Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
85
votes
11answers
54k views

Why is client-side hashing of a password so uncommon?

There are very few websites that hash the users password before submitting it to the server. Javascript doesn't even have support for SHA or other algorithms. But I can think of quite a few ...
65
votes
7answers
21k views

Is it unsafe to show message that username/account does not exist at login? [duplicate]

According to the OWASP Auth Guidelines, "An application should respond with a generic error message regardless of whether the user ID or password was incorrect. It should also give no indication to ...
17
votes
6answers
4k views

Is it safe to store 2FA tokens together with passwords in 1password?

I'm using 1password and I've seen 1password allows you to store 2FA tokens in the same place where you store the password. I don't like the idea of having everything in the same place as if someone ...
12
votes
2answers
619 views

Is it dangerous to delete my email account?

If I delete an email from a popular provider (Gmail), would it be possible for somebody to register a new email account under the same name and use it to steal my identity? For example, my email ...
528
votes
3answers
89k views

Why can I log in to my Facebook account with a misspelled email/password?

I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were ...
88
votes
3answers
17k views

Google account verification request

Yesterday evening my android phone (Google Play Services app) asked me to log in again into my account due to "security changes" (I don't remember the exact wording used). I double checked it was the ...
151
votes
5answers
13k views

What to do if stuck with website that has poor security?

I have a student loan account with a company, not the biggest company but big enough to where they should have their act together. Today I couldn't remember my password to log into my account ...
123
votes
8answers
21k views

Why is storing passwords in version control a bad idea?

My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?" I gave him an answer that ...
36
votes
4answers
6k views

What can I do if I discover that my password hash has been leaked in pastebin?

Entering my email at https://haveibeenpwned.com/, I was told that I have been pwned. I am in http://pastebin.com/SCLNRHJQ I already tried to find out my password by simply md5-hashing all my ...
12
votes
4answers
2k views

Gmail account hack prevention and recovery

I am doing a research on how to prevent my gmail account from being hacked and what are the options of claiming it back. The associated phone number and recovery email can be changed, in fact I ...
9
votes
4answers
11k views

Is encryption of passwords needed for an HTTPS website? [duplicate]

I am in a bit of confusion as we have been asked to AES encrypt passwords before sending it to the server. The whole website communicates over HTTPS with the server and uses secure cookies. AFAIK, ...
1
vote
2answers
45 views

Policy implications of changing passwords versus disabling accounts in Active Directory

Is there any guidance stating that the best way to handle leavers is to disable accounts (at least initially) instead of changing passwords? Given that AD supports this option I would assume this is ...
9
votes
2answers
218 views

Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process?

According to the Google information page here: https://support.google.com/accounts/answer/6103523 If you don’t have another second step or forgot your password Note: 2-Step Verification ...
2
votes
5answers
452 views

Why should the *nix system administrator account (root) have a strong password if remote root logins are disabled?

It is a commonly accepted best security practice to disable remote root logins on *nix systems including Linux. Thus, in order to log in directly as root, you need to have physical access to a trusted ...
2
votes
1answer
160 views

Two factor authentication: Why ask for password first? [duplicate]

Every website that I came across that uses two-factor authentication asks the user for their password first. Then, after a correct password was entered, an SMS or an e-mail is sent that contains ...
1
vote
5answers
225 views

Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN

I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
166
votes
4answers
40k views

GitLab account hacked and repo wiped

I was working on a project, a private repo, and suddenly all the commits disappeared and were replaced with a single text file saying To recover your lost code and avoid leaking it: Send us 0.1 ...
51
votes
5answers
6k views

Is it possible to detect security breaches as a user before they're announced?

I'm always concerned about the security of services I use. I'm even more concerned since security breaches have been happening more and more lately, and they always generate a lot of noise in the ...
25
votes
3answers
22k views

How to check if a Wi-Fi network is safe to connect to?

