We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
0
votes
2answers
88 views

Is there another way than session hijacking to access user account through XSS?

If I have discovered an XSS vulnerability, is there another way of gaining access to an account without session hijacking? Mainly because on most of the sites I test, the HttpOnly and Secure flags are ...
41
votes
1answer
6k views

Why do I need two parameters in an HTTP parameter pollution attack?

I'm reading about HTTP parameter pollution and I'm confused about one thing. If there is an endpoint like this, https://security.stackexchange.com/editpost/?postuid=19348 and you tried a HPP attack, ...
1
vote
2answers
116 views

Buying keycodes online safely/anonymously

I lost a cd key for a very old game and need to replace it with a new one. I can't find anymore physical copies to buy, but I found cd keys for them are offered on sites like Ebay which could replace ...
2
votes
1answer
83 views

When using a shared / public VPN, can others on the same IP address log into your accounts?

I know browsers use cookies so that, for example, if I log into Facebook on a public computer and forget to log out, the next person who opens up a new browser can go into my account. Does this work ...
2
votes
3answers
325 views

Is using weak login credentials always bad?

I am currently using 9 digit numbers to authenticate writers on two apps. In the first app, this unlocks editing tools for use in making content rich dhtml documents which are stored on the local ...
2
votes
0answers
109 views

Hacked iCloud account: how can I protect my iPhone security?

My iCloud account has been hacked. I access links sent by hackers that compromise my iCloud account. The hackers don't have physically access to my phone, the compromised links are sent by them ...
0
votes
2answers
116 views

Can wireshark capture the exact payload and end point of API used by my Mobile APP?

I was just wondering if someone having total control over his/her network, is running my mobile app. Also wireshark is capturing all requests made using the network. My app is calling API endpoint ...
0
votes
1answer
78 views

Should I send login id on email?

I have a very common use case where an admin is creating an account of the user and then I need to send the login id generated by my system to the user. And the user will need to set a password on the ...
-1
votes
2answers
94 views

CDN change for “enhanced security”? (now uses cookies)

For the past few months, I've been unable to continue a particular course on udemy. I can access all other video courses accept that particular course and their support has answered "We recently ...
63
votes
3answers
8k views

Website returning plaintext password [duplicate]

I have recently logged into a website. When I clicked on the "Update Profile" page, you are displayed with a list of text boxes for all the user fields, e.g. name, email, phone number etc. There is ...
2
votes
1answer
272 views

sudo restrictions circumvention with pkexec: root shell

I had corrupted my sudo setup. With no possibility to login as root (locked root account, broken sudo), a search made it clear: use pkexec. It worked. So far, so good. But that turns out to be a big ...
2
votes
1answer
112 views

Why does Google 2FA not display the correct location when behind proxy?

I'm on my corporate proxy and using Google 2-factor authentication to log into my machine. When I get the notification on my phone, it says that I'm trying to connect from Moscow, Russia, even though ...
86
votes
5answers
22k views

Why would someone open a Netflix account using my Gmail address?

This is something that happened to me a few months ago. I don't know if it is a hack attempt, although I can't think of any way that there could be any danger or any personal information gained. I ...
0
votes
1answer
40 views

Safe to consider webapp user's email as implicitly confirmed after a password reset?

In my system, a new user must confirm his email. But there is an edge case: he registers does not confirm forgets password, performs password reset (which involves a mail loop) At that point I know ...
0
votes
2answers
129 views

How safe are passwords while using prompt?

Simple question. How safe are passwords while using prompt? For example logging through SSH. ssh user@server and then you have question for password - of course hidden but... what's going "under ...
0
votes
0answers
145 views

I used my school account to use Office 365. Can my school control my device now?

