Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

114 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
149 views

Is asking the e-banking username/password from a 3rd party site compliant with 3dsecure and PSD2?

Recently I tried to make an online purchase in one of the biggest e-commerce sites in Greece. During checkout, and after providing debit card details, it asked me to provide the username/password (not ...
user avatar
3 votes
0 answers
171 views

Add another layer of security in accounts except phone number

I recently came across articles where an attacker contacted a telecom company and got them to change the sim card registered with the target's phone number. After doing so, he was able to reset the ...
user avatar
  • 131
3 votes
0 answers
190 views

Hacked iCloud account: how can I protect my iPhone security?

My iCloud account has been hacked. I access links sent by hackers that compromise my iCloud account. The hackers don't have physically access to my phone, the compromised links are sent by them ...
user avatar
  • 31
3 votes
2 answers
635 views

Using SessionStorage for Some User Info

I have an application that currently keeps a few properties from a user's profile in session storage for the app to use when necessary. We don't keep sensitive data like username or password or ssn in ...
user avatar
  • 171
3 votes
0 answers
256 views

Detect Kerberoasting activity

I am working to detect kerberoasting activity and I am referring this link. It states that an account cannot be requesting several different service names within a second or two of each other. What is ...
user avatar
2 votes
0 answers
135 views

How good can X-Frame-Options HTTP header do against click-jacking?

X-Frame-Options HTTP header is used to tell if a webpage is allowed to be used in a frame/iframe. Frames can be used for click-jacking/UI-redress attacks. It is advised to set X-Frame-Options to '...
user avatar
  • 121
2 votes
0 answers
264 views

In forgotten password is asking user their TOTP among other details secure?

I have started to work on the Forgotten password feature on my website. Based on OWASP Forgot Password cheatsheet, the user should provide enough information to confirm that it is really them. The ...
user avatar
  • 3,743
2 votes
0 answers
221 views

Grace period for users after re-enabling account disabled by PCI-DSS 8.1.4?

We have an automated system to disable user accounts that have seen no logins for 90 days. We also have a process of re-enabling such accounts (at the behest of the affected users), and this process ...
user avatar
  • 343
2 votes
0 answers
275 views

Is storing an encrypted 2FA backup on Bitwarden (a password manager) a good idea?

I am at the moment using Bitwarden and a separate 2FA app. I am trying to figure out a way to be able to securely recover my access to credentials and 2FA in case my phone/laptop/other electronic ...
user avatar
2 votes
0 answers
302 views

How are github personal access tokens and other github auth for 3rd parties not a securty issue?

Many services integrate with github. Some of them seem to require a personal access token with "repo" permission. Personal access tokens are global across all projects. In other words you may want to ...
user avatar
  • 458
2 votes
2 answers
197 views

Quantify security strength from entropy and lifetime

Entropy or randomness is a quantitative measure of security strength for various types of passcodes, but in current times with digital technology, breaches, and cracking tools it seems that lifetime ...
user avatar
  • 31
2 votes
0 answers
137 views

Gmail (Dot) Phishing Attack From Avalanche Botnet

I'm a full-stack web developer working in a small startup and have been wearing many hats as a result. I am by no means a cyber or information security expert. I'm looking for a general evaluation of ...
user avatar
2 votes
0 answers
177 views

Hacked Raspberry-pi server

My internet provider doesn't let me open my ports, it's an optional service, and even when they finally said over the phone that I was allowed to open the ports I was still not able to. So I was ...
user avatar
2 votes
0 answers
1k views

How to secure an API key from client side?

I'm having an issue and I'm pretty sure I'm not the first on that. I'm hoping to have a few great ways, hopefully bulletproof, to avoid any issues, so here it is. I provide an API that converts HTML ...
user avatar
  • 2,649
2 votes
0 answers
145 views

How safe are cookies for payment application?

Recently we started working on a mobile payment app.We are not looking for a way to implement a "Remember me" function. We wondered if we should use session cookies, JWT or maybe other method of ...
user avatar
2 votes
0 answers
153 views

Strategy regarding an (almost always) offline app

I'm currently in internship in a software/app development company, where I have to come up with an idea about how can we handle the fact that the user will mostly use an app offline. Basically, the ...
user avatar
  • 21
2 votes
0 answers
66 views

Extent of data seperation within multiple user accounts in Android

What is the extent to which data is separated between user accounts on Android? For example, can I have a different facebook account/any other social media account on each and trust these won't be ...
user avatar
  • 21
1 vote
0 answers
25 views

Obfuscate account availability during creation or not?

