Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
0 votes
0 answers
47 views

Is storing passwords in encrypted container still bad practice? [duplicate]

Suppose I need to store a bunch of passwords: storing them in a txt or odt file inside an encrypted container, such as the ones produced by VeraCrypt, is bad practice? Would I put myself at risk? If ...
user avatar
  • 101
0 votes
1 answer
411 views

Is it safe to send verification code in the subject of the email?

I am wondering if it's safe to send the signup, reset password, 6 digit verification code in the subject of the email. Example: "Welcome to the Application, Your verification code is XXXXXX" ...
user avatar
  • 105
0 votes
1 answer
1k views

Can my school look at my search history through Google Chrome if I am logged in through my school account? [duplicate]

I am doing online school at the moment and I am wondering if my school tracks and looks at everything I search just through my school Gmail account. I am on my own network and pc which has never been ...
user avatar
0 votes
0 answers
73 views

Secure authentication for sites which allow user to modify js/html

We have a site builder, allows users to add/modify JS/HTML/CSS. Is it possible to provide a global authentication for it? I mean users login once but can interact with all sites as their own names. ...
user avatar
  • 101
2 votes
0 answers
219 views

Grace period for users after re-enabling account disabled by PCI-DSS 8.1.4?

We have an automated system to disable user accounts that have seen no logins for 90 days. We also have a process of re-enabling such accounts (at the behest of the affected users), and this process ...
user avatar
  • 343
1 vote
3 answers
231 views

Admin change user details / account information in admin interface

I'm creating this admin dashboard, and I have a question wich I have been stuck on for a while now. And I'm starting to question what kind of data the admin should be able edit/view on the other ...
user avatar
1 vote
2 answers
177 views

Is my email, pc or something else hacked?

Recently I registered iCloud account with my gmail account. Now I received fake email from "iCloud" on mail.com email address which I use frequently for registering accounts on various sites....
user avatar
-6 votes
1 answer
169 views

Is it possible to hack a StackOverflow account? [closed]

Is it possible that a StackOverflow account can be hacked without the owner knowing? If a StackOverflow account is hacked, is any other information (like social media passwords) exposed other than ...
user avatar
  • 390
2 votes
0 answers
275 views

Is storing an encrypted 2FA backup on Bitwarden (a password manager) a good idea?

I am at the moment using Bitwarden and a separate 2FA app. I am trying to figure out a way to be able to securely recover my access to credentials and 2FA in case my phone/laptop/other electronic ...
user avatar
0 votes
2 answers
107 views

Store cookies for multiple sites on remote server and connect from multiple clients

Would it be secure to: Store all my website cookies (stack sites, webhost, github, web-based email, etc) on a remote server (using an customized open-source VPN or something) Login to the server with ...
user avatar
  • 105
0 votes
0 answers
71 views

How does Instagram know my location even if I use VPN and have no sim card? [duplicate]

I'm using this Instagram account only on my 2nd phone which has no sim card and airplane mode always on. I use VPN 100% of the time when connecting to the internet. The account isn't linked with any ...
user avatar
  • 1
16 votes
2 answers
11k views

How safe is it to store your passwords in a modern browser?

There's a few questions here along these same lines already, but they're nearly a decade old. I'd like to know if things have changed, especially now that Chrome has become more aggressive about ...
user avatar
0 votes
2 answers
318 views

Replace hashing function with asymmetric cryptography when password authentication

I would like to know if the following ideas are feasible: Hash function is one-way function. Generate public key from private key is irreversible(asymmetric cryptography). User password entry -> ...
user avatar
0 votes
0 answers
347 views

Android: How safe is PBKDF2 with a 4 digit pin?

Our Product Manager wants a 4 digit pin for login in our app, obviously for UX reasons, so user don't have to remember their password each time when they login. A refresh token can be retrieved from ...
user avatar
  • 101
0 votes
1 answer
117 views

How to store Personal Access Token securely on shared machine

We have a shared machine in the office, used for demo'ing our product. I want to be able to fetch the latest code from Github. We have 2FA enabled, so I can't use my login password for https ...
user avatar
  • 173
1 vote
0 answers
182 views

Different certificate issuers on same site based on browser

When I try to access some web site on firefox I get this: The cut out rectangle is COMPANY-NAME-ROOT-CA and that issuer (COMPANY-NAME-ROOT-CA) was also added as trusted on some peoples PC. But when I ...
user avatar
  • 11
5 votes
2 answers
2k views

I woke up and my email has been signed up to hundreds of online services. How can I fix this?

