Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
-3 votes
0 answers
38 views

Can my employer still access my account after signing out from work pc and switching passwords?

I logged into a private google account on a work laptop. I switched passwords and anything a few seconds later. Could my employer still see and access new activity on my google account even though I ...
0 votes
0 answers
29 views

Can my employer see my private google account history when just logging in and out in a matter of 10 seconds on a work laptop (REPOSTED)

So I did this post before on a guest account but I had further questions so now I'm posing it on a real one. Can my employer see my private google history/”google activity” if I didn’t do anything on ...
0 votes
0 answers
3 views

Windows log : identify difference between desktop login and UAC login [migrated]

Our desktop support team grants everyone an account for daily activities in the company, and also grands a local administrator account for specific people (mostly developers) so they can install ...
1 vote
4 answers
403 views

E-Mail privacy proxy for hiding real e-mail?

Do E-Mail proxy services exists to improve privacy and security? Privacy in the sense that one wouldn't need to give a website his/her username (possibly even in the firstname.lastname@domain.tld ...
0 votes
3 answers
650 views

Can a password change via CSRF lead to account takeover?

If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF ...
6 votes
2 answers
566 views

Friend's Instagram account repeatedly hacked despite changing all information and enabling 2FA

My friends Instagram account has repeatedly been hacked. Someone is gaining access to her account, proceeding to change all the security information to lock her out. Then posts scam ads on her account....
2 votes
2 answers
197 views

Quantify security strength from entropy and lifetime

Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
0 votes
0 answers
51 views

Finding Public Ip Address of security camera [migrated]

I have installed my home security camera and it's run on 192.168.192.2 localhost and is accessible through android apps. But I would like to know what the public IP address of this camera is so I can ...
28 votes
3 answers
8k views

Someone created a Disney+ account with my e-mail address. Are there any security concerns?

I got an Email (to my iCloud address) from Disney+. The email contained a subscriber agreement. I did not register for their service myself. On the Disney+ website I saw that there was indeed an ...
3 votes
2 answers
632 views

Using SessionStorage for Some User Info

I have an application that currently keeps a few properties from a user's profile in session storage for the app to use when necessary. We don't keep sensitive data like username or password or ssn in ...
0 votes
3 answers
440 views

Android phone's lockscreen PIN disappeared?

I own a ZTE Axon 7 (model 2017G) that I purchased secondhand from a reputable vendor in Germany ca. 3 years ago. The phone has been working well, and I updated the OS to Android 8.0. manually earlier ...
51 votes
5 answers
6k views

Is it possible to detect security breaches as a user before they're announced?

I'm always concerned about the security of services I use. I'm even more concerned since security breaches have been happening more and more lately, and they always generate a lot of noise in the ...
0 votes
1 answer
86 views

Voice input as security measures for system authentication

Can voice input as a password be a useful security measure as an alternative to a strong password and biometrics (face, thumb, signature etc)? The voice inputted as a password will be saved as a sound ...
46 votes
6 answers
11k views

User Account with no password

I'm currently job searching, and sometimes I come across sites that are just huge databases full job postings, and before you apply you have to create an account. I came across a site, but I'm ...
0 votes
2 answers
42 views

Does showing the permission level of an account to all users a bad security practice?

On my school website I can list all existing accounts in the system to send them a message. Each account has a logo showing the user role (admin, professor or student) and I can directly filter on it. ...
0 votes
1 answer
106 views

Storage access permissions before initial unlock upon startup

How do Android devices (at least all the non-enterprise personal devices I remember owning) display the wallpaper (usually chosen from the 'downloads' folder) on the lock screen when it first is ...
0 votes
1 answer
48 views

Google Login vs. Username + Password

Is a Google login actually any more secure than a username and password login? Assuming the username + password uses encrypted passwords in the DB and a 1 week access token, I don't really see how it ...
0 votes
0 answers
22 views

SpringBoot Web Application Security for apis working on static token?

