Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
2
votes
2answers
112 views

How often, if at all, should I rotate my passwords?

In the course of my computer working I daily use dozens of username/passphrase pairs. Within the limits of my understanding and restrictions I apply the best practices for security. Unfortunately I ...
1
vote
0answers
60 views

Track HTTP(S) Network calls being made by an Android Device

I am planning to track the Network calls being made by apps and the website of an Android Device. I have used the Burp Suite tool for tracking the network calls. Until now the Android Device and the ...
1
vote
0answers
54 views

Are there any statistics about most common account thefts?

I am trying to evaluate how safe personal accounts are (including my own). Are there any statistics on the top security flaws which cause accounts to be compromised/stolen? Like: 25% of cases is ...
2
votes
0answers
76 views

How are github personal access tokens and other github auth for 3rd parties not a securty issue?

Many services integrate with github. Some of them seem to require a personal access token with "repo" permission. Personal access tokens are global across all projects. In other words you may want to ...
1
vote
0answers
59 views

Using uuidv4 in url to allow non registered users to refund purchases

I know reading that title probably made some of you gag, but let me explain the situation. I was tasked with creating a pretty straightforward storefront web app (php/laravel/stripe for payments) ...
-2
votes
1answer
62 views

Know location and IP address [closed]

Today someone tried to access my LinkedIn account. When I logged into my LinkedIn account, I received PIN by mail. So how can I know the location and IP address of the hacker?
1
vote
1answer
60 views

Do registration codes need expiry?

I work on an application where users are sent a unique registration code in the post. They use this, along with other personal information known to the user, to confirm the identity of the user upon ...
50
votes
4answers
7k views

Log user out after change of IP address?

Does it make sense to log a user out from a web service after the user's IP address is changed? I understand that a change of an IP address might indicate a man-in-the-middle attack. Then again IP ...
0
votes
0answers
11 views

Dockerfile - What user should be the owner for a mount point?

In the docker-compose file, below is the volumes instruction for builder service: builder: build: ../../ dockerfile: docker/dev/Dockerfile volumes: - ../../target:/wheelhouse volumes_from:...
61
votes
6answers
9k views

Is 2FA via mobile phone still a good idea when phones are the most exposed device?

Everyone knows that two factors are better than one. My problem is that often the only second factor allowed is text messages sent to your mobile phone. This creates two concerns: I travel frequently ...
0
votes
1answer
59 views

Creating a dummy account for account verification

I recently wanted to do some major changes to my account for an online game. So they wanted to do a thorough account verification. First they asked me for some character information which can be ...
1
vote
3answers
251 views

If no one knows a password, is there a reason to change it?

Scenario: A high level access account on a single machine, where the account is created by the system/application with a secure password, without exposing the password to a human or to any other ...
0
votes
0answers
28 views

Is User Account Login Related to BitLocker Encryption Key

When I enabled BitLocker on my system-drive, I wasn't asked to select an unlock-method. I didn't have to enter any new passwords/keys. I only selected a few options for the encryption, and the process ...
0
votes
1answer
81 views

Crack a single http cookie and gain access to a random user's account! [duplicate]

I was looking for lots of information about cookies recently. What attracted me the most was the fact that cookies come in all forms and can be hijacked through arp poisining and spoofing on the local ...
0
votes
0answers
50 views

Sony Access Log (Playstation Network) does not exists

Yesterday my wife receive some emails from Sony confirming her purchases on Playstation Network. The only problem is: she was with my side watching Netflix on the smart Tv. The purchased items is a ...
0
votes
1answer
48 views

Quantify security strength from entropy and lifetime

Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
1
vote
1answer
52 views

operating system requiring two or more users to access admin account

Suppose I'm designing a system where I want to make sure that no single user who goes rogue can commit a malicious action. (I'm ducking the question of how two or more users could collude.) And I ...
1
vote
1answer
101 views

What can a hacker do if I publish my email id and password but have 2FA on all of my accounts?

I have 2FA on ALL of my accounts. But my password was leaked in 7 breaches. Unfortunately I have used the same password for most of the accounts. Is it possible for him/her to bypass the 2FA?
2
votes
1answer
36 views

Known methods/techniques for thwarting credential phising attacks

Is the solution to preventing credential phising attacks is really only 'educating' people about it? For the sake of this question, let us assume that I have a web application that takes a username ...
1
vote
2answers
100 views

Is storing a JWT secret as docker env variable acceptable?

I understand how JWTs work and that with my secret anyone can issue new tokens. I control the server that my node website runs on and am considering different options for hosting the key. In code - ...
1
vote
0answers
50 views

Suspicious Android app - install on its own - no uninstall option - name in Japanese [closed]

I recently saw the app below in my phone. Have disabled it immediately when I saw it. Have no idea: what it is why it's in my phone how long it's been there and how to uninstall it (there's no ...
0
votes
0answers
26 views

Security risk of using a budgeting app connected to bank accounts [duplicate]

I've been tracking my budget the old way for a few years now by using excel spread sheets that have my checking account ledger, and monthly expenses broken down to categories. But I have noticed more ...
1
vote
0answers
71 views

I'm looking for an email provider like this [closed]

I am looking for email providers with the following conditions for privacy. email providers that: Are free. Do not require JavaScript or other credentials for registration. Provide an onion service. ...
3
votes
1answer
117 views

How to know if a web page is valid and not a man in the middle fake page?

Recently, the facebook page changed on my computer (on others from the same router, I get the regular page). I checked the ssl certificate, and it seems to be authentic, however, as the page does not ...
5
votes
4answers
302 views

Is revealing a PC account user name bad?