I woke up this morning to over 900 emails of several online services asking to confirm I’ve made an account. Last month my email had been compromised and they managed to get into my eBay and Amazon ...
user avatar
2 votes
1 answer
83 views

What all security do i need to check to secure my application? [closed]

For an application with login and logout functionalities and browsing based upon authentication , what all do i need to secure it ? I am basically very new to security and googling is leading to more ...
user avatar
1 vote
0 answers
77 views

In the context of emails, what can be digitally signed and what should be digitally signed in the sub context of deal documents?

I was once a customer of a certain developer who sold a SaaS bookkeeping software which allowed sending deal documents (invoice, receipt, etc) to a customer, from the software's very own email server, ...
user avatar
  • 11
10 votes
3 answers
6k views

How safe is opening any website on new browser tab?

When I do online shopping where I use my credit card information to purchase, I clear the browser cache, cookies and only open that single site. After I am done, I again clear the cache, cookies and ...
user avatar
  • 217
1 vote
0 answers
144 views

Is it a bad practice to store my user's ObjectId in a JWT in the sub claim?

Is it a bad practice to store my user's ObjectId in a JWT in the sub claim? I could create an alternate UUID field in the user database and use this instead, but I wondered if I should? I use this sub ...
user avatar
  • 111
26 votes
4 answers
4k views

On my website's account creation form, how to avoid leaking the information that an email address already has an account? [duplicate]

It seems common practice, when denying access to a user because of an incorrect email / password combination, to not specify which of the username or password was incorrect. This avoids leaking the ...
user avatar
  • 403
18 votes
1 answer
5k views

Why does Windows not always force me to confirm my password when changing it?

If I can change my password with cmd net user example * without needing to confirm my old password, why, when I change my password in the usual way (via settings or control panel), do I need to ...
user avatar
  • 183
0 votes
1 answer
115 views

Securing application server for a single user

I'm building some simple dashboard app for myself, but I want to have them on multiple devices - hence the server and front end. As I will be the only user who will access the application server, what ...
user avatar
2 votes
1 answer
78 views

Implications re security practices of full account access granted to third parties

I'm working with a company (say, Acme) that does some ongoing data collection and processing for me. The data in question is private but not all that sensitive. Part of Acme's service has password-...
user avatar
  • 121
0 votes
4 answers
300 views

Password is visible in online sign up form

I am about to sign up for an online school, which is an accredited statewide online school, and notice that the password they want me to enter is fully visible on the form. Should I be concern about ...
user avatar
  • 113
0 votes
3 answers
440 views

Android phone's lockscreen PIN disappeared?

I own a ZTE Axon 7 (model 2017G) that I purchased secondhand from a reputable vendor in Germany ca. 3 years ago. The phone has been working well, and I updated the OS to Android 8.0. manually earlier ...
user avatar
  • 181
0 votes
1 answer
122 views

How to guarantee only my client application can request a nonce?

I have a web site and a service in a server. I'm developing the "Register User" and "Login" components. I've searched on the internet and I've found two protocols to login user ...
user avatar
  • 103
78 votes
8 answers
15k views

What is the suggested best practice for changing a user's email address?

I recently jumped onto the hypetrain for an unnamed email service and am currently on my way to update all my accounts on various websites to get most of my (future) data off Google's Gmail. During ...
user avatar
  • 1,023
2 votes
1 answer
233 views

Authenticate limited client devices from server without login process

I have limited client devices and one server. I want to create a client-server secure connection while app installation but don't want human-interaction between devices and server like registration or ...
user avatar
1 vote
2 answers
152 views

What does it mean to get an email from someone with a different actual sender?

I got a strange email and I just want to confirm my suspicions. For background, I have my own email server which I set up using iRedMail on a VPS. I have an acquaintance who most likely has me on ...
user avatar
0 votes
2 answers
1k views

How might this Amazon account hack occur?

My mother recently had her Amazon account (buyer, not seller) hacked. She is not a security expert but does work in database management, so she is definitely not computer illiterate. I am also not a ...
user avatar
  • 101
2 votes
1 answer
319 views

Getting numerous HEAD requests by Java user agents to resources that require authentication to view within a web application. Should I block them?

