Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
0
votes
0answers
14 views

How does Instagram know my location even if I use VPN and have no sim card? [duplicate]

I'm using this Instagram account only on my 2nd phone which has no sim card and airplane mode always on. I use VPN 100% of the time when connecting to the internet. The account isn't linked with any ...
0
votes
0answers
38 views

How secure is the apple cross device copy and paste feature?

I can copy and paste between my iPhone and MacBook Pro it's a great feature that I find myself using frequently. I am frequently copy and pasting from my password manager to log in to different sites....
0
votes
0answers
27 views

Forward secrecy in Merkle trees vs. hash chains

Say we have a one-time password authentication system that uses a Merkle tree. Assume that the secret keys are of the form {sk0, sk1, ..., sk7}, and at time t = 3 an attacker recovers sk6. Will he/she ...
5
votes
1answer
122 views

How safe is it to store your passwords in a modern browser?

There's a few questions here along these same lines already, but they're nearly a decade old. I'd like to know if things have changed, especially now that Chrome has become more aggressive about ...
0
votes
0answers
50 views

My forgotten password was spelled out to me by customer support [closed]

This is regarding the same statewide online charter school I asked about here. This time I forgot my password, clicked to reset it, was directed to call customer support, and, upon identifying me, the ...
0
votes
0answers
47 views

Can my emails be accessed over compromised router? [closed]

If a router is compromised, can someone: Access emails or files passing through that router? Prevent incoming mails from reaching my inbox? Send emails from my email address, pretending as me, ...
0
votes
0answers
30 views

Which physical vault would be the better option for storing and monitoring the master password securely? [closed]

I need a solution to securely manage access to our enterprise LastPass master password. The requirement is 2 people in one country and 2 people in another country (for business continuity) will need ...
0
votes
2answers
85 views

Replace hashing function with asymmetric cryptography when password authentication

I would like to know if the following ideas are feasible: Hash function is one-way function. Generate public key from private key is irreversible(asymmetric cryptography). User password entry -> ...
0
votes
0answers
37 views

Android: How safe is PBKDF2 with a 4 digit pin?

Our Product Manager wants a 4 digit pin for login in our app, obviously for UX reasons, so user don't have to remember their password each time when they login. A refresh token can be retrieved from ...
0
votes
1answer
34 views

How to store Personal Access Token securely on shared machine

We have a shared machine in the office, used for demo'ing our product. I want to be able to fetch the latest code from Github. We have 2FA enabled, so I can't use my login password for https ...
1
vote
0answers
90 views

Different certificate issuers on same site based on browser

When I try to access some web site on firefox I get this: The cut out rectangle is COMPANY-NAME-ROOT-CA and that issuer (COMPANY-NAME-ROOT-CA) was also added as trusted on some peoples PC. But when I ...
3
votes
1answer
164 views

I woke up and my email has been signed up to hundreds of online services. How can I fix this?

I woke up this morning to over 900 emails of several online services asking to confirm I’ve made an account. Last month my email had been compromised and they managed to get into my eBay and Amazon ...
2
votes
1answer
42 views

What all security do i need to check to secure my application? [closed]

For an application with login and logout functionalities and browsing based upon authentication , what all do i need to secure it ? I am basically very new to security and googling is leading to more ...
1
vote
0answers
41 views

In the context of emails, what can be digitally signed and what should be digitally signed in the sub context of deal documents?

I was once a customer of a certain developer who sold a SaaS bookkeeping software which allowed sending deal documents (invoice, receipt, etc) to a customer, from the software's very own email server, ...
10
votes
3answers
5k views

How safe is opening any website on new browser tab?

When I do online shopping where I use my credit card information to purchase, I clear the browser cache, cookies and only open that single site. After I am done, I again clear the cache, cookies and ...
0
votes
0answers
9 views

find who is the user with administrative permissions who performed the most administrative activities in the same session ms365 [migrated]

Hi I'm new to ms 365 and I wanted to know if it is possible to find who is the user with administrative permissions who performed the most administrative activities/actions in the same session. I ...
1
vote
0answers
40 views

Is it a bad practice to store my user's ObjectId in a JWT in the sub claim?

