Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
0
votes
0answers
31 views

Is data stored on a standard mac user account considered secure from other users on that same local computer?

I'm trying to figure out if the data created by a Mac user on a local mac is truly secure from other users on that same mac. For example, on MacOS Catalina, I have three accounts: Administrator User ...
0
votes
0answers
12 views

Institution can access my email (inbox/sent items/etc) and edit it? [migrated]

First of all, I have thoroughly read the answers to the following questions and none of them answer my queries: Can Google Chrome read/scan my ProtonMail inbox page? Can my IT department read my ...
0
votes
1answer
76 views

How do I protect my info from apps like CallApp?

It appears to me that apps like Whoscall and CallApp might access your photos and such. In case of a potential data breach/hacking in one of these apps - how can I delete my info from their servers?
0
votes
0answers
45 views

What do apps like TrueCaller, CallApp and Whoscall share with others? [closed]

I've downloaded the apps TrueCaller, CallApp and Whoscall. Then I realised they have privacy issues. Do they share one's photos? Gmail? What can I do to remove my info from there? TrueCaller has had a ...
-2
votes
1answer
56 views

I opened an http website from my email, how can I know if it's safe?

So, I have Google alerts set for a few words, and one of these alerts had a link to the site "chatsosedi.ru" which I opened. I found out the site isn't https. I clicked on it before realizing. Is it ...
0
votes
2answers
249 views

Can my oppressive government trace my Twitter activity and detect me?

I want to be active on Twitter against our oppressive government. Can my government trace and detect me? Twitter is banned here and we must use VPNs. I use Outline (Shadowsocks) mostly. Is there any ...
-1
votes
0answers
37 views

Is it possible data collection of RFID, WI-FI and Mobiles be use to mimic attacks? [closed]

This data that has been collected, can someone, for example, in a different location get access to it? Even buses nowadays provide wifi. Can they use such means to gain access to these details and use ...
0
votes
0answers
50 views

questions about keyloggers and personal security [closed]

Is it possible to hide a keylogger in an image that infects the offender and sends their data to intended victim instead?
0
votes
1answer
66 views

Why there are some weird requests to my web hosting [duplicate]

I was doing my plesk hosting logs checking for web and database development. Somehow, I had seen some weird ip trying to communicate to hosting. Wonder what is the purpose of these anonymous requests. ...
0
votes
0answers
36 views

Any security standards applicable to empty S3 buckets?

My employer has a lot of S3 buckets which are no longer used or are just sitting there empty. Cleaning them up would obviously reduce the attack surface and be less to monitor and secure, but that ...
0
votes
2answers
72 views

E-Mail privacy proxy for hiding real e-mail?

Do E-Mail proxy services exists to improve privacy and security? Privacy in the sense that one wouldn't need to give a website his/her username (possibly even in the firstname.lastname@domain.tld ...
1
vote
1answer
88 views

Risk of Docker backdoor allowing impersonation

I am a junior web developer. All I know is mostly about web development. I have no skills and knowledge about system security and know little about Linux. I work in a company which is developing some ...
3
votes
1answer
170 views

Risks of allowing employees using personal GitHub accounts for work

Proprietary software developed by a (smallish) company is stored in the company's GitHub private repository. For work, software engineers are requested to create company-specific GitHub account bound ...
0
votes
0answers
83 views

Could this be considered lateral movement or is this normal activity?

Has anyone encountered this type of logon (4624 Type 3). The accounts are logging on then off within a few seconds. We are noticing this activity in the morning, which would be when they start working....
1
vote
1answer
132 views

Is an OS more vulnerable while it is being updated?

Are there any additional attack vectors that apply when an OS is being updated? For example, would the services that are being updated be unstable? An OS is generally more secure after being updated, ...
0
votes
0answers
73 views

How to encrypt user files securely on the server with PHP

Description: I want to create an upload center for small files (word/excel/zip documents etc) with PHP. I want to protect files uploaded by user as much as possible, so if server is breached, ...
3
votes
1answer
135 views

Is it possible to mac-spoof Xfinity Wireless?

