Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

70 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
124 views

Add another layer of security in accounts except phone number

I recently came across articles where an attacker contacted a telecom company and got them to change the sim card registered with the target's phone number. After doing so, he was able to reset the ...
3
votes
2answers
199 views

Using SessionStorage for Some User Info

I have an application that currently keeps a few properties from a user's profile in session storage for the app to use when necessary. We don't keep sensitive data like username or password or ssn in ...
3
votes
0answers
206 views

Detect Kerberoasting activity

I am working to detect kerberoasting activity and I am referring this link. It states that an account cannot be requesting several different service names within a second or two of each other. What is ...
2
votes
1answer
60 views

Requiring an on-site visit to reset a password or get VPN access

This is a question born more from the user perspective but I'm wondering how it fits into a proper user creation and management policy. As a consultant I tend to work with various different clients ...
2
votes
1answer
79 views

Double JWT submit method

I'm implementing my JWT method by using the double submit method: where we separate the payload & header portion of the JWT from the signature. The header & payload is stored in a separate ...
2
votes
0answers
132 views

How are github personal access tokens and other github auth for 3rd parties not a securty issue?

Many services integrate with github. Some of them seem to require a personal access token with "repo" permission. Personal access tokens are global across all projects. In other words you may want to ...
2
votes
0answers
124 views

Hacked iCloud account: how can I protect my iPhone security?

My iCloud account has been hacked. I access links sent by hackers that compromise my iCloud account. The hackers don't have physically access to my phone, the compromised links are sent by them ...
2
votes
0answers
87 views

Gmail (Dot) Phishing Attack From Avalanche Botnet

I'm a full-stack web developer working in a small startup and have been wearing many hats as a result. I am by no means a cyber or information security expert. I'm looking for a general evaluation of ...
2
votes
0answers
122 views

Hacked Raspberry-pi server

My internet provider doesn't let me open my ports, it's an optional service, and even when they finally said over the phone that I was allowed to open the ports I was still not able to. So I was ...
2
votes
1answer
176 views

Smartphone fingerprint plus iris scanning for login

I have often thought about the fact that when intimate relationship partners live together they eventually tend to sneak over your shoulder and gain access to your password on either your mobile phone ...
2
votes
0answers
934 views

How to secure an API key from client side?

I'm having an issue and I'm pretty sure I'm not the first on that. I'm hoping to have a few great ways, hopefully bulletproof, to avoid any issues, so here it is. I provide an API that converts HTML ...
2
votes
0answers
82 views

How safe are cookies for payment application?

Recently we started working on a mobile payment app.We are not looking for a way to implement a "Remember me" function. We wondered if we should use session cookies, JWT or maybe other method of ...
2
votes
0answers
112 views

Strategy regarding an (almost always) offline app

I'm currently in internship in a software/app development company, where I have to come up with an idea about how can we handle the fact that the user will mostly use an app offline. Basically, the ...
2
votes
0answers
182 views

Git Server with several repos

I'm not sure if I'm allowed to post and have one of my newly asked question on both security.stackexchange and unix.stackexchange or not, but I think it is appropriate to ask the question here too ...
1
vote
0answers
42 views

Is using localhost for sensitive data secure?

I'm working with a nonprofit that wants to use CiviCRM to process its donor, member, and patron personal information. Civi is CMS-based, and will only run via WordPress, Drupal, Joomla, etc. Newb ...
1
vote
0answers
40 views

Why does THC Hydra and Medusa give false positives when used on TP-Link Netcam?

One of the tests I carried out was brute-forcing. I already knew what the username and password was for a factory reset IP Netcam but wanted to see how it would work in practice and if it even worked ...
1
vote
1answer
116 views

Password reset link vs Temporary password

Which is harder to exploit: Password reset link with tokens/timestamps/code/ticket etc Or, temporary password sent on user mail using which login can be done and password can be changed. Any ...
1
vote
0answers
52 views

How is the ownership of a hacked account assigned back to the rightful owner, if the owner used made-up info to create the account?