Is it a bad practice to store my user's ObjectId in a JWT in the sub claim? I could create an alternate UUID field in the user database and use this instead, but I wondered if I should? I use this sub ...
24
votes
4answers
3k views

On my website's account creation form, how to avoid leaking the information that an email address already has an account? [duplicate]

It seems common practice, when denying access to a user because of an incorrect email / password combination, to not specify which of the username or password was incorrect. This avoids leaking the ...
19
votes
2answers
5k views

Why does Windows not always force me to confirm my password when changing it?

If I can change my password with cmd net user example * without needing to confirm my old password, why, when I change my password in the usual way (via settings or control panel), do I need to ...
0
votes
1answer
60 views

Securing application server for a single user

I'm building some simple dashboard app for myself, but I want to have them on multiple devices - hence the server and front end. As I will be the only user who will access the application server, what ...
2
votes
1answer
45 views

Implications re security practices of full account access granted to third parties

I'm working with a company (say, Acme) that does some ongoing data collection and processing for me. The data in question is private but not all that sensitive. Part of Acme's service has password-...
0
votes
4answers
190 views

Password is visible in online sign up form

I am about to sign up for an online school, which is an accredited statewide online school, and notice that the password they want me to enter is fully visible on the form. Should I be concern about ...
0
votes
2answers
83 views

Android phone's lockscreen PIN disappeared?

I own a ZTE Axon 7 (model 2017G) that I purchased secondhand from a reputable vendor in Germany ca. 3 years ago. The phone has been working well, and I updated the OS to Android 8.0. manually earlier ...
0
votes
1answer
52 views

How to guarantee only my client application can request a nonce?

I have a web site and a service in a server. I'm developing the "Register User" and "Login" components. I've searched on the internet and I've found two protocols to login user ...
69
votes
8answers
10k views

What is the suggested best practice for changing a user's email address?

I recently jumped onto the hypetrain for an unnamed email service and am currently on my way to update all my accounts on various websites to get most of my (future) data off Google's Gmail. During ...
2
votes
1answer
101 views

Authenticate limited client devices from server without login process

I have limited client devices and one server. I want to create a client-server secure connection while app installation but don't want human-interaction between devices and server like registration or ...
1
vote
2answers
72 views

What does it mean to get an email from someone with a different actual sender?

I got a strange email and I just want to confirm my suspicions. For background, I have my own email server which I set up using iRedMail on a VPS. I have an acquaintance who most likely has me on ...
0
votes
1answer
156 views

How might this Amazon account hack occur?

My mother recently had her Amazon account (buyer, not seller) hacked. She is not a security expert but does work in database management, so she is definitely not computer illiterate. I am also not a ...
3
votes
1answer
57 views

Getting numerous HEAD requests by Java user agents to resources that require authentication to view within a web application. Should I block them?

I have recently started using Cloudflare's firewall in front of a web application. This app has a limited user base of selected applicants and they must log in to view anything. There is no public ...
1
vote
1answer
75 views

Properly granting restrictive administrative privileges to developers on a production server [closed]

I am a business owner with a strong technical background, say a programmer, though not an advanced system administrator. I've bought a VPS server where I want to host several applications and webpages....
0
votes
1answer
76 views

Why to use username and password instead of just a long password? [duplicate]

Why do most websites use the pair of username and password as we can just use a long password like a token to identify a user? A simple example: On the server, we create a JSON file with user data ...
2
votes
1answer
44 views

Protecting an account after staying logged in in a public place

I had forgotten to log out of my personal T-Mobile web account on my computer at work today. When I came home, I remembered, so I logged on to my account at home (different computer, different network,...
0
votes
1answer
75 views

What do these credit security alerts mean?