My partner and I are arguing about our auth system. They believe that obfuscating the existence of another account (by showing a generic error) is preferable to surfacing an error warning about ...
user avatar
1 vote
0 answers
72 views

Is it necessary to have keep these 4 accounts separate from password manager?

Microsoft Authenticator requires an: Outlook account Verification account iCloud account The first two are required to set up the authenticator on a new device, the latter stores all the data to be ...
user avatar
  • 9
1 vote
0 answers
122 views

Potential Western Union Scam - Account Registration

In recent weeks I have seen a handful of senior employees in my organization receive a confirmation email from Wester Union for a new account creation. The issue is that none of these users have ...
user avatar
  • 172
1 vote
0 answers
70 views

How to provide | revoke access to an AWS machine without going through the AWS console

Assuming if you do via SSH (which is shared among multiple team members), how to manage this from a security perspective or should each user be given a separate SSH key
user avatar
  • 111
1 vote
1 answer
518 views

Does adding a recovery phone number to a Gmail account make it less secure, in the case that I lose both my laptop and phone?

Background I have a "main" Gmail account, which I set to keep logged in, on my laptop. This "main" Gmail account is important, because it's the email address I used to sign up for ...
user avatar
1 vote
0 answers
200 views

httpOnly Cookie Security Flaw

I'm bit confused about this security flaw. I'm in real need of help in this :smile: My express code (not using any sessions, just cookie-parser) app.get("/signin", (req, res) => { if(!...
user avatar
1 vote
0 answers
105 views

How Can I Backup App Data In Android/iOS Devices?

After my other post I'm looking over some other possibilities to do what I'm trying to do. How To Recover End-To-End Encrypted Data After Losing Private Key? If I save user data in server, in order to ...
user avatar
  • 247
1 vote
0 answers
70 views

2FA/MFA in a resource-constraint product

I'm working on a resource-constraint product and asked to enable support for MFA/2FA for all maintenance services. Given that MFA/2FA is about using two elements out of three(something you have, know, ...
user avatar
1 vote
0 answers
128 views

Zero-Trust alternative to google sign-in, is this a feasable design?

I was thinking about zero-trust systems over the last few weeks and it seems like there are many things that could be implemented that way. With password managers being one of those things, I was ...
user avatar
  • 697
1 vote
0 answers
106 views

How do you protect against Active Directory Golden Ticket Attacks?

I'm looking at hardening our AD. One concern I have is around Golden Ticket Attacks using Mimikatz and the likes (https://attack.stealthbits.com/how-golden-ticket-attack-works). One of the things that ...
user avatar
  • 71
1 vote
0 answers
410 views

My college manages my Google account, can they view my browsing history if I use a personal device on a home network while logged in?

I have found multiple sources telling me otherwise, but most are outdated by a year or two. If I am logged into my G-suite managed account on google, and search something up on a home network and ...
user avatar
  • 11
1 vote
0 answers
183 views

Different certificate issuers on same site based on browser

When I try to access some web site on firefox I get this: The cut out rectangle is COMPANY-NAME-ROOT-CA and that issuer (COMPANY-NAME-ROOT-CA) was also added as trusted on some peoples PC. But when I ...
user avatar
  • 11
1 vote
0 answers
77 views

In the context of emails, what can be digitally signed and what should be digitally signed in the sub context of deal documents?

I was once a customer of a certain developer who sold a SaaS bookkeeping software which allowed sending deal documents (invoice, receipt, etc) to a customer, from the software's very own email server, ...
user avatar
  • 11
1 vote
0 answers
145 views

Is it a bad practice to store my user's ObjectId in a JWT in the sub claim?

Is it a bad practice to store my user's ObjectId in a JWT in the sub claim? I could create an alternate UUID field in the user database and use this instead, but I wondered if I should? I use this sub ...
user avatar
  • 111
1 vote
0 answers
130 views

Is using localhost for sensitive data secure?

I'm working with a nonprofit that wants to use CiviCRM to process its donor, member, and patron personal information. Civi is CMS-based, and will only run via WordPress, Drupal, Joomla, etc. Newb ...
user avatar
1 vote
0 answers
504 views

Why does THC Hydra and Medusa give false positives when used on TP-Link Netcam?

