Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
3 votes
1 answer
1k views

CSRF double submit cookie pattern questions

I have some questions about CSRF protection, specifically about the "double submit cookie" pattern. What I have learned so far, is that this pattern has some weaknesses. But we can add some ...
user avatar
  • 31
1 vote
0 answers
70 views

How to provide | revoke access to an AWS machine without going through the AWS console

Assuming if you do via SSH (which is shared among multiple team members), how to manage this from a security perspective or should each user be given a separate SSH key
user avatar
  • 111
2 votes
2 answers
228 views

Do account names need to be protected? [closed]

I signed into my bank's website and they demanded I change my username because it was found on the web--duh, it's my name and I've been online since the old BBS days. Huh? Since when are account ...
user avatar
0 votes
1 answer
133 views

Google Chrome, the best bet for online privacy? [closed]

You may think I'm crazy, that's why I'm here to ask. I read this page which went over the privacy and security of many if not all browsers. From his reporting, and my own logic, that the government ...
user avatar
  • 103
1 vote
2 answers
318 views

Noob question on security of localhost

This may already have been answered, but I'm having difficulty understanding the technical jargon of various posts. I have to give a Callback URL to receive some sort of validation, to use an API. ...
user avatar
1 vote
1 answer
514 views

Does adding a recovery phone number to a Gmail account make it less secure, in the case that I lose both my laptop and phone?

Background I have a "main" Gmail account, which I set to keep logged in, on my laptop. This "main" Gmail account is important, because it's the email address I used to sign up for ...
user avatar
1 vote
0 answers
113 views

Why do I receive so many password reset/welcome emails from services I'm not a customer of? [closed]

Over the years I've received the occasional password reset from a service I've never used (or even heard of sometimes). As far as I can tell, the emails are genuinely being generated and sent by the ...
user avatar
  • 111
1 vote
1 answer
455 views

Is it safe to use 2FA within a password manager relative to using a separate app for 2FA? [duplicate]

Nowadays, many Password managers offer options for 2-Factor Authentication such as TOTP. I am really confused regarding this. Isn't the whole point of 2FA is to prove you have a second way of proving ...
user avatar
  • 2,652
1 vote
0 answers
198 views

httpOnly Cookie Security Flaw

I'm bit confused about this security flaw. I'm in real need of help in this :smile: My express code (not using any sessions, just cookie-parser) app.get("/signin", (req, res) => { if(!...
user avatar
2 votes
1 answer
296 views

What precisely about Zoom is not secure? [closed]

My agency (which isn't a high security-risk, top-secret place) has an almost zero tolerance rule for Zoom and I am curious why. We are told to use WebEx instead but I fail to see why WebEx is more ...
user avatar
1 vote
3 answers
1k views

Are security questions considered as 2FA?

Many sites have a step during registration when you have to create security questions and answers for them. Is this type of security layer considered as 2FA? From what I know, 2FA is used for the ...
user avatar
  • 41
1 vote
3 answers
306 views

Why is it not recommended to permanently use the root account for all tasks?

Yes, I did read this answer: https://apple.stackexchange.com/questions/192365/is-it-ok-to-use-the-root-user-as-a-normal-user/192422#192422 But I still fail to understand the reasoning behind this ...
user avatar
  • 5,607
1 vote
0 answers
100 views

Email Takeover Scam? [closed]

I've been receiving a lot of email lately intended for "Daniel L...", a person with the same last name and same first initial as me. It appears this person has requested information from ...
user avatar
  • 193
1 vote
0 answers
105 views

How Can I Backup App Data In Android/iOS Devices?

After my other post I'm looking over some other possibilities to do what I'm trying to do. How To Recover End-To-End Encrypted Data After Losing Private Key? If I save user data in server, in order to ...
user avatar
  • 247
12 votes
4 answers
8k views

How To Recover End-To-End Encrypted Data After Losing Private Key?

I'm creating a mobile app which has chat feature in it. Since I wanted to make it secure, I'll do some encryption to messages and the data. I'm thinking of using End-To-End encryption for it but I've ...
user avatar
  • 247
0 votes
1 answer
135 views

How do I prevent my Facebook and Instagram acccount from appearing in "people you may know" recommendations?

Facebook tends to "recommend" your account based on IP and collected data. How do I keep it hidden from people that are geographically related to me? I want to create a pseudo-anonymous ...
user avatar
1 vote
2 answers
122 views

Site password being used to secure ZIP download, are they storing my password in plaintext?

