Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

1
vote
0answers
32 views

Are there any reliable and updated sources or feeds for password dumps? [on hold]

I am looking for any reliable, up-to-date sources (which may be RSS feeds, websites, or anything else OSINT-based) which contain password dumps and their relative links. I am looking particularly for ...
0
votes
2answers
77 views

Account Recovery: Displaying username without verification

I'm not a security guy, so bear with me. As discussed in other topics, usernames in and of themselves are valid forms of verification, and there's nothing particularly sensitive or secure about ...
1
vote
1answer
64 views

Could it be possible to diminish the damage of having one's VPS inspected by the host?

I'm planning to run/have some quite sensitive data on a VPS, however, knowing well that the host could at any time access the data (rare but as long as it could happen in theory, I would very much ...
0
votes
2answers
67 views

Private Google account at work

I have an old private tablet at work with my private Google account on it .It's connected to our WiFi, where i logged in with my personal working code. Never use it much as I just play some music on ...
5
votes
2answers
165 views

How to convince users that security is a good thing?

So I took over as senior IT manager at a small company a couple months ago. Up to now, there was no "IT department" as such, just another guy who "did computers". To this point: things are running off ...
1
vote
2answers
48 views

Saving unhashed first name and last name on a non-encrypted database on phone

Using react-native, we save the first name and last name in Redux, which is a non-encrypted database within the app. I have been tasked to secure this data. Either encrypt these two fields or save ...
1
vote
0answers
62 views

Wiping a smartphone/laptop for travel purposes

What is the best way to prepare your laptop and smartphone for travel? I envision having an encrypted back up stored at home; then factory resetting the smartphones/laptops for travel and installing ...
51
votes
2answers
12k views

Is this Paypal Github SDK reference really a dangerous site?

I'm working on integrating a payment system with paypal in C#, and I installed the official paypal nuget package. Then I went to the paypal github site. And linked to this below site (SDK Reference). ...
0
votes
0answers
17 views

Windows event log - Security - Audit failure

Every one hour or so I have this event in my Event viewer -> Windows logs -> Security log. I understand the consent.exe is Windows' UAC control, what i wan't to know is why and what is trying ...
2
votes
0answers
59 views

Gmail (Dot) Phishing Attack From Avalanche Botnet

I'm a full-stack web developer working in a small startup and have been wearing many hats as a result. I am by no means a cyber or information security expert. I'm looking for a general evaluation of ...
1
vote
1answer
48 views

Is it at all possible to store Windows Sticky Notes in a secure manner?

Example: Users want to use Sticky Notes for quick note taking. They don't like other options, they want Sticky Notes. However, Sticky Notes normally stores the information in a SQL db that can be ...
2
votes
2answers
231 views

What to do about company that sent my password information in plaintext?

I make monthly payments to a website/company who insecurely stores my information. These are in the form of loan payments, so I don't know if I can change who I pay to. I asked for login assistance ...
0
votes
0answers
21 views

Using OTAC as authentication to account recovery schemes

I develop a mobile application that is authenticated to a service utilizing a Challenge-Response scheme. During the registration a Device Key asymmetric key is generated and signed using a User Key ...
1
vote
1answer
18 views

Extending on-premise security to a virtual machine used in Home Office environment

The environment Our company has a reasonable (from the point of view of a regular employee) security policy consisting of, among other things: Sophos suite covering both local antivirus solution and ...
2
votes
0answers
91 views

Hacked Raspberry-pi server

My internet provider doesn't let me open my ports, it's an optional service, and even when they finally said over the phone that I was allowed to open the ports I was still not able to. So I was ...
2
votes
1answer
76 views

Concerning The OWASP Security Guidelines As They Apply To Site Registration / Could honeypotting work?

I'm tossing an idea around in my mind. I want to bounce it off the community to see if this holds any water. First - the OWASP guidelines never specify any method of action when you're dealing with ...
0
votes
0answers
25 views

Saving all secret keys, access data in heroku environ instead of config file?

