Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
0 votes
1 answer
128 views

Does Microsoft scan the contents of documents uploaded to onedrives personal vault?

Specifically do they, but not "Can they" only because I'm fully aware that they are, and always have been, capable of intruding on any/all personal/sensitive data that isn't encrypted on a ...
user avatar
  • 1
0 votes
1 answer
73 views

O365 MFA: Challenge (Approve or Deny) sign on - dangerous?

I have been searching resources online about proper MFA/2FA (with O365 specifically) considerations. How is the MFA push challenge notification to Approve or Deny a sign-on not dangerous? I have yet ...
user avatar
  • 1
0 votes
1 answer
171 views

Why not use a long life session ID for auto-login instead of a persistent cookie with a token?

On the PHP website it is stated that "Developers must not use long life session IDs for auto-login because it increases the risk of stolen sessions.". Instead it is recommended to use a ...
user avatar
  • 1
1 vote
2 answers
358 views

Virtual Yubikey [closed]

If reports are to be believed, Google and others are starting to force 2FA on user accounts starting late ~2021: https://www.theverge.com/2021/10/5/22710421/google-security-2fa-inactive-account-...
user avatar
  • 27
0 votes
1 answer
85 views

Using SSO for a cryptocurrency app

Let us say you have an app where the users will be required to deposit cryptocurrency. Is it safe to let users sign in with third-party authentication? For example "sign in with Google" or &...
user avatar
  • 133
1 vote
1 answer
149 views

Why do services generate multiple 2FA backup codes?

In case you lose access to your two-factor authentication (2FA) codes, you are only required to enter one of the backup codes. So why do services like Google generate multiple codes if it doesn't ...
user avatar
  • 113
18 votes
2 answers
3k views

Will this Account Lockout mechanism increase the severity of a information leakage vulnerability that leaks usernames?

I found an information leakage vulnerability on a company website and I found that the information includes all the usernames of the users. I also observed that the application uses a lockout ...
user avatar
0 votes
2 answers
118 views

Low-privilege account and sudo permissions

Ok, so one common security practice is creating a low privilege account to work from when not installing tools and making system changes. This question is more towards penetration testing platforms. ...
user avatar
0 votes
1 answer
68 views

Active Directory Security Advice/Insight For Intranet Application

I have been tasked with coming up with the authentication/authorization for an enterprise intranet web application. The requirements I were given were: Must authenticate against Active Directory All ...
user avatar
  • 101
0 votes
0 answers
86 views

Problem regarding secret messages on Facebook

A few days back,I downloaded the Facebook download your data and found a place in messages where it is shown that I have sent and received secret messages. But I am sure that I have never sent or ...
user avatar
  • 1
7 votes
1 answer
4k views

Logging in as another user - Security Issue

Two users are using same web application online. Suddenly, I checked my profile and it was data of another user. How this is possible? We both are using the same app at the same time, the app is on ...
user avatar
0 votes
0 answers
80 views

Is it possible for someone to get my personal information if I log in with their google mail id in my device for some work related thing?

I was working on an app for a client which had a premium subscription with play store with their mail id, so I had to log in with their email on my device to test the application. But right after I ...
user avatar
0 votes
1 answer
132 views

Are there any other account system attacks I should be aware about?

Not fully sure if these types of questions are allowed here, but don't see anything against it in the help centre so I'm assuming it is. Please point me to a better place to ask if it's not! I'm ...
user avatar
0 votes
1 answer
107 views

Storage access permissions before initial unlock upon startup

How do Android devices (at least all the non-enterprise personal devices I remember owning) display the wallpaper (usually chosen from the 'downloads' folder) on the lock screen when it first is ...
user avatar
0 votes
0 answers
30 views

OTP vs Passwords [duplicate]

People hate having passwords for numerous apps on their phone. I want to create an e-Commerce app with some social features like following friends, so I was thinking to replace the passwords and ...
user avatar
  • 1
0 votes
0 answers
25 views

Is there any way to deal with hacked website? [duplicate]

Our website has got hacked and we have no idea how to deal with it. It's a core PHP website uploaded over Cpanel. Now neither we are able to open Cpanel nor hit the website. It shows this: Now, what ...
user avatar
1 vote
0 answers
122 views

Potential Western Union Scam - Account Registration

In recent weeks I have seen a handful of senior employees in my organization receive a confirmation email from Wester Union for a new account creation. The issue is that none of these users have ...
user avatar
  • 172
2 votes
3 answers
444 views

To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?

