Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
2
votes
4answers
970 views

Is there more of a security risk by providing an email when creating a new account?

With all of these recent breaches, I have been thinking about security best practices. One thing I was thinking about was the fact that some sites allow you to log into a site using your EMAIL OR ...
-1
votes
1answer
2k views

What is this type of authentication with device id and token?

I'm trying to understand this strategy of authentication that I'm using to access resources of an enterprise. Basically, they have given me clientId and clientSecret, which I use to generate deviceId ...
1
vote
1answer
124 views

Windows Domain Account Unlock Best Practices?

We have a setup where if a user gets locked out of their Windows machine, then their department or assistant manager can unlock their account. We are being asked to expand this so that any employee ...
3
votes
1answer
449 views

How secure is IDology's ExpectID (as used on airbnb)?

To quote https://travel.stackexchange.com/a/72476/2928 I entered the last four digits of my SSN and provided basic DOB and full name. Then it asked me three security questions that only I would ...
1
vote
1answer
873 views

Microsoft support asking me for my phone IMEI?

I just contacted Microsoft support on my Lumia phone via the preinstalled "Contact Support" app, about an issue of the language of comments on apps in the Store being in the wrong language (different ...
-5
votes
1answer
101 views

Lost my facebook account and all related pictures [closed]

I had to change my account. I must have been hacked. I received a message to go to facebook.com. also settings to turn off all sms. I don't know what to do and facebook gave me a new account. I lost ...
5
votes
2answers
1k views

Time Based Authentication Verification Token

I'm building a long-lived session system which requires that users verify their authentication before performing "dangerous" operations, such as changing critical settings, deleting their account, etc....
2
votes
1answer
164 views

Can email services upload files from your computer without your permission/knowledge?

The company I work for is involved in security clearance work, and thus all company computers are monitored (files, screenshots, etc). I am routinely logged onto my company email service with my ...
1
vote
3answers
1k views

Prompt for PIN when installing Android Apps?

is there a way to disable app installations until you provide a certain PIN? I have the following scenario in mind: I'm a heavy Google Photos and Google Drive user, but only from my Windows computer ...
3
votes
2answers
1k views

Are password generators secure?

Here's a scenario that I often encounter: Some user needs access to something on my network, but they don't have an existing account in AD. I create an AD account for them which I then use to allow ...
0
votes
2answers
70 views

Is there any added security/vulnerabilities if you allow a “trusted-party” to vouch you are legit, if you were locked out of your account?

I was reading this answer on a question. https://security.stackexchange.com/a/498/106817 Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at ...
1
vote
2answers
128 views

Does an image showing exception error on my site pose a prominent security risk?

I wrote a small website in PHP and ZF2. Had a friend test it out by posting a link to it on Facebook. Apparently I forgot to turn off ZendFramework reporting and he find an error. Posted a photo ...
0
votes
1answer
136 views

Windows security & data protection

I work for a hotel. The hotel stores a MySQL database online. This database only contains a Reference ID, number of nights and so on, but no private data. No names, no personal information on guests. ...
1
vote
3answers
103 views

Is there an added benefit to authentication within a part of an application, after authenticated into the main application?

Essentially I have a application that is 2 parts. One part is on the user's machine, which will upload files to my server, and the other part is a web application that works with those files. ...
3
votes
1answer
10k views

Google Drive photo security and publicly visible lh*.googleusercontent.com

I thought Google Drive was more secure than this. If I upload a photo to Google Drive, I don't care that it's entrusted to them and I also assume someone working there can look at it. No big deal. ...
3
votes
2answers
269 views

What is the safest Google account recovery option?

I have a Google account with a strong password and 2-factor authentication set up, and I worry about what would happen if I lost my phone with the 2FA app. I want to set up a recovery option, and I ...
1
vote
2answers
244 views

How are sites like PersonalCapital safe/trustworthy?