Recently a utility provider has started to attach a zip file including my bill inside, however, they have secured the zip file using my online web account password. I am not too concerned about ...
user avatar
13 votes
2 answers
4k views

How does Google save our passwords on their server?

My friend recently told me that: Google doesn't have our passwords saved on their database. Instead they put our password when typed on browser, through an algorithm and it'll produce a unique ...
user avatar
2 votes
3 answers
204 views

How can I prevent API bot automation by a legitimate user?

My web application is a long sequence of games, which submit progress results back to the server via a web API. These progress messages are how we know how many points the user has earned. The points ...
user avatar
4 votes
0 answers
149 views

Is asking the e-banking username/password from a 3rd party site compliant with 3dsecure and PSD2?

Recently I tried to make an online purchase in one of the biggest e-commerce sites in Greece. During checkout, and after providing debit card details, it asked me to provide the username/password (not ...
user avatar
0 votes
1 answer
199 views

How Forgot Password Works?

For my website I need to add "forgot password" functionality. As I searched on the internet there are too much vulnerabilities you may encounter in case of wrong implementing this ...
user avatar
  • 3
1 vote
1 answer
197 views

Why don't security conscious websites use a combination of private unique identifier and password to secure their logins?

To be clear when I say "private unique identifier" I mean an identifier, which is not stored on the database for the website, it would be hashed in combination with the password and a good ...
user avatar
  • 115
-2 votes
2 answers
163 views

Encryption layers

I'm curious, as a green programmer, if one used layers of encryption methods, would this be more difficult to crack or impossible? Example: Layer 1- encryption method 1 "Encrypt this string" ...
user avatar
  • 117
0 votes
0 answers
31 views

How easy to crack simple, custom algorithm? [duplicate]

Out of curiosity. I am a green as grass programmer coming from other career disciplines and am learning multiple languages right now so play nice and keep it simple please. Interested in simple ...
user avatar
  • 117
0 votes
1 answer
88 views

Is using a server as bridge secure enough to protect the end data?

It comes to my mind a security problem that I would have accessing some data. My current problem is the following: There is a server in AWS London where you can access some data, by law, that data ...
user avatar
  • 111
3 votes
1 answer
140 views

Should users be allowed to to login with the same email when an email change is requested but not completed?

I've found a very similar question: Should users be allowed to log in with the same password when a password change is requested but not changed?. But the key difference here is that requesting an ...
user avatar
0 votes
2 answers
531 views

Is there any additional overhead over using Oauth vs Client Certificates?

I have a requirement to add security between service to API communication. The current implementation is client certificates. The client gets a certificate and just sends it in a cookie to the API. ...
user avatar
  • 103
1 vote
1 answer
106 views

Push button in Security key used for 2FA/MFA

I have come across many security keys from different manufacturers such as solokeys, yubico etc.., for the purposes of 2FA/MFA. Products vary basically w.r.t features such as USB-A, USB-C, Apple ...
user avatar
1 vote
0 answers
70 views

2FA/MFA in a resource-constraint product

I'm working on a resource-constraint product and asked to enable support for MFA/2FA for all maintenance services. Given that MFA/2FA is about using two elements out of three(something you have, know, ...
user avatar
-1 votes
1 answer
158 views

Following the new WhatsApp data privacy update, why does WhatsApp ask from users, even if they didn't, who is going to check their source code?

New WhatsApp data privacy update, that it will share our data with Facebook, we all know Facebook owns WhatsApp and this is obvious Facebook can always access users of WhatsApp as well. So why to ask ...
user avatar
  • 99
1 vote
0 answers
128 views

Zero-Trust alternative to google sign-in, is this a feasable design?

I was thinking about zero-trust systems over the last few weeks and it seems like there are many things that could be implemented that way. With password managers being one of those things, I was ...
user avatar
  • 697
1 vote
0 answers
106 views

How do you protect against Active Directory Golden Ticket Attacks?

I'm looking at hardening our AD. One concern I have is around Golden Ticket Attacks using Mimikatz and the likes (https://attack.stealthbits.com/how-golden-ticket-attack-works). One of the things that ...
user avatar
  • 71
1 vote
1 answer
229 views

Is it possible to get infected when using a smartTV between two computers?

Been given a smart tv that used to be used as display connected to a pc with a HDMI cable, now I'm using it as a display as well, over HDMI too. I was thinking maybe when connected to a network or ...
user avatar
0 votes
0 answers
101 views

Returned computer with Microsoft Account : have I compromised security?

