Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
2
votes
2answers
245 views

How do I protect myself against SIM hijacking/social engineering?

There are several posts like these: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd https://motherboard.vice.com/en_us/article/5984zn/listen-to-sim-jacking-account-ransom-...
8
votes
2answers
194 views

Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process?

According to the Google information page here: https://support.google.com/accounts/answer/6103523 If you don’t have another second step or forgot your password Note: 2-Step Verification ...
2
votes
1answer
142 views

Smartphone fingerprint plus iris scanning for login

I have often thought about the fact that when intimate relationship partners live together they eventually tend to sneak over your shoulder and gain access to your password on either your mobile phone ...
2
votes
1answer
151 views

Security implications of auto-submitting OTP?

So the question was originally asked as a part of the UX question here. My question is that, Are there any security risks involved when I auto-submit the OTP? Currently, I'm limiting the number of ...
1
vote
0answers
51 views

Automatic Paypal payment through API

I am building a game similar to HQ trivia, that when someone gives all the correct answers at the end of the game he or she gets money sent to their Paypal account, my concern is obviously security. ...
0
votes
1answer
56 views

iCloud Security Concern: browser session authentication storage after 2-factor?

Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie? My concern is, if ...
0
votes
1answer
118 views

Is using HOTP only authorization considered weak?

Migrated from ServerFault, as advised there. I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes. I fully understand 2FA is more secure than Single ...
2
votes
3answers
152 views

How are “security questions” not a major security hole for any application that uses them?

So the original security model was to ask the user for an email address, at time of account creation, and if they forgot their password the system would email a new password to this email address. ...
62
votes
5answers
22k views

Logged out of Facebook on all devices on a sudden. Should I be worried about being hacked?

A while ago, I was opening Facebook app on Android and then I got the message "Session expired. Please log in again.". I then tried logging in with my current password and was success to log in my ...
0
votes
1answer
1k views

Is it okay to save passwords as base64 strings with no other hashing or encryption beforehand?

I've just inherited a project where all the passwords on the server side are simply converted to base64 and put in the database. No salt, no hash, nothing. Just a simple db.Add(password.ToBase64) kind ...
1
vote
1answer
90 views

Is it safe to receive (One Time Password) OTP to the Mobile where the online banking application is installed?

Assume a customer of a bank is using online banking facility and he is using an online banking application on mobile (android). There could be a possibility that particular mobile could be ...
-1
votes
1answer
129 views

Is there anyway I can prove a snap account isn’t mine

My boyfriend thinks a Snapchat account is mine when it isn’t. Is there anyway I can prove this is not true if the owner of the account won’t message me back?
14
votes
6answers
3k views

Is it safe to store 2FA tokens together with passwords in 1password?

I'm using 1password and I've seen 1password allows you to store 2FA tokens in the same place where you store the password. I don't like the idea of having everything in the same place as if someone ...
1
vote
3answers
1k views

Is it normal for a website to show an API key in plain text that allows full access to your personal information?

I noticed some websites do this and I am not sure if this is normal or not. So for example, on some websites, I go into setting and can create an API key that will be visible in plain text. Also, ...
0
votes
1answer
131 views

Principle of Least privilege; is it ever a 'good idea' to give standard users administrative privileges?

There are a number of users in the business who are required to perform administrative tasks on machines, not least the IT Service Desk, also Devs etc. The only requirement for administrative access ...
6
votes
3answers
3k views

My sites have been hacked by cpamatik.com , it passes all security checks with Google and Sucuri, but still redirects, any idea? [duplicate]

Almost all my sites got hacked by cpamatik.com virus All CMS were up to date, plugins, modules etc..(Drupal and Wordpress) , some sites I have logged in to work on, but some sites I haven't touched ...
1
vote
1answer
304 views

Best practices to protect public/private SSH key pair in web interface?

