Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

Filter by
Sorted by
Tagged with
5
votes
1answer
202 views

Inspecting code elements in browser when logging in

When I use the built-in Chrome inspect element, click on the networking tab and view a login.action file or session file, it shows the password in plain text. Is this normal?
4
votes
3answers
145 views

Security problem with confirmation email

I have an app, and when they first login, I send a classic confirmation email. When users need to reinstall the app, sometimes users send messages to our support saying: "I don't remember the email ...
9
votes
3answers
2k views

How does entering “a” phone number help Google “verify it's me?”

Today I tried to sign into my Google account while at university. Google blocked the attempt, and asked for a phone number. Below is a screenshot of the form Google showed me. It says: Verify it's ...
5
votes
2answers
201 views

iTunes Account Joined Family Group Without Permission

A few weeks ago now I received an email that someone (not me) had made some in-game purchases on an iTunes account. I logged into my iTunes account and saw the transactions and that my account was ...
3
votes
3answers
399 views

Password manager and account recovery

I'd like to start using a password manager, but I'm not sure how to handle account recovery. I'm not a criminal or a secret agent, so if I lose my master password (or my second authentication factor, ...
1
vote
1answer
1k views

URL changes to *.compute-1.amazonaws.com/ when entering website, do I have a problem?

I was browsing for help on how to connect a PS2 controller to my pc. I found what I was looking for here: https://gaming.stackexchange.com/questions/262873/do-playstation-2-controllers-support-usb-...
1
vote
2answers
5k views

What is the point of Microsofts 30 day security update waiting period

If you want to update your security info (such as a password). You need to verify your ID with your phone or another email. If you don't have any connected to you account (or forgot them), you can add ...
3
votes
2answers
175 views

Securely storing account credentials/information for critical company services - the bus factor

Question: I'm trying to figure out best practices for storing authentication credentials for critical company services - hosting services, domain registration services, recruiting portals, etc... To ...
1
vote
2answers
58 views

Will this auth scheme be secure and protect user passwords/hashes?

I am working on a website with accounts and I want a login scheme that does not expose users' passwords or hashes in the event of a total security failure. I would greatly appreciate some feedback on ...
1
vote
0answers
189 views

Should I use a random password for my technical user?

I am trying to find the smartest way to handle the root password in my product. For legacy reasons, I need to have a technical account. My services create a token associated with this account ...
2
votes
2answers
210 views

What should happen when an account is unlocked?

After a user's account is locked, and an admin goes to unlock it, should the user be required to reset their password? Or should they just be able to login without changing their password?
4
votes
1answer
73 views

Is there a benefit to setting up a security key on an account that already has phone-based 2FA?

I'm looking at 2FA options for my Google account, and I noticed they now allow you to add a security key to your account. I'm a bit of a novice to infosec, but I'm struggling to see the benefit for me....
2
votes
1answer
59 views

Erasing files and passes - how to understand them? [duplicate]

A few months ago, I downloaded Edenwaith Permanent Eraser from the edenwaith website and set it to DoE (3x) in the preferences. I am using Mac Mini 2011, MacOS Sierra, and use it to delete files and ...
3
votes
1answer
5k views

Should user account be locked after X amount of failed logins?

I have almost finished developing my login system and there is one more thing that I'm not sure about. So many debates I found on the internet about counting invalid logins and locking users account. ...
-1
votes
1answer
82 views

Can this be bypassed with SQL Injection?

This is my php code: $uname = $_POST['username']; $pwd = md5($_POST['password']); $sql = "SELECT * FROM `user` WHERE username = '$uname' AND password = '$pwd'"; My friend gave me this code but I’d ...
-1
votes
2answers
150 views

Is there a single change that could have made the biggest password hacks much harder?

