Questions tagged [account-security]
Security controls and features related to an end user's account with a web/mobile based application or an operating system.
703
questions
-3
votes
0
answers
38
views
Can my employer still access my account after signing out from work pc and switching passwords?
I logged into a private google account on a work laptop. I switched passwords and anything a few seconds later. Could my employer still see and access new activity on my google account even though I ...
- 11
0
votes
0
answers
29
views
Can my employer see my private google account history when just logging in and out in a matter of 10 seconds on a work laptop (REPOSTED)
So I did this post before on a guest account but I had further questions so now I'm posing it on a real one.
Can my employer see my private google history/”google activity” if I didn’t do anything on ...
- 11
0
votes
0
answers
3
views
Windows log : identify difference between desktop login and UAC login [migrated]
Our desktop support team grants everyone an account for daily activities in the company, and also grands a local administrator account for specific people (mostly developers) so they can install ...
- 225
1
vote
4
answers
403
views
E-Mail privacy proxy for hiding real e-mail?
Do E-Mail proxy services exists to improve privacy and security?
Privacy in the sense that one wouldn't need to give a website his/her username (possibly even in the firstname.lastname@domain.tld ...
CommunityBot
- 1
0
votes
3
answers
650
views
Can a password change via CSRF lead to account takeover?
If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF ...
- 123k
6
votes
2
answers
566
views
Friend's Instagram account repeatedly hacked despite changing all information and enabling 2FA
My friends Instagram account has repeatedly been hacked. Someone is gaining access to her account, proceeding to change all the security information to lock her out. Then posts scam ads on her account....
CommunityBot
- 1
2
votes
2
answers
197
views
Quantify security strength from entropy and lifetime
Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
CommunityBot
- 1
0
votes
0
answers
51
views
Finding Public Ip Address of security camera [migrated]
I have installed my home security camera and it's run on 192.168.192.2 localhost and is accessible through android apps. But I would like to know what the public IP address of this camera is so I can ...
- 7,472
28
votes
3
answers
8k
views
Someone created a Disney+ account with my e-mail address. Are there any security concerns?
I got an Email (to my iCloud address) from Disney+. The email contained a subscriber agreement. I did not register for their service myself. On the Disney+ website I saw that there was indeed an ...
CommunityBot
- 1
3
votes
2
answers
632
views
Using SessionStorage for Some User Info
I have an application that currently keeps a few properties from a user's profile in session storage for the app to use when necessary. We don't keep sensitive data like username or password or ssn in ...
CommunityBot
- 1
0
votes
3
answers
440
views
Android phone's lockscreen PIN disappeared?
I own a ZTE Axon 7 (model 2017G) that I purchased secondhand from a reputable vendor in Germany ca. 3 years ago. The phone has been working well, and I updated the OS to Android 8.0. manually earlier ...
- 23
51
votes
5
answers
6k
views
Is it possible to detect security breaches as a user before they're announced?
I'm always concerned about the security of services I use. I'm even more concerned since security breaches have been happening more and more lately, and they always generate a lot of noise in the ...
- 5,308
0
votes
1
answer
86
views
Voice input as security measures for system authentication
Can voice input as a password be a useful security measure as an alternative to a strong password and biometrics (face, thumb, signature etc)?
The voice inputted as a password will be saved as a sound ...
- 123k
46
votes
6
answers
11k
views
User Account with no password
I'm currently job searching, and sometimes I come across sites that are just huge databases full job postings, and before you apply you have to create an account. I came across a site, but I'm ...
0
votes
2
answers
42
views
Does showing the permission level of an account to all users a bad security practice?
On my school website I can list all existing accounts in the system to send them a message. Each account has a logo showing the user role (admin, professor or student) and I can directly filter on it.
...
- 4,199
0
votes
1
answer
106
views
Storage access permissions before initial unlock upon startup
How do Android devices (at least all the non-enterprise personal devices I remember owning) display the wallpaper (usually chosen from the 'downloads' folder) on the lock screen when it first is ...
CommunityBot
- 1
0
votes
1
answer
48
views
Google Login vs. Username + Password
Is a Google login actually any more secure than a username and password login?
Assuming the username + password uses encrypted passwords in the DB and a 1 week access token, I don't really see how it ...
- 66
0
votes
0
answers
22
views
SpringBoot Web Application Security for apis working on static token?
