Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
103 votes
12 answers
70k views

Why is client-side hashing of a password so uncommon?

There are very few websites that hash the users password before submitting it to the server. Javascript doesn't even have support for SHA or other algorithms. But I can think of quite a few ...
user avatar
  • 1,143
77 votes
7 answers
29k views

Is it unsafe to show message that username/account does not exist at login? [duplicate]

According to the OWASP Auth Guidelines, "An application should respond with a generic error message regardless of whether the user ID or password was incorrect. It should also give no indication to ...
user avatar
  • 888
32 votes
6 answers
10k views

Is it safe to store 2FA tokens together with passwords in 1password? [duplicate]

I'm using 1password and I've seen 1password allows you to store 2FA tokens in the same place where you store the password. I don't like the idea of having everything in the same place as if someone ...
user avatar
553 votes
3 answers
98k views

Why can I log in to my Facebook account with a misspelled email/password?

I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were ...
user avatar
  • 3,605
12 votes
2 answers
3k views

Is it dangerous to delete my email account?

If I delete an email from a popular provider (Gmail), would it be possible for somebody to register a new email account under the same name and use it to steal my identity? For example, my email ...
user avatar
  • 271
5 votes
2 answers
2k views

I woke up and my email has been signed up to hundreds of online services. How can I fix this?

I woke up this morning to over 900 emails of several online services asking to confirm I’ve made an account. Last month my email had been compromised and they managed to get into my eBay and Amazon ...
user avatar
26 votes
3 answers
33k views

How to check if a Wi-Fi network is safe to connect to?

I always feel scared to connect to hotel, airport Wi-Fi etc. I feel that if the Wi-Fi router is hacked, my personal information can be collected by a hacker. How can I determine if a Wi-Fi network is ...
user avatar
89 votes
3 answers
18k views

Google account verification request

Yesterday evening my android phone (Google Play Services app) asked me to log in again into my account due to "security changes" (I don't remember the exact wording used). I double checked it was the ...
user avatar
  • 1,941
4 votes
5 answers
586 views

Why should the *nix system administrator account (root) have a strong password if remote root logins are disabled?

It is a commonly accepted best security practice to disable remote root logins on *nix systems including Linux. Thus, in order to log in directly as root, you need to have physical access to a trusted ...
user avatar
  • 7,670
2 votes
1 answer
2k views

Should I be worried by an email which said my account was under attack? [duplicate]

So, today I received an email in my Gmail account which landed automatically in the spam folder. This was the email content: Hi! As you may have noticed, I sent you an email from your account. ...
user avatar
2 votes
3 answers
443 views

To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?

I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
user avatar
  • 131
153 votes
5 answers
13k views

What to do if stuck with website that has poor security?

I have a student loan account with a company, not the biggest company but big enough to where they should have their act together. Today I couldn't remember my password to log into my account ...
user avatar
  • 1,796
127 votes
8 answers
26k views

Why is storing passwords in version control a bad idea?

My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?" I gave him an answer that ...
user avatar
  • 6,514
96 votes
6 answers
56k views

Why would someone open a Netflix account using my Gmail address?

This is something that happened to me a few months ago. I don't know if it is a hack attempt, although I can't think of any way that there could be any danger or any personal information gained. I ...
user avatar
37 votes
4 answers
7k views

What can I do if I discover that my password hash has been leaked in pastebin?

Entering my email at https://haveibeenpwned.com/, I was told that I have been pwned. I am in http://pastebin.com/SCLNRHJQ I already tried to find out my password by simply md5-hashing all my ...
user avatar
  • 2,143
50 votes
4 answers
9k views

Log user out after change of IP address?

Does it make sense to log a user out from a web service after the user's IP address is changed? I understand that a change of an IP address might indicate a man-in-the-middle attack. Then again IP ...
user avatar
14 votes
5 answers
2k views

Gmail account hack prevention and recovery

I am doing a research on how to prevent my gmail account from being hacked and what are the options of claiming it back. The associated phone number and recovery email can be changed, in fact I ...
user avatar
11 votes
4 answers
16k views

Is encryption of passwords needed for an HTTPS website? [duplicate]

I am in a bit of confusion as we have been asked to AES encrypt passwords before sending it to the server. The whole website communicates over HTTPS with the server and uses secure cookies. AFAIK, ...
user avatar
1 vote
3 answers
306 views

Why is it not recommended to permanently use the root account for all tasks?

