Questions tagged [account-security]
Security controls and features related to an end user's account with a web/mobile based application or an operating system.
450
questions
0
votes
1answer
48 views
Quantify security strength from entropy and lifetime
Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
62
votes
5answers
22k views
Logged out of Facebook on all devices on a sudden. Should I be worried about being hacked?
A while ago, I was opening Facebook app on Android and then I got the message "Session expired. Please log in again.". I then tried logging in with my current password and was success to log in my ...
1
vote
0answers
53 views
Are there any statistics about most common account thefts?
I am trying to evaluate how safe personal accounts are (including my own).
Are there any statistics on the top security flaws which cause accounts to be compromised/stolen?
Like: 25% of cases is ...
2
votes
0answers
76 views
How are github personal access tokens and other github auth for 3rd parties not a securty issue?
Many services integrate with github. Some of them seem to require a personal access token with "repo" permission. Personal access tokens are global across all projects. In other words you may want to ...
1
vote
0answers
58 views
Using uuidv4 in url to allow non registered users to refund purchases
I know reading that title probably made some of you gag, but let me explain the situation. I was tasked with creating a pretty straightforward storefront web app (php/laravel/stripe for payments) ...
-2
votes
1answer
59 views
Know location and IP address [closed]
Today someone tried to access my LinkedIn account. When I logged into my LinkedIn account, I received PIN by mail. So how can I know the location and IP address of the hacker?
4
votes
1answer
1k views
non secure connection in youtube
I was browsing a while ago on youtube, I saw it shows an insecure connection even though it was over https.
I'm using ghostery and adblock to block trackers but nothing more, I don't think it's the ...
50
votes
4answers
7k views
Log user out after change of IP address?
Does it make sense to log a user out from a web service after the user's IP address is changed?
I understand that a change of an IP address might indicate a man-in-the-middle attack. Then again IP ...
1
vote
1answer
60 views
Do registration codes need expiry?
I work on an application where users are sent a unique registration code in the post. They use this, along with other personal information known to the user, to confirm the identity of the user upon ...
1
vote
2answers
89 views
Is storing a JWT secret as docker env variable acceptable?
I understand how JWTs work and that with my secret anyone can issue new tokens. I control the server that my node website runs on and am considering different options for hosting the key.
In code - ...
1
vote
1answer
363 views
BitLocker Recovery Key and Microsoft Account Password
I have a Windows 10 Pro machine; the administrator (and only) account is a Microsoft account. I am trying to set up BitLocker to ensure maximum security and safety, even from Microsoft.
I understand ...
61
votes
6answers
9k views
Is 2FA via mobile phone still a good idea when phones are the most exposed device?
Everyone knows that two factors are better than one. My problem is that often the only second factor allowed is text messages sent to your mobile phone. This creates two concerns:
I travel frequently ...
0
votes
0answers
11 views
Dockerfile - What user should be the owner for a mount point?
In the docker-compose file, below is the volumes instruction for builder service:
builder:
build: ../../
dockerfile: docker/dev/Dockerfile
volumes:
- ../../target:/wheelhouse
volumes_from:...
1
vote
3answers
262 views
Why are data breaches like the one at Quora considered so bad?
Today, I read this article that said that some hacker stole personal information of 100 million users of Quora — which allegedly is half of the total user base of Quora. This is kind of like when ...
1
vote
3answers
235 views
If no one knows a password, is there a reason to change it?
Scenario: A high level access account on a single machine, where the account is created by the system/application with a secure password, without exposing the password to a human or to any other ...
0
votes
1answer
59 views
Creating a dummy account for account verification
I recently wanted to do some major changes to my account for an online game. So they wanted to do a thorough account verification.
First they asked me for some character information which can be ...
0
votes
0answers
28 views
Is User Account Login Related to BitLocker Encryption Key
When I enabled BitLocker on my system-drive, I wasn't asked to select an unlock-method. I didn't have to enter any new passwords/keys. I only selected a few options for the encryption, and the process ...