I have one Spring boot Web application which has few apis facing internet, deployed on aws, they work on JWT token, they're fairly secure. But there are few apis that work on static token validation. ...
- 1
0
votes
4
answers
711
views
Router access, am I in danger?
I learned I can access my router from a the internet like so
http://ipaddress/login.html
I was wondering if anyone could gain access to my router control panel. IF that is the case can they ...
- 123k
1
vote
0
answers
83
views
Displaying a user's password in plaintext on login pages. Why is this practice becoming more widespread? [duplicate]
Over the years I've noticed that more and more login pages implement an eye icon next to the password field, that on click toggles between hidden and plaintext view of the password typed in that field....
- 123k
0
votes
1
answer
73
views
Passing the session ID of an unauthenticated user to a valid session using Burp
I am passing the Cookie header of a valid authenticated, high privileged user to the unauthenticated or low privileged user using Autorize (Burp Extension).
So ideally, the Autorize says the requests ...
- 1,163
5
votes
2
answers
2k
views
I woke up and my email has been signed up to hundreds of online services. How can I fix this?
I woke up this morning to over 900 emails of several online services asking to confirm I’ve made an account. Last month my email had been compromised and they managed to get into my eBay and Amazon ...
- 9,428
1
vote
1
answer
132
views
How can one mitigate both account-level DOS attacks and online brute force attacks at the same time?
I was recently reading this question, where the accepted answer claims that it is easy for attackers to bypass rate limiting that is based on IP, which makes any sort of IP rate limiting to prevent a ...
CommunityBot
- 1
0
votes
0
answers
45
views
How this JSON object can be exploitable?
I was reading this documentation https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security_Cheat_Sheet.html#server-side
One of the security recommendation is - Always return JSON with an Object on ...
- 53
1
vote
2
answers
213
views
Do registration codes need expiry?
I work on an application where users are sent a unique registration code in the post. They use this, along with other personal information known to the user, to confirm the identity of the user upon ...
CommunityBot
- 1
1
vote
3
answers
231
views
Admin change user details / account information in admin interface
I'm creating this admin dashboard, and I have a question wich I have been stuck on for a while now.
And I'm starting to question what kind of data the admin should be able edit/view on the other ...
CommunityBot
- 1
0
votes
1
answer
81
views
How could attacker know user names of my Google Workspace? [closed]
I found in my Google admin logs that someone from outside my organization is trying to log in frequently by testing all our user accounts against weak passwords. I'm wondering how could that happen?
...
- 123k
2
votes
4
answers
1k
views
Is it secure to make my Threema ID public?
I've had Threema for a few days (a couple of friends forced me to buy it). It's pretty neat but I'm afraid that I'm not connected to everyone since my mail/phone-number data is pretty small or ...
- 127
0
votes
2
answers
2k
views
Unknown numbers sending videos on WhatsApp. What should I do?
A number with ISD code +92 sent a video via WhatsApp. No text, only a video. About 20 days later, another number with same ISD sent another video.
Should I open the video?
OR
Should I Report and Block?...
CommunityBot
- 1
0
votes
0
answers
14
views
Leaving half open or full open connection having SYN cookie
Suppose an attacker collects a large number of initial sequence numbers sent by the server. Can the
attacker cause the server to create many fully open connections by sending ACKs with those initial
...
0
votes
0
answers
10
views
Creating half open or full open connection in presence of SYN cookie
Suppose an attacker knows that a target host uses SYN cookies. Can the attacker create half-open or fully open connections by simply sending an ACK packet to the target? Why or why not?
0
votes
2
answers
118
views
Low-privilege account and sudo permissions
Ok, so one common security practice is creating a low privilege account to work from when not installing tools and making system changes. This question is more towards penetration testing platforms. ...
CommunityBot
- 1
0
votes
0
answers
62
views
Using someone else's SSL certificate [duplicate]
As far as I know, the SSL certificate is public and anyone can read it. Is it possible in this case, for example, when someone, having copied the SSL certificate of my bank for himself, will be able ...
- 9
0
votes
1
answer
34
views
Will Lastpass ignore old 2FA tokens from the Yubikey? (tokens leaked accidentally)
Somestimes I press on my yubikey accidentally and it writes the token on the screen and even sends automatically to the person I'm talking to on some chat, because it presses enter. This happened ...