Background Comcast/Xfinity operates various wireless hotspots across the US, accessed via the SSID xfinitywifi through the many wireless access points shown on https://hotspots.wifi.xfinity.com/ ...
1
vote
1answer
61 views

Can someone redirect or block emails of a specific sender?

I’m expecting some information from a governmental organisation, they claim that they already send the info via email, but I have never received anything. They also have an automatic reply email, ...
0
votes
0answers
46 views

Western Digital My Cloud - Website GUI & Security

I am trying to figure out if using the Website "files.mycloud.com" is exposing my files to being intercepted at a central point. I see that there is an HTTPS connection with valid cert for *.mycloud....
0
votes
2answers
108 views

Best way to authorize and authenticate a user on web API

I am doing a hypothetical web just for learn some security tips and the first problem I've found is the login, I've read like 40 articles, a lot of questions here on stackoverflow and I still don't ...
1
vote
0answers
49 views

How to implement a “Forgot password?” functionality using php-encryption's KeyProtectedByPassword and 2FA?

I'm currently migrating the encryption functionality used in a PHP project from mcrypt (which was deprecated in PHP 7.1.x and no longer works from PHP 7.2 onward) to openssl, using the defuse/php-...
1
vote
0answers
112 views

How could a mobile banking app be hacked?

My phone got stolen, and sent back to where it was stolen a day after. At the moment of stealing, the phone was locked. When I received it back, there was no money left in my bank account. The ...
0
votes
2answers
109 views

Baking a better cookie - How can we prevent a high-jacking of the user's local cookie file to exploit accepted cookie use?

This question is similar to Hashing cookie-values & preventing cookie-stealing however, it is significantly different as I am interested in preventing (internal) subscription fraud, rather than an ...
0
votes
0answers
35 views

Why use a refresh token for authentication?

I recently stumbled upon this article which recommends using two tokens for authentication. Once the user is logged-in (or registered), the client receives an access token and a refresh token, ...
0
votes
1answer
48 views

Golang REST API: Security checks? [duplicate]

It's my first time building and deploying a REST API with just the standard library. Are there any gotchas I should keep an eye out for regarding securing my REST API?
2
votes
2answers
231 views

How often, if at all, should I rotate my passwords?

In the course of my computer working I daily use dozens of username/passphrase pairs. Within the limits of my understanding and restrictions I apply the best practices for security. Unfortunately I ...
1
vote
0answers
74 views

Track HTTP(S) Network calls being made by an Android Device

I am planning to track the Network calls being made by apps and the website of an Android Device. I have used the Burp Suite tool for tracking the network calls. Until now the Android Device and the ...
1
vote
0answers
54 views

Are there any statistics about most common account thefts?

I am trying to evaluate how safe personal accounts are (including my own). Are there any statistics on the top security flaws which cause accounts to be compromised/stolen? Like: 25% of cases is ...
2
votes
0answers
88 views

How are github personal access tokens and other github auth for 3rd parties not a securty issue?

Many services integrate with github. Some of them seem to require a personal access token with "repo" permission. Personal access tokens are global across all projects. In other words you may want to ...
1
vote
0answers
60 views

Using uuidv4 in url to allow non registered users to refund purchases

I know reading that title probably made some of you gag, but let me explain the situation. I was tasked with creating a pretty straightforward storefront web app (php/laravel/stripe for payments) ...
-2
votes
1answer
66 views

Know location and IP address [closed]

Today someone tried to access my LinkedIn account. When I logged into my LinkedIn account, I received PIN by mail. So how can I know the location and IP address of the hacker?
1
vote
1answer
72 views

Do registration codes need expiry?

I work on an application where users are sent a unique registration code in the post. They use this, along with other personal information known to the user, to confirm the identity of the user upon ...
50
votes
4answers
7k views

Log user out after change of IP address?

