Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
0
votes
1answer
46 views

Received an HTML file in an email and opened it. Can someone check the code to make sure user is ok? [on hold]

this happened to a user in my work environment. He received an email with an html attachment. He opened it and was directed to a website that said something like view file. When you pushed that you ...
0
votes
0answers
24 views

Security risk of using a budgeting app connected to bank accounts [duplicate]

I've been tracking my budget the old way for a few years now by using excel spread sheets that have my checking account ledger, and monthly expenses broken down to categories. But I have noticed more ...
-1
votes
0answers
35 views

How to match encrypted hash from different platforms using aes-256?

I'm totally new on technical security. I'm confused about how to implement AES-256 algorithm on API and mobile (React Native), I've tried to find any reference about my case, currently i'm not find it ...
1
vote
0answers
64 views

I'm looking for an email provider like this [closed]

I am looking for email providers with the following conditions for privacy. email providers that: Are free. Do not require JavaScript or other credentials for registration. Provide an onion service. ...
3
votes
1answer
103 views

How to know if a web page is valid and not a man in the middle fake page?

Recently, the facebook page changed on my computer (on others from the same router, I get the regular page). I checked the ssl certificate, and it seems to be authentic, however, as the page does not ...
5
votes
4answers
250 views

Is revealing a PC account user name bad?

Typical computers with modern operating systems require log-on accounts with a user name and a password. Is it dangerous to reveal the user name of the log-on account to the public? My research: I ...
18
votes
3answers
6k views

Stolen MacBook: should I worry about my data?

Unfortunately, someone stole my laptop (a MacBook) and I did not realize that for 48 hours. Now, this was a work laptop and my company's security team is going to wipe the laptop remotely as soon as ...
2
votes
1answer
160 views

How do attacks on password locked accounts work?

A lot of questions here are about the safety of passwords e.g a Login Password to an account on site X. But how can attackers get in the account when they have to guess the passwords? I know there is ...
0
votes
0answers
69 views

How secure is passwordless and keyless SSH login on 127.0.0.1 only, over a secure authenticated tunnel?

I want to use CA signed SSH keys (that would be rotated frequently and have short expiry, ideally centrally managed, all that great stuff). Unfortunately, most of windows GUI tools, such as WinSCP or ...
0
votes
1answer
75 views

Received Whatsapp security code through a local mobile number. Is this a thing to be worried about? [closed]

Before when I used to register my number of whatsapp .... I used to get verification code from a special number like (56789).... but recently when I tried to register my number I got code from a local ...
0
votes
2answers
67 views

Is a web app vulnerable if it only uses session token in cookie to authenticate a user

I am new to bug hunting and i came across this website, so i came across this bug or atleast what i think is a bug so help me understand and tell me if i should consider it a vulnerability. The ...
1
vote
0answers
71 views

How to prevent phone number being searched online? [closed]

Recently, read an article about phone number being used to hack into one's account. NYTIMES-Phone hacking What needs to be done to prevent my phone number being searched? (Return invalid hyperlinks ...
0
votes
1answer
273 views

Why would I 'have been pwned' on a website that I never had an account on? [duplicate]

I was recently sent a notification by https://haveibeenpwned.com/ that one of my email addresses has been found in a breach, in particular in a breach of https://www.chegg.com. I am positive I never ...
1
vote
1answer
52 views

Why CORS is still securing an open api where all requests have a wildcard (*)?

In case of an open API, the only possible value for Access-Control-Allow-Origin is a wildcard (*), since you can't have a list of allowed domains. Still, this seems not to bug developpers and appears ...
0
votes
2answers
78 views

Is there any security reason for re-directing to the main/mobile page after login?

Scenario: User searches for something and gets a link to a sub-page on a site, proceeds to go there, but is asked to sign-up/login - they do so, only then once they are logged in, they are redirected ...
1
vote
1answer
91 views

Can not logout when the network is unreachable [duplicate]

I had checked youtube.com and stackoverflow.com. And found both of them can not log out if the network is unreachable. I think this is a security risk, right? Please image a situation below: I ...
267
votes
3answers
26k views

Why can I log in to my Facebook account with a misspelled email/password?

