All Questions

Filter by
Sorted by
Tagged with
2
votes
0answers
233 views

Different email address in the email and the cancellation link in “Security alert for your linked Google Account” [closed]

In order to be able to help my mother, my gmail is listed as a recovery email for her Google account, mother@gmail.com (not her actual address). Today I received a "Security alert for your linked ...
0
votes
2answers
113 views

Account Recovery: Displaying username without verification

I'm not a security guy, so bear with me. As discussed in other topics, usernames in and of themselves are valid forms of verification, and there's nothing particularly sensitive or secure about ...
0
votes
2answers
190 views

Find the person behind an email address using its recovery email in Gmail

Note: This is based on a true story! The Story: Alice and Bob are good friends and each one knows the personal email address of the other person and they contact with each other using it. Let's ...
0
votes
0answers
48 views

Policy for regaining access to a colleague's account

I run a SaaS used by teams to collect company-related information (think something like Crashlytics). Even if the tool lets users invite their colleagues, we often find cases of individuals who ...
3
votes
3answers
398 views

Password manager and account recovery

I'd like to start using a password manager, but I'm not sure how to handle account recovery. I'm not a criminal or a secret agent, so if I lose my master password (or my second authentication factor, ...
19
votes
4answers
3k views

How secure are password managers with account recovery?

The major commercial password manager companies claim to have a "zero knowledge" system. This means the master password of the user is the only way to decrypt the data and it's is not stored anywhere. ...
2
votes
1answer
180 views

No password root accounts of an entire laboratory!

2 days ago some of the university staff asked me about 3 computers here. All the computers are using Ubuntu and have the exact same password on the login screen for the superuser. Let's say StackPa$$...
4
votes
2answers
1k views

Does Google account's “recovery phone” have any benefit if I never forget my password?

Google lets you add a recovery phone number to your account because: Your recovery phone is used to reach you in case we detect unusual activity in your account or you accidentally get locked out. ...