I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
user avatar
  • 131
0 votes
0 answers
366 views

Security: Plaid vs Quicken vs Mint

Why are people so quick to criticize Plaid for using login info when trusted apps like Mint do the same thing? They require username and password for bank info, but seem to be trusted. I wanted to use ...
user avatar
0 votes
4 answers
248 views

Forget Me Not? Abandoning the Forgot Password Functionality

They say a chain is only as secure as its weakest link. When it comes to account security it seems to me that the Forgot My Password functionality is the weakest link in the security chain because it ...
user avatar
1 vote
1 answer
195 views

Your username can only be changed once?

I've seen quite a few security centric sites enforce this policy: Your username can only be changed once My question is: Is this done from a security standpoint? If yes, what is the logic behind it? ...
user avatar
1 vote
1 answer
133 views

Can Identity Theft Protection Services Get Hacked?

I recently was dumbfounded by a question whether identity theft protection services can get hacked. Me and my family we're T-Mobile customers in the US and after the recent T-Mobile hack we got free ...
user avatar
  • 153
0 votes
3 answers
189 views

Is it safe to open email links in a private window?

Sometimes there are links on the email you have to click because they are agrements, but they are coming from a different URL. As of now what I'm doing is opening a private window and pasting the link ...
user avatar
  • 363
1 vote
1 answer
160 views

Is there a way to know when someone tries to guess your gmail password?

Is there a way to check if someone is trying to login to my Gmail account without knowing the password (so they keep trying to guess the password and failing repeatedly or trying to guess the answers ...
user avatar
0 votes
0 answers
59 views

Are ACL IDs considered sensitive data?

I imagine this is a redundant question by the inherent nature of ACL's, however I can't find any inkling of an answer so I'm happy to be the one to ask. Specifically related to the Parse platform but ...
user avatar
  • 117
0 votes
0 answers
102 views

How many emails and accounts an organization's administrator and developer should have?

Let's say there is a small organization called "Example" with the registered domain "example.com". There is a person, Bob, who has full control over the organization's GitHub ...
user avatar
1 vote
1 answer
804 views

OpenSSH AuthorizedPrincipalsFile Allows Any User

I am bewildered as to the below config and subsequent behaviour. /etc/ssh/sshd_config: AuthorizedPrincipalsFile /etc/ssh/principals /etc/ssh/principals: all host.example.com dev This allows me to ...
user avatar
2 votes
1 answer
288 views

If browsing the web with root is dangerous, isn't browsing the web with a sudo enabled account only marginally safer?

If I get hit with malware while performing daily tasks (e.g. - checking email, web browsing, etc.) with a root shell, the malware will own my machine. If the aforementioned occurs whilst on a standard ...
user avatar
  • 43
-1 votes
2 answers
189 views

Is it Safe to Rely on Gmail API to Reward Users for Placing Orders on Merchant Sites?

I have an application that rewards users for placing orders with certain merchants. In order to verify that the order was actually placed and delivered, a user is required to grant us read access to a ...
user avatar
0 votes
1 answer
145 views

Should I save my 2FA setup keys instead of recovery keys?

In case we lose access to our 2 Factor Authenticator, we can use our one time recovery codes to regain access to our accounts But what if we store the setup key itself instead of the recovery codes? ...
user avatar
  • 1
1 vote
2 answers
158 views

Is it normal/safe/justifiable that a bank asks me for my full login details (account id and PIN) when calling via mobile phone?

I am calling my bank via mobile phone (in Germany) and the electronic voice asks me to type in my account access id (via the number pad), and like-wise, type in my account PIN, all the numbers, not ...
user avatar
  • 111
0 votes
1 answer
134 views

Am I writing a good login system? [closed]

I am designing a login system for my React app. All user data must be protected in case of a db leak. I only store encrypted data, with the exception of the email. To encrypt I need a key and I don't ...
user avatar
84 votes
7 answers
21k views

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

I did some research about how secure and private SMS messages are. Providers and governments can see these SMS messages in plaintext, but what is weird is that these messages are not encrypted in ...
user avatar
2 votes
1 answer
134 views

Security implications of using a non-hash in the password column

Imagine a webapp that uses a traditional email-password-login, with the users-table saving the password salted and hashed using bcrypt. Now a secondary login method should be implemented, like an API ...
user avatar
2 votes
2 answers
2k views

Will Google Authenticator stop a sim-swap attack from compromising my Coinbase?