512
votes
3answers
84k views
Why can I log in to my Facebook account with a misspelled email/password?
I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were ...
0
votes
1answer
79 views
Crack a single http cookie and gain access to a random user's account! [duplicate]
I was looking for lots of information about cookies recently. What attracted me the most was the fact that cookies come in all forms and can be hijacked through arp poisining and spoofing on the local ...
0
votes
0answers
48 views
Sony Access Log (Playstation Network) does not exists
Yesterday my wife receive some emails from Sony confirming her purchases on Playstation Network. The only problem is: she was with my side watching Netflix on the smart Tv.
The purchased items is a ...
1
vote
1answer
52 views
operating system requiring two or more users to access admin account
Suppose I'm designing a system where I want to make sure that no single user who goes rogue can commit a malicious action. (I'm ducking the question of how two or more users could collude.) And I ...
6
votes
3answers
16k views
How can application like Whatsdog detect user online status from Whatsapp?
Whatsdog detects whether your victim is online or not. What are they doing in the background? We know that Whatsapp does not provide any API or SDK for this, so how can anyone monitor this type of ...
1
vote
1answer
101 views
What can a hacker do if I publish my email id and password but have 2FA on all of my accounts?
I have 2FA on ALL of my accounts. But my password was leaked in 7 breaches.
Unfortunately I have used the same password for most of the accounts.
Is it possible for him/her to bypass the 2FA?
2
votes
1answer
36 views
Known methods/techniques for thwarting credential phising attacks
Is the solution to preventing credential phising attacks is really only 'educating' people about it?
For the sake of this question, let us assume that I have a web application that takes a username ...
86
votes
5answers
22k views
Why would someone open a Netflix account using my Gmail address?
This is something that happened to me a few months ago. I don't know if it is a hack attempt, although I can't think of any way that there could be any danger or any personal information gained.
I ...
1
vote
1answer
522 views
Norms and Compliance for storing bank account details
I am from India and working on a B2C service product. There I have to transfer money to my customers, so I need their bank account number and IFSC code.
However, I was wondering if there are some ...
1
vote
0answers
49 views
Suspicious Android app - install on its own - no uninstall option - name in Japanese [closed]
I recently saw the app below in my phone. Have disabled it immediately when I saw it. Have no idea:
what it is
why it's in my phone
how long it's been there
and how to uninstall it (there's no ...
0
votes
1answer
127 views
Application design to avoid XSS & CSRF attacks
I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
0
votes
0answers
26 views
Security risk of using a budgeting app connected to bank accounts [duplicate]
I've been tracking my budget the old way for a few years now by using excel spread sheets that have my checking account ledger, and monthly expenses broken down to categories. But I have noticed more ...
0
votes
1answer
108 views
What should be done if 2FA was turned off in an unexpected manner?
Today when I logged in Facebook, no 2FA was shown.
I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
14
votes
6answers
3k views
Is it safe to store 2FA tokens together with passwords in 1password?
I'm using 1password and I've seen 1password allows you to store 2FA tokens in the same place where you store the password.
I don't like the idea of having everything in the same place as if someone ...
4
votes
2answers
835 views
Keeping AWS account ID secret
Must my AWS account ID be kept secret? Can anything at all be done using just the AWS account ID?
From the AWS documentation:
The AWS account ID is a 12-digit number, such as 123456789012, that ...
2
votes
1answer
142 views
Smartphone fingerprint plus iris scanning for login
I have often thought about the fact that when intimate relationship partners live together they eventually tend to sneak over your shoulder and gain access to your password on either your mobile phone ...
1
vote
1answer
84 views
AD user recreation, security issue
I have some users that prefer to create a new user account instead of resetting the password (or investigating why there is an issue with the account). Then delete the old account.
I've personally ...