Whilst I was setting up Office 365, there was an option that said "allow my organization to manage my device". I unchecked it, but I can still access their network drives. Does this mean they now ...
2
votes
0answers
236 views

Different email address in the email and the cancellation link in “Security alert for your linked Google Account” [closed]

In order to be able to help my mother, my gmail is listed as a recovery email for her Google account, mother@gmail.com (not her actual address). Today I received a "Security alert for your linked ...
0
votes
1answer
87 views

Is it safe to use RPC with sensitive data through an encrypted VPN connection instead of SSL/TLS?

I have an application where there I'm planning the following setup: user <-----------------> layer 1 server <------------------> backend server internet (https) ...
164
votes
4answers
39k views

GitLab account hacked and repo wiped

I was working on a project, a private repo, and suddenly all the commits disappeared and were replaced with a single text file saying To recover your lost code and avoid leaking it: Send us 0.1 ...
0
votes
0answers
66 views

Different password recovery code received from Facebook

After a long time, I tried to login in to Facebook just to find that I forgot my password. So, to generate new password I used the 'forgot password' option in which a security code to reset password ...
16
votes
1answer
3k views

Github account hacked and repo wiped - Github Response

One of my repo's was wiped today and just a message left in its place with a bitcoin ransom. I've no idea how they accessed my account, can't really see anything on github security page. The domain ...
9
votes
3answers
2k views

How does Comcast know my WiFi password?

How does Comcast know my WiFi password? I generated it via KeePass and entered it into my Arris router/cable modem myself, and I bought the router used from a friend. When I went to the account web ...
24
votes
1answer
9k views

False 'Security alert' from Google - every login generates mails from 'no-reply@accounts.google.com'

Every time I log in to Google with the same MacBook I get this email: New device signed in to example@gmail.com Your Google Account was just signed in to from a new Mac device. You're getting ...
1
vote
1answer
85 views

Will SIM‐like PIN on website as second password increase security

On SIM cards, which are used in mobile telephony, PIN (and PUK) is used. Unlike a password, they are locked after some incorrect attempts to prevent brute force attack. If wrong PIN is entered 3 times,...
0
votes
0answers
18 views

Security risks in confirming the username instead of confirming the username and password combination [duplicate]

Most of the login pages like Google, Outlook and Yahoo! confirm the username first and then ask for a password instead of confirming the username and password combination altogether. Isn't it less ...
0
votes
2answers
130 views

Can a password change via CSRF lead to account takeover?

If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF ...
1
vote
2answers
109 views

SendGrid Github Account Credentials Scanning

Some time ago a developer in my team accidentally published some code to his GitHub repository containing ENV_VARS that belonged to our company's SendGrid account. Fortunately I noticed this as soon ...
1
vote
1answer
88 views

How can I create a hidden Administrator account in a public computer?

After my journey for finding a way to create a truly private user account in a public computer (the setup I'm trying to do this on is detailed in this other question) ended in an epic fail I'm now ...
1
vote
1answer
756 views

Why should I use jwt in Refresh Token? [duplicate]

I use Refresh Token to handling expired Access Token, and in log out, I can remove Refresh Token from the database. Refresh Token must never expire (not sure) because the user can check "remember me". ...
0
votes
1answer
287 views

How can Opera browser access my sessions on Google Chrome?

I just installed Opera browser v60 (i.e. Reborn 3) on Windows 10. I noticed that it has automatically (without my consent and permission) taken all my bookmarks in Google Chrome and added to the ...
0
votes
1answer
56 views

Authentication System Usernames [duplicate]

For a reason I can't fathom, people seem to subscribe to the opinion that a secret username isn't more secure than a public one. I find this opinion completely ludicrous and would like to know why ...
1
vote
0answers
186 views

Android storage permission

There are a number of apps which ask for storage permission in Android. However it is unclear exactly what parts of storage are they able to access with this permission. As an example, would an app ...
1
vote
0answers
73 views

Authentication: E-mailing security codes vs clickable links

I've noticed a trend in how big companies (Amazon, Skype, and a few others I don't remember in particular) handle e-mail authentication. Rather than e-mailing clickable links with some single-use ...
10
votes
1answer
272 views

Is it possible to “reverse engineer” identicons?