This may not be the correct place to ask. Forgive me, if it is not. I bought a computer from ebay second-hand and did not receive activated Windows 10. When I requested a registery key I was sent an ...
user avatar
  • 101
0 votes
1 answer
2k views

In what cases people know that I see their stories on instagram or mystalk? [closed]

I don't have an instagram account, but I always look to my friends' profiles on instagram or mystalk and see their stories. BTW my google account is always signed in when I check their stories on ...
user avatar
  • 103
2 votes
0 answers
134 views

How good can X-Frame-Options HTTP header do against click-jacking?

X-Frame-Options HTTP header is used to tell if a webpage is allowed to be used in a frame/iframe. Frames can be used for click-jacking/UI-redress attacks. It is advised to set X-Frame-Options to '...
user avatar
  • 121
0 votes
1 answer
89 views

Permissions to set for Secure internet browsing in Windows 10 (Pro)

In the recent past I have been a victim of virus/malware attacks on my home computer running Windows 10 (Home), since I used the same account with high access rights to also browse the internet. ...
user avatar
0 votes
0 answers
71 views

Most secure way to authenticate VPN via script for connection from remote server to home network?

What is the most secure way to automatically connect my remote server via OpenVPN to my home network for running a script? The plan is I want to automatically backup some folders to my Synology NAS at ...
user avatar
  • 11
0 votes
0 answers
22 views

Found out that a paid VPN service emails plaintext passwords [duplicate]

I recently found out that a VPN service does not hash their customer passwords and I need professional insight on how to deal with this. Here's how I found out: Bought a subscription on the wrong ...
user avatar
0 votes
1 answer
336 views

Can the school see what you do on the school's Google account even on your own device and at home?

I was on my normal gmail account that I always use, then this website opened my google docs app which was signed into my school account and it put some weird stuff on there like “i’m the hottest girl ...
user avatar
1 vote
1 answer
96 views

Direct VPN access to DBs - government guidelines (DBAs at home COVID)

We have DBAs who want to access SQL DBs over DirectAccess (DA). The ask is to open port TCP 1530 over DA. At the moment, we have 6,000 people using DA, we can't filter on a specific group of DBAs. ...
user avatar
  • 71
9 votes
1 answer
544 views

Why do some sites enforce low-security passwords? [duplicate]

I get that what comprises a good password is a bit of a moving target and not everyone agrees - just run a password through a number of checkers to see how it is rated differently depending on the ...
user avatar
  • 91
1 vote
0 answers
409 views

My college manages my Google account, can they view my browsing history if I use a personal device on a home network while logged in?

I have found multiple sources telling me otherwise, but most are outdated by a year or two. If I am logged into my G-suite managed account on google, and search something up on a home network and ...
user avatar
  • 11
0 votes
1 answer
161 views

Security risk for allowing accounts without captcha

I run a website that allows people to create accounts with an email address address and a password. Over the last month, I have had about 100 accounts created with email addresses that look like this:...
user avatar
0 votes
0 answers
108 views

Accounts hacked. Eventually showing a different device

I recently made a new Facebook account from my android phone [ver. 6.0.1] and when I checked active sessions, instead of my android device a, Linux desktop was displayed. Then I checked my Gmail and I ...
user avatar
3 votes
2 answers
350 views

Protecting an invitation to join the system

I'm having a debate with a coworker right now about how to design an invitation system. The idea is that the mobile app will be able to send an invitation link to, say, a Whatsapp group, and people ...
user avatar
2 votes
0 answers
264 views

In forgotten password is asking user their TOTP among other details secure?

I have started to work on the Forgotten password feature on my website. Based on OWASP Forgot Password cheatsheet, the user should provide enough information to confirm that it is really them. The ...
user avatar
  • 3,743
0 votes
1 answer
73 views

Deactivate MFA protected accounts

Does it still make sense with multi factor protected accounts to deactivate them after a certain period of inactivity? I'd say yes because the user himself probably doesn't remember that an account ...
user avatar
  • 137
0 votes
0 answers
106 views

how did they get my credit card

I recently went on to the Dr Squatch website to buy some soap that I've been seeing in all of those Youtube video ads. What happened really freaked me out. The website asked for my email, and I ...
user avatar
0 votes
2 answers
123 views

Logging SSH commands on Linux - is custom kernel the only way?

I've done some research and it looks like that the way linux keeps history is less about security and audit and more about helping the user. Even after making changes to instantly log the command and ...
user avatar
  • 3,086

1 2
3
4 5
15