Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
0 votes
0 answers
76 views

How to verify the genuine user identity using Google signin API?

I'm developing a mobile app. I have a question, and here is the scenario. If a person is logging into the App with google sign in API in a public network. The website will verify the user with his ...
user avatar
0 votes
0 answers
151 views

Ionic local storage store sensitive data for private app

I'm new to the ionic framework and have some basics of it and currently I'm developing a private app for my family only that store some sensitive information in the localstorage. I used some crypto ...
user avatar
  • 1
1 vote
2 answers
221 views

In case of TOTP code generation, why do products prefer a generic authenticator apps, such as Google Authenticator?

All the products supporting TOTP-based 2FA use one of the common authenticator apps such as Google Authenticator, Authy, etc. I want to understand whether there are any security reasons behind why ...
user avatar
0 votes
2 answers
119 views

Why is having the username and password no longer enough to log in to an account anywhere?

I have a friendly, fun bot on Twitch. I haven't logged into its account for ages, purely communicating with the Twitch API and their IRC service. The other day, they announced a new annouying "Oauth" ...
user avatar
1 vote
0 answers
504 views

Why does THC Hydra and Medusa give false positives when used on TP-Link Netcam?

One of the tests I carried out was brute-forcing. I already knew what the username and password was for a factory reset IP Netcam but wanted to see how it would work in practice and if it even worked ...
user avatar
  • 11
1 vote
1 answer
238 views

Find the flaw in my architecture: Shamir's Secret implementation for data encryption and recovery

This will be a long one. Here's the thing: I want to build a privacy-preserving system where the user data is not even accessible to the database administrator. Intuitively, I immediately thought ...
user avatar
41 votes
4 answers
10k views

Are password managers more secure than a slightly different password for each website?

Let's say I use a 5 word password composed of 4 words plus the name of the website I'm accessing. For example for GitHub, it would be something like "correct battery horse staple github". How is that ...
user avatar
  • 529
2 votes
1 answer
460 views

Off-Facebook activities received from apps and websites NEVER logged in via Facebook

Facebook has recently launched "off facebook activity" which lets you see all the activities shared by other apps/websites that you have interacted with. But how did those apps and websites share ...
user avatar
0 votes
0 answers
18 views

If I store users username and password in cookies, for next time users logged in if they were clicked the remember me, is that a good idea? [duplicate]

I built new web application. In my login system I make remember me check box, If user clicks on that then his/her username and password will stored in cookies so for next time they will logged in ...
user avatar
0 votes
2 answers
3k views

How to make sure my phone is secure after a phishing attempt?

Situation: My phone is an android (Samsung Galaxy s6) - In a moment of mindless distraction yesterday I opened a pdf in a phishing email - it did contain a link but I did not click it. Very shortly ...
user avatar
0 votes
0 answers
30 views

Sending password plain text in POST body is safe? [duplicate]

I recently started learning about pentesting, and I tried to see the request body of a website that I use frequently, and that's what I saw: ("senha" means "password" in portuguese and "entrar" means ...
user avatar
1 vote
1 answer
139 views

How to prevent attempts to log into my accounts?

I'm sure everybody knows the e-mails that many web services send out when you log into your account from an unknown device or geo-location to inform you about suspicious login activity. The problems ...
user avatar
2 votes
2 answers
588 views

How to know if my router has been hacked?

I have a (maybe dumb) question for you. I was wondering if there is a way to know if my router has been hacked. I secured it the best that I can and also made it so only the mac addresses of the ...
user avatar
  • 21
2 votes
2 answers
718 views

Can an Android app steal cached/stored passwords from other apps on my phone

Can an android app steal a stored password from any other app I have installed? Say I have snapchat and I only log in once and stay logged in, if I later delete the cache from that app it will log me ...
user avatar
142 votes
24 answers
25k views

Why can't I just let customers connect directly to my database?

I'm pretty sure this is a stupid idea but I'd like to know why, so bear with me for a moment. Lots of the work backend developers do is providing CRUD access to customers via HTTP, essentially mapping ...
user avatar
0 votes
2 answers
705 views

False positive security alert from Google?

I just had this security alert about one of my Google accounts: Device : Unknown device Time : 25 minutes ago Place : United States IP Address : 2a00:1450:4864:20::51b Someone just used your ...
user avatar
  • 119
0 votes
1 answer
516 views

How does BINs vulnerabilities work?

