Questions tagged [account-security]
Security controls and features related to an end user's account with a web/mobile based application or an operating system.
496
questions
-1
votes
1answer
23 views
Privacy: why do I have to delete an account instead of simply no longer using it?
I try to avoid big internet companies (big tech) and try to find decentralized and/or open source alternatives.
I use a password manager with unique usernames and generated, complex passwords.
A lot ...
2
votes
1answer
59 views
Double JWT submit method
I'm implementing my JWT method by using the double submit method: where we separate the payload & header portion of the JWT from the signature.
The header & payload is stored in a separate ...
1
vote
1answer
68 views
How can one mitigate both account-level DOS attacks and online brute force attacks at the same time?
I was recently reading this question, where the accepted answer claims that it is easy for attackers to bypass rate limiting that is based on IP, which makes any sort of IP rate limiting to prevent a ...
1
vote
1answer
104 views
Password reset link vs Temporary password
Which is harder to exploit:
Password reset link with tokens/timestamps/code/ticket etc
Or, temporary password sent on user mail using which login can be done and password can be changed.
Any ...
0
votes
0answers
38 views
A website redirected me to “transreten[dot]com”, without my consent. How do I know whether my phone is infected or not? [closed]
I cannot tell whether or not the website has any virus issues, or if it has an effect on my information security.
1
vote
1answer
82 views
Do registration codes need expiry?
I work on an application where users are sent a unique registration code in the post. They use this, along with other personal information known to the user, to confirm the identity of the user upon ...
3
votes
2answers
307 views
Is storing a JWT secret as docker env variable acceptable?
I understand how JWTs work and that with my secret anyone can issue new tokens. I control the server that my node website runs on and am considering different options for hosting the key.
In code - ...
0
votes
1answer
50 views
Could modded versions of Kik messenger pose a security threat to other Kik users?
I was on the Kik messenger app, and someone in a group chat posted screenshots of his modded Kik app that contains an "IP grabber". He said he could hack people easily, and was very fast to tell me my ...
24
votes
1answer
9k views
False 'Security alert' from Google - every login generates mails from 'no-reply@accounts.google.com'
Every time I log in to Google with the same MacBook I get this email:
New device signed in to
example@gmail.com
Your Google Account was just signed in to from a new Mac device. You're getting ...
2
votes
1answer
264 views
Security of PIN that spells out words?
Description
PayPal suggests that generating a PIN by spelling words (on a numeric pad, e.g., [ABC] = 2) is a good method for security and memorability, e.g., B-L-U-E-C-O-W = 2583269.
My knowledge ...
0
votes
0answers
31 views
How Do Online Identiy Verification Companies Ensures Their APIs to Be Not Abused?
I am trying to implement a photo ID verification along with a live-selfie verification on my Android/iOS apps.
I figured that I might be able to implement these features using Python machine learning ...
0
votes
0answers
16 views
Does hashing client-side increase security when dealing with an untrustworthy server? [duplicate]
Does hashing once on clientside and once on server-side increase security when dealing with an untrustworthy server?
For example when dealing with open source projects where users can self-host their ...
5
votes
3answers
161 views
Is Using VPN Useful For Strictly Personal Use?
I understand the necessity of using VPN when connecting to the work network from the outside.
What I want to know is there any benefit for a strictly consumer computer that is connected to the ...
0
votes
1answer
84 views
school google account on my school computer
I'm logged into my school Google account at home. Can what I search at home on my own computer be checked by my school even though I'm not using their computers?
4
votes
2answers
501 views
Is it possible to mac-spoof Xfinity Wireless?
Background
Comcast/Xfinity operates various wireless hotspots across the US, accessed via the SSID xfinitywifi through the many wireless access points shown on https://hotspots.wifi.xfinity.com/
...
0
votes
3answers
119 views
E-Mail privacy proxy for hiding real e-mail?
Do E-Mail proxy services exists to improve privacy and security?