Yes, I did read this answer: https://apple.stackexchange.com/questions/192365/is-it-ok-to-use-the-root-user-as-a-normal-user/192422#192422 But I still fail to understand the reasoning behind this ...
user avatar
  • 5,607
1 vote
2 answers
93 views

Policy implications of changing passwords versus disabling accounts in Active Directory

Is there any guidance stating that the best way to handle leavers is to disable accounts (at least initially) instead of changing passwords? Given that AD supports this option I would assume this is ...
user avatar
9 votes
2 answers
353 views

Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process?

According to the Google information page here: https://support.google.com/accounts/answer/6103523 If you don’t have another second step or forgot your password Note: 2-Step Verification requires an ...
user avatar
  • 220
5 votes
5 answers
3k views

Do security questions make sense?

Is it a good practice, or is it obsolete? I'm asking because I've never managed to remember a single security question, thus I always write down the answers. I think they are useless, long passwords ...
user avatar
2 votes
1 answer
307 views

Two factor authentication: Why ask for password first? [duplicate]

Every website that I came across that uses two-factor authentication asks the user for their password first. Then, after a correct password was entered, an SMS or an e-mail is sent that contains ...
user avatar
  • 149
1 vote
5 answers
313 views

Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN

I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
user avatar
  • 1,319
0 votes
1 answer
453 views

Is using HOTP only authorization considered weak?

I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes. I fully understand 2FA is more secure than Single Authorization, but it is also more inconvenient for a ...
user avatar
  • 217
0 votes
1 answer
321 views

QR Code Security Testing [closed]

Within the scope of a project for my client, I test the existing site and the project for security vulnerabilities using OWASP ZAP. The client uses invitations with QR Codes and QR Codes to login to ...
user avatar
  • 131
173 votes
4 answers
44k views

GitLab account hacked and repo wiped

I was working on a project, a private repo, and suddenly all the commits disappeared and were replaced with a single text file saying To recover your lost code and avoid leaking it: Send us 0.1 ...
user avatar
  • 1,113
84 votes
7 answers
21k views

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

I did some research about how secure and private SMS messages are. Providers and governments can see these SMS messages in plaintext, but what is weird is that these messages are not encrypted in ...
user avatar
115 votes
13 answers
28k views

Is it good or bad practice to allow a user to change their username?

I have looked all over online as well as this site to try to find out more information regarding the security of this, but haven't found anything. In my particular case, the product is a website, but ...
user avatar
  • 1,051
142 votes
24 answers
25k views

Why can't I just let customers connect directly to my database?

I'm pretty sure this is a stupid idea but I'd like to know why, so bear with me for a moment. Lots of the work backend developers do is providing CRUD access to customers via HTTP, essentially mapping ...
user avatar
51 votes
5 answers
6k views

Is it possible to detect security breaches as a user before they're announced?

I'm always concerned about the security of services I use. I'm even more concerned since security breaches have been happening more and more lately, and they always generate a lot of noise in the ...
user avatar
  • 9,490
58 votes
7 answers
25k views

Email received regarding Security flaw in website

I received an email to techsupport@websitename.com (pretty generic email) saying that there was a security flaw in my website etc. etc My initial reaction was that this was a scam. (How/why did they ...
user avatar
  • 695
36 votes
8 answers
12k views

Why use random characters in passwords?

I've seen some similar questions but maybe not exactly what I'm asking. Also I can't say that I've followed all the technical jargon in previous posts and am really after more of an intuitive ...
user avatar
70 votes
6 answers
14k views

Can a malicious actor lock the real user out by deliberately trying incorrect passwords every X minutes?