7
votes
1answer
2k views
Android update phone number, “To continue, first verify it's you”
I was minding my own business, didn't change phone, password, or diet. Then on 3 November 2017 a popup asks for my google password. Is this foul play or just bad googly manners? Should I comply, ...
3
votes
1answer
116 views
How to know if a web page is valid and not a man in the middle fake page?
Recently, the facebook page changed on my computer (on others from the same router, I get the regular page). I checked the ssl certificate, and it seems to be authentic, however, as the page does not ...
1
vote
0answers
69 views
I'm looking for an email provider like this [closed]
I am looking for email providers with the following conditions for privacy.
email providers that:
Are free.
Do not require JavaScript or other credentials for registration.
Provide an onion service.
...
1
vote
1answer
395 views
In what cases is it ok keep a user logged in or provide auto login if an app starts?
I am wondering what the difference is between WhatsApp and my Bank application, and what considerations determine what is the right approach to handle user authentication.
WhatsApp:
I create my ...
0
votes
1answer
56 views
iCloud Security Concern: browser session authentication storage after 2-factor?
Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie?
My concern is, if ...
5
votes
4answers
298 views
Is revealing a PC account user name bad?
Typical computers with modern operating systems require log-on accounts with a user name and a password. Is it dangerous to reveal the user name of the log-on account to the public?
My research:
I ...
18
votes
3answers
6k views
Stolen MacBook: should I worry about my data?
Unfortunately, someone stole my laptop (a MacBook) and I did not realize that for 48 hours. Now, this was a work laptop and my company's security team is going to wipe the laptop remotely as soon as ...
2
votes
1answer
231 views
How do attacks on password locked accounts work?
A lot of questions here are about the safety of passwords e.g a Login Password to an account on site X. But how can attackers get in the account when they have to guess the passwords? I know there is ...
0
votes
0answers
72 views
How secure is passwordless and keyless SSH login on 127.0.0.1 only, over a secure authenticated tunnel?
I want to use CA signed SSH keys (that would be rotated frequently and have short expiry, ideally centrally managed, all that great stuff). Unfortunately, most of windows GUI tools, such as WinSCP or ...
0
votes
2answers
76 views
Is a web app vulnerable if it only uses session token in cookie to authenticate a user
I am new to bug hunting and i came across this website, so i came across this bug or atleast what i think is a bug so help me understand and tell me if i should consider it a vulnerability.
The ...
1
vote
0answers
73 views
How to prevent phone number being searched online? [closed]
Recently, read an article about phone number being used to hack into one's account.
NYTIMES-Phone hacking
What needs to be done to prevent my phone number being searched? (Return invalid hyperlinks ...
0
votes
1answer
282 views
Why would I 'have been pwned' on a website that I never had an account on? [duplicate]
I was recently sent a notification by https://haveibeenpwned.com/ that one of my email addresses has been found in a breach, in particular in a breach of https://www.chegg.com. I am positive I never ...
1
vote
2answers
223 views
How are sites like PersonalCapital safe/trustworthy?
Sites like PersonalCapital require you submit your account login details for every one of your banking account providers.
Could personal capital potentially log into your financial accounts and make ...
1
vote
1answer
60 views
Why CORS is still securing an open api where all requests have a wildcard (*)?
In case of an open API, the only possible value for Access-Control-Allow-Origin is a wildcard (*), since you can't have a list of allowed domains.
Still, this seems not to bug developpers and appears ...
3
votes
2answers
107 views
Using SessionStorage for Some User Info
I have an application that currently keeps a few properties from a user's profile in session storage for the app to use when necessary. We don't keep sensitive data like username or password or ssn in ...
0
votes
2answers
80 views
Is there any security reason for re-directing to the main/mobile page after login?
Scenario: User searches for something and gets a link to a sub-page on a site, proceeds to go there, but is asked to sign-up/login - they do so, only then once they are logged in, they are redirected ...