I've got a dilemma here: I'm working on a system that will connect to remote linux servers for monitoring and automating some processes. Since user+pass is insecure for obvious reasons and public/...
2
votes
0answers
656 views

How to secure an API key from client side?

I'm having an issue and I'm pretty sure I'm not the first on that. I'm hoping to have a few great ways, hopefully bulletproof, to avoid any issues, so here it is. I provide an API that converts HTML ...
5
votes
2answers
160 views

Is it possible to use drawing or scribbling as a way of authentication?

There is a service called https://www.typingdna.com/ which authenticates users based on their typing habits and it works pretty well but it still requires a password. In order to try and replace the ...
2
votes
4answers
102 views

What are some existing or ideas where the use of a password can be replaced to login to a service? [closed]

The password has been a method of authentication for a long time now and we always hear of breaches happening where users passwords get stolen and sometimes are not even hashed at all or correctly. ...
2
votes
2answers
144 views

Why do login systems tell users an email address is not in the system? [duplicate]

Am I right assuming that by telling an attacker an email is or is not in the system the login is in fact weakened? Meaning if the attacker knows the email is correct he/she in fact already has 50% of ...
4
votes
2answers
833 views

Keeping AWS account ID secret

Must my AWS account ID be kept secret? Can anything at all be done using just the AWS account ID? From the AWS documentation: The AWS account ID is a 12-digit number, such as 123456789012, that ...
2
votes
0answers
60 views

What is the value of multi-page login forms? [duplicate]

Various sites use a multi-page login. On the first page the user is chosen (i.e. email address), and on the second page, a password is given. Many banks use it, Google has this also. I first ...
1
vote
0answers
84 views

Email login bug, is it a security concern for email users?

(The name is vague on purpose because I'm not entirely sure how bad of an issue this is or if it is well known yet and I don't want to accidentally leak some kind of major breach type thing) Scenario:...
0
votes
2answers
96 views

Should I change my built-in Administrator password?

I had never thought much about this until the only account on my home PC somehow lost admin privileges (changing to guest - I suspect this is a Microsoft bug but will probably never know). So, ...
121
votes
8answers
20k views

Why is storing passwords in version control a bad idea?

My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?" I gave him an answer that ...
2
votes
1answer
149 views

Concerted attack on linked google accounts?

Yesterday I received two (authentic) e-mails from Google saying they prevented sign-in attempts to two (very old) google accounts of mine. Google says they used the correct passwords, which turned out ...
2
votes
1answer
222 views

Is IP address whitelisting useful if the IP address is not “secret”?

I'm working on an application that will have access to API keys supplied by our users. The application makes API calls on behalf of our users. The API we're using allows users to whitelist IP ...
15
votes
3answers
4k views

Is this bank website secure enough? No https in login page

Today I opened a bank account to invest my savings. Here's the link to the login page: http://www1.directatrading.com/ I noticed it doesn't use Https protocol (neither is that page nor in the landing ...
2
votes
1answer
64 views

Is there a diagram based language for modelling security?

A lot of us will be familiar with UML for software engineering. Its uses are plentiful. Is there such a thing as a set of conventionally used diagrams for modelling any security scenario (speaking as ...
-1
votes
3answers
188 views

How to limit Administrators by day of the week

I have 69 Administrators in AD and I have noticed they are doing all kinds of whacky (and untrustworthy) things. This is an audit nightmare, and I was wondering if there is a way to disable an Admin ...
-2
votes
2answers
109 views

Best way to store passwords across devices? [duplicate]

KeePass is not good. It would work perfectly if all I wanted my passwords for were accounts on my computer, but if I needed to log in to Netflix on my TV, or my Facebook at a friend's house, I'm out ...
0
votes
2answers
123 views

Privacy of client's virtual machine in cloud computing

As we know clients can create and run their virtual machines (VM)in the cloud computing. My question is about the confidentiality of data stored in the client's VM. Question 1: Does data stored in a ...
2
votes
0answers
64 views

How safe are cookies for payment application?

