vote
1answer
98 views

My boss installs software using domain admin. Should I show that this is bad?

At my workplace, users on most workstations (Win7 and 10 blend) do not have local admin rights. As a technical team we often need this for software installs, and so the director gets called around to ...
1
vote
3answers
106 views

Can I get 2FA for my private domain e-mail account? [closed]

Is it possible to somehow get 2FA for my e-mail accounts even if they're hosted on custom / private domains? (e.g mymail@mycooldomain.com and not gmail)
1
vote
1answer
56 views

wp-config leaked, how to change salts [closed]

define('SECURE_AUTH_KEY', define('AUTH_KEY', define('LOGGED_IN_KEY', define('NONCE_KEY', define('AUTH_SALT', define('SECURE_AUTH_SALT', define('LOGGED_IN_SALT', define(...
2
votes
1answer
110 views

How does medium.com know my google account?

I went to an article on medium.com earlier today, and instead of the annoying full screen popup they usually show to returning visitors, I saw this in the upper right corner: Right there on the ...
1
vote
1answer
41 views

Norms and Compliance for storing bank account details

I am from India and working on a B2C service product. There I have to transfer money to my customers, so I need their bank account number and IFSC code. However, I was wondering if there are some ...
-2
votes
1answer
81 views

What are the risks of visiting someone else's Google Photo while logged in?

I was browsing Reddit on its official mobile app. I tapped on a photo to see a larger version. I was expecting to be lead to Imgur, but to my surprise it went to Google Photos. Having the app for ...
1
vote
3answers
134 views

Router access, am I in danger?

I learned I can access my router from a web device like so http://ipaddress/login.html I was wondering if anyone could gain access to my router control panel. IF that is the case can they compromise ...
0
votes
1answer
59 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
2
votes
1answer
101 views

Websites that can connect with Gmail

I'm currently job searching, and came across a site that knows when I'm signed into G-mail. A quick look at the login page shows that I can use my Gmail account to login. Looking at the Google API, ...
1
vote
3answers
194 views

Why are data breaches like the one at Quora considered so bad?

Today I read this article that said that some hacker just stole Quora's user base personal information. The article said that about 100 million users personal information got stolen. It's also ...
1
vote
2answers
138 views

Getting access and logging into employee's laptop - Can IT get access without the employee's own credentials?

If an employee's laptop is taken back from him/her for purposes of investigation, can the IT department/team that is in charge of issuing laptops etc. log into the employee's network account on this ...
0
votes
2answers
90 views

Find the person behind an email address using its recovery email in Gmail

Note: This is based on a true story! The Story: Alice and Bob are good friends and each one knows the personal email address of the other person and they contact with each other using it. Let's ...
1
vote
1answer
51 views

hiding emails in database [closed]

I am making a webpage (similar to a social media) which will be open-source, but will probably only run off one server, with multiple levels (php, javascript(hopefully without any modules), postgresql)...
64
votes
6answers
15k views

Employer makes me use what I believe to be an insecure website for HR functions. What to do?

At my job, to be able to view my paychecks, vacation hours and HR data on myself I need to log into a 3rd party website. I'm by no means a security expert or expert programmer but I could tell (...
2
votes
2answers
56 views

does vBulletin and similar discussion forum CMS store previous email address and password hash in database?

I am in the process of De-Googling myself and use complex passwords. I change my registered Gmail to an alternative mail provider I change my password to a complex one I use mostly vbulletin and ...
3
votes
2answers
58 views

Using SessionStorage for Some User Info

I have an application that currently keeps a few properties from a user's profile in session storage for the app to use when necessary. We don't keep sensitive data like username or password or ssn in ...
0
votes
2answers
156 views

What consequences could there be to the continued use of an operating system without updating?

As it is well known, the extended support of Windows 7 (Service Pack 1) ends on January 14, 2020. Due to the short time that remains, I raise this question. What consequences could an outdated ...
1
vote
0answers
39 views

Password Reset URL strategy

Designing a new flow for a "forgot your password" feature we are developing, i came across a challenging question regarding the URL and the commitment that has to be made between frontend and backend ...
4
votes
1answer
141 views

How Homebrew may impact your Mac's security [duplicate]

I read (here and here) that Homebrew (the Unix package manager) is a significant Mac security risk. An attack is allowed because Homebrew makes /usr/local/bin writable without root user privilege, ...
0
votes
1answer
36 views

Find the way back to the safe mode

I use MAC OS operation system that I frequently connect to my iPhone, I use Gmail, my university e-mail service, my university personal space, and numerous other websites that require log-in. I know ...
1
vote
2answers
50 views

Are there security pitfalls on relying on an emails domain to automatically assign permissions?

I'm working in a new clients system, and they automatically assign permissions based on the domain name for the email address the account was created under (they do require validation via an email). ...
1
vote
1answer
29 views

Center for Internet Security Version 6.1 Critical Security Control 16-10

My project is implementing The CIS Critical Security Controls, Version 6.1 Can anyone please give me some advice on how we can address sub-control 16.10 which says..... "Profile each user’s typical ...
2
votes
2answers
128 views

How does Gmail detect if my email account is accessed from another computer?

