We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

51 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
1answer
1k views

non secure connection in youtube

I was browsing a while ago on youtube, I saw it shows an insecure connection even though it was over https. I'm using ghostery and adblock to block trackers but nothing more, I don't think it's the ...
3
votes
0answers
121 views

Add another layer of security in accounts except phone number

I recently came across articles where an attacker contacted a telecom company and got them to change the sim card registered with the target's phone number. After doing so, he was able to reset the ...
3
votes
2answers
108 views

Using SessionStorage for Some User Info

I have an application that currently keeps a few properties from a user's profile in session storage for the app to use when necessary. We don't keep sensitive data like username or password or ssn in ...
3
votes
0answers
192 views

Detect Kerberoasting activity

I am working to detect kerberoasting activity and I am referring this link. It states that an account cannot be requesting several different service names within a second or two of each other. What is ...
2
votes
0answers
76 views

How are github personal access tokens and other github auth for 3rd parties not a securty issue?

Many services integrate with github. Some of them seem to require a personal access token with "repo" permission. Personal access tokens are global across all projects. In other words you may want to ...
2
votes
0answers
109 views

Hacked iCloud account: how can I protect my iPhone security?

My iCloud account has been hacked. I access links sent by hackers that compromise my iCloud account. The hackers don't have physically access to my phone, the compromised links are sent by them ...
2
votes
0answers
82 views

Gmail (Dot) Phishing Attack From Avalanche Botnet

I'm a full-stack web developer working in a small startup and have been wearing many hats as a result. I am by no means a cyber or information security expert. I'm looking for a general evaluation of ...
2
votes
0answers
109 views

Hacked Raspberry-pi server

My internet provider doesn't let me open my ports, it's an optional service, and even when they finally said over the phone that I was allowed to open the ports I was still not able to. So I was ...
2
votes
1answer
142 views

Smartphone fingerprint plus iris scanning for login

I have often thought about the fact that when intimate relationship partners live together they eventually tend to sneak over your shoulder and gain access to your password on either your mobile phone ...
2
votes
0answers
662 views

How to secure an API key from client side?

I'm having an issue and I'm pretty sure I'm not the first on that. I'm hoping to have a few great ways, hopefully bulletproof, to avoid any issues, so here it is. I provide an API that converts HTML ...
2
votes
0answers
64 views

How safe are cookies for payment application?

Recently we started working on a mobile payment app.We are not looking for a way to implement a "Remember me" function. We wondered if we should use session cookies, JWT or maybe other method of ...
2
votes
0answers
108 views

Strategy regarding an (almost always) offline app

I'm currently in internship in a software/app development company, where I have to come up with an idea about how can we handle the fact that the user will mostly use an app offline. Basically, the ...
2
votes
0answers
182 views

Git Server with several repos

I'm not sure if I'm allowed to post and have one of my newly asked question on both security.stackexchange and unix.stackexchange or not, but I think it is appropriate to ask the question here too ...
1
vote
0answers
48 views

Track HTTP(S) Network calls being made by an Android Device

I am planning to track the Network calls being made by apps and the website of an Android Device. I have used the Burp Suite tool for tracking the network calls. Until now the Android Device and the ...
1
vote
0answers
54 views

Are there any statistics about most common account thefts?

I am trying to evaluate how safe personal accounts are (including my own). Are there any statistics on the top security flaws which cause accounts to be compromised/stolen? Like: 25% of cases is ...
1
vote
0answers
59 views

Using uuidv4 in url to allow non registered users to refund purchases

I know reading that title probably made some of you gag, but let me explain the situation. I was tasked with creating a pretty straightforward storefront web app (php/laravel/stripe for payments) ...
1
vote
1answer
60 views

Do registration codes need expiry?

I work on an application where users are sent a unique registration code in the post. They use this, along with other personal information known to the user, to confirm the identity of the user upon ...
1
vote
2answers
97 views

Is storing a JWT secret as docker env variable acceptable?

I understand how JWTs work and that with my secret anyone can issue new tokens. I control the server that my node website runs on and am considering different options for hosting the key. In code - ...
1
vote
0answers
186 views

Android storage permission

There are a number of apps which ask for storage permission in Android. However it is unclear exactly what parts of storage are they able to access with this permission. As an example, would an app ...
1
vote
0answers
74 views

Authentication: E-mailing security codes vs clickable links

I've noticed a trend in how big companies (Amazon, Skype, and a few others I don't remember in particular) handle e-mail authentication. Rather than e-mailing clickable links with some single-use ...
1
vote
0answers
76 views

Wiping a smartphone/laptop for travel purposes

What is the best way to prepare your laptop and smartphone for travel? I envision having an encrypted back up stored at home; then factory resetting the smartphones/laptops for travel and installing ...
1
vote
1answer
364 views

BitLocker Recovery Key and Microsoft Account Password

I have a Windows 10 Pro machine; the administrator (and only) account is a Microsoft account. I am trying to set up BitLocker to ensure maximum security and safety, even from Microsoft. I understand ...
1
vote
0answers
51 views

Automatic Paypal payment through API

I am building a game similar to HQ trivia, that when someone gives all the correct answers at the end of the game he or she gets money sent to their Paypal account, my concern is obviously security. ...
1
vote
0answers
86 views

Email login bug, is it a security concern for email users?

(The name is vague on purpose because I'm not entirely sure how bad of an issue this is or if it is well known yet and I don't want to accidentally leak some kind of major breach type thing) Scenario:...
1
vote
0answers
189 views

Should I use a random password for my technical user?