Does it make sense to log a user out from a web service after the user's IP address is changed? I understand that a change of an IP address might indicate a man-in-the-middle attack. Then again IP ...
0
votes
0answers
14 views

Dockerfile - What user should be the owner for a mount point?

In the docker-compose file, below is the volumes instruction for builder service: builder: build: ../../ dockerfile: docker/dev/Dockerfile volumes: - ../../target:/wheelhouse volumes_from:...
62
votes
6answers
9k views

Is 2FA via mobile phone still a good idea when phones are the most exposed device?

Everyone knows that two factors are better than one. My problem is that often the only second factor allowed is text messages sent to your mobile phone. This creates two concerns: I travel frequently ...
0
votes
1answer
62 views

Creating a dummy account for account verification

I recently wanted to do some major changes to my account for an online game. So they wanted to do a thorough account verification. First they asked me for some character information which can be ...
1
vote
3answers
267 views

If no one knows a password, is there a reason to change it?

Scenario: A high level access account on a single machine, where the account is created by the system/application with a secure password, without exposing the password to a human or to any other ...
0
votes
1answer
47 views

Is User Account Login Related to BitLocker Encryption Key

When I enabled BitLocker on my system-drive, I wasn't asked to select an unlock-method. I didn't have to enter any new passwords/keys. I only selected a few options for the encryption, and the process ...
0
votes
1answer
83 views

Crack a single http cookie and gain access to a random user's account! [duplicate]

I was looking for lots of information about cookies recently. What attracted me the most was the fact that cookies come in all forms and can be hijacked through arp poisining and spoofing on the local ...
0
votes
0answers
58 views

Sony Access Log (Playstation Network) does not exists

Yesterday my wife receive some emails from Sony confirming her purchases on Playstation Network. The only problem is: she was with my side watching Netflix on the smart Tv. The purchased items is a ...
0
votes
1answer
48 views

Quantify security strength from entropy and lifetime

Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
1
vote
1answer
52 views

operating system requiring two or more users to access admin account

Suppose I'm designing a system where I want to make sure that no single user who goes rogue can commit a malicious action. (I'm ducking the question of how two or more users could collude.) And I ...
1
vote
1answer
101 views

What can a hacker do if I publish my email id and password but have 2FA on all of my accounts?

I have 2FA on ALL of my accounts. But my password was leaked in 7 breaches. Unfortunately I have used the same password for most of the accounts. Is it possible for him/her to bypass the 2FA?
2
votes
1answer
38 views

Known methods/techniques for thwarting credential phising attacks

Is the solution to preventing credential phising attacks is really only 'educating' people about it? For the sake of this question, let us assume that I have a web application that takes a username ...
2
votes
2answers
159 views

Is storing a JWT secret as docker env variable acceptable?

I understand how JWTs work and that with my secret anyone can issue new tokens. I control the server that my node website runs on and am considering different options for hosting the key. In code - ...
1
vote
0answers
54 views

Suspicious Android app - install on its own - no uninstall option - name in Japanese [closed]

I recently saw the app below in my phone. Have disabled it immediately when I saw it. Have no idea: what it is why it's in my phone how long it's been there and how to uninstall it (there's no ...
0
votes
0answers
28 views

Security risk of using a budgeting app connected to bank accounts [duplicate]

I've been tracking my budget the old way for a few years now by using excel spread sheets that have my checking account ledger, and monthly expenses broken down to categories. But I have noticed more ...
1
vote
0answers
76 views

I'm looking for an email provider like this [closed]

I am looking for email providers with the following conditions for privacy. email providers that: Are free. Do not require JavaScript or other credentials for registration. Provide an onion service. ...
3
votes
1answer
120 views

How to know if a web page is valid and not a man in the middle fake page?

Recently, the facebook page changed on my computer (on others from the same router, I get the regular page). I checked the ssl certificate, and it seems to be authentic, however, as the page does not ...
5
votes
4answers
350 views

Is revealing a PC account user name bad?

Typical computers with modern operating systems require log-on accounts with a user name and a password. Is it dangerous to reveal the user name of the log-on account to the public? My research: I ...