I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were ...
0
votes
2answers
72 views

What are the security practice or case studies for account lockouts?

We have a platform where users can sign up for free using their email addresses (they can also associate social media account). Other than the name, email and social account there no other personal ...
1
vote
1answer
83 views

AD user recreation, security issue

I have some users that prefer to create a new user account instead of resetting the password (or investigating why there is an issue with the account). Then delete the old account. I've personally ...
1
vote
5answers
216 views

Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN

I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
2
votes
1answer
48 views

How do I migrate my private key from one device to another in instant messaging app?

I was thinking about end-to-end encryption for my chat application, but I am struggling to understand how do I migrate my private keys from one device to another. One option I thought is to store ...
1
vote
1answer
87 views

Exchange sensitive information through public chat

Is there a way to exchange phone numbers/email addresses through public chats with a person without giving them or other communication information away to all the other people in the public chat? ...
0
votes
2answers
183 views

Could clicking a Grabify link to my Facebook page get me hacked?

My newest boyfriend sent me a Grabify link on Messenger. Without thinking (probably because of trusting him), I clicked the link (yeah, I'm an idiot, lol). The link has routed to my Facebook account. ...
0
votes
0answers
43 views

Is a trusted device, on a public network, still vulnerable to a man in the middle attack? [duplicate]

For example, if I am using my personal laptop on a public wifi, and type in the website I want to go to that includes HTTPS, (lets assume https://www.google.com/gmail/) can I reasonably trust that I'm ...
29
votes
6answers
5k views

The most secure way to handle someone forgetting to verify their account?

Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account. Suppose they forget to verify it, and later try to login. Should the error ...
1
vote
1answer
39 views

Having web client do requests with User's 3rd party API key?

I am trying to figure out the best way to do this. I have done some searching and all I have found is about storing API keys in a back end, nothing like my use-case where there is no back end. ...
2
votes
1answer
224 views

Is it insecure to not let a user choose their own username, and base the username on a known pattern?

I have recently changed banks and my new bank has a benefit scheme (discounts etc.) that has its own website and different login details to my online banking (I think the benefits system is ...
0
votes
1answer
92 views

Can 2FA keys be duplicated?

I want to order a 2FA key (like yubikey) online and I want to know if someone could make a duplicate of whatever key I order during shipping. I don't want to discuss if someone could access my package....
-5
votes
1answer
141 views

Is there some hidden worm attached with whatsapp messages that state forward this messgae to 20 people? [closed]

NOTE: I am New contributor, if the question needs some improvement please tell in comment before down voting! Usually I see messages on whatsapp and sometime on some other forums stating that forward ...
3
votes
0answers
119 views

Add another layer of security in accounts except phone number

I recently came across articles where an attacker contacted a telecom company and got them to change the sim card registered with the target's phone number. After doing so, he was able to reset the ...
0
votes
1answer
46 views

Why do we need token authentication?

If I'm creating an authorization service for my application, why can't I just hash the password and save the the username and hashed password in my User table? Why should I use a token authentication ...
1
vote
1answer
144 views

Do non-administrator Windows accounts need strong passwords?

I have always used long passphrases for my own Windows user accounts. But I know some people who use moderately common passwords (we'll say they're in the top 1,000 most used passwords, but not in the ...
1
vote
1answer
66 views

Banking app logon - multiple fingerprints on a device vs 2 passwords known by 1 person

Yesterday I logged on to my banking app via my iPhone. The normal procedure was to enter information that consisted of: The answer to a security question. This had to be entered in full and was the ...
0
votes
1answer
62 views

Block SMTP Connection That Doesn't Have Credentials

I am able to do the following and connect successfully without any type of credentials: telnet <IP Address> 25 When I am in I can verfiy emails, send emails, etc. I feel like this is a ...
0
votes
2answers
82 views

Is there another way than session hijacking to access user account through XSS?