I am trying to find the smartest way to handle the root password in my product. For legacy reasons, I need to have a technical account. My services create a token associated with this account ...
1
vote
1answer
397 views

In what cases is it ok keep a user logged in or provide auto login if an app starts?

I am wondering what the difference is between WhatsApp and my Bank application, and what considerations determine what is the right approach to handle user authentication. WhatsApp: I create my ...
1
vote
0answers
299 views

Clicking a spoofed message customised to receivers id from Android

Last night my friend's Skype account(which he stopped using 3 years ago) sent all of his contacts a web spoofed message in the following format www.google.com/something/something/... id= with the ...
1
vote
0answers
132 views

Obfuscate exposed access_token in Javascript

I am building a static website with an Instagram feed and I came across a solution that utilizes Javascript to access API data for a single user. The method many are using is outlined in this blog ...
1
vote
0answers
43 views

Why does my email encryption certificate need to be signed?

My email client allows for separate keys for signing and encryption, so my signature key pair can be generated and signed by a third party and my encryption keys can be generated by me personally ...
1
vote
0answers
21 views

Extent of data seperation within multiple user accounts in Android

What is the extent to which data is separated between user accounts on Android? For example, can I have a different facebook account/any other social media account on each and trust these won't be ...
1
vote
0answers
54 views

Cannot disable read access the Windows 7 security log

So we have some Windows 7 systems with some security requirements. I am trying to disable read access the security log. The command “wevtutil gl security” shows a result of the following: ...
1
vote
0answers
198 views

Can work computer pick up iPhone browser history of connected to personal wifi

Can my work computer pick up my iPhone's browsing history when I am working from home and they are connected to my personal wifi? My laptop is connected VPN at home.
0
votes
0answers
11 views

Dockerfile - What user should be the owner for a mount point?

In the docker-compose file, below is the volumes instruction for builder service: builder: build: ../../ dockerfile: docker/dev/Dockerfile volumes: - ../../target:/wheelhouse volumes_from:...
0
votes
0answers
28 views

Is User Account Login Related to BitLocker Encryption Key

When I enabled BitLocker on my system-drive, I wasn't asked to select an unlock-method. I didn't have to enter any new passwords/keys. I only selected a few options for the encryption, and the process ...
0
votes
0answers
49 views

Sony Access Log (Playstation Network) does not exists

Yesterday my wife receive some emails from Sony confirming her purchases on Playstation Network. The only problem is: she was with my side watching Netflix on the smart Tv. The purchased items is a ...
0
votes
1answer
48 views

Quantify security strength from entropy and lifetime

Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
0
votes
0answers
73 views

How secure is passwordless and keyless SSH login on 127.0.0.1 only, over a secure authenticated tunnel?

I want to use CA signed SSH keys (that would be rotated frequently and have short expiry, ideally centrally managed, all that great stuff). Unfortunately, most of windows GUI tools, such as WinSCP or ...
0
votes
0answers
145 views

I used my school account to use Office 365. Can my school control my device now?

Whilst I was setting up Office 365, there was an option that said "allow my organization to manage my device". I unchecked it, but I can still access their network drives. Does this mean they now ...
0
votes
0answers
66 views

Different password recovery code received from Facebook

After a long time, I tried to login in to Facebook just to find that I forgot my password. So, to generate new password I used the 'forgot password' option in which a security code to reset password ...
0
votes
1answer
127 views

Application design to avoid XSS & CSRF attacks

I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
0
votes
0answers
50 views

Using OTAC as authentication to account recovery schemes

I develop a mobile application that is authenticated to a service utilizing a Challenge-Response scheme. During the registration a Device Key asymmetric key is generated and signed using a User Key ...
0
votes
0answers
59 views

Saving all secret keys, access data in heroku environ instead of config file?

I have a python/flask app and I use heroku to host it. I use some additional services, such as stripe, postgresql or emails. All these services have either secret keys or other access data, which ...
0
votes
1answer
108 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
0
votes
1answer
56 views

iCloud Security Concern: browser session authentication storage after 2-factor?

Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie? My concern is, if ...
0
votes
0answers
48 views

Policy for regaining access to a colleague's account

I run a SaaS used by teams to collect company-related information (think something like Crashlytics). Even if the tool lets users invite their colleagues, we often find cases of individuals who ...
0
votes
0answers
102 views

Hiding computers behind redis pub/sub?

I have a problem which is 1 http service i'm developing will receive user sensitive data ( 3rd party API KEYS ) and i need to store the keys somewhere where i can retrieve them in clear text. One of ...
0
votes
0answers
43 views

Proper way to document and log brute force attacks when creating a user account

We have the following use case: Users can self register for a business account by filling a validation form with their ID, first name, last name, and DOB. ID is something that only the user knows ...
0
votes
2answers
80 views

Can you use Google's authenticator app when Google “makes sure that you’re really you”?

I've heard that you can configure your Google account to use its (more secure) authenticator app rather than sending you a text message - in my most recent case, this was when Google sent me a text ...
0
votes
2answers
300 views

Is my online account at a financial firm safe?

I have recently opened an account at a brokerage firm, based in India, which unfortunately it seems to me is not following good measure to ensure security. But I maybe wrong since I am not an expert ...
-1
votes
1answer
133 views

What is optimal way to connect accounts to 2FA on phone?

I have Google Acc 0 (GAO) mostly for bank porpoises and some "official" services. This email basically "surname.name@google.com" and I put in my old C.V. and some other contact information. When I got ...