Questions tagged [account-security]

Security controls and features related to an end user's account with a web/mobile based application or an operating system.

73 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
0
votes
0answers
50 views

Is data stored on a standard mac user account considered secure from other users on that same local computer?

I'm trying to figure out if the data created by a Mac user on a local mac is truly secure from other users on that same mac. For example, on MacOS Catalina, I have three accounts: Administrator User ...
0
votes
0answers
39 views

Any security standards applicable to empty S3 buckets?

My employer has a lot of S3 buckets which are no longer used or are just sitting there empty. Cleaning them up would obviously reduce the attack surface and be less to monitor and secure, but that ...
0
votes
3answers
137 views

E-Mail privacy proxy for hiding real e-mail?

Do E-Mail proxy services exists to improve privacy and security? Privacy in the sense that one wouldn't need to give a website his/her username (possibly even in the firstname.lastname@domain.tld ...
0
votes
0answers
86 views

Could this be considered lateral movement or is this normal activity?

Has anyone encountered this type of logon (4624 Type 3). The accounts are logging on then off within a few seconds. We are noticing this activity in the morning, which would be when they start working....
0
votes
0answers
462 views

How to encrypt user files securely on the server with PHP

Description: I want to create an upload center for small files (word/excel/zip documents etc) with PHP. I want to protect files uploaded by user as much as possible, so if server is breached, ...
0
votes
0answers
83 views

Western Digital My Cloud - Website GUI & Security

I am trying to figure out if using the Website "files.mycloud.com" is exposing my files to being intercepted at a central point. I see that there is an HTTPS connection with valid cert for *.mycloud....
0
votes
0answers
43 views

Why use a refresh token for authentication?

I recently stumbled upon this article which recommends using two tokens for authentication. Once the user is logged-in (or registered), the client receives an access token and a refresh token, ...
0
votes
0answers
19 views

Dockerfile - What user should be the owner for a mount point?

In the docker-compose file, below is the volumes instruction for builder service: builder: build: ../../ dockerfile: docker/dev/Dockerfile volumes: - ../../target:/wheelhouse volumes_from:...
0
votes
1answer
92 views

Is User Account Login Related to BitLocker Encryption Key

When I enabled BitLocker on my system-drive, I wasn't asked to select an unlock-method. I didn't have to enter any new passwords/keys. I only selected a few options for the encryption, and the process ...
0
votes
0answers
62 views

Sony Access Log (Playstation Network) does not exists

Yesterday my wife receive some emails from Sony confirming her purchases on Playstation Network. The only problem is: she was with my side watching Netflix on the smart Tv. The purchased items is a ...
0
votes
0answers
92 views

How secure is passwordless and keyless SSH login on 127.0.0.1 only, over a secure authenticated tunnel?

I want to use CA signed SSH keys (that would be rotated frequently and have short expiry, ideally centrally managed, all that great stuff). Unfortunately, most of windows GUI tools, such as WinSCP or ...
0
votes
0answers
718 views

I used my school account to use Office 365. Can my school control my device now?

Whilst I was setting up Office 365, there was an option that said "allow my organization to manage my device". I unchecked it, but I can still access their network drives. Does this mean they now ...
0
votes
0answers
75 views

Different password recovery code received from Facebook

After a long time, I tried to login in to Facebook just to find that I forgot my password. So, to generate new password I used the 'forgot password' option in which a security code to reset password ...
0
votes
1answer
150 views

Application design to avoid XSS & CSRF attacks

I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
0
votes
1answer
105 views

iCloud Security Concern: browser session authentication storage after 2-factor?

Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie? My concern is, if ...
0
votes
0answers
48 views

Policy for regaining access to a colleague's account

I run a SaaS used by teams to collect company-related information (think something like Crashlytics). Even if the tool lets users invite their colleagues, we often find cases of individuals who ...
0
votes
0answers
115 views

Hiding computers behind redis pub/sub?

I have a problem which is 1 http service i'm developing will receive user sensitive data ( 3rd party API KEYS ) and i need to store the keys somewhere where i can retrieve them in clear text. One of ...
0
votes
0answers
45 views

Proper way to document and log brute force attacks when creating a user account

We have the following use case: Users can self register for a business account by filling a validation form with their ID, first name, last name, and DOB. ID is something that only the user knows ...
0
votes
1answer
101 views

school google account on my school computer

I'm logged into my school Google account at home. Can what I search at home on my own computer be checked by my school even though I'm not using their computers?
0
votes
2answers
89 views

Can you use Google's authenticator app when Google “makes sure that you’re really you”?

I've heard that you can configure your Google account to use its (more secure) authenticator app rather than sending you a text message - in my most recent case, this was when Google sent me a text ...
0
votes
2answers
304 views

Is my online account at a financial firm safe?

I have recently opened an account at a brokerage firm, based in India, which unfortunately it seems to me is not following good measure to ensure security. But I maybe wrong since I am not an expert ...
-1
votes
1answer
140 views

What is optimal way to connect accounts to 2FA on phone?

I have Google Acc 0 (GAO) mostly for bank porpoises and some "official" services. This email basically "surname.name@google.com" and I put in my old C.V. and some other contact information. When I got ...
-1
votes
1answer
198 views

Is there anyway I can prove a snap account isn’t mine

My boyfriend thinks a Snapchat account is mine when it isn’t. Is there anyway I can prove this is not true if the owner of the account won’t message me back?

1
2