Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
-3 votes
0 answers
38 views

Can my employer still access my account after signing out from work pc and switching passwords?

I logged into a private google account on a work laptop. I switched passwords and anything a few seconds later. Could my employer still see and access new activity on my google account even though I ...
user avatar
  • 11
0 votes
0 answers
29 views

Can my employer see my private google account history when just logging in and out in a matter of 10 seconds on a work laptop (REPOSTED)

So I did this post before on a guest account but I had further questions so now I'm posing it on a real one. Can my employer see my private google history/”google activity” if I didn’t do anything on ...
user avatar
  • 11
0 votes
0 answers
3 views

Windows log : identify difference between desktop login and UAC login [migrated]

Our desktop support team grants everyone an account for daily activities in the company, and also grands a local administrator account for specific people (mostly developers) so they can install ...
user avatar
  • 225
0 votes
0 answers
51 views

Finding Public Ip Address of security camera [migrated]

I have installed my home security camera and it's run on 192.168.192.2 localhost and is accessible through android apps. But I would like to know what the public IP address of this camera is so I can ...
user avatar
28 votes
3 answers
8k views

Someone created a Disney+ account with my e-mail address. Are there any security concerns?

I got an Email (to my iCloud address) from Disney+. The email contained a subscriber agreement. I did not register for their service myself. On the Disney+ website I saw that there was indeed an ...
user avatar
  • 291
0 votes
2 answers
42 views

Does showing the permission level of an account to all users a bad security practice?

On my school website I can list all existing accounts in the system to send them a message. Each account has a logo showing the user role (admin, professor or student) and I can directly filter on it. ...
user avatar
0 votes
1 answer
48 views

Google Login vs. Username + Password

Is a Google login actually any more secure than a username and password login? Assuming the username + password uses encrypted passwords in the DB and a 1 week access token, I don't really see how it ...
user avatar
  • 142
0 votes
0 answers
22 views

SpringBoot Web Application Security for apis working on static token?

I have one Spring boot Web application which has few apis facing internet, deployed on aws, they work on JWT token, they're fairly secure. But there are few apis that work on static token validation. ...
user avatar
  • 1
1 vote
0 answers
83 views

Displaying a user's password in plaintext on login pages. Why is this practice becoming more widespread? [duplicate]

Over the years I've noticed that more and more login pages implement an eye icon next to the password field, that on click toggles between hidden and plaintext view of the password typed in that field....
user avatar
  • 111
0 votes
0 answers
45 views

How this JSON object can be exploitable?

I was reading this documentation https://cheatsheetseries.owasp.org/cheatsheets/AJAX_Security_Cheat_Sheet.html#server-side One of the security recommendation is - Always return JSON with an Object on ...
user avatar
0 votes
1 answer
81 views

How could attacker know user names of my Google Workspace? [closed]

I found in my Google admin logs that someone from outside my organization is trying to log in frequently by testing all our user accounts against weak passwords. I'm wondering how could that happen? ...
user avatar
  • 109
0 votes
0 answers
14 views

Leaving half open or full open connection having SYN cookie

Suppose an attacker collects a large number of initial sequence numbers sent by the server. Can the attacker cause the server to create many fully open connections by sending ACKs with those initial ...
user avatar
0 votes
0 answers
10 views

Creating half open or full open connection in presence of SYN cookie

Suppose an attacker knows that a target host uses SYN cookies. Can the attacker create half-open or fully open connections by simply sending an ACK packet to the target? Why or why not?
user avatar
0 votes
0 answers
62 views

Using someone else's SSL certificate [duplicate]

As far as I know, the SSL certificate is public and anyone can read it. Is it possible in this case, for example, when someone, having copied the SSL certificate of my bank for himself, will be able ...
user avatar
  • 9
0 votes
1 answer
73 views

Passing the session ID of an unauthenticated user to a valid session using Burp

I am passing the Cookie header of a valid authenticated, high privileged user to the unauthenticated or low privileged user using Autorize (Burp Extension). So ideally, the Autorize says the requests ...
user avatar
0 votes
0 answers
44 views

Rails API Session Security and CSRF

I am doing an api with Rails(api-only). Security is so importand for me. I got 2 question. 1-) I am keeping user's id in session[:authID], is it safe to use like this? 2-) Do i need CSRF protection ...
user avatar
  • 1
0 votes
1 answer
86 views

Voice input as security measures for system authentication

Can voice input as a password be a useful security measure as an alternative to a strong password and biometrics (face, thumb, signature etc)? The voice inputted as a password will be saved as a sound ...
user avatar
1 vote
0 answers
25 views

Obfuscate account availability during creation or not?