Which information is utilized in the account recovery process, after an account hack, if all personal information used to create the account was made-up (such as a nickname) and it's impossible to ...
1
vote
0answers
76 views

How to implement a “Forgot password?” functionality using php-encryption's KeyProtectedByPassword and 2FA?

I'm currently migrating the encryption functionality used in a PHP project from mcrypt (which was deprecated in PHP 7.1.x and no longer works from PHP 7.2 onward) to openssl, using the defuse/php-...
1
vote
0answers
468 views

How could a mobile banking app be hacked?

My phone got stolen, and sent back to where it was stolen a day after. At the moment of stealing, the phone was locked. When I received it back, there was no money left in my bank account. The ...
1
vote
0answers
82 views

Track HTTP(S) Network calls being made by an Android Device

I am planning to track the Network calls being made by apps and the website of an Android Device. I have used the Burp Suite tool for tracking the network calls. Until now the Android Device and the ...
1
vote
0answers
54 views

Are there any statistics about most common account thefts?

I am trying to evaluate how safe personal accounts are (including my own). Are there any statistics on the top security flaws which cause accounts to be compromised/stolen? Like: 25% of cases is ...
1
vote
0answers
62 views

Using uuidv4 in url to allow non registered users to refund purchases

I know reading that title probably made some of you gag, but let me explain the situation. I was tasked with creating a pretty straightforward storefront web app (php/laravel/stripe for payments) ...
1
vote
1answer
83 views

Do registration codes need expiry?

I work on an application where users are sent a unique registration code in the post. They use this, along with other personal information known to the user, to confirm the identity of the user upon ...
1
vote
2answers
78 views

Quantify security strength from entropy and lifetime

Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
1
vote
0answers
227 views

Android storage permission

There are a number of apps which ask for storage permission in Android. However it is unclear exactly what parts of storage are they able to access with this permission. As an example, would an app ...
1
vote
0answers
75 views

Authentication: E-mailing security codes vs clickable links

I've noticed a trend in how big companies (Amazon, Skype, and a few others I don't remember in particular) handle e-mail authentication. Rather than e-mailing clickable links with some single-use ...
1
vote
0answers
80 views

Wiping a smartphone/laptop for travel purposes

What is the best way to prepare your laptop and smartphone for travel? I envision having an encrypted back up stored at home; then factory resetting the smartphones/laptops for travel and installing ...
1
vote
0answers
60 views

Automatic Paypal payment through API

I am building a game similar to HQ trivia, that when someone gives all the correct answers at the end of the game he or she gets money sent to their Paypal account, my concern is obviously security. ...
1
vote
0answers
88 views

Email login bug, is it a security concern for email users?

(The name is vague on purpose because I'm not entirely sure how bad of an issue this is or if it is well known yet and I don't want to accidentally leak some kind of major breach type thing) Scenario:...
1
vote
0answers
210 views

Should I use a random password for my technical user?

I am trying to find the smartest way to handle the root password in my product. For legacy reasons, I need to have a technical account. My services create a token associated with this account ...
1
vote
0answers
299 views

Clicking a spoofed message customised to receivers id from Android

Last night my friend's Skype account(which he stopped using 3 years ago) sent all of his contacts a web spoofed message in the following format www.google.com/something/something/... id= with the ...
1
vote
0answers
137 views

Obfuscate exposed access_token in Javascript

I am building a static website with an Instagram feed and I came across a solution that utilizes Javascript to access API data for a single user. The method many are using is outlined in this blog ...
1
vote
0answers
43 views

Why does my email encryption certificate need to be signed?

