Questions tagged [user-management]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

To SCIM or not to SCIM [closed]

SCIM is a protocol for on- and offboarding of employee accounts in external systems (e.g. e-mail systems, HR- and payroll, etc). While elegant, there is a non-zero cost in setup and maintenance of ...
user avatar
1 vote
2 answers
74 views

How to non-intrusively monitor my team's MacBooks secure configuration?

I'm managing a small remote team. We care about security and I want to be sure that our MacBooks comply with at least basic security standards, such as CIS benchmark. These are the ways I see I could ...
user avatar
1 vote
1 answer
63 views

Is it safe for website to generate fake profile pages?

Today I found a website which generates a fake profile when asked if said profile exists. Example: www.site.com/user/mycoolname doesn't exist yet. But if I put it in the browser for the site I get a ...
user avatar
0 votes
0 answers
50 views

Are hashed passwords transferred to a server for user authentication? [duplicate]

A question I came up with while reading in my information security class. Let's say website ABC which uses username and password combinations to authenticate users and has a user John. When John goes ...
user avatar
  • 1
1 vote
1 answer
57 views

Securely adding new users to account

In a multi-tenant application, I'm thinking of the right way to let a tenant add users to its account. Assume the "root" user (that signed up and created the tenant) already exists. At some ...
user avatar
  • 143
0 votes
1 answer
93 views

Is there a secure way of handling online payments without user accounts and logging in?

I'm creating a subscription-based desktop application, but there is no authentication on the platform as the "user" is the computer upon which the application is installed. This means no ...
user avatar
1 vote
3 answers
142 views

Is it more or less secure to use IAM (AWS user management) if you only have one user?

This is an edge case, and as soon as multiple users are accessing the AWS Console in anyway, IAM is the only good option, but what if you only have one user? I've always assumed that if only one ...
user avatar
  • 302
0 votes
1 answer
102 views

Is there an effective way to disable root access on linux in an office setting

I'm currently working for SaaS a company and as part of a security audit we were advised to remove all administrative access from all laptops/end-user pc's for a Principle of Least Permissions. Is ...
user avatar
  • 101
1 vote
0 answers
86 views

How can OAuth2 (tokens) fit into dynamic sites that still wants to call protected API's via JavaScript?

(I try to understand different concepts regarding web development in general) Most information I find is about Single Page Applications, but how does a dynamic site make use of (for example) OAuth2/...
user avatar
  • 111
2 votes
1 answer
131 views

Risk associated with Exchange email address as username when AD authentication is enabled

In my existing setup, we have Exchange Server joined with Windows Active Directory. Both the username and email address are the same for user accounts. Our support party also recommended using this ...
user avatar
  • 25
4 votes
0 answers
633 views

Maximum password length for user accounts on Ubuntu

I have a VPS hosted at a remote location. Obviously the host can login directly (without SSH or any keys) on this box and I want to make brute force password guessing as hard as possible for a bad ...
user avatar
65 votes
2 answers
12k views

How can I prevent a computer from turning ON?

I was reading this question on Stack Exchange Workplace community and it indicates that an IT team was able to prevent a user from turning their laptop on (power on). My laptop access has been shut ...
user avatar
  • 1,403
2 votes
0 answers
215 views

Grace period for users after re-enabling account disabled by PCI-DSS 8.1.4?

We have an automated system to disable user accounts that have seen no logins for 90 days. We also have a process of re-enabling such accounts (at the behest of the affected users), and this process ...
user avatar
  • 343
0 votes
3 answers
460 views

Associate API key with user

I am creating a public API that will require API key authentication. When a user wants to register a new API key, they send a request to one of our endpoints with a list of permissions they want. We ...
user avatar
1 vote
0 answers
110 views

How can I stop an authorized user from consuming all the bandwidth on my home network? [closed]

Me and my neighbours share a home network managed by me, paid for by the landlord. This person overloads the bandwidth on the regular, jitter spikes up to the 300s,down speed fluctuates, overall ...
user avatar
10 votes
2 answers
2k views

When should user invite links (tokens) expire?