Many companies have some BINs where you can enter a fake credit card and you get a premium account (the Credit card is based on a BIN that just trick or bypass the plateform), I want to know how ...
user avatar
0 votes
0 answers
45 views

My PC was infected by belombrea dot com. Kaspersky didn't detect it. Is a factory reset enough? [duplicate]

Also I had it for around 3 days. It downloaded a file that's 1kb big on my PC. What should I do? I'm afraid to use my PC again.
user avatar
-1 votes
1 answer
97 views

Privacy: why do I have to delete an account instead of simply no longer using it?

I try to avoid big internet companies (big tech) and try to find decentralized and/or open source alternatives. I use a password manager with unique usernames and generated, complex passwords. A lot ...
user avatar
  • 1,409
1 vote
1 answer
132 views

How can one mitigate both account-level DOS attacks and online brute force attacks at the same time?

I was recently reading this question, where the accepted answer claims that it is easy for attackers to bypass rate limiting that is based on IP, which makes any sort of IP rate limiting to prevent a ...
user avatar
  • 215
1 vote
4 answers
6k views

Could modded versions of Kik messenger pose a security threat to other Kik users?

I was on the Kik messenger app, and someone in a group chat posted screenshots of his modded Kik app that contains an "IP grabber". He said he could hack people easily, and was very fast to tell me my ...
user avatar
2 votes
1 answer
569 views

Security of PIN that spells out words?

Description PayPal suggests that generating a PIN by spelling words (on a numeric pad, e.g., [ABC] = 2) is a good method for security and memorability, e.g., B-L-U-E-C-O-W = 2583269. My knowledge ...
user avatar
  • 123
0 votes
0 answers
22 views

Does hashing client-side increase security when dealing with an untrustworthy server? [duplicate]

Does hashing once on clientside and once on server-side increase security when dealing with an untrustworthy server? For example when dealing with open source projects where users can self-host their ...
user avatar
  • 1
0 votes
1 answer
267 views

school google account on my school computer

I'm logged into my school Google account at home. Can what I search at home on my own computer be checked by my school even though I'm not using their computers?
user avatar
5 votes
3 answers
298 views

Is Using VPN Useful For Strictly Personal Use?

I understand the necessity of using VPN when connecting to the work network from the outside. What I want to know is there any benefit for a strictly consumer computer that is connected to the ...
user avatar
2 votes
1 answer
208 views

Double JWT submit method

I'm implementing my JWT method by using the double submit method: where we separate the payload & header portion of the JWT from the signature. The header & payload is stored in a separate ...
user avatar
  • 335
0 votes
1 answer
374 views

Creating secure virtual machine that nobody can see its content including the host machine? [duplicate]

This problem is completely different from "running malware in a VM"! Suppose I want to have a virtual machine running some software with secret data. But I do not have complete control of the host ...
user avatar
  • 103
2 votes
2 answers
656 views

Password reset link vs Temporary password

Which is harder to exploit: Password reset link with tokens/timestamps/code/ticket etc Or, temporary password sent on user mail using which login can be done and password can be changed. Any ...
user avatar
0 votes
1 answer
604 views

Unknown Google Account Signed into Browser

An unknown Google account is signed into Firefox on my Arch Linux machine. The computer is in my apartment (where I live alone) and I lock the screen when I leave. Some observations: The unknown ...
user avatar
2 votes
3 answers
268 views

Downsides of allowing multiple emails per user?

There's lots of information on using one email for multiple accounts, but how about the other way around? I'm building a service and considering allowing users to log in with any of their registered ...
user avatar
16 votes
3 answers
5k views

Am I generating email link tokens correctly?

I am developing a reliable system for token generation and validation used mainly for links in confirmation emails (reset password request, change email flow, activate an account, etc...). There are ...
user avatar
  • 261
0 votes
1 answer
155 views

Why ASP.Net Identity sends sensitive information to clients?

As far as I understand, Identity sends to the user an encrypted token with some user information like the user name and expiration date. Then, when a new request arrives to the server, it decrypts it ...
user avatar
  • 123
27 votes
8 answers
13k views

Are there joint password accounts? (Like bank accounts)

Online joint accounts that are similar to bank accounts that are joint accounts? Say you want to have two partners for a certain account, let's say a PayPal account, and you want to make it so that ...
user avatar
  • 635
1 vote
0 answers
97 views

How is the ownership of a hacked account assigned back to the rightful owner, if the owner used made-up info to create the account?