As shown in this question, default user avatars (like mine) are identicons and are generated with the user's email (where provided) or the user's IP address (where the email is not provided). Given ...
0
votes
3answers
161 views

Are email systems like Countermail safe?

I am aware of some of the main competitors in this space, including: Lavabit, Countermail, Fastmail, Proton. But, I don't have enough knowledge to differentiate them. Along the same line, I don't ...
2
votes
1answer
1k views

Should I be worried by an email which said my account was under attack? [duplicate]

So, today I received an email in my Gmail account which landed automatically in the spam folder. This was the email content: Hi! As you may have noticed, I sent you an email from your account. ...
1
vote
1answer
61 views

SAML Security Question

I have a SaaS app (App), and it has established SAML trust relationships with two of our clients, Acme and Foo. Acme users log in to App through an IdP-initiated flow. Foo users also log in to App ...
2
votes
4answers
208 views

Is it possible to create a truly private user account in a public computer?

In my college computer that runs Windows 7 Professional SP1 I have an administrator account. I have full access to the entire computer and the files of every other account that's signed up. The ...
-2
votes
1answer
144 views

What’s the best way to report an IP address from Romania?

I recently received an email from a company sending me a security code that I didn’t ask for. It showed me the IP address that the request came from and it shows that it is in Romania but I live in ...
0
votes
1answer
127 views

Application design to avoid XSS & CSRF attacks

I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
1
vote
0answers
37 views

Are there any reliable and updated sources or feeds for password dumps? [closed]

I am looking for any reliable, up-to-date sources (which may be RSS feeds, websites, or anything else OSINT-based) which contain password dumps and their relative links. I am looking particularly for ...
0
votes
2answers
113 views

Account Recovery: Displaying username without verification

I'm not a security guy, so bear with me. As discussed in other topics, usernames in and of themselves are valid forms of verification, and there's nothing particularly sensitive or secure about ...
1
vote
1answer
98 views

Could it be possible to diminish the damage of having one's VPS inspected by the host?

I'm planning to run/have some quite sensitive data on a VPS, however, knowing well that the host could at any time access the data (rare but as long as it could happen in theory, I would very much ...
0
votes
2answers
161 views

Private Google account at work

I have an old private tablet at work with my private Google account on it .It's connected to our WiFi, where i logged in with my personal working code. Never use it much as I just play some music on ...
5
votes
2answers
315 views

How to convince users that security is a good thing?

So I took over as senior IT manager at a small company a couple months ago. Up to now, there was no "IT department" as such, just another guy who "did computers". To this point: things are running off ...
1
vote
2answers
76 views

Saving unhashed first name and last name on a non-encrypted database on phone

Using react-native, we save the first name and last name in Redux, which is a non-encrypted database within the app. I have been tasked to secure this data. Either encrypt these two fields or save ...
1
vote
0answers
76 views

Wiping a smartphone/laptop for travel purposes

What is the best way to prepare your laptop and smartphone for travel? I envision having an encrypted back up stored at home; then factory resetting the smartphones/laptops for travel and installing ...
52
votes
2answers
12k views

Is this Paypal Github SDK reference really a dangerous site?

I'm working on integrating a payment system with paypal in C#, and I installed the official paypal nuget package. Then I went to the paypal github site. And linked to this below site (SDK Reference). ...
0
votes
1answer
246 views

Windows event log - Security - Audit failure

Every one hour or so I have this event in my Event viewer -> Windows logs -> Security log. I understand the consent.exe is Windows' UAC control, what i wan't to know is why and what is trying ...
2
votes
0answers
81 views

Gmail (Dot) Phishing Attack From Avalanche Botnet

I'm a full-stack web developer working in a small startup and have been wearing many hats as a result. I am by no means a cyber or information security expert. I'm looking for a general evaluation of ...