Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
-2 votes
0 answers
34 views

Sam found a very useful web page, which contains links to many [closed]

Sam found a very useful web page, which contains links to many interesting papers. He wants to download those papers. Instead of clicking on each of the links, he wrote a program that parses a HTML ...
-3 votes
0 answers
34 views

Porque pasa esto? [closed]

Porque no me deja publicar en facebook. Cuando intento publicar, antes de publicar, la imagen aparece en gris. Al intentar publicar, se queda en "Publicando". Lo intenté en otra red social y ...
0 votes
0 answers
41 views

Where do you store private keys for web use?

So we have an app that stores private keys on the device(mobile). It’s used for preventing users from logging into another device unless they recover the account and to access some encrypted files. ...
  • 1
2 votes
2 answers
96 views

Data and Account security on Android phone in case of it being stolen

How secure are Android smartphones when someone gets physical access to the phone, in other words, someone stealing my phone and how to improve this security? I'm especially worried about all the ...
  • 21
-1 votes
0 answers
47 views

Account Creation of Spambots

Whenever I binge through some youtube shorts or videos, I find many of the comments were spamming adult content or a group of bots interacting within themselves promoting a site (I have never clicked ...
0 votes
1 answer
79 views

Unauthorized access to Google account after change of password, what now?

About a month ago, a friend got a security warning about some stranger signing into his Google account, so we changed his password to a strong randomly generated password with all characters (I think ...
0 votes
3 answers
98 views

Is my Hotmail compromised as many emails have been sent automatically?

There were hundreds of emails sent from my Hotmail account between 30 Aug to 1 Sept to many Hotmail and Outlook addresses with sECURED.shtml attachment of 764KB. Some emails were not delivered and ...
0 votes
0 answers
69 views

X11 forwarding to another user. How it's possible?

I would like to understand how the following problem is technically possible: In my company, we have a machine which I and several colleagues connect to. I regularly use x11 forwarding when I connect ...
18 votes
4 answers
6k views

Is it bad practice to have a 'super admin' - so they effectively bypass security checks in your system?

I have seen a few system designs in my time and one question keeps cropping up: Is it bad practice to have 'super admin' - single user - or 'super admin' privileges in your system? By that I mean ...
  • 291
0 votes
1 answer
27 views

What is the two_factor_authentication.recovery_codes_regenerated security event in the GutHub account

I made some changes to my GitHub account security, notably I added two new hardware security keys and removed SMS as a 2FA backup method. 8 days later today, I randomly checked the GitHub's own ...
0 votes
0 answers
34 views

Can my employer see my private google account history when just logging in and out in a matter of 10 seconds on a work laptop (REPOSTED) [duplicate]

So I did this post before on a guest account but I had further questions so now I'm posing it on a real one. Can my employer see my private google history/”google activity” if I didn’t do anything on ...
  • 1
29 votes
3 answers
9k views

Someone created a Disney+ account with my e-mail address. Are there any security concerns?

I got an Email (to my iCloud address) from Disney+. The email contained a subscriber agreement. I did not register for their service myself. On the Disney+ website I saw that there was indeed an ...
  • 301
0 votes
2 answers
61 views

Does showing the permission level of an account to all users a bad security practice?

On my school website I can list all existing accounts in the system to send them a message. Each account has a logo showing the user role (admin, professor or student) and I can directly filter on it. ...
0 votes
1 answer
52 views

Google Login vs. Username + Password

Is a Google login actually any more secure than a username and password login? Assuming the username + password uses encrypted passwords in the DB and a 1 week access token, I don't really see how it ...
  • 142
0 votes
0 answers
23 views

SpringBoot Web Application Security for apis working on static token?

I have one Spring boot Web application which has few apis facing internet, deployed on aws, they work on JWT token, they're fairly secure. But there are few apis that work on static token validation. ...
  • 1
1 vote
0 answers
86 views

Displaying a user's password in plaintext on login pages. Why is this practice becoming more widespread? [duplicate]

Over the years I've noticed that more and more login pages implement an eye icon next to the password field, that on click toggles between hidden and plaintext view of the password typed in that field....
  • 111
0 votes
0 answers
52 views

How this JSON object can be exploitable?