CommunityBot
- 1
0
votes
1
answer
301
views
iCloud Security Concern: browser session authentication storage after 2-factor?
Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie?
My concern is, if ...
CommunityBot
- 1
0
votes
1
answer
73
views
O365 MFA: Challenge (Approve or Deny) sign on - dangerous?
I have been searching resources online about proper MFA/2FA (with O365 specifically) considerations.
How is the MFA push challenge notification to Approve or Deny a sign-on not dangerous? I have yet ...
CommunityBot
- 1
1
vote
1
answer
514
views
Does adding a recovery phone number to a Gmail account make it less secure, in the case that I lose both my laptop and phone?
Background
I have a "main" Gmail account, which I set to keep logged in, on my laptop. This "main" Gmail account is important, because it's the email address I used to sign up for ...
CommunityBot
- 1
0
votes
1
answer
163
views
Why not use a long life session ID for auto-login instead of a persistent cookie with a token?
On the PHP website it is stated that "Developers must not use long life session IDs for auto-login because it increases the risk of stolen sessions.". Instead it is recommended to use a ...
CommunityBot
- 1
0
votes
0
answers
44
views
Rails API Session Security and CSRF
I am doing an api with Rails(api-only). Security is so importand for me. I got 2 question.
1-) I am keeping user's id in session[:authID], is it safe to use like this?
2-) Do i need CSRF protection ...
- 1
1
vote
0
answers
25
views
Obfuscate account availability during creation or not?
My partner and I are arguing about our auth system. They believe that obfuscating the existence of another account (by showing a generic error) is preferable to surfacing an error warning about ...
- 11
0
votes
0
answers
36
views
Just got "Find My Device located this device" notification - but I didn't try to locate it and I'm login only at that Android device and my closed PC
This is weird - I've checked my Google account and I'm only logged in at my Android device, my PC (which was closed at the time of the msg.), and Chromecast device.
Couldn't find anywhere any ...
- 123k
84
votes
7
answers
21k
views
Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?
I did some research about how secure and private SMS messages are.
Providers and governments can see these SMS messages in plaintext,
but what is weird is that these messages are not encrypted in ...
- 4,185
0
votes
0
answers
64
views
Outlook - Windows Security Pop Up Never Goes Away. Potential Compromise?
I have a user who has reported that they are getting a Windows Security pop up from Outlook that keeps showing up even after clicking Cancel and signing out/in shown below
Luckily, the user didn't ...
- 123k
0
votes
1
answer
25
views
Prevent client access being the same as admin access in web application
My colleagues and I are developing a public web application with client and admin access.
I'm concerned about security, being the application public. I would like to add every layer, as long as it's ...
0
votes
0
answers
165
views
Windows hello pin removal/crack
Is there a workaround to the Windows 10 Hello PIN security login policy?
The PIN is the only credential needed to log in, no password is set, checked with samdump2.
I inherited this computer from a ...
- 123k
0
votes
1
answer
257
views
Can Google see the screen when using Chrome Remote Desktop?
I was wondering if Google can see my computer screen while I'm using Chrome Remote Desktop.
Let's assume there's my main PC named A and my other PC named B.
PC B will have the Chrome extension ...
- 11
0
votes
0
answers
11
views
Site-specific account vs "single sign-on" for personal accounts?
The title of this question is a bit hard to word concisely, partially due to my own lack of terminology. What I am trying to ask is, when signing up for a service in a personal capacity (say Airbnb) ...
- 101
0
votes
1
answer
124
views
Doesn't 2FA increase the vulnerability of an account?
You create an account on an online service X with login=your email + password. Compare these 2 situations:
No 2FA enabled. The only risk is if your email is compromised: the "I lost my password&...
CommunityBot
- 1
0
votes
0
answers
37
views
Should I let administrator account bypass IP ACL?
Let's say there is a system that can set IP ACL for security.
If administrator can't bypass IP ACL, account may by locked up when machine or network IP changed
But if administrator can bypass IP ACL, ...
- 8,427
29
votes
7
answers
9k
views
Is it safe to store account credentials in an Excel sheet protected with a password?
Basically the title. For example, how bad is it to store passwords in an Excel sheet protected with a password, instead of storing passwords in Keypass or something else like Zoho Vault? Of course, ...
- 2,914