I have a python/flask app and I use heroku to host it. I use some additional services, such as stripe, postgresql or emails. All these services have either secret keys or other access data, which ...
1
vote
1answer
51 views

Account identified only by name, surname and date of birth

I am working in QA field and we have a project about a famous booking website. I have discovered that if I create an account with the same name, surname and date of birth of an already registered ...
1
vote
2answers
60 views

Where would I go to use a reliably secure encrypted internet connection?

Lately, I’ve been paying $100 a month for Fios. I’m thinking of canceling this service because I rarely use my internet at home, since I’m at school most of the time and my college offers internet (...
1
vote
1answer
436 views

'Critical security alert for your linked Google Account ' but I don't recognize the account

I received an email entitled : 'Critical security alert for your linked Google Account' .. The body says: Someone knows the password to your linked Google Account ----------@gmail.com ...
0
votes
1answer
73 views

BitLocker Recovery Key and Microsoft Account Password

I have a Windows 10 Pro machine; the administrator (and only) account is a Microsoft account. I am trying to set up BitLocker to ensure maximum security and safety, even from Microsoft. I understand ...
0
votes
1answer
49 views

Gmail Contact List Safety

How can I know that my Gmail is spoofed or sending spams to other people I sent email to them before? I don't have clear signs of that especially my contact list is empty but I'm afraid this may ...
0
votes
1answer
40 views

What would be the best way to evaulate the database management systems? [closed]

I am an Information security analyst, looking for creative, non traditional, and unapproved ways to query/evaluate DBMS applications that includes SQL Server and PostgreSQL. Goal here is to protect ...
1
vote
2answers
107 views

Why is it unsafe to use a password that exists online?

I recently saw a post asking why something that appeared to be a random string of characters was a bad password. One of the answers was that it already exists on a website so you can Google it by just ...
3
votes
3answers
131 views

When websites use SMS as part of a password reset scheme, why do they ask for the user's phone number?

I've noticed if you do a password reset on iCloud, for example, it prompts you for your phone number before sending the SMS. Since many people already know your phone number, or it may be listed ...
2
votes
1answer
43 views

What is the impact of leaving disabled root key on AWS instance?

I have a user which, when asked to create an IAM root user account, left the now disabled root key on the instance. When asked to remove the root key, he said it's disabled now so what's the ...
73
votes
8answers
14k views

Is displaying remaining password retry count a security risk?

Some websites display a remaining password retry count when I input wrong passwords more than twice. For example, displaying that there are 3 retries remaining until locking out my account. Is this ...
0
votes
1answer
42 views

How do JavaScript (and mobile) APIs keep user data clean?

Let's say we're running Google Analytics, and we're tracking user specific data (or displaying contents based on that data, such as most recently viewed pages) -- we add a pixel, and then we pass the ...
3
votes
2answers
106 views

Should I inform the previous email account that it is no longer the main email address of my user?

I'm building a website where you can register with an email account. In your account private section you can find a form where you can change the email address to use when logging in. I wanted this ...
5
votes
2answers
196 views

2 factor authentication, fob management

I love the idea of 2 factor authentication but how can I make sure I'm not caught in the wind without such keys? I thought about switching to a fob for services that support it. Is there a fob that I ...
2
votes
1answer
87 views

Facebook security algorithm: Locked out of my own account after resetting password

I created a secondary Facebook account months ago from Argentina. Now I logged back in, and noticed countless logins from RUSSIA and the account is clearly being used by some Russian dude. I logged ...
0
votes
2answers
27 views

media uploads and social sites group privacy etc

On sites like Facebook etc. you have the ability to create "private" photo albums that are only shared with selected friends, similarly in Messenger you can upload an image just to a specific chat. ...
1
vote
1answer
102 views

My boss installs software using domain admin. Should I show that this is bad?