I was reading this documentation https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security_Cheat_Sheet.html#server-side One of the security recommendation is - Always return JSON with an Object on ...
0 votes
1 answer
82 views

How could attacker know user names of my Google Workspace? [closed]

I found in my Google admin logs that someone from outside my organization is trying to log in frequently by testing all our user accounts against weak passwords. I'm wondering how could that happen? ...
  • 109
0 votes
0 answers
16 views

Leaving half open or full open connection having SYN cookie

Suppose an attacker collects a large number of initial sequence numbers sent by the server. Can the attacker cause the server to create many fully open connections by sending ACKs with those initial ...
0 votes
0 answers
12 views

Creating half open or full open connection in presence of SYN cookie

Suppose an attacker knows that a target host uses SYN cookies. Can the attacker create half-open or fully open connections by simply sending an ACK packet to the target? Why or why not?
0 votes
0 answers
62 views

Using someone else's SSL certificate [duplicate]

As far as I know, the SSL certificate is public and anyone can read it. Is it possible in this case, for example, when someone, having copied the SSL certificate of my bank for himself, will be able ...
  • 9
0 votes
1 answer
102 views

Passing the session ID of an unauthenticated user to a valid session using Burp

I am passing the Cookie header of a valid authenticated, high privileged user to the unauthenticated or low privileged user using Autorize (Burp Extension). So ideally, the Autorize says the requests ...
0 votes
0 answers
58 views

Rails API Session Security and CSRF

I am doing an api with Rails(api-only). Security is so importand for me. I got 2 question. 1-) I am keeping user's id in session[:authID], is it safe to use like this? 2-) Do i need CSRF protection ...
  • 1
0 votes
1 answer
87 views

Voice input as security measures for system authentication

Can voice input as a password be a useful security measure as an alternative to a strong password and biometrics (face, thumb, signature etc)? The voice inputted as a password will be saved as a sound ...
1 vote
0 answers
25 views

Obfuscate account availability during creation or not?

My partner and I are arguing about our auth system. They believe that obfuscating the existence of another account (by showing a generic error) is preferable to surfacing an error warning about ...
0 votes
0 answers
37 views

Just got "Find My Device located this device" notification - but I didn't try to locate it and I'm login only at that Android device and my closed PC

This is weird - I've checked my Google account and I'm only logged in at my Android device, my PC (which was closed at the time of the msg.), and Chromecast device. Couldn't find anywhere any ...
0 votes
0 answers
81 views

Outlook - Windows Security Pop Up Never Goes Away. Potential Compromise?

I have a user who has reported that they are getting a Windows Security pop up from Outlook that keeps showing up even after clicking Cancel and signing out/in shown below Luckily, the user didn't ...
  • 133
0 votes
1 answer
28 views

Prevent client access being the same as admin access in web application

My colleagues and I are developing a public web application with client and admin access. I'm concerned about security, being the application public. I would like to add every layer, as long as it's ...
0 votes
0 answers
250 views

Windows hello pin removal/crack

Is there a workaround to the Windows 10 Hello PIN security login policy? The PIN is the only credential needed to log in, no password is set, checked with samdump2. I inherited this computer from a ...
  • 1
0 votes
1 answer
378 views

Can Google see the screen when using Chrome Remote Desktop?

I was wondering if Google can see my computer screen while I'm using Chrome Remote Desktop. Let's assume there's my main PC named A and my other PC named B. PC B will have the Chrome extension ...
  • 1
0 votes
0 answers
11 views

Site-specific account vs "single sign-on" for personal accounts?

The title of this question is a bit hard to word concisely, partially due to my own lack of terminology. What I am trying to ask is, when signing up for a service in a personal capacity (say Airbnb) ...
  • 101
0 votes
1 answer
130 views

Doesn't 2FA increase the vulnerability of an account?

You create an account on an online service X with login=your email + password. Compare these 2 situations: No 2FA enabled. The only risk is if your email is compromised: the "I lost my password&...
  • 3
0 votes
1 answer
42 views

Will Lastpass ignore old 2FA tokens from the Yubikey? (tokens leaked accidentally)

Somestimes I press on my yubikey accidentally and it writes the token on the screen and even sends automatically to the person I'm talking to on some chat, because it presses enter. This happened ...
0 votes
0 answers
39 views

Should I let administrator account bypass IP ACL?