In recent years there have been a number of spectacularly huge hacks. As examples: The 2013-14 hack of Yahoo involving 3 billion accounts The 2016 hack of Adult Friend Finder involving 400+ million ...
57
votes
8answers
19k views

Brutalized VPS recovery data now available. Considerations? [closed]

Backstory My sites and VPS were stolen from me. The hosting company and I were locked out and unable to access it. They weren't able to create a temp password for access because the attacker blocked ...
0
votes
1answer
438 views

Website Security Breach from an Iframe

I know my website is being breached by a third-party web application under the following scenario: My users put credentials to my site into a third-party web application The third-party web ...
4
votes
4answers
488 views

Phone number setup for security

Several Q&As here highlight the danger of phone hacking. For example, this. In a nutshell, the solution is to NOT give your phone number, except to your bank or government. Unfortunately, that ...
1
vote
0answers
55 views

Bought a used surface book online, any security precautions to take? [duplicate]

I have purchased a used surface book from Ebay, unpackaged and ran the device. The low price of the device lured me in despite my adverse attitude to used devices. Is there anything I need to perform ...
2
votes
2answers
7k views

Importance of a short expire time on JWTs

We are currently using JSON web tokens for authentication for our website's API. We use 1 hour short-lived access tokens that get refreshed using a permanent revocable refresh token. Now we want to ...
2
votes
1answer
71 views

Attack vectors that go through previously compromised accounts

Assume an attacker gains access to a user's account on some cloud service (like my Google, Microsoft, or whatever ), the user discovers this, and changes their password. What are the scenarios that ...
19
votes
4answers
3k views

How secure are password managers with account recovery?

The major commercial password manager companies claim to have a "zero knowledge" system. This means the master password of the user is the only way to decrypt the data and it's is not stored anywhere. ...
23
votes
3answers
2k views

Why are developers using embedded user agents for 3rd party auth? What are the alternatives?

I've noticed a trend in mobile and desktop apps in recent years with the advent of OAuth (and it may also affect other frameworks) to request a user to sign up or log in using 3rd party authentication ...
1
vote
1answer
64 views

Why not resend email confirmation email at the point of failed sign-in? (vs force a button press)

Assuming an app/website where email confirmation is required before logging in: If newly registered user tries to sign in, a common flow is to tell them they are have not confirmed their email ...
0
votes
2answers
336 views

How to set up security on my phone [duplicate]

I am using my friends Wi-Fi and I don't want anyone else using the same Wi-Fi to be able to see what I am doing on my phone. How do I put up some kind of security so that people in the same network ...
2
votes
2answers
124 views

Wireless network solution? WPA2/MAC Filtering problems

In short we have 7 Mobile Casio Scanners that seem to be incapable of holding their Wi-Fi passwords, they sometimes lose them for no apparent reason. We of course, cannot give out the wireless ...
0
votes
2answers
80 views

Can you use Google's authenticator app when Google “makes sure that you’re really you”?

I've heard that you can configure your Google account to use its (more secure) authenticator app rather than sending you a text message - in my most recent case, this was when Google sent me a text ...
0
votes
1answer
560 views

Received a mail that my password for an app has been reset. Does this mean my GMail is compromised?

Today morning I received a very troubling message in my inbox. I saw that there was a message that my account password for ZoHo has been successfully reset. I don't remember making any such request ...
2
votes
2answers
1k views

How to implement 2FA without user phone

I have a problem: users share their credentials with other users. I have to create a way to ensure that users are using their own credentials to access the system. I think creating a 2 factor ...
78
votes
8answers
18k views

Company does not want any names on phishing reports

We have been recently contracted to run phishing tests for a company. Let's call it a company but basically they are obligated, by law, to assess the security of their environment with phishing ...
1
vote
1answer
260 views

limit malicious log in attempts on wordpress site

Following my previous question, I have installed an "activity log" plugin on my site, from this I can see several malicious log in attempts. In above image we can see a new attempt each second, these ...
7
votes
1answer
103 views

Rationale for security lockout after changing a password

I was recently locked out of an account (for 30 minutes), not for failing a certain number of attempts at a password, but instead for changing the password after answering security questions. What ...
3
votes
1answer
170 views