At my workplace, users on most workstations (Win7 and 10 blend) do not have local admin rights. As a technical team we often need this for software installs, and so the director gets called around to ...
1
vote
3answers
122 views

Can I get 2FA for my private domain e-mail account? [closed]

Is it possible to somehow get 2FA for my e-mail accounts even if they're hosted on custom / private domains? (e.g mymail@mycooldomain.com and not gmail)
1
vote
1answer
60 views

wp-config leaked, how to change salts [closed]

define('SECURE_AUTH_KEY', define('AUTH_KEY', define('LOGGED_IN_KEY', define('NONCE_KEY', define('AUTH_SALT', define('SECURE_AUTH_SALT', define('LOGGED_IN_SALT', define(...
3
votes
1answer
184 views

How does medium.com know my google account?

I went to an article on medium.com earlier today, and instead of the annoying full screen popup they usually show to returning visitors, I saw this in the upper right corner: Right there on the ...
1
vote
1answer
97 views

Norms and Compliance for storing bank account details

I am from India and working on a B2C service product. There I have to transfer money to my customers, so I need their bank account number and IFSC code. However, I was wondering if there are some ...
-2
votes
1answer
88 views

What are the risks of visiting someone else's Google Photo while logged in?

I was browsing Reddit on its official mobile app. I tapped on a photo to see a larger version. I was expecting to be lead to Imgur, but to my surprise it went to Google Photos. Having the app for ...
1
vote
3answers
145 views

Router access, am I in danger?

I learned I can access my router from a web device like so http://ipaddress/login.html I was wondering if anyone could gain access to my router control panel. IF that is the case can they compromise ...
0
votes
1answer
64 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
2
votes
1answer
104 views

Websites that can connect with Gmail

I'm currently job searching, and came across a site that knows when I'm signed into G-mail. A quick look at the login page shows that I can use my Gmail account to login. Looking at the Google API, ...
1
vote
3answers
199 views

Why are data breaches like the one at Quora considered so bad?

Today I read this article that said that some hacker just stole Quora's user base personal information. The article said that about 100 million users personal information got stolen. It's also ...
1
vote
2answers
138 views

Getting access and logging into employee's laptop - Can IT get access without the employee's own credentials?

If an employee's laptop is taken back from him/her for purposes of investigation, can the IT department/team that is in charge of issuing laptops etc. log into the employee's network account on this ...
0
votes
2answers
104 views

Find the person behind an email address using its recovery email in Gmail

Note: This is based on a true story! The Story: Alice and Bob are good friends and each one knows the personal email address of the other person and they contact with each other using it. Let's ...
1
vote
1answer
52 views

hiding emails in database [closed]

I am making a webpage (similar to a social media) which will be open-source, but will probably only run off one server, with multiple levels (php, javascript(hopefully without any modules), postgresql)...
64
votes
6answers
15k views

Employer makes me use what I believe to be an insecure website for HR functions. What to do?

At my job, to be able to view my paychecks, vacation hours and HR data on myself I need to log into a 3rd party website. I'm by no means a security expert or expert programmer but I could tell (...
2
votes
2answers
60 views

does vBulletin and similar discussion forum CMS store previous email address and password hash in database?

I am in the process of De-Googling myself and use complex passwords. I change my registered Gmail to an alternative mail provider I change my password to a complex one I use mostly vbulletin and ...
3
votes
2answers
60 views

Using SessionStorage for Some User Info

I have an application that currently keeps a few properties from a user's profile in session storage for the app to use when necessary. We don't keep sensitive data like username or password or ssn in ...
0
votes
2answers
182 views

What consequences could there be to the continued use of an operating system without updating?

As it is well known, the extended support of Windows 7 (Service Pack 1) ends on January 14, 2020. Due to the short time that remains, I raise this question. What consequences could an outdated ...
1
vote
0answers
52 views

Password Reset URL strategy

Designing a new flow for a "forgot your password" feature we are developing, i came across a challenging question regarding the URL and the commitment that has to be made between frontend and backend ...