We have a system in which external users can be invited to our identity management system. The users are not employees of our company, but of our customers. The administrators of the customer do not ...
user avatar
0 votes
1 answer
115 views

Should admin user be visible to regular users

When building a system, where all users belong to the same organisation, should regular users be able to see admin users? On one hand one could argue that there is no need for this information to be ...
user avatar
1 vote
0 answers
99 views

using public key crypto instead of password for authentication [closed]

I'm the head of IT and development in a small group of enthusiasts spending their free time with a bit of hobby development. We don't have an office yet, but maybe consider to rent some small office ...
user avatar
2 votes
2 answers
184 views

How to provide personal User Page after User already signed up without Password?

I created a small website where participants can sign up with some data (name, email, birthdate, ...) but they don't have to set username and password. After a while it would be useful to provide ...
user avatar
6 votes
2 answers
424 views

How to convince users that security is a good thing?

So I took over as senior IT manager at a small company a couple months ago. Up to now, there was no "IT department" as such, just another guy who "did computers". To this point: things are running off ...
user avatar
70 votes
10 answers
21k views

Why avoid shared user accounts?

I know its best practice not to allow shared user accounts, but where is this best practice defined? Is it an ISO standard or something? What is the reasons to always create per person accounts?
user avatar
0 votes
1 answer
156 views

How to catch people creating many accounts on the same website using very unique credentials?

Nowadays e-commerce is the new trend compared to the retail stores, but some sellers will manipulate their rankings through false purchases of their own items to boost rankings significantly. The ...
user avatar
  • 109
0 votes
0 answers
67 views

Most accessible yet secure way to verify a user over the phone who has an account online

We have a service where people register online and log fairly sensitive records. They might want to phone up and ask for a status update on these records. At the time they are calling, they may not ...
user avatar
1 vote
2 answers
160 views

Should a system require a password confirmation for accounts managed by an administrator?

Suppose you have a user account management subsystem with a web UI. You can change user account passwords in regular masked input password fields in HTML POST forms. I'm wondering, is it fine if such ...
user avatar
  • 11
1 vote
1 answer
158 views

My boss installs software using domain admin. Should I show that this is bad?

At my workplace, users on most workstations (Win7 and 10 blend) do not have local admin rights. As a technical team we often need this for software installs, and so the director gets called around to ...
user avatar
  • 11
3 votes
3 answers
347 views

Encrypt User specific Information without a password

Given scenario: I have an application (NodeJS) running on Heroku, the database is RDS on Amazon and I use Auth0 for authentication. I don't have access to passwords of the users, some users use social ...
user avatar
  • 131
1 vote
1 answer
90 views

What are the pieces of information delivered in a user profile at the end of a OpenID Connect flow?

From what I understand about using OpenID Connect (over OAuth2), is that we end up with some JSON containing information about the user. That information is transported as a JSON Web Token. ➥ What ...
user avatar
3 votes
2 answers
611 views

Using SessionStorage for Some User Info

I have an application that currently keeps a few properties from a user's profile in session storage for the app to use when necessary. We don't keep sensitive data like username or password or ssn in ...
user avatar
  • 171
2 votes
2 answers
535 views

Separation of duties for user account creation

Are there any implementations (such as Active Directory) that have applied separation of duties to user account creation, which would require the create user account task and approval task to be done ...
user avatar
  • 155
1 vote
1 answer
79 views

Center for Internet Security Version 6.1 Critical Security Control 16-10

My project is implementing The CIS Critical Security Controls, Version 6.1 Can anyone please give me some advice on how we can address sub-control 16.10 which says..... "Profile each user’s typical ...
user avatar
  • 113
8 votes
1 answer
892 views

How can utilities with setuid set to root be secure if they are debuggable?

Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that: I can freely debug all programs I have the permission to run, even those that have ...
user avatar
  • 5,587
7 votes
2 answers
685 views

Win10: Access other logged on users' memory

How easily can admin users access the data of other users' running processes on Windows 10? Especially webpages loaded by Chrome. Example Context Bob and Alice share a single Windows 10 ...
user avatar
0 votes
4 answers
212 views

Anything particularly wrong with putting an auth code in marketing emails?

