We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
81
votes
11answers
50k views

Why is client-side hashing of a password so uncommon?

There are very few websites that hash the users password before submitting it to the server. Javascript doesn't even have support for SHA or other algorithms. But I can think of quite a few ...
65
votes
7answers
19k views

Is it unsafe to show message that username/account does not exist at login? [duplicate]

According to the OWASP Auth Guidelines, "An application should respond with a generic error message regardless of whether the user ID or password was incorrect. It should also give no indication to ...
14
votes
6answers
3k views

Is it safe to store 2FA tokens together with passwords in 1password?

I'm using 1password and I've seen 1password allows you to store 2FA tokens in the same place where you store the password. I don't like the idea of having everything in the same place as if someone ...
11
votes
2answers
544 views

Is it dangerous to delete my email account?

If I delete an email from a popular provider (Gmail), would it be possible for somebody to register a new email account under the same name and use it to steal my identity? For example, my email ...
88
votes
3answers
17k views

Google account verification request

Yesterday evening my android phone (Google Play Services app) asked me to log in again into my account due to "security changes" (I don't remember the exact wording used). I double checked it was the ...
512
votes
3answers
85k views

Why can I log in to my Facebook account with a misspelled email/password?

I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were ...
152
votes
5answers
13k views

What to do if stuck with website that has poor security?

I have a student loan account with a company, not the biggest company but big enough to where they should have their act together. Today I couldn't remember my password to log into my account ...
121
votes
8answers
20k views

Why is storing passwords in version control a bad idea?

My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?" I gave him an answer that ...
36
votes
4answers
6k views

What can I do if I discover that my password hash has been leaked in pastebin?

Entering my email at https://haveibeenpwned.com/, I was told that I have been pwned. I am in http://pastebin.com/SCLNRHJQ I already tried to find out my password by simply md5-hashing all my ...
12
votes
4answers
2k views

Gmail account hack prevention and recovery

I am doing a research on how to prevent my gmail account from being hacked and what are the options of claiming it back. The associated phone number and recovery email can be changed, in fact I ...
9
votes
4answers
9k views

Is encryption of passwords needed for an HTTPS website? [duplicate]

I am in a bit of confusion as we have been asked to AES encrypt passwords before sending it to the server. The whole website communicates over HTTPS with the server and uses secure cookies. AFAIK, ...
1
vote
2answers
44 views

Policy implications of changing passwords versus disabling accounts in Active Directory

Is there any guidance stating that the best way to handle leavers is to disable accounts (at least initially) instead of changing passwords? Given that AD supports this option I would assume this is ...
8
votes
2answers
195 views

Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process?

According to the Google information page here: https://support.google.com/accounts/answer/6103523 If you don’t have another second step or forgot your password Note: 2-Step Verification ...
2
votes
1answer
149 views

Two factor authentication: Why ask for password first? [duplicate]

Every website that I came across that uses two-factor authentication asks the user for their password first. Then, after a correct password was entered, an SMS or an e-mail is sent that contains ...
2
votes
5answers
442 views

Why should the *nix system administrator account (root) have a strong password if remote root logins are disabled?

It is a commonly accepted best security practice to disable remote root logins on *nix systems including Linux. Thus, in order to log in directly as root, you need to have physical access to a trusted ...
1
vote
5answers
216 views

Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN

I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
164
votes
4answers
39k views

GitLab account hacked and repo wiped

I was working on a project, a private repo, and suddenly all the commits disappeared and were replaced with a single text file saying To recover your lost code and avoid leaking it: Send us 0.1 ...
51
votes
5answers
6k views

Is it possible to detect security breaches as a user before they're announced?

I'm always concerned about the security of services I use. I'm even more concerned since security breaches have been happening more and more lately, and they always generate a lot of noise in the ...
23
votes
3answers
19k views

How to check if a Wi-Fi network is safe to connect to?

I always feel scared to connect to hotel, airport Wi-Fi etc. I feel that if the Wi-Fi router is hacked, my personal information can be collected by a hacker. How can I determine if a Wi-Fi network is ...
57
votes
7answers
15k views

Email received regarding Security flaw in website

I received an email to techsupport@websitename.com (pretty generic email) saying that there was a security flaw in my website etc. etc My initial reaction was that this was a scam. (How/why did they ...
68
votes
6answers
13k views

Can a malicious actor lock the real user out by deliberately trying incorrect passwords every X minutes?

Some websites lock out a user after a series of incorrect password attempts for example for 15 minutes. If a malicious actor knows this, can they deliberately try logging in with incorrect passwords ...
51
votes
7answers
11k views

Why does one need a strong password on Unix?

SSH Server: I only allow public key authentication. Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
17
votes
4answers
820 views

Help! My information has been stolen! What do I do now?

This is an attempt to ask a canonical question to expand upon another post with a similar name. The goal is to create something helpful that can be used as a duplicate when non experts ask about ...
11
votes
4answers
5k views

What's the best length for randomly generated passwords? (Security vs. compatibility)

It's generally recommend to use a unique password for each online service, a random password generator to create them and a password manager to store them. I've started to replace all my online ...
1
vote
0answers
204 views

What else can I do to protect my accounts? [closed]

I am trying to make sure all my accounts are secure from unauthorised access and have turned on all security measures that I can find to make sure my stuff is protected. Here is what I have in place: ...
1
vote
4answers
331 views

Can use this security system on websites?

I have created a password security system. I wanted to get your reviews about it and its technical problems. In this system, users create a dynamic password that will change every time they try to ...
12
votes
3answers
1k views

Steam and two-factor authentication

The Steam platform is designed to encourage users to use two-factor authentication. One of the community tasks (achievement-like objectives) on Steam is "Use the Steam Mobile App for two-factor ...
3
votes
1answer
177 views

A bot edited all pages on my Wordpress installation

I manage a Wordpress site for an event registration. The site is only active for a few months a year. The rest of the year it's idle, as in it's up, but not actively maintained. Now the time has come ...
3
votes
1answer
2k views

How to securely store and use 3rd party API Keys?

I've seen a few questions here with similar concerns but i felt like this specific question wasn't asked or replied to, so I'll try my best to illustrate my case here. The problem: The platform I'm ...
3
votes
2answers
318 views

How to secure/cleanup my accounts after having an old email account breached

I have two email accounts. My main one that I created a few years ago and switched to, which has a very strong/unique password that is not written down or stored anywhere. It also has 2-factor auth ...
2
votes
4answers
208 views

Is it possible to create a truly private user account in a public computer?

In my college computer that runs Windows 7 Professional SP1 I have an administrator account. I have full access to the entire computer and the files of every other account that's signed up. The ...
2
votes
1answer
233 views

How do attacks on password locked accounts work?

A lot of questions here are about the safety of passwords e.g a Login Password to an account on site X. But how can attackers get in the account when they have to guess the passwords? I know there is ...
0
votes
2answers
161 views

Private Google account at work

I have an old private tablet at work with my private Google account on it .It's connected to our WiFi, where i logged in with my personal working code. Never use it much as I just play some music on ...
0
votes
1answer
2k views

Is it okay to save passwords as base64 strings with no other hashing or encryption beforehand?

I've just inherited a project where all the passwords on the server side are simply converted to base64 and put in the database. No salt, no hash, nothing. Just a simple db.Add(password.ToBase64) kind ...