A bank where I have an auto loan has a credit reporting feature. The feature shows that I have several "Dark Web Alerts" for "Compromised Email Address". The alerts list the breached sites, for ...
0
votes
0answers
42 views

Dedicated device for online investing and other security measures

I like to invest money online. I invest in both cryptocurrencies as well as regular stocks. As my bankroll grows (let's say 20k+ in the near future), I feel like I need to start taking more serious ...
1
vote
1answer
78 views

Recycled phone numbers [closed]

I just wanted to ask because I am in a situation now, where I have been locked out of my Instagram due to my mobile phone provider deactivating my Simcard. I have contacted Instagram support sending ...
5
votes
1answer
119 views

Giving different passwords to the app servers to access the same database. Pros and Cons?

Let's say we have one db server. three app servers with full database access. Which scenario is the best? Each app server connects to that one database with different passwords. Example: app srv 1 ...
1
vote
0answers
42 views

Is using localhost for sensitive data secure?

I'm working with a nonprofit that wants to use CiviCRM to process its donor, member, and patron personal information. Civi is CMS-based, and will only run via WordPress, Drupal, Joomla, etc. Newb ...
0
votes
1answer
73 views

QR Code Security Testing [closed]

Within the scope of a project for my client, I test the existing site and the project for security vulnerabilities using OWASP ZAP. The client uses invitations with QR Codes and QR Codes to login to ...
2
votes
1answer
61 views

Requiring an on-site visit to reset a password or get VPN access

This is a question born more from the user perspective but I'm wondering how it fits into a proper user creation and management policy. As a consultant I tend to work with various different clients ...
3
votes
1answer
95 views

Security of bank account using a 8 digit password

Few months ago, my bank forced me to change my password. It was a random 32 characters long password, stored in a well-known password manager. The new password had to be exactly 8 digits, to be ...
1
vote
2answers
62 views

Wordpress Backups and Security

Apart from all the other security and design flaws of Wordpress, there is 1 point that particularly got my attention: "Automatic Backups". These are saved inside the Wordpress directory. If you ask ...
0
votes
3answers
777 views

Discord server leaking IP addresses

I was on Discord, and someone sent me an invite to a server called "Operation: Pridefall". I didn't know what it was, the link is http://discord.gg/xxxxxxxxx - and the invite was legit. I thought it ...
0
votes
1answer
97 views

How safe is my login system (conceptually)?

I implemented a 2FA authentication for a web app with PHP and Google Authenticator. In order to login to my system there are a few steps: User types in a complex master password in order to access ...
0
votes
1answer
82 views

using Uuid for security

I read that uuid does not bring any security advantages But I can't find why It doesn't bring a little bit of extra security in the scenario below ?: Consider that right now the session id is ...
0
votes
1answer
85 views

Have I really been hacked or am I falling for a phishing scam [duplicate]

I received an email on the 14th saying that a hacker has access to my pc it says that at the time of hacking my account (myemail@gmail.com) had this password (it was a version of my password but not ...
0
votes
0answers
47 views

How to allow account recovery when a user loses everything?

Preface We are currently creating a new system for our clients and are stuck on account recovery when a user loses access to everything. The system is entirely controlled by our company in the ...
0
votes
0answers
39 views

How to verify the genuine user identity using Google signin API?

I'm developing a mobile app. I have a question, and here is the scenario. If a person is logging into the App with google sign in API in a public network. The website will verify the user with his ...
0
votes
0answers
54 views

Ionic local storage store sensitive data for private app

I'm new to the ionic framework and have some basics of it and currently I'm developing a private app for my family only that store some sensitive information in the localstorage. I used some crypto ...
0
votes
2answers
55 views

In case of TOTP code generation, why do products prefer a generic authenticator apps, such as Google Authenticator?

All the products supporting TOTP-based 2FA use one of the common authenticator apps such as Google Authenticator, Authy, etc. I want to understand whether there are any security reasons behind why ...
0
votes
2answers
72 views

Why is having the username and password no longer enough to log in to an account anywhere?

I have a friendly, fun bot on Twitch. I haven't logged into its account for ages, purely communicating with the Twitch API and their IRC service. The other day, they announced a new annouying "Oauth" ...

1
2 3 4 5
12