Which information is utilized in the account recovery process, after an account hack, if all personal information used to create the account was made-up (such as a nickname) and it's impossible to ...
user avatar
0 votes
1 answer
180 views

Account lockout for inexistant accounts

I am starting to implement an exponential backoff system to lockout accounts after a certain amount of failed attempts (1min after 5 fails, 2min after 10 fails, etc.). However, as this source suggests,...
user avatar
1 vote
1 answer
192 views

Secure Windows 10 Home admin's data behind a password, even when user apps are running

Windows 10 Home's default account lock system for the admin account is not completely secure because there are multiple free password recovery tools & ways available that can be used by a non-...
user avatar
9 votes
3 answers
317 views

Is there a benefit to using a different email for every online account?

I have a domain email address which in addition to being able to create multiple mail accounts allows the creation of aliases for each inbox. Is there any benefit to security in using a different ...
user avatar
  • 91
5 votes
1 answer
3k views

Can the GlobalProtect VPN of my company track websites when Disabled?

I just installed the Global Protect VPN from my company on my local machine so I can access our servers remotely. I just "agreed" to the following statement: VPN Connected This system is for ...
user avatar
  • 153
0 votes
2 answers
246 views

What's the safest password type? [closed]

I've used Dashline (password manager) with random generated passwords, but I forgot the master password and there is no way to get it back. I read that password managers and random generated passwords ...
user avatar
0 votes
2 answers
191 views

jwt symmetric signature security risks (from client side)

I am currently implementing an iOS app, which integrates with a cloud hosted .net backend system in azure, which. The api login endpoint takes user/pass -> replies with an signed only HS256 jwt token....
user avatar
0 votes
1 answer
206 views

How do I protect my info from apps like CallApp?

It appears to me that apps like Whoscall and CallApp might access your photos and such. In case of a potential data breach/hacking in one of these apps - how can I delete my info from their servers?
user avatar
-2 votes
1 answer
107 views

I opened an http website from my email, how can I know if it's safe?

So, I have Google alerts set for a few words, and one of these alerts had a link to the site "chatsosedi.ru" which I opened. I found out the site isn't https. I clicked on it before realizing. Is it ...
user avatar
0 votes
2 answers
1k views

Can my oppressive government trace my Twitter activity and detect me?

I want to be active on Twitter against our oppressive government. Can my government trace and detect me? Twitter is banned here and we must use VPNs. I use Outline (Shadowsocks) mostly. Is there any ...
user avatar
  • 103
0 votes
1 answer
114 views

Why there are some weird requests to my web hosting [duplicate]

I was doing my plesk hosting logs checking for web and database development. Somehow, I had seen some weird ip trying to communicate to hosting. Wonder what is the purpose of these anonymous requests. ...
user avatar
1 vote
4 answers
403 views

E-Mail privacy proxy for hiding real e-mail?

Do E-Mail proxy services exists to improve privacy and security? Privacy in the sense that one wouldn't need to give a website his/her username (possibly even in the firstname.lastname@domain.tld ...
user avatar
  • 233
1 vote
1 answer
173 views

Risk of Docker backdoor allowing impersonation

I am a junior web developer. All I know is mostly about web development. I have no skills and knowledge about system security and know little about Linux. I work in a company which is developing some ...
user avatar
  • 13
5 votes
1 answer
786 views

Risks of allowing employees using personal GitHub accounts for work

Proprietary software developed by a (smallish) company is stored in the company's GitHub private repository. For work, software engineers are requested to create company-specific GitHub account bound ...
user avatar
1 vote
1 answer
191 views

Is an OS more vulnerable while it is being updated?

Are there any additional attack vectors that apply when an OS is being updated? For example, would the services that are being updated be unstable? An OS is generally more secure after being updated, ...
user avatar
0 votes
0 answers
2k views

How to encrypt user files securely on the server with PHP

Description: I want to create an upload center for small files (word/excel/zip documents etc) with PHP. I want to protect files uploaded by user as much as possible, so if server is breached, ...
user avatar
  • 61
4 votes
2 answers
4k views

Is it possible to mac-spoof Xfinity Wireless?

Background Comcast/Xfinity operates various wireless hotspots across the US, accessed via the SSID xfinitywifi through the many wireless access points shown on https://hotspots.wifi.xfinity.com/ ...
user avatar
  • 401

1
3 4
5
6 7
15