How does Gmail detect when my mail is accessed from another computer? Does it keep track of my MAC address to check whether a new device is used? I think it doesn't have anything to do with IP address....
0
votes
2answers
108 views

Can employers log internet traffic of employees personal computers? [closed]

I have a suspicion that my employer is misusing their work monitoring and remote access software to check my online activity outside of work. I have the software installed on my personal machine as I ...
0
votes
1answer
138 views

Is it safe to store user's secure pass-code in database with encrypted form while creating bitcoin wallet?

I would like to create a Bitcoin Wallet. Part of the process is to store public and private keys in encrypted form in server database. All keys I am storing is encrypted using user's passcode. 1) ...
1
vote
1answer
62 views

Manage Logs of Excessive Member and Server Authentication Failures

Currently, in our SIEM environment, we are attempting to reduce noise and any non-actionable items. One of the most frequent items we receive on a weekly basis is a report based on excessive member ...
-1
votes
1answer
29 views

which antivirus best for window 10 on hp laptops? [closed]

which antivirus best for window 10 for security and virus protection specially for hp laptops.
2
votes
2answers
169 views

How do I protect myself against SIM hijacking/social engineering?

There are several posts like these: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd https://motherboard.vice.com/en_us/article/5984zn/listen-to-sim-jacking-account-ransom-...
7
votes
2answers
156 views

Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process?

According to the Google information page here: https://support.google.com/accounts/answer/6103523 If you don’t have another second step or forgot your password Note: 2-Step Verification ...
2
votes
1answer
58 views

Smartphone fingerprint plus iris scanning for login

I have often thought about the fact that when intimate relationship partners live together they eventually tend to sneak over your shoulder and gain access to your password on either your mobile phone ...
2
votes
1answer
52 views

Security implications of auto-submitting OTP?

So the question was originally asked as a part of the UX question here. My question is that, Are there any security risks involved when I auto-submit the OTP? Currently, I'm limiting the number of ...
1
vote
0answers
34 views

Automatic Paypal payment through API

I am building a game similar to HQ trivia, that when someone gives all the correct answers at the end of the game he or she gets money sent to their Paypal account, my concern is obviously security. ...
0
votes
1answer
34 views

iCloud Security Concern: browser session authentication storage after 2-factor?

Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie? My concern is, if ...
0
votes
1answer
59 views

Is using HOTP only authorization considered weak?

Migrated from ServerFault, as advised there. I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes. I fully understand 2FA is more secure than Single ...
2
votes
3answers
92 views

How are “security questions” not a major security hole for any application that uses them?

So the original security model was to ask the user for an email address, at time of account creation, and if they forgot their password the system would email a new password to this email address. ...
62
votes
5answers
14k views

Logged out of Facebook on all devices on a sudden. Should I be worried about being hacked?

A while ago, I was opening Facebook app on Android and then I got the message "Session expired. Please log in again.". I then tried logging in with my current password and was success to log in my ...
-1
votes
1answer
141 views

Is it okay to save passwords as base64 strings with no other hashing or encryption beforehand?

I've just inherited a project where all the passwords on the server side are simply converted to base64 and put in the database. No salt, no hash, nothing. Just a simple db.Add(password.ToBase64) kind ...
0
votes
1answer
57 views

Is it safe to receive (One Time Password) OTP to the Mobile where the online banking application is installed?

Assume a customer of a bank is using online banking facility and he is using an online banking application on mobile (android). There could be a possibility that particular mobile could be ...
-1
votes
1answer
115 views

Is there anyway I can prove a snap account isn’t mine

My boyfriend thinks a Snapchat account is mine when it isn’t. Is there anyway I can prove this is not true if the owner of the account won’t message me back?
5
votes
6answers
370 views

Is it safe to store 2FA tokens together with passwords in 1password?

I'm using 1password and I've seen 1password allows you to store 2FA tokens in the same place where you store the password. I don't like the idea of having everything in the same place as if someone ...
1
vote
3answers
200 views

Is it normal for a website to show an API key in plain text that allows full access to your personal information?

I noticed some websites do this and I am not sure if this is normal or not. So for example, on some websites, I go into setting and can create an API key that will be visible in plain text. Also, ...
0
votes
1answer
101 views

Principle of Least privilege; is it ever a 'good idea' to give standard users administrative privileges?

There are a number of users in the business who are required to perform administrative tasks on machines, not least the IT Service Desk, also Devs etc. The only requirement for administrative access ...
5
votes
3answers
3k views

My sites have been hacked by cpamatik.com , it passes all security checks with Google and Sucuri, but still redirects, any idea? [duplicate]

Almost all my sites got hacked by cpamatik.com virus All CMS were up to date, plugins, modules etc..(Drupal and Wordpress) , some sites I have logged in to work on, but some sites I haven't touched ...