My partner and I are arguing about our auth system. They believe that obfuscating the existence of another account (by showing a generic error) is preferable to surfacing an error warning about ...
user avatar
0 votes
0 answers
36 views

Just got "Find My Device located this device" notification - but I didn't try to locate it and I'm login only at that Android device and my closed PC

This is weird - I've checked my Google account and I'm only logged in at my Android device, my PC (which was closed at the time of the msg.), and Chromecast device. Couldn't find anywhere any ...
user avatar
0 votes
0 answers
64 views

Outlook - Windows Security Pop Up Never Goes Away. Potential Compromise?

I have a user who has reported that they are getting a Windows Security pop up from Outlook that keeps showing up even after clicking Cancel and signing out/in shown below Luckily, the user didn't ...
user avatar
  • 133
0 votes
1 answer
25 views

Prevent client access being the same as admin access in web application

My colleagues and I are developing a public web application with client and admin access. I'm concerned about security, being the application public. I would like to add every layer, as long as it's ...
user avatar
0 votes
0 answers
165 views

Windows hello pin removal/crack

Is there a workaround to the Windows 10 Hello PIN security login policy? The PIN is the only credential needed to log in, no password is set, checked with samdump2. I inherited this computer from a ...
user avatar
  • 1
0 votes
1 answer
257 views

Can Google see the screen when using Chrome Remote Desktop?

I was wondering if Google can see my computer screen while I'm using Chrome Remote Desktop. Let's assume there's my main PC named A and my other PC named B. PC B will have the Chrome extension ...
user avatar
  • 1
0 votes
0 answers
11 views

Site-specific account vs "single sign-on" for personal accounts?

The title of this question is a bit hard to word concisely, partially due to my own lack of terminology. What I am trying to ask is, when signing up for a service in a personal capacity (say Airbnb) ...
user avatar
  • 101
0 votes
1 answer
124 views

Doesn't 2FA increase the vulnerability of an account?

You create an account on an online service X with login=your email + password. Compare these 2 situations: No 2FA enabled. The only risk is if your email is compromised: the "I lost my password&...
user avatar
  • 3
0 votes
1 answer
34 views

Will Lastpass ignore old 2FA tokens from the Yubikey? (tokens leaked accidentally)

Somestimes I press on my yubikey accidentally and it writes the token on the screen and even sends automatically to the person I'm talking to on some chat, because it presses enter. This happened ...
user avatar
0 votes
0 answers
37 views

Should I let administrator account bypass IP ACL?

Let's say there is a system that can set IP ACL for security. If administrator can't bypass IP ACL, account may by locked up when machine or network IP changed But if administrator can bypass IP ACL, ...
user avatar
6 votes
2 answers
566 views

Friend's Instagram account repeatedly hacked despite changing all information and enabling 2FA

My friends Instagram account has repeatedly been hacked. Someone is gaining access to her account, proceeding to change all the security information to lock her out. Then posts scam ads on her account....
user avatar
29 votes
7 answers
9k views

Is it safe to store account credentials in an Excel sheet protected with a password?

Basically the title. For example, how bad is it to store passwords in an Excel sheet protected with a password, instead of storing passwords in Keypass or something else like Zoho Vault? Of course, ...
user avatar
  • 393
1 vote
1 answer
91 views

How to set up a restricted account for reverse SSH port forwarding in a safe way?

I have a server (M: Main) that I trust very much (I have it home, locked, with an alarm, etc), to which I can SSH from the internet. I also have a number of "remote servers" and "IoT ...
user avatar
  • 255
39 votes
8 answers
6k views

Can the manufacturer remotely turn off my device?

In connection with recent events, I, as an ordinary citizen of Russia, wonder - can smartphone manufacturers (Google, Apple, Huawei, etc.) or any another (such as Microsoft, Cisco etc) remotely turn ...
user avatar
0 votes
0 answers
41 views

AWS IAM Access Issue

We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is just erring or ...
user avatar
0 votes
0 answers
13 views

How to verify the reliability of the request (impersonation)?

I'm using JWT for authentication and I use HTTPS. For every request that is made to the server has a header with bearer Token which has an access token. To retrieve my user info Page I have coded my ...
user avatar
0 votes
1 answer
79 views

How to send JWT Access token with requests without being sniffed?