I have one Spring boot Web application which has few apis facing internet, deployed on aws, they work on JWT token, they're fairly secure. But there are few apis that work on static token validation. ...
0 votes
4 answers
711 views

Router access, am I in danger?

I learned I can access my router from a the internet like so http://ipaddress/login.html I was wondering if anyone could gain access to my router control panel. IF that is the case can they ...
1 vote
0 answers
83 views

Displaying a user's password in plaintext on login pages. Why is this practice becoming more widespread? [duplicate]

Over the years I've noticed that more and more login pages implement an eye icon next to the password field, that on click toggles between hidden and plaintext view of the password typed in that field....
0 votes
1 answer
73 views

Passing the session ID of an unauthenticated user to a valid session using Burp

I am passing the Cookie header of a valid authenticated, high privileged user to the unauthenticated or low privileged user using Autorize (Burp Extension). So ideally, the Autorize says the requests ...
5 votes
2 answers
2k views

I woke up and my email has been signed up to hundreds of online services. How can I fix this?

I woke up this morning to over 900 emails of several online services asking to confirm I’ve made an account. Last month my email had been compromised and they managed to get into my eBay and Amazon ...
1 vote
1 answer
132 views

How can one mitigate both account-level DOS attacks and online brute force attacks at the same time?

I was recently reading this question, where the accepted answer claims that it is easy for attackers to bypass rate limiting that is based on IP, which makes any sort of IP rate limiting to prevent a ...
0 votes
0 answers
45 views

How this JSON object can be exploitable?

I was reading this documentation https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security_Cheat_Sheet.html#server-side One of the security recommendation is - Always return JSON with an Object on ...
1 vote
2 answers
213 views

Do registration codes need expiry?

I work on an application where users are sent a unique registration code in the post. They use this, along with other personal information known to the user, to confirm the identity of the user upon ...
1 vote
3 answers
231 views

Admin change user details / account information in admin interface

I'm creating this admin dashboard, and I have a question wich I have been stuck on for a while now. And I'm starting to question what kind of data the admin should be able edit/view on the other ...
0 votes
1 answer
81 views

How could attacker know user names of my Google Workspace? [closed]

I found in my Google admin logs that someone from outside my organization is trying to log in frequently by testing all our user accounts against weak passwords. I'm wondering how could that happen? ...
2 votes
4 answers
1k views

Is it secure to make my Threema ID public?

I've had Threema for a few days (a couple of friends forced me to buy it). It's pretty neat but I'm afraid that I'm not connected to everyone since my mail/phone-number data is pretty small or ...
0 votes
2 answers
2k views

Unknown numbers sending videos on WhatsApp. What should I do?

A number with ISD code +92 sent a video via WhatsApp. No text, only a video. About 20 days later, another number with same ISD sent another video. Should I open the video? OR Should I Report and Block?...
0 votes
0 answers
14 views

Leaving half open or full open connection having SYN cookie

Suppose an attacker collects a large number of initial sequence numbers sent by the server. Can the attacker cause the server to create many fully open connections by sending ACKs with those initial ...
0 votes
0 answers
10 views

Creating half open or full open connection in presence of SYN cookie

Suppose an attacker knows that a target host uses SYN cookies. Can the attacker create half-open or fully open connections by simply sending an ACK packet to the target? Why or why not?
0 votes
2 answers
118 views

Low-privilege account and sudo permissions

Ok, so one common security practice is creating a low privilege account to work from when not installing tools and making system changes. This question is more towards penetration testing platforms. ...
0 votes
0 answers
62 views

Using someone else's SSL certificate [duplicate]

As far as I know, the SSL certificate is public and anyone can read it. Is it possible in this case, for example, when someone, having copied the SSL certificate of my bank for himself, will be able ...
0 votes
1 answer
34 views

Will Lastpass ignore old 2FA tokens from the Yubikey? (tokens leaked accidentally)

Somestimes I press on my yubikey accidentally and it writes the token on the screen and even sends automatically to the person I'm talking to on some chat, because it presses enter. This happened ...
0 votes
1 answer
301 views

iCloud Security Concern: browser session authentication storage after 2-factor?

Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie? My concern is, if ...
0 votes
1 answer
73 views

O365 MFA: Challenge (Approve or Deny) sign on - dangerous?

I have been searching resources online about proper MFA/2FA (with O365 specifically) considerations. How is the MFA push challenge notification to Approve or Deny a sign-on not dangerous? I have yet ...
1 vote
1 answer
514 views

Does adding a recovery phone number to a Gmail account make it less secure, in the case that I lose both my laptop and phone?

Background I have a "main" Gmail account, which I set to keep logged in, on my laptop. This "main" Gmail account is important, because it's the email address I used to sign up for ...
0 votes
1 answer
163 views

Why not use a long life session ID for auto-login instead of a persistent cookie with a token?

On the PHP website it is stated that "Developers must not use long life session IDs for auto-login because it increases the risk of stolen sessions.". Instead it is recommended to use a ...
0 votes
0 answers
44 views

Rails API Session Security and CSRF

I am doing an api with Rails(api-only). Security is so importand for me. I got 2 question. 1-) I am keeping user's id in session[:authID], is it safe to use like this? 2-) Do i need CSRF protection ...
1 vote
0 answers
25 views

Obfuscate account availability during creation or not?

My partner and I are arguing about our auth system. They believe that obfuscating the existence of another account (by showing a generic error) is preferable to surfacing an error warning about ...
0 votes
0 answers
36 views

Just got "Find My Device located this device" notification - but I didn't try to locate it and I'm login only at that Android device and my closed PC

This is weird - I've checked my Google account and I'm only logged in at my Android device, my PC (which was closed at the time of the msg.), and Chromecast device. Couldn't find anywhere any ...
84 votes
7 answers
21k views

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

I did some research about how secure and private SMS messages are. Providers and governments can see these SMS messages in plaintext, but what is weird is that these messages are not encrypted in ...
0 votes
0 answers
64 views

Outlook - Windows Security Pop Up Never Goes Away. Potential Compromise?

I have a user who has reported that they are getting a Windows Security pop up from Outlook that keeps showing up even after clicking Cancel and signing out/in shown below Luckily, the user didn't ...
0 votes
1 answer
25 views

Prevent client access being the same as admin access in web application

My colleagues and I are developing a public web application with client and admin access. I'm concerned about security, being the application public. I would like to add every layer, as long as it's ...
0 votes
0 answers
165 views

Windows hello pin removal/crack

Is there a workaround to the Windows 10 Hello PIN security login policy? The PIN is the only credential needed to log in, no password is set, checked with samdump2. I inherited this computer from a ...
0 votes
1 answer
257 views

Can Google see the screen when using Chrome Remote Desktop?

I was wondering if Google can see my computer screen while I'm using Chrome Remote Desktop. Let's assume there's my main PC named A and my other PC named B. PC B will have the Chrome extension ...
0 votes
0 answers
11 views

Site-specific account vs "single sign-on" for personal accounts?

The title of this question is a bit hard to word concisely, partially due to my own lack of terminology. What I am trying to ask is, when signing up for a service in a personal capacity (say Airbnb) ...
0 votes
1 answer
124 views

Doesn't 2FA increase the vulnerability of an account?

You create an account on an online service X with login=your email + password. Compare these 2 situations: No 2FA enabled. The only risk is if your email is compromised: the "I lost my password&...
0 votes
0 answers
37 views

Should I let administrator account bypass IP ACL?

Let's say there is a system that can set IP ACL for security. If administrator can't bypass IP ACL, account may by locked up when machine or network IP changed But if administrator can bypass IP ACL, ...
29 votes
7 answers
9k views

Is it safe to store account credentials in an Excel sheet protected with a password?

Basically the title. For example, how bad is it to store passwords in an Excel sheet protected with a password, instead of storing passwords in Keypass or something else like Zoho Vault? Of course, ...

1
2 3 4 5
15