One of the tests I carried out was brute-forcing. I already knew what the username and password was for a factory reset IP Netcam but wanted to see how it would work in practice and if it even worked ...
user avatar
  • 11
1 vote
1 answer
132 views

How can one mitigate both account-level DOS attacks and online brute force attacks at the same time?

I was recently reading this question, where the accepted answer claims that it is easy for attackers to bypass rate limiting that is based on IP, which makes any sort of IP rate limiting to prevent a ...
user avatar
  • 215
1 vote
0 answers
97 views

How is the ownership of a hacked account assigned back to the rightful owner, if the owner used made-up info to create the account?

Which information is utilized in the account recovery process, after an account hack, if all personal information used to create the account was made-up (such as a nickname) and it's impossible to ...
user avatar
1 vote
0 answers
164 views

How to implement a "Forgot password?" functionality using php-encryption's KeyProtectedByPassword and 2FA?

I'm currently migrating the encryption functionality used in a PHP project from mcrypt (which was deprecated in PHP 7.1.x and no longer works from PHP 7.2 onward) to openssl, using the defuse/php-...
user avatar
1 vote
0 answers
678 views

How could a mobile banking app be hacked?

My phone got stolen, and sent back to where it was stolen a day after. At the moment of stealing, the phone was locked. When I received it back, there was no money left in my bank account. The ...
user avatar
  • 127
1 vote
0 answers
128 views

Track HTTP(S) Network calls being made by an Android Device

I am planning to track the Network calls being made by apps and the website of an Android Device. I have used the Burp Suite tool for tracking the network calls. Until now the Android Device and the ...
user avatar
  • 111
1 vote
0 answers
93 views

Are there any statistics about most common account thefts?

I am trying to evaluate how safe personal accounts are (including my own). Are there any statistics on the top security flaws which cause accounts to be compromised/stolen? Like: 25% of cases is ...
user avatar
  • 111
1 vote
0 answers
104 views

Using uuidv4 in url to allow non registered users to refund purchases

I know reading that title probably made some of you gag, but let me explain the situation. I was tasked with creating a pretty straightforward storefront web app (php/laravel/stripe for payments) ...
user avatar
1 vote
2 answers
214 views

Do registration codes need expiry?

I work on an application where users are sent a unique registration code in the post. They use this, along with other personal information known to the user, to confirm the identity of the user upon ...
user avatar
  • 11
1 vote
0 answers
301 views

Android storage permission

There are a number of apps which ask for storage permission in Android. However it is unclear exactly what parts of storage are they able to access with this permission. As an example, would an app ...
user avatar
  • 109
1 vote
0 answers
112 views

Authentication: E-mailing security codes vs clickable links

I've noticed a trend in how big companies (Amazon, Skype, and a few others I don't remember in particular) handle e-mail authentication. Rather than e-mailing clickable links with some single-use ...
user avatar
  • 158
1 vote
0 answers
123 views

Wiping a smartphone/laptop for travel purposes

What is the best way to prepare your laptop and smartphone for travel? I envision having an encrypted back up stored at home; then factory resetting the smartphones/laptops for travel and installing ...
user avatar
  • 111
1 vote
0 answers
128 views

Automatic Paypal payment through API

I am building a game similar to HQ trivia, that when someone gives all the correct answers at the end of the game he or she gets money sent to their Paypal account, my concern is obviously security. ...
user avatar
  • 111
1 vote
0 answers
129 views

Email login bug, is it a security concern for email users?

(The name is vague on purpose because I'm not entirely sure how bad of an issue this is or if it is well known yet and I don't want to accidentally leak some kind of major breach type thing) Scenario:...
user avatar
  • 119
1 vote
0 answers
254 views

Should I use a random password for my technical user?

I am trying to find the smartest way to handle the root password in my product. For legacy reasons, I need to have a technical account. My services create a token associated with this account ...
user avatar
1 vote
0 answers
337 views

Clicking a spoofed message customised to receivers id from Android

Last night my friend's Skype account(which he stopped using 3 years ago) sent all of his contacts a web spoofed message in the following format www.google.com/something/something/... id= with the ...
user avatar
1 vote
0 answers
187 views

Obfuscate exposed access_token in Javascript

I am building a static website with an Instagram feed and I came across a solution that utilizes Javascript to access API data for a single user. The method many are using is outlined in this blog ...
user avatar
  • 305
1 vote
0 answers
77 views

Why does my email encryption certificate need to be signed?

My email client allows for separate keys for signing and encryption, so my signature key pair can be generated and signed by a third party and my encryption keys can be generated by me personally ...
user avatar