I've been working on my first project, and my initial registered users haven't been particularly sticky. I'd like to send them an email with some news and information and have them be instantly logged ...
user avatar
5 votes
3 answers
342 views

As "Head of IT" is it reasonable not to have access to Email or backup management as could contain sensitive information

I work for a medium sized company of around 100 people or so - and I am employed to be Head of IT responsible for backups, security, sorting out technical issues, among other things etc etc. However ...
user avatar
  • 183
1 vote
1 answer
284 views

Dealing with shared credentials when an employee leaves

We have around 20+ accounts of different services (company email inboxes, forums, social media, Github, etc.) we use in my team. For security reasons, whenever some employee leaves us, I need to ...
user avatar
20 votes
6 answers
10k views

Is there a security advantage or risk in removing disabled user accounts?

So I'm having a debate with someone about whether or not to remove disabled accounts. My stance is that it is good network hygiene, reduces the amount of noise to sift through, etc. However, the ...
user avatar
  • 330
2 votes
2 answers
248 views

Password same-account indicators on websites

I am creating a user system which will be used across multiple websites without the use of SSO (the extra hassle really isn't worth it at the minute). I am looking at ways of telling users that they ...
user avatar
  • 149
5 votes
1 answer
204 views

Is there any danger in subpages that can be called by url but cannot compile due to missing includes?

I have a webpage that basically uses the following structure: index.php functions.php pages/a.php pages/b.php ... When I call index.php, the user is prompted to login or is logged in automatically ...
user avatar
  • 51
1 vote
2 answers
175 views

Self-Coded User Authentication Security

We are currently using Apache Shiro for our User Authentication needs. We have dynamic authorization\authentication needs, in some cases users will be authenticated using Active Directory while some ...
user avatar
1 vote
1 answer
414 views

User Credentials for Accessing Network Resources

I am in the process of setting up the infrastructure for microservices using RabbitMQ as our message broker for our company. I am trying to figure out the best way to handle security for the system. ...
user avatar
1 vote
1 answer
178 views

Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?

When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system? Is it ...
user avatar
2 votes
3 answers
241 views

What attacks are possible if you can scrape a list of users?

Have there been any attacks (or can you think of a potential attack) that hinged on being able to figure out if a user exists in a system? For example, in a web app there is a "Reset password" page ...
user avatar
  • 397
1 vote
1 answer
483 views

Rubber ducky windows mitigation

So I am familiar with badusb or rubber ducky attacks, I lack possession of one currently to test any of my questions. Essentially my question is can you mitigate rubber ducky attacks using windows ...
user avatar
  • 28
-5 votes
1 answer
265 views

Why threat modelling and risk planning does not consider the sex of users? [closed]

Isn't it scientifically proven that men and women have very different psychologies? So that, at least they must have different attitudes towards security policies and guidelines compliance. All of ...
user avatar
0 votes
1 answer
94 views

Jira external users verification

I have a Jira site where my customers' employees can open bugs, view bug statuses and so on. I manage these users inside my Jira (external users) and they have username and password with limited ...
user avatar
  • 11
3 votes
1 answer
218 views

Is it good practice if all programs have their own user ID? [closed]

Typically, each physical user on a system has an ID, and a running process is run as the user who starts it. This means the process is able to access all of the user's files, even those that not ...
user avatar
  • 1,613
-1 votes
1 answer
535 views

plutil -p /Library/Preferences/com.apple.preferences.account.plist

plutil -p /Library/Preferences/com.apple.preferences.accounts.plist shows some deleted usernames that I am in the same school with. Am I hacked by them?? I am really concerned. Additional information:...
user avatar
2 votes
2 answers
266 views

storing user's information without been able to access it

For a university project of mine I am making a password manager online and I want to be able to store user's passwords on my server without being able to access it myself. Here is what I intend to do: ...
user avatar
1 vote
2 answers
176 views

How to safely setup user rights inside a backup folder?

I use a Synology NAS that has full Linux based user rights control and I want to setup a root shared folder called backup where I'll save backups from different technologies: Time Machine and Windows ...
user avatar
  • 125
1 vote
1 answer
108 views

Should I have two accounts in my NAS (ex.: Bob as user and Poseidon as admin, both controlled by me)?

I have a Synology NAS running in a SOHO network and I'd like to maintain it secure. First thing I did was disable the default admin and guest accounts, second I created some accounts and this is what ...
user avatar
  • 125