If I have discovered an XSS vulnerability, is there another way of gaining access to an account without session hijacking? Mainly because on most of the sites I test, the HttpOnly and Secure flags are ...
41
votes
1answer
5k views

Why do I need two parameters in an HTTP parameter pollution attack?

I'm reading about HTTP parameter pollution and I'm confused about one thing. If there is an endpoint like this, https://security.stackexchange.com/editpost/?postuid=19348 and you tried a HPP attack, ...
1
vote
2answers
112 views

Buying keycodes online safely/anonymously

I lost a cd key for a very old game and need to replace it with a new one. I can't find anymore physical copies to buy, but I found cd keys for them are offered on sites like Ebay which could replace ...
2
votes
1answer
78 views

When using a shared / public VPN, can others on the same IP address log into your accounts?

I know browsers use cookies so that, for example, if I log into Facebook on a public computer and forget to log out, the next person who opens up a new browser can go into my account. Does this work ...
2
votes
3answers
321 views

Is using weak login credentials always bad?

I am currently using 9 digit numbers to authenticate writers on two apps. In the first app, this unlocks editing tools for use in making content rich dhtml documents which are stored on the local ...
2
votes
0answers
107 views

Hacked iCloud account: how can I protect my iPhone security?

My iCloud account has been hacked. I access links sent by hackers that compromise my iCloud account. The hackers don't have physically access to my phone, the compromised links are sent by them ...
0
votes
2answers
99 views

Can wireshark capture the exact payload and end point of API used by my Mobile APP?

I was just wondering if someone having total control over his/her network, is running my mobile app. Also wireshark is capturing all requests made using the network. My app is calling API endpoint ...
0
votes
1answer
78 views

Should I send login id on email?

I have a very common use case where an admin is creating an account of the user and then I need to send the login id generated by my system to the user. And the user will need to set a password on the ...
-1
votes
2answers
94 views

CDN change for “enhanced security”? (now uses cookies)

For the past few months, I've been unable to continue a particular course on udemy. I can access all other video courses accept that particular course and their support has answered "We recently ...
63
votes
3answers
8k views

Website returning plaintext password [duplicate]

I have recently logged into a website. When I clicked on the "Update Profile" page, you are displayed with a list of text boxes for all the user fields, e.g. name, email, phone number etc. There is ...
2
votes
1answer
207 views

sudo restrictions circumvention with pkexec: root shell

I had corrupted my sudo setup. With no possibility to login as root (locked root account, broken sudo), a search made it clear: use pkexec. It worked. So far, so good. But that turns out to be a big ...
2
votes
1answer
110 views

Why does Google 2FA not display the correct location when behind proxy?

I'm on my corporate proxy and using Google 2-factor authentication to log into my machine. When I get the notification on my phone, it says that I'm trying to connect from Moscow, Russia, even though ...
86
votes
5answers
21k views

Why would someone open a Netflix account using my Gmail address?

This is something that happened to me a few months ago. I don't know if it is a hack attempt, although I can't think of any way that there could be any danger or any personal information gained. I ...
0
votes
1answer
40 views

Safe to consider webapp user's email as implicitly confirmed after a password reset?

In my system, a new user must confirm his email. But there is an edge case: he registers does not confirm forgets password, performs password reset (which involves a mail loop) At that point I know ...
0
votes
2answers
127 views

How safe are passwords while using prompt?

Simple question. How safe are passwords while using prompt? For example logging through SSH. ssh user@server and then you have question for password - of course hidden but... what's going "under ...
0
votes
0answers
141 views

I used my school account to use Office 365. Can my school control my device now?

Whilst I was setting up Office 365, there was an option that said "allow my organization to manage my device". I unchecked it, but I can still access their network drives. Does this mean they now ...