Recently we started working on a mobile payment app.We are not looking for a way to implement a "Remember me" function. We wondered if we should use session cookies, JWT or maybe other method of ...
3
votes
2answers
137 views

Email/facebook account/internet protection service for private community

I apologize in advance for any inaccuracy. I am part of a yoga community which has no particular activity on the web or in the informatic sector. All we have that can be regarded as web-related is ...
2
votes
2answers
257 views

Frequent flyer number security risk or not?

Many booking websites or tickets "re-sellers" expose in plain view for the current authenticated user the commonly used "Frequent flyer number". Should this be considered a security risk? Can this ...
9
votes
5answers
1k views

Should I authenticate user on every request?

I'm working on a social network using Vue.js on frontend, and Node/Express on backend. To store user sessions I'm using Redis. I'm wondering if I should hit Redis everytime user requests content, or ...
23
votes
3answers
19k views

How to check if a Wi-Fi network is safe to connect to?

I always feel scared to connect to hotel, airport Wi-Fi etc. I feel that if the Wi-Fi router is hacked, my personal information can be collected by a hacker. How can I determine if a Wi-Fi network is ...
-2
votes
1answer
58 views

How to use Cox ISP and maintain secure account information? [closed]

Cox ISP has been changing my account information like my address, phone number and name to the wrong addresses, names and phone numbers. I ask them to make the corrections and they don't. Instead ...
45
votes
6answers
10k views

User Account with no password

I'm currently job searching, and sometimes I come across sites that are just huge databases full job postings, and before you apply you have to create an account. I came across a site, but I'm ...
1
vote
1answer
146 views

Dealing with shared credentials when an employee leaves

We have around 20+ accounts of different services (company email inboxes, forums, social media, Github, etc.) we use in my team. For security reasons, whenever some employee leaves us, I need to ...
1
vote
3answers
276 views

What are the security implications of allowing guest checkout using an email bound to known account?

For a webshop, we allow customers to place an order either as a logged in user, or as a guest. Guest checkout in itself is a quite common feature for webshops. The webshop in question is selling ...
5
votes
1answer
230 views

Dual - control (two man access) to AWS root logins?

I've been going around a few threads / questions here but none of them actually talked about concrete implementation of two-man authorization methods. I've read reasonable amount of ideas and "why"s ...
1
vote
1answer
34 views

Safely connect to remote site from cloud based code

I am connecting my computer located at my home to a remote server. To communicate with the server, I use a config file that contains my private and public keys and a passphrase. My code reads the ...
0
votes
1answer
70 views

Working from a USB [closed]

I have a Mac for my work laptop and I would like to work on my xCode project, I can't work on the laptop directly and save the file to computer due to fears that it could one day be recovered & be ...
2
votes
0answers
108 views

Strategy regarding an (almost always) offline app

I'm currently in internship in a software/app development company, where I have to come up with an idea about how can we handle the fact that the user will mostly use an app offline. Basically, the ...
17
votes
4answers
819 views

Help! My information has been stolen! What do I do now?

This is an attempt to ask a canonical question to expand upon another post with a similar name. The goal is to create something helpful that can be used as a duplicate when non experts ask about ...
3
votes
2answers
117 views

Keeping an ex or current spouse from accessing an account

I'm working on improving the security of an application for something much like paying child support. With that said, if the wrong person gains access to our application, it can become very dangerous ...
50
votes
6answers
22k views

Can a hacker, that knows my IP address, remotely access accounts I have left logged in on my computer?

I frequently leave accounts logged in on my personal computer because of the immense physical and cryptological barriers a hacker would have to overcome to access my computer. Could a hacker, that ...
3
votes
4answers
689 views

Do security questions make sense?

Is it a good practice, or is it obsolete? I'm asking because I've never managed to remember a single security question, thus I always write down the answers. I think they are useless, long passwords ...