A bot edited all pages on my Wordpress installation

I manage a Wordpress site for an event registration. The site is only active for a few months a year. The rest of the year it's idle, as in it's up, but not actively maintained. Now the time has come ...
2
votes
2answers
174 views

Sending Credentials On Each Request

I am going to be using a Symfony SMB Bundle like this to browse a Windows File System through PHP. To do this - I'll create a Web API that will return a list of files and directories in a directory ...
57
votes
7answers
15k views

Email received regarding Security flaw in website

I received an email to techsupport@websitename.com (pretty generic email) saying that there was a security flaw in my website etc. etc My initial reaction was that this was a scam. (How/why did they ...
1
vote
1answer
115 views

Secure forwarding of 2FA SMS codes [closed]

Do solutions exist for forwarding SMS messages whereby: the service provider stores no logs of messages login protection with google authenticator or comparable
0
votes
2answers
3k views

Where can I find Google Backup Codes? [closed]

I am traveling long term and I don't want to put my SIM card in the phone every month to receive the SMS code when signing-in to Google (I always recieve 10+ other text messages which costs me a lot). ...
0
votes
1answer
81 views

I've been hacked now how do I recover [closed]

So around December 12th my home network got taken over. I had the default password set and never changed the ssid. Anyway now I don't know what to do. I can't access the web interface of my router so ...
77
votes
10answers
26k views

Bank wants my Online-banking PIN through the telephone

My new girocard did not reach me. I wanted to call the bank to block the old and get a new one. So I checked my online banking and found a phone number ("Block card: girocard or visa card lost? Call ...
1
vote
1answer
395 views

In what cases is it ok keep a user logged in or provide auto login if an app starts?

I am wondering what the difference is between WhatsApp and my Bank application, and what considerations determine what is the right approach to handle user authentication. WhatsApp: I create my ...
0
votes
1answer
60 views

What are the most frequent ways someone's password “leaks”? [closed]

List of user:hash published? Same password for web and local (os...)? Phishing?
1
vote
1answer
62 views

Is non-malicious unauthorised usage likely to suggest a security compromise?

In the midst of using a popular online service the other day, I noticed some curious activity. My usage was diverted - while I was interacting with the service - into activities that were not (and ...
1
vote
1answer
119 views

How difficult is it to determine whether an account got hacked or why do games allow account recovery while refusing to lift bans for hackers' deeds? [closed]

Many games and websites have an explicit policy that the owner of the account is fully responsible for any and all activity from that account and therefore suspensions will not be shortened or removed ...
3
votes
1answer
88 views

Can you start a shell with a service account in Windows?

In windows, there are service accounts like HOSTNAME\IUSR which are able to run certain processes (IIS in this case). Are these accounts vulnerable to being broken into and starting a remote shell (...
1
vote
1answer
1k views

Does an ISP monitor user browsing history without a subpoena? [closed]

I understand that an ISP has the ability to monitor a user's Internet browsing history, but do they actually do it without a subpoena/court order? And if they do, does the user's history look exactly ...
4
votes
1answer
354 views

SSH and man-in-the-middle

Assume the following scenario and please correct me if I am wrong somewhere: There is a client and there is an SSH server that the client connects to. There is also a man-in-the-middle (MIM) which is ...
86
votes
1answer
7k views

Why are files that are not assigned to a user considered a security risk? [duplicate]

From the Linux Bible, edition 9: Files that are not assigned to any username are considered to be a security risk. How is this possible and how could this be exploited? Edit:My question isn't a ...
0
votes
1answer
98 views

How do authentication system know if I am reusing a password? How is this secure?

My question is how is it possible to know if I am reusing a password? Are they storing my old password as well [in plaintext]? If an admin had access to the backend, wouldn't they have access to all ...
6
votes
2answers
1k views

Does Yandex browser have known records of snooping for user data & passwords?

I've installed Yandex Browser (Based on Chromium) on Windows 10. I use LastPass for logins so I asked Yandex to not remember passwords. While I was trying to login to another website, it gave me a ...