If I use Google Authenticator for Coinbase, and someone sim-swaps my phone number and gains full access to my email account, can they drain my Coinbase account? They would be in control of my email, ...
user avatar
1 vote
1 answer
123 views

Questionable email from discord [duplicate]

I got a gmail from discord saying a new account had been registered and prompting me to click a verification link. Weirdly, I never made that account, and I already had a discord account under my ...
user avatar
0 votes
0 answers
128 views

MacBook Pro is Powered On but Locked. Is my VeraCrypt data Readable if Laptop Stolen?

Secenario Consider the case of a MacBook Pro with FileVault active. The computer is on and I'm properly logged on. I frequently need to access sensitive data located in text files on an encrypted ...
user avatar
10 votes
4 answers
3k views

Password management of emailed cleartext passwords

If a website emails a password in cleartext when you use the "forgot password" function, is there any possibility that the password is hashed? It does generate a different password if you ...
user avatar
  • 103
0 votes
1 answer
108 views

Should I use in-app 2fa If I login with google (and have 2fa on google on)

All users in my google domain use 2fa on google accounts. We have on-premise software (gitlab for example) that allows us use google accounts to login. Also, gitlab has a feature of 2fa. Should we use ...
user avatar
0 votes
2 answers
207 views

Password Strength Determination

Recently, I've checked the some articles including R. E. Smith, The Strong Password Dilemma. ch. 6., Password Strength: An Empirical Analysis, Distance between two passwords and Password strength ...
user avatar
  • 103
0 votes
0 answers
163 views

Best secure approach with Basic Auth

Due to several customer reasons our product needs to support Basic Auth as primary authentication mechanism with client's service account. We are using Bcrypt to store customer's password in our DB, ...
user avatar
2 votes
1 answer
90 views

Sharing account verification tokens to third parties

This is a brief sanity check for myself to confirm whether or not the premise of the title is a good idea or not. Suppose we have an internal system for password reset or account verification. When a ...
user avatar
  • 23
0 votes
1 answer
323 views

Can my company track my laptop if I've reinstalled the operating system?

I was given a laptop by my company. I reinstalled everything and now I occasionally open Whatsapp web in the background to reply to messages. Most of the times my laptop is connected to the Company's ...
user avatar
0 votes
2 answers
104 views

Is it possible to remove data from specific folders on any unauthorized login attempt?

I have a Windows 10 PC. I don't want anyone to grab my private data stored on my PC even if they manage to get my login password. Earlier, I used software that can easily get rid of any administrator ...
user avatar
  • 101
0 votes
0 answers
74 views

Display a token's expiration date to a user

We use multiple kinds of token in our system for : Invitation to joint a group Account creation (validate if the user possesses the email address) Validate email address The tokens are sent in a ...
user avatar
1 vote
1 answer
496 views

How good/bad is this implementation to secure password?

I've just started new project and decide to try something new, so I'am not using anymore EnityFramework and Identity framework. I Decide to try MongoDB, so i wanted to design from scratch storing ...
user avatar
  • 113
1 vote
1 answer
112 views

How do Services recognise 2-Factor Authentication codes as correct?

Something about the flow of setting up 2-factor authentication is not clear to me. This is the flow of setting up a Service* to use a 2-factor auth app**: Choose setup 2-factor auth in the account ...
user avatar
-1 votes
1 answer
129 views

Security technologies that implements security through "organic-like" obscurity? [closed]

Are there any advanced security technologies, for example, establishing a secured connection, which first require authentication based on security through organic-like changing obscurity of secrecy? I'...
user avatar
  • 1
14 votes
6 answers
6k views

2FA: Why do I need to keep my backup codes for each platform on paper?

I'm looking into setting up 2-factor authentication for my registered accounts. However, when setting up 2FA, for example Reddit, you need to write down backup codes in order to regain access to your ...
user avatar
  • 259
3 votes
1 answer
1k views

CSRF double submit cookie pattern questions

I have some questions about CSRF protection, specifically about the "double submit cookie" pattern. What I have learned so far, is that this pattern has some weaknesses. But we can add some ...
user avatar
  • 31

1
2
3 4 5
15