Let's say there is a system that can set IP ACL for security. If administrator can't bypass IP ACL, account may by locked up when machine or network IP changed But if administrator can bypass IP ACL, ...
6 votes
3 answers
775 views

Friend's Instagram account repeatedly hacked despite changing all information and enabling 2FA

My friends Instagram account has repeatedly been hacked. Someone is gaining access to her account, proceeding to change all the security information to lock her out. Then posts scam ads on her account....
29 votes
7 answers
10k views

Is it safe to store account credentials in an Excel sheet protected with a password?

Basically the title. For example, how bad is it to store passwords in an Excel sheet protected with a password, instead of storing passwords in Keypass or something else like Zoho Vault? Of course, ...
  • 393
1 vote
1 answer
106 views

How to set up a restricted account for reverse SSH port forwarding in a safe way?

I have a server (M: Main) that I trust very much (I have it home, locked, with an alarm, etc), to which I can SSH from the internet. I also have a number of "remote servers" and "IoT ...
  • 255
39 votes
8 answers
6k views

Can the manufacturer remotely turn off my device?

In connection with recent events, I, as an ordinary citizen of Russia, wonder - can smartphone manufacturers (Google, Apple, Huawei, etc.) or any another (such as Microsoft, Cisco etc) remotely turn ...
0 votes
0 answers
45 views

AWS IAM Access Issue

We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is just erring or ...
0 votes
0 answers
16 views

How to verify the reliability of the request (impersonation)?

I'm using JWT for authentication and I use HTTPS. For every request that is made to the server has a header with bearer Token which has an access token. To retrieve my user info Page I have coded my ...
0 votes
1 answer
108 views

How to send JWT Access token with requests without being sniffed?

I'm trying to create a mobile app which helps to connect with my mobile app. While going through authentication I used JWT. While authenticating it, it returns access token and refresh token to the ...
1 vote
2 answers
64 views

Non-repudiation of customer data

For our web application we are maintaining some data, pertaining to our subscribers, on our server. Some of this data is sensitive and we would like to implement some "security measures" ...
  • 111
0 votes
0 answers
71 views

Android Keychain: How to restrict the system-wide credentials based on the app developer or manufacturer only?

As I have been reading about the Android Keychain API, I have been particularly concerned about whether or not Android provides a way to restrict the keys installed as part of Keychain API to certain ...
1 vote
0 answers
72 views

Is it necessary to have keep these 4 accounts separate from password manager?

Microsoft Authenticator requires an: Outlook account Verification account iCloud account The first two are required to set up the authenticator on a new device, the latter stores all the data to be ...
  • 9
0 votes
0 answers
107 views

Can my school see what I searched for while logged in?

I'm on my laptop at home and I wasn't logged into any Google account but I was on my school's Microsoft account. Can the school still see my searches?
  • 1
1 vote
3 answers
355 views

Is there really any benefit in having a separate local admin account

I have been thinking of implementing a new practice where local admin privileges are disabled entirely from all endpoints. For users who need to elevate privileges, they will have a separate admin ...
0 votes
0 answers
53 views

Google Password I didn't create

I opened Google, and a popup occurred briefly before I reflexively closed it. I then realized it had said something about a new password saved to the Google Password Manager, I think - which is weird,...
  • 111
0 votes
0 answers
60 views

Red Hat Password Security Settings(/etc/pam.d/system-auth, /etc/login.defs)

I'm doing Red Hat (RHEL 6.5) security settings. If I set up the two files as shown below, is there no security effect on each other? /etc/pam.d/system-auth password requisite pam_cracklib.so retry=3 ...
1 vote
0 answers
89 views

Your opinion on my encryption security concept for my mobile app using Firebase and an external backend server? [closed]

I'm brainstorming a good architecture that allows me to store user generated data from my mobile app securely on my backend server, without forcing the user to remember an encryption password. The ...
19 votes
3 answers
3k views

Should I visit a website of a popular company if the browser warns of a potential security risk?

I have faced this situation several times. Some websites are presented as a potential security risk. Should I continue to browse such a webpage? I am attaching one example, just an example. Actually I ...
  • 291

1
2 3 4 5
15