Sites like PersonalCapital require you submit your account login details for every one of your banking account providers. Could personal capital potentially log into your financial accounts and make ...
0
votes
2answers
1k views

Wipe out or dissapear and start over again in internet for personal security? [duplicate]

The other I was talking with a work mate that is part of finances and He made a question that I couldn't answer at the moment. "I have a lot of accounts and information about me internet. I'm really ...
2
votes
1answer
103 views

Accounts being accessed from X country

So recently I've been getting emails that X account has been accessed from Y country with an IP address that I obviously don't own. An example would be my Steam account which recently got accessed ...
151
votes
5answers
13k views

What to do if stuck with website that has poor security?

I have a student loan account with a company, not the biggest company but big enough to where they should have their act together. Today I couldn't remember my password to log into my account ...
2
votes
1answer
122 views

Information Security on a lost android phone

Recently, my android mobile phone was lost/stolen. I had logged into several applications such as Facebook, Paytm, etc. Thus, there are chances that my personal/ transaction details might be leaked. ...
51
votes
5answers
6k views

Is it possible to detect security breaches as a user before they're announced?

I'm always concerned about the security of services I use. I'm even more concerned since security breaches have been happening more and more lately, and they always generate a lot of noise in the ...
1
vote
1answer
749 views

Is Trillian application unsafe? (Got “Someone has your password” message from Google)

Trying to connect to GoogleTalk from the Trillian app for Android (a universal instant messenger app), I got denied even with the correct password. Then Google e-mailed me saying that my password is ...
1
vote
2answers
171 views

Security reasons for kicking user when logged in from two places

When account A has logged into computer A, and then account A starts to log in to computer B, account A in computer A will automatically be logged out. May I know what are the possible reasons in why ...
3
votes
2answers
340 views

How to secure/cleanup my accounts after having an old email account breached

I have two email accounts. My main one that I created a few years ago and switched to, which has a very strong/unique password that is not written down or stored anywhere. It also has 2-factor auth ...
1
vote
0answers
205 views

What else can I do to protect my accounts? [closed]

I am trying to make sure all my accounts are secure from unauthorised access and have turned on all security measures that I can find to make sure my stuff is protected. Here is what I have in place: ...
1
vote
0answers
198 views

Can work computer pick up iPhone browser history of connected to personal wifi

Can my work computer pick up my iPhone's browsing history when I am working from home and they are connected to my personal wifi? My laptop is connected VPN at home.
12
votes
3answers
1k views

Steam and two-factor authentication

The Steam platform is designed to encourage users to use two-factor authentication. One of the community tasks (achievement-like objectives) on Steam is "Use the Steam Mobile App for two-factor ...
5
votes
1answer
177 views

Should I use Google Accounts or my own hashed password system?

I have a relatively critical control-panel online. If someone with malicious intent were to log in, there would be a significant risk to property. I will be hosting said site on Google App Engine, ...
12
votes
2answers
827 views

Should I worry about a breach where my password was not revealed?

After browsing another question on this site, I discovered haveibeenpwned.com and thought I'd check my email. It came up with one breach which has, apparently, not been widely shared and does not ...
36
votes
4answers
6k views

What can I do if I discover that my password hash has been leaked in pastebin?

Entering my email at https://haveibeenpwned.com/, I was told that I have been pwned. I am in http://pastebin.com/SCLNRHJQ I already tried to find out my password by simply md5-hashing all my ...
83
votes
11answers
53k views

Why is client-side hashing of a password so uncommon?

There are very few websites that hash the users password before submitting it to the server. Javascript doesn't even have support for SHA or other algorithms. But I can think of quite a few ...
3
votes
1answer
104 views

What can I do to separate users best way if they are allowed to run their ruby (python) code

I have Ubuntu server 12.04 on VDS and I allow users to run their own Rails applications on behalf their own accounts. That means: They can use any shell they want They can upload what they want, e.g. ...
12
votes
4answers
2k views

Gmail account hack prevention and recovery

I am doing a research on how to prevent my gmail account from being hacked and what are the options of claiming it back. The associated phone number and recovery email can be changed, in fact I ...

1 6 7 8 9 10