Typical computers with modern operating systems require log-on accounts with a user name and a password. Is it dangerous to reveal the user name of the log-on account to the public? My research: I ...
18
votes
3answers
6k views

Stolen MacBook: should I worry about my data?

Unfortunately, someone stole my laptop (a MacBook) and I did not realize that for 48 hours. Now, this was a work laptop and my company's security team is going to wipe the laptop remotely as soon as ...
2
votes
1answer
233 views

How do attacks on password locked accounts work?

A lot of questions here are about the safety of passwords e.g a Login Password to an account on site X. But how can attackers get in the account when they have to guess the passwords? I know there is ...
0
votes
0answers
75 views

How secure is passwordless and keyless SSH login on 127.0.0.1 only, over a secure authenticated tunnel?

I want to use CA signed SSH keys (that would be rotated frequently and have short expiry, ideally centrally managed, all that great stuff). Unfortunately, most of windows GUI tools, such as WinSCP or ...
0
votes
2answers
77 views

Is a web app vulnerable if it only uses session token in cookie to authenticate a user

I am new to bug hunting and i came across this website, so i came across this bug or atleast what i think is a bug so help me understand and tell me if i should consider it a vulnerability. The ...
1
vote
0answers
73 views

How to prevent phone number being searched online? [closed]

Recently, read an article about phone number being used to hack into one's account. NYTIMES-Phone hacking What needs to be done to prevent my phone number being searched? (Return invalid hyperlinks ...
0
votes
1answer
283 views

Why would I 'have been pwned' on a website that I never had an account on? [duplicate]

I was recently sent a notification by https://haveibeenpwned.com/ that one of my email addresses has been found in a breach, in particular in a breach of https://www.chegg.com. I am positive I never ...
1
vote
1answer
63 views

Why CORS is still securing an open api where all requests have a wildcard (*)?

In case of an open API, the only possible value for Access-Control-Allow-Origin is a wildcard (*), since you can't have a list of allowed domains. Still, this seems not to bug developpers and appears ...
0
votes
2answers
80 views

Is there any security reason for re-directing to the main/mobile page after login?

Scenario: User searches for something and gets a link to a sub-page on a site, proceeds to go there, but is asked to sign-up/login - they do so, only then once they are logged in, they are redirected ...
1
vote
1answer
93 views

Can not logout when the network is unreachable [duplicate]

I had checked youtube.com and stackoverflow.com. And found both of them can not log out if the network is unreachable. I think this is a security risk, right? Please image a situation below: I ...
513
votes
3answers
85k views

Why can I log in to my Facebook account with a misspelled email/password?

I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were ...
0
votes
2answers
77 views

What are the security practice or case studies for account lockouts?

We have a platform where users can sign up for free using their email addresses (they can also associate social media account). Other than the name, email and social account there no other personal ...
1
vote
1answer
84 views

AD user recreation, security issue

I have some users that prefer to create a new user account instead of resetting the password (or investigating why there is an issue with the account). Then delete the old account. I've personally ...
1
vote
5answers
216 views

Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN

I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
2
votes
1answer
48 views

How do I migrate my private key from one device to another in instant messaging app?

I was thinking about end-to-end encryption for my chat application, but I am struggling to understand how do I migrate my private keys from one device to another. One option I thought is to store ...
1
vote
1answer
94 views

Exchange sensitive information through public chat

Is there a way to exchange phone numbers/email addresses through public chats with a person without giving them or other communication information away to all the other people in the public chat? ...
0
votes
2answers
341 views

Could clicking a Grabify link to my Facebook page get me hacked?

My newest boyfriend sent me a Grabify link on Messenger. Without thinking (probably because of trusting him), I clicked the link (yeah, I'm an idiot, lol). The link has routed to my Facebook account. ...
0
votes
0answers
45 views

Is a trusted device, on a public network, still vulnerable to a man in the middle attack? [duplicate]

For example, if I am using my personal laptop on a public wifi, and type in the website I want to go to that includes HTTPS, (lets assume https://www.google.com/gmail/) can I reasonably trust that I'm ...
29
votes
6answers
5k views

The most secure way to handle someone forgetting to verify their account?

Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account. Suppose they forget to verify it, and later try to login. Should the error ...
1
vote
1answer
41 views

Having web client do requests with User's 3rd party API key?

I am trying to figure out the best way to do this. I have done some searching and all I have found is about storing API keys in a back end, nothing like my use-case where there is no back end. ...
2
votes
1answer
233 views

Is it insecure to not let a user choose their own username, and base the username on a known pattern?

I have recently changed banks and my new bank has a benefit scheme (discounts etc.) that has its own website and different login details to my online banking (I think the benefits system is ...
0
votes
1answer
102 views

Can 2FA keys be duplicated?

I want to order a 2FA key (like yubikey) online and I want to know if someone could make a duplicate of whatever key I order during shipping. I don't want to discuss if someone could access my package....
-5
votes
1answer
151 views

Is there some hidden worm attached with whatsapp messages that state forward this messgae to 20 people? [closed]

NOTE: I am New contributor, if the question needs some improvement please tell in comment before down voting! Usually I see messages on whatsapp and sometime on some other forums stating that forward ...
3
votes
0answers
121 views

Add another layer of security in accounts except phone number

I recently came across articles where an attacker contacted a telecom company and got them to change the sim card registered with the target's phone number. After doing so, he was able to reset the ...
0
votes
1answer
50 views

Why do we need token authentication?

If I'm creating an authorization service for my application, why can't I just hash the password and save the the username and hashed password in my User table? Why should I use a token authentication ...
1
vote
1answer
150 views

Do non-administrator Windows accounts need strong passwords?

I have always used long passphrases for my own Windows user accounts. But I know some people who use moderately common passwords (we'll say they're in the top 1,000 most used passwords, but not in the ...