Privacy in the sense that one wouldn't need to give a website his/her username (possibly even in the firstname.lastname@domain.tld ...
1
vote
2answers
68 views
Quantify security strength from entropy and lifetime
Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
1
vote
0answers
294 views
How could a mobile banking app be hacked?
My phone got stolen, and sent back to where it was stolen a day after.
At the moment of stealing, the phone was locked. When I received it back, there was no money left in my bank account.
The ...
0
votes
1answer
86 views
Creating secure virtual machine that nobody can see its content including the host machine? [duplicate]
This problem is completely different from "running malware in a VM"! Suppose I want to have a virtual machine running some software with secret data. But I do not have complete control of the host ...
4
votes
1answer
2k views
non secure connection in youtube
I was browsing a while ago on youtube, I saw it shows an insecure connection even though it was over https.
I'm using ghostery and adblock to block trackers but nothing more, I don't think it's the ...
0
votes
1answer
81 views
Unknown Google Account Signed into Browser
An unknown Google account is signed into Firefox on my Arch Linux machine. The computer is in my apartment (where I live alone) and I lock the screen when I leave.
Some observations:
The unknown ...
0
votes
1answer
110 views
What happens if your Skype gets hacked? [closed]
Say that, although you did take into account all the security advices, your account ends up being hacked.
Then what happens?
Can they "jump" from Skype to the whole device?
To steal my contacts, ...
2
votes
2answers
424 views
BitLocker Recovery Key and Microsoft Account Password
I have a Windows 10 Pro machine; the administrator (and only) account is a Microsoft account. I am trying to set up BitLocker to ensure maximum security and safety, even from Microsoft.
I understand ...
1
vote
3answers
129 views
Downsides of allowing multiple emails per user?
There's lots of information on using one email for multiple accounts, but how about the other way around? I'm building a service and considering allowing users to log in with any of their registered ...
0
votes
1answer
64 views
jwt symmetric signature security risks (from client side)
I am currently implementing an iOS app, which integrates with a cloud hosted .net backend system in azure, which.
The api login endpoint takes user/pass -> replies with an signed only HS256 jwt token....
16
votes
3answers
4k views
Am I generating email link tokens correctly?
I am developing a reliable system for token generation and validation used mainly for links in confirmation emails (reset password request, change email flow, activate an account, etc...).
There are ...
2
votes
1answer
194 views
What are the security risks of resetting your password every time you login?
Is it a good idea in terms of security to reset your password every time you login and just fill your password with a bunch of random symbols, letters and words that you don't memorise?
Since ...
0
votes
0answers
43 views
Why ASP.Net Identity sends sensitive information to clients?
As far as I understand, Identity sends to the user an encrypted token with some user information like the user name and expiration date. Then, when a new request arrives to the server, it decrypts it ...
27
votes
8answers
9k views
Are there joint password accounts? (Like bank accounts)
Online joint accounts that are similar to bank accounts that are joint accounts?
Say you want to have two partners for a certain account, let's say a PayPal account, and you want to make it so that ...
2
votes
3answers
655 views
Is it secure to make my Threema ID public?
I've had Threema for a few days (a couple of friends forced me to buy it). It's pretty neat but I'm afraid that I'm not connected to everyone since my mail/phone-number data is pretty small or ...
1
vote
0answers
51 views
How is the ownership of a hacked account assigned back to the rightful owner, if the owner used made-up info to create the account?
Which information is utilized in the account recovery process, after an account hack, if all personal information used to create the account was made-up (such as a nickname) and it's impossible to ...
1
vote
1answer
60 views
Secure Windows 10 Home admin's data behind a password, even when user apps are running
Windows 10 Home's default account lock system for the admin account is not completely secure because there are multiple free password recovery tools & ways available that can be used by a non-...
0
votes
1answer
78 views
Account lockout for inexistant accounts
I am starting to implement an exponential backoff system to lockout accounts after a certain amount of failed attempts (1min after 5 fails, 2min after 10 fails, etc.). However, as this source suggests,...