I'm trying to create a mobile app which helps to connect with my mobile app. While going through authentication I used JWT. While authenticating it, it returns access token and refresh token to the ...
user avatar
1 vote
2 answers
63 views

Non-repudiation of customer data

For our web application we are maintaining some data, pertaining to our subscribers, on our server. Some of this data is sensitive and we would like to implement some "security measures" ...
user avatar
  • 111
0 votes
0 answers
52 views

Android Keychain: How to restrict the system-wide credentials based on the app developer or manufacturer only?

As I have been reading about the Android Keychain API, I have been particularly concerned about whether or not Android provides a way to restrict the keys installed as part of Keychain API to certain ...
user avatar
1 vote
0 answers
72 views

Is it necessary to have keep these 4 accounts separate from password manager?

Microsoft Authenticator requires an: Outlook account Verification account iCloud account The first two are required to set up the authenticator on a new device, the latter stores all the data to be ...
user avatar
  • 9
0 votes
0 answers
107 views

Can my school see what I searched for while logged in?

I'm on my laptop at home and I wasn't logged into any Google account but I was on my school's Microsoft account. Can the school still see my searches?
user avatar
  • 1
1 vote
3 answers
277 views

Is there really any benefit in having a separate local admin account

I have been thinking of implementing a new practice where local admin privileges are disabled entirely from all endpoints. For users who need to elevate privileges, they will have a separate admin ...
user avatar
0 votes
0 answers
49 views

Google Password I didn't create

I opened Google, and a popup occurred briefly before I reflexively closed it. I then realized it had said something about a new password saved to the Google Password Manager, I think - which is weird,...
user avatar
  • 111
0 votes
0 answers
56 views

Red Hat Password Security Settings(/etc/pam.d/system-auth, /etc/login.defs)

I'm doing Red Hat (RHEL 6.5) security settings. If I set up the two files as shown below, is there no security effect on each other? /etc/pam.d/system-auth password requisite pam_cracklib.so retry=3 ...
user avatar
1 vote
0 answers
84 views

Your opinion on my encryption security concept for my mobile app using Firebase and an external backend server? [closed]

I'm brainstorming a good architecture that allows me to store user generated data from my mobile app securely on my backend server, without forcing the user to remember an encryption password. The ...
user avatar
19 votes
3 answers
3k views

Should I visit a website of a popular company if the browser warns of a potential security risk?

I have faced this situation several times. Some websites are presented as a potential security risk. Should I continue to browse such a webpage? I am attaching one example, just an example. Actually I ...
user avatar
  • 291
0 votes
1 answer
51 views

Basic explanation for why I'm getting different IP addresses when querying for users IP W/without VPN?

I'm trying to work out some basic knowledge of rate-limiting for my server security so I know how it works. Seems pretty simple as there are different algorithms as well as IP limiting methods. This ...
user avatar
  • 117
0 votes
2 answers
121 views

Someone accessed my phone application in Android 10 and dialled some codes to do some transactions while I was using the Tor browser [closed]

I was accessing some sites with the Tor browser. I got the URLs from some site and was hitting them one by one just to explore. Suddenly pages stopped responding but the internet was working fine. ...
user avatar
0 votes
2 answers
2k views

Unknown numbers sending videos on WhatsApp. What should I do?

A number with ISD code +92 sent a video via WhatsApp. No text, only a video. About 20 days later, another number with same ISD sent another video. Should I open the video? OR Should I Report and Block?...
user avatar
1 vote
0 answers
76 views

Clarification on log4j Service Requirements [duplicate]

We're currently trying to prioritize our mitigations for CVE-2021-44228. The obvious priority is to deal with any Internet facing java (apache?) applications that use a vulnerable log4j library and\or ...
user avatar
0 votes
0 answers
89 views

My email listed in a breach on sites I do not recognize ever sign into. What happen?

I use Firefox Monitor to keep me updated if my email ever turn up on breaches or data dumps. It curates breaches data from many sources and cross reference our email to check if our email turn up on ...
user avatar
  • 101
36 votes
8 answers
12k views

Why use random characters in passwords?

I've seen some similar questions but maybe not exactly what I'm asking. Also I can't say that I've followed all the technical jargon in previous posts and am really after more of an intuitive ...
user avatar
0 votes
1 answer
256 views

Is there any risk installing and using WeChat in phone or computer [closed]

Is there any legitimate concerns of using WeChat in phone or computer? Is it possible they expose message data to others or for their own use? Also, will the installation of the official WeChat app ...
user avatar

1
2 3 4 5
15