I have recently started using Cloudflare's firewall in front of a web application. This app has a limited user base of selected applicants and they must log in to view anything. There is no public ...
user avatar
  • 175
1 vote
1 answer
288 views

Properly granting restrictive administrative privileges to developers on a production server [closed]

I am a business owner with a strong technical background, say a programmer, though not an advanced system administrator. I've bought a VPS server where I want to host several applications and webpages....
user avatar
  • 11
0 votes
1 answer
161 views

Why to use username and password instead of just a long password? [duplicate]

Why do most websites use the pair of username and password as we can just use a long password like a token to identify a user? A simple example: On the server, we create a JSON file with user data ...
user avatar
  • 117
2 votes
1 answer
79 views

Protecting an account after staying logged in in a public place

I had forgotten to log out of my personal T-Mobile web account on my computer at work today. When I came home, I remembered, so I logged on to my account at home (different computer, different network,...
user avatar
0 votes
1 answer
127 views

What do these credit security alerts mean?

A bank where I have an auto loan has a credit reporting feature. The feature shows that I have several "Dark Web Alerts" for "Compromised Email Address". The alerts list the breached sites, for ...
user avatar
  • 103
0 votes
0 answers
101 views

Dedicated device for online investing and other security measures

I like to invest money online. I invest in both cryptocurrencies as well as regular stocks. As my bankroll grows (let's say 20k+ in the near future), I feel like I need to start taking more serious ...
user avatar
1 vote
1 answer
198 views

Recycled phone numbers [closed]

I just wanted to ask because I am in a situation now, where I have been locked out of my Instagram due to my mobile phone provider deactivating my Simcard. I have contacted Instagram support sending ...
user avatar
5 votes
1 answer
244 views

Giving different passwords to the app servers to access the same database. Pros and Cons?

Let's say we have one db server. three app servers with full database access. Which scenario is the best? Each app server connects to that one database with different passwords. Example: app srv 1 ...
user avatar
1 vote
0 answers
130 views

Is using localhost for sensitive data secure?

I'm working with a nonprofit that wants to use CiviCRM to process its donor, member, and patron personal information. Civi is CMS-based, and will only run via WordPress, Drupal, Joomla, etc. Newb ...
user avatar
0 votes
1 answer
321 views

QR Code Security Testing [closed]

Within the scope of a project for my client, I test the existing site and the project for security vulnerabilities using OWASP ZAP. The client uses invitations with QR Codes and QR Codes to login to ...
user avatar
  • 131
2 votes
1 answer
142 views

Requiring an on-site visit to reset a password or get VPN access

This is a question born more from the user perspective but I'm wondering how it fits into a proper user creation and management policy. As a consultant I tend to work with various different clients ...
user avatar
3 votes
1 answer
229 views

Security of bank account using a 8 digit password

Few months ago, my bank forced me to change my password. It was a random 32 characters long password, stored in a well-known password manager. The new password had to be exactly 8 digits, to be ...
user avatar
  • 133
1 vote
2 answers
104 views

Wordpress Backups and Security

Apart from all the other security and design flaws of Wordpress, there is 1 point that particularly got my attention: "Automatic Backups". These are saved inside the Wordpress directory. If you ask ...
user avatar
  • 135
0 votes
2 answers
9k views

Discord server leaking IP addresses

I was on Discord, and someone sent me an invite to a server called "Operation: Pridefall". I didn't know what it was, the link is http://discord.gg/xxxxxxxxx - and the invite was legit. I thought it ...
user avatar
0 votes
1 answer
191 views

How safe is my login system (conceptually)?

I implemented a 2FA authentication for a web app with PHP and Google Authenticator. In order to login to my system there are a few steps: User types in a complex master password in order to access ...
user avatar
  • 135
1 vote
1 answer
979 views

using Uuid for security

I read that uuid does not bring any security advantages But I can't find why It doesn't bring a little bit of extra security in the scenario below ?: Consider that right now the session id is ...
user avatar
  • 13
0 votes
1 answer
148 views

Have I really been hacked or am I falling for a phishing scam [duplicate]

I received an email on the 14th saying that a hacker has access to my pc it says that at the time of hacking my account (myemail@gmail.com) had this password (it was a version of my password but not ...
user avatar
0 votes
0 answers
96 views

How to allow account recovery when a user loses everything?

Preface We are currently creating a new system for our clients and are stuck on account recovery when a user loses access to everything. The system is entirely controlled by our company in the ...
user avatar
  • 101

1 2 3
4
5
15