9
votes
3answers
203 views
Is there a benefit to using a different email for every online account?
I have a domain email address which in addition to being able to create multiple mail accounts allows the creation of aliases for each inbox.
Is there any benefit to security in using a different ...
4
votes
1answer
132 views
Can the GlobalProtect VPN of my company track websites when Disabled?
I just installed the Global Protect VPN from my company on my local machine so I can access our servers remotely. I just "agreed" to the following statement:
VPN Connected
This system is for ...
0
votes
2answers
122 views
What's the safest password type? [closed]
I've used Dashline (password manager) with random generated passwords, but I forgot the master password and there is no way to get it back. I read that password managers and random generated passwords ...
0
votes
0answers
49 views
Is data stored on a standard mac user account considered secure from other users on that same local computer?
I'm trying to figure out if the data created by a Mac user on a local mac is truly secure from other users on that same mac. For example, on MacOS Catalina, I have three accounts:
Administrator
User ...
0
votes
1answer
96 views
How do I protect my info from apps like CallApp?
It appears to me that apps like Whoscall and CallApp might access your photos and such. In case of a potential data breach/hacking in one of these apps - how can I delete my info from their servers?
0
votes
1answer
142 views
Application design to avoid XSS & CSRF attacks
I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
-2
votes
1answer
61 views
I opened an http website from my email, how can I know if it's safe?
So, I have Google alerts set for a few words, and one of these alerts had a link to the site "chatsosedi.ru" which I opened. I found out the site isn't https. I clicked on it before realizing. Is it ...
4
votes
5answers
1k views
Do security questions make sense?
Is it a good practice, or is it obsolete? I'm asking because I've never managed to remember a single security question, thus I always write down the answers. I think they are useless, long passwords ...
0
votes
2answers
304 views
Can my oppressive government trace my Twitter activity and detect me?
I want to be active on Twitter against our oppressive government. Can my government trace and detect me?
Twitter is banned here and we must use VPNs. I use Outline (Shadowsocks) mostly. Is there any ...
0
votes
1answer
67 views
Why there are some weird requests to my web hosting [duplicate]
I was doing my plesk hosting logs checking for web and database development. Somehow, I had seen some weird ip trying to communicate to hosting. Wonder what is the purpose of these anonymous requests. ...
0
votes
0answers
38 views
Any security standards applicable to empty S3 buckets?
My employer has a lot of S3 buckets which are no longer used or are just sitting there empty. Cleaning them up would obviously reduce the attack surface and be less to monitor and secure, but that ...
85
votes
11answers
54k views
Why is client-side hashing of a password so uncommon?
There are very few websites that hash the users password before submitting it to the server. Javascript doesn't even have support for SHA or other algorithms.
But I can think of quite a few ...
0
votes
1answer
116 views
What should be done if 2FA was turned off in an unexpected manner?
Today when I logged in Facebook, no 2FA was shown.
I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
3
votes
1answer
454 views
How secure is IDology's ExpectID (as used on airbnb)?
To quote https://travel.stackexchange.com/a/72476/2928
I entered the last four digits of my SSN and provided basic DOB and full name. Then it asked me three security questions that only I would ...
1
vote
1answer
100 views
Risk of Docker backdoor allowing impersonation
I am a junior web developer. All I know is mostly about web development. I have no skills and knowledge about system security and know little about Linux.
I work in a company which is developing some ...
3
votes
1answer
195 views
Risks of allowing employees using personal GitHub accounts for work
Proprietary software developed by a (smallish) company is stored in the company's GitHub private repository. For work, software engineers are requested to create company-specific GitHub account bound ...
2
votes
1answer
164 views
Smartphone fingerprint plus iris scanning for login
I have often thought about the fact that when intimate relationship partners live together they eventually tend to sneak over your shoulder and gain access to your password on either your mobile phone ...