My email client allows for separate keys for signing and encryption, so my signature key pair can be generated and signed by a third party and my encryption keys can be generated by me personally ...
1
vote
0answers
21 views

Extent of data seperation within multiple user accounts in Android

What is the extent to which data is separated between user accounts on Android? For example, can I have a different facebook account/any other social media account on each and trust these won't be ...
1
vote
0answers
63 views

Cannot disable read access the Windows 7 security log

So we have some Windows 7 systems with some security requirements. I am trying to disable read access the security log. The command “wevtutil gl security” shows a result of the following: ...
1
vote
0answers
202 views

Can work computer pick up iPhone browser history of connected to personal wifi

Can my work computer pick up my iPhone's browsing history when I am working from home and they are connected to my personal wifi? My laptop is connected VPN at home.
0
votes
2answers
69 views

Android phone's lockscreen PIN disappeared?

I own a ZTE Axon 7 (model 2017G) that I purchased secondhand from a reputable vendor in Germany ca. 3 years ago. The phone has been working well, and I updated the OS to Android 8.0. manually earlier ...
0
votes
0answers
39 views

Dedicated device for online investing and other security measures

I like to invest money online. I invest in both cryptocurrencies as well as regular stocks. As my bankroll grows (let's say 20k+ in the near future), I feel like I need to start taking more serious ...
0
votes
0answers
46 views

How to allow account recovery when a user loses everything?

Preface We are currently creating a new system for our clients and are stuck on account recovery when a user loses access to everything. The system is entirely controlled by our company in the ...
0
votes
0answers
39 views

How to verify the genuine user identity using Google signin API?

I'm developing a mobile app. I have a question, and here is the scenario. If a person is logging into the App with google sign in API in a public network. The website will verify the user with his ...
0
votes
0answers
53 views

Ionic local storage store sensitive data for private app

I'm new to the ionic framework and have some basics of it and currently I'm developing a private app for my family only that store some sensitive information in the localstorage. I used some crypto ...
0
votes
2answers
51 views

In case of TOTP code generation, why do products prefer a generic authenticator apps, such as Google Authenticator?

All the products supporting TOTP-based 2FA use one of the common authenticator apps such as Google Authenticator, Authy, etc. I want to understand whether there are any security reasons behind why ...
0
votes
3answers
380 views

Could modded versions of Kik messenger pose a security threat to other Kik users?

I was on the Kik messenger app, and someone in a group chat posted screenshots of his modded Kik app that contains an "IP grabber". He said he could hack people easily, and was very fast to tell me my ...
0
votes
0answers
35 views

How Do Online Identiy Verification Companies Ensures Their APIs to Be Not Abused?

I am trying to implement a photo ID verification along with a live-selfie verification on my Android/iOS apps. I figured that I might be able to implement these features using Python machine learning ...
0
votes
1answer
70 views

jwt symmetric signature security risks (from client side)

I am currently implementing an iOS app, which integrates with a cloud hosted .net backend system in azure, which. The api login endpoint takes user/pass -> replies with an signed only HS256 jwt token....
0
votes
0answers
50 views

Is data stored on a standard mac user account considered secure from other users on that same local computer?

I'm trying to figure out if the data created by a Mac user on a local mac is truly secure from other users on that same mac. For example, on MacOS Catalina, I have three accounts: Administrator User ...
0
votes
0answers
39 views

Any security standards applicable to empty S3 buckets?

My employer has a lot of S3 buckets which are no longer used or are just sitting there empty. Cleaning them up would obviously reduce the attack surface and be less to monitor and secure, but that ...
0
votes
3answers
129 views

E-Mail privacy proxy for hiding real e-mail?

Do E-Mail proxy services exists to improve privacy and security? Privacy in the sense that one wouldn't need to give a website his/her username (possibly even in the firstname.lastname@domain.tld ...
0
votes
0answers
86 views

Could this be considered lateral movement or is this normal activity?

Has anyone encountered this type of logon (4624 Type 3). The accounts are logging on then off within a few seconds. We are noticing this activity in the morning, which would be when they start working....