Some websites lock out a user after a series of incorrect password attempts for example for 15 minutes. If a malicious actor knows this, can they deliberately try logging in with incorrect passwords ...
user avatar
  • 865
63 votes
6 answers
10k views

Is 2FA via mobile phone still a good idea when phones are the most exposed device?

Everyone knows that two factors are better than one. My problem is that often the only second factor allowed is text messages sent to your mobile phone. This creates two concerns: I travel frequently ...
user avatar
52 votes
6 answers
11k views

Why does one need a strong password on Unix?

SSH Server: I only allow public-key authentication. Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
user avatar
  • 819
12 votes
4 answers
8k views

How To Recover End-To-End Encrypted Data After Losing Private Key?

I'm creating a mobile app which has chat feature in it. Since I wanted to make it secure, I'll do some encryption to messages and the data. I'm thinking of using End-To-End encryption for it but I've ...
user avatar
  • 247
19 votes
4 answers
1k views

Help! My information has been stolen! What do I do now?

This is an attempt to ask a canonical question to expand upon another post with a similar name. The goal is to create something helpful that can be used as a duplicate when non experts ask about ...
user avatar
76 votes
10 answers
29k views

Bank wants my Online-banking PIN through the telephone

My new girocard did not reach me. I wanted to call the bank to block the old and get a new one. So I checked my online banking and found a phone number ("Block card: girocard or visa card lost? Call ...
user avatar
  • 2,143
3 votes
1 answer
1k views

CSRF double submit cookie pattern questions

I have some questions about CSRF protection, specifically about the "double submit cookie" pattern. What I have learned so far, is that this pattern has some weaknesses. But we can add some ...
user avatar
  • 31
16 votes
2 answers
11k views

How safe is it to store your passwords in a modern browser?

There's a few questions here along these same lines already, but they're nearly a decade old. I'd like to know if things have changed, especially now that Chrome has become more aggressive about ...
user avatar
13 votes
4 answers
7k views

What's the best length for randomly generated passwords? (Security vs. compatibility)

It's generally recommend to use a unique password for each online service, a random password generator to create them and a password manager to store them. I've started to replace all my online ...
user avatar
12 votes
3 answers
2k views

Steam and two-factor authentication

The Steam platform is designed to encourage users to use two-factor authentication. One of the community tasks (achievement-like objectives) on Steam is "Use the Steam Mobile App for two-factor ...
user avatar
  • 223
1 vote
1 answer
460 views

Why must I register a new phone for 2FA services? The number is the same, isn't that enough?

I have a smartphone and I use 2FA to log in to several services - bank, github, world of warcraft, etc. If I were ever to lose/destroy my phone without making prior arrangements for account recovery ...
user avatar
1 vote
5 answers
420 views

Can use this security system on websites?

I have created a password security system. I wanted to get your reviews about it and its technical problems. In this system, users create a dynamic password that will change every time they try to ...
user avatar
1 vote
0 answers
243 views

What else can I do to protect my accounts? [closed]

I am trying to make sure all my accounts are secure from unauthorised access and have turned on all security measures that I can find to make sure my stuff is protected. Here is what I have in place: ...
user avatar
  • 1,177
0 votes
2 answers
630 views

Private Google account at work

I have an old private tablet at work with my private Google account on it .It's connected to our WiFi, where i logged in with my personal working code. Never use it much as I just play some music on ...
user avatar
0 votes
1 answer
267 views

school google account on my school computer

I'm logged into my school Google account at home. Can what I search at home on my own computer be checked by my school even though I'm not using their computers?
user avatar
-1 votes
1 answer
129 views

Security technologies that implements security through "organic-like" obscurity? [closed]

Are there any advanced security technologies, for example, establishing a secured connection, which first require authentication based on security through organic-like changing obscurity of secrecy? I'...
user avatar
  • 1
6 votes
2 answers
402 views

What is the safest Google account recovery option?

I have a Google account with a strong password and 2-factor authentication set up, and I worry about what would happen if I lost my phone with the 2FA app. I want to set up a recovery option, and I ...
user avatar
  • 1,905