I always feel scared to connect to hotel, airport Wi-Fi etc. I feel that if the Wi-Fi router is hacked, my personal information can be collected by a hacker. How can I determine if a Wi-Fi network is ...
57
votes
7answers
16k views

Email received regarding Security flaw in website

I received an email to techsupport@websitename.com (pretty generic email) saying that there was a security flaw in my website etc. etc My initial reaction was that this was a scam. (How/why did they ...
91
votes
5answers
38k views

Why would someone open a Netflix account using my Gmail address?

This is something that happened to me a few months ago. I don't know if it is a hack attempt, although I can't think of any way that there could be any danger or any personal information gained. I ...
69
votes
6answers
13k views

Can a malicious actor lock the real user out by deliberately trying incorrect passwords every X minutes?

Some websites lock out a user after a series of incorrect password attempts for example for 15 minutes. If a malicious actor knows this, can they deliberately try logging in with incorrect passwords ...
51
votes
7answers
11k views

Why does one need a strong password on Unix?

SSH Server: I only allow public key authentication. Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
18
votes
4answers
840 views

Help! My information has been stolen! What do I do now?

This is an attempt to ask a canonical question to expand upon another post with a similar name. The goal is to create something helpful that can be used as a duplicate when non experts ask about ...
12
votes
3answers
1k views

Steam and two-factor authentication

The Steam platform is designed to encourage users to use two-factor authentication. One of the community tasks (achievement-like objectives) on Steam is "Use the Steam Mobile App for two-factor ...
11
votes
4answers
5k views

What's the best length for randomly generated passwords? (Security vs. compatibility)

It's generally recommend to use a unique password for each online service, a random password generator to create them and a password manager to store them. I've started to replace all my online ...
1
vote
0answers
206 views

What else can I do to protect my accounts? [closed]

I am trying to make sure all my accounts are secure from unauthorised access and have turned on all security measures that I can find to make sure my stuff is protected. Here is what I have in place: ...
1
vote
4answers
336 views

Can use this security system on websites?

I have created a password security system. I wanted to get your reviews about it and its technical problems. In this system, users create a dynamic password that will change every time they try to ...
4
votes
5answers
1k views

Do security questions make sense?

Is it a good practice, or is it obsolete? I'm asking because I've never managed to remember a single security question, thus I always write down the answers. I think they are useless, long passwords ...
3
votes
1answer
2k views

How to securely store and use 3rd party API Keys?

I've seen a few questions here with similar concerns but i felt like this specific question wasn't asked or replied to, so I'll try my best to illustrate my case here. The problem: The platform I'm ...
3
votes
2answers
341 views

How to secure/cleanup my accounts after having an old email account breached

I have two email accounts. My main one that I created a few years ago and switched to, which has a very strong/unique password that is not written down or stored anywhere. It also has 2-factor auth ...
3
votes
1answer
178 views

A bot edited all pages on my Wordpress installation

I manage a Wordpress site for an event registration. The site is only active for a few months a year. The rest of the year it's idle, as in it's up, but not actively maintained. Now the time has come ...
2
votes
1answer
1k views

Should I be worried by an email which said my account was under attack? [duplicate]

So, today I received an email in my Gmail account which landed automatically in the spam folder. This was the email content: Hi! As you may have noticed, I sent you an email from your account. ...
2
votes
1answer
258 views

How do attacks on password locked accounts work?

A lot of questions here are about the safety of passwords e.g a Login Password to an account on site X. But how can attackers get in the account when they have to guess the passwords? I know there is ...
2
votes
4answers
212 views

Is it possible to create a truly private user account in a public computer?

In my college computer that runs Windows 7 Professional SP1 I have an administrator account. I have full access to the entire computer and the files of every other account that's signed up. The ...
1
vote
1answer
3k views

Is it okay to save passwords as base64 strings with no other hashing or encryption beforehand?

I've just inherited a project where all the passwords on the server side are simply converted to base64 and put in the database. No salt, no hash, nothing. Just a simple db.Add(password.ToBase64) kind ...
0
votes
2answers
225 views

Private Google account at work

I have an old private tablet at work with my private Google account on it .It's connected to our WiFi, where i logged in with my personal working code. Never use it much as I just play some music on ...