Questions tagged [user-management]
The user-management tag has no usage guidance.
96
questions
0
votes
0
answers
31
views
Make use of encrypted or anonymous data in database [duplicate]
As an answer to the following question, I read the idea of encrypting user data with 2 keys based on random generation and the user password:
Store encrypted user data in database
But could anyone ...
- 1
0
votes
1
answer
131
views
Is every string a possible username?
I have noticed that a lot of websites only allow a fixed amount of username changes, and does not allow the reuse of a previously or currently used username. For example, on Fandom.com once a username ...
- 1
-1
votes
1
answer
106
views
Can Outlook stay connected to an email account through a password change?
Corporate setting, multiple people have access to the same email account (it is a functional not a personal account). Order of events:
User A opens Outlook, connects to the shared email account, ...
- 183
2
votes
0
answers
302
views
Active Directory and External Email Accounts
In my place of work we have an on-prem Active Directory with 'staff' accounts. Each of these AD accounts has an associated company email, e.g. jo[email protected]
Within the same AD we also have '...
- 129
1
vote
0
answers
27
views
Account creation flow for semi-internal applications
We are developing an application that is to be used internally at our clients companies, but will be exposed as a public accessible website.
We have some clients who wish to use local accounts on our ...
- 11
1
vote
1
answer
486
views
Is TLS needed on loopback for local security?
So the scenario is that we have a server shared with a number of users, with me being the server administrator and able to determine permission assignments.
The server is running a service on loopback ...
- 113
1
vote
2
answers
145
views
How to non-intrusively monitor my team's MacBooks secure configuration?
I'm managing a small remote team. We care about security and I want to be sure that our MacBooks comply with at least basic security standards, such as CIS benchmark.
These are the ways I see I could ...
2
votes
1
answer
169
views
Is it safe for website to generate fake profile pages?
Today I found a website which generates a fake profile when asked if said profile exists. Example: www.site.com/user/mycoolname doesn't exist yet. But if I put it in the browser for the site I get a ...
- 21
0
votes
0
answers
88
views
Are hashed passwords transferred to a server for user authentication? [duplicate]
A question I came up with while reading in my information security class. Let's say website ABC which uses username and password combinations to authenticate users and has a user John. When John goes ...
- 1
1
vote
1
answer
80
views
Securely adding new users to account
In a multi-tenant application, I'm thinking of the right way to let a tenant add users to its account. Assume the "root" user (that signed up and created the tenant) already exists. At some ...
- 143
1
vote
1
answer
220
views
Is there a secure way of handling online payments without user accounts and logging in?
I'm creating a subscription-based desktop application, but there is no authentication on the platform as the "user" is the computer upon which the application is installed. This means no ...
- 11
2
votes
3
answers
439
views
Is it more or less secure to use IAM (AWS user management) if you only have one user?
This is an edge case, and as soon as multiple users are accessing the AWS Console in anyway, IAM is the only good option, but what if you only have one user?
I've always assumed that if only one ...
- 376
0
votes
1
answer
117
views
Is there an effective way to disable root access on linux in an office setting
I'm currently working for SaaS a company and as part of a security audit we were advised to remove all administrative access from all laptops/end-user pc's for a Principle of Least Permissions.
Is ...
- 101
1
vote
0
answers
98
views
How can OAuth2 (tokens) fit into dynamic sites that still wants to call protected API's via JavaScript?
(I try to understand different concepts regarding web development in general)
Most information I find is about Single Page Applications, but how does a dynamic site make use of (for example) OAuth2/...
- 111
2
votes
1
answer
200
views
Risk associated with Exchange email address as username when AD authentication is enabled
In my existing setup, we have Exchange Server joined with Windows Active Directory. Both the username and email address are the same for user accounts. Our support party also recommended using this ...
- 25
4
votes
0
answers
2k
views
Maximum password length for user accounts on Ubuntu
I have a VPS hosted at a remote location. Obviously the host can login directly (without SSH or any keys) on this box and I want to make brute force password guessing as hard as possible for a bad ...
- 165
65
votes
2
answers
13k
views
How can I prevent a computer from turning ON?
I was reading this question on Stack Exchange Workplace community and it indicates that an IT team was able to prevent a user from turning their laptop on (power on).
My laptop access has been shut ...
- 1,403
2
votes
0
answers
351
views
Grace period for users after re-enabling account disabled by PCI-DSS 8.1.4?
We have an automated system to disable user accounts that have seen no logins for 90 days. We also have a process of re-enabling such accounts (at the behest of the affected users), and this process ...
- 343
0
votes
3
answers
906
views
Associate API key with user
I am creating a public API that will require API key authentication. When a user wants to register a new API key, they send a request to one of our endpoints with a list of permissions they want. We ...
1
vote
0
answers
115
views
How can I stop an authorized user from consuming all the bandwidth on my home network? [closed]
Me and my neighbours share a home network managed by me, paid for by the landlord.
This person overloads the bandwidth on the regular, jitter spikes up to the 300s,down speed fluctuates, overall ...
11
votes
2
answers
4k
views
When should user invite links (tokens) expire?
We have a system in which external users can be invited to our identity management system.
The users are not employees of our company, but of our customers. The administrators of the
customer do not ...
0
votes
1
answer
145
views
Should admin user be visible to regular users
When building a system, where all users belong to the same organisation, should regular users be able to see admin users?
On one hand one could argue that there is no need for this information to be ...
1
vote
0
answers
107
views
using public key crypto instead of password for authentication [closed]
I'm the head of IT and development in a small group of enthusiasts spending their free time with a bit of hobby development. We don't have an office yet, but maybe consider to rent some small office ...
- 31
2
votes
2
answers
191
views
How to provide personal User Page after User already signed up without Password?
I created a small website where participants can sign up with some data (name, email, birthdate, ...) but they don't have to set username and password.
After a while it would be useful to provide ...
- 21
6
votes
2
answers
470
views
How to convince users that security is a good thing?
So I took over as senior IT manager at a small company a couple months ago. Up to now, there was no "IT department" as such, just another guy who "did computers". To this point: things are running off ...
- 211
71
votes
10
answers
23k
views
Why avoid shared user accounts?
I know its best practice not to allow shared user accounts, but where is this best practice defined? Is it an ISO standard or something? What is the reasons to always create per person accounts?
- 749
0
votes
1
answer
165
views
How to catch people creating many accounts on the same website using very unique credentials?
Nowadays e-commerce is the new trend compared to the retail stores, but some sellers will manipulate their rankings through false purchases of their own items to boost rankings significantly. The ...
- 109
0
votes
0
answers
89
views
Most accessible yet secure way to verify a user over the phone who has an account online
We have a service where people register online and log fairly sensitive records. They might want to phone up and ask for a status update on these records.
At the time they are calling, they may not ...
2
votes
2
answers
177
views
Should a system require a password confirmation for accounts managed by an administrator?
Suppose you have a user account management subsystem with a web UI. You can change user account passwords in regular masked input password fields in HTML POST forms. I'm wondering, is it fine if such ...
- 21
1
vote
1
answer
169
views
My boss installs software using domain admin. Should I show that this is bad?
At my workplace, users on most workstations (Win7 and 10 blend) do not have local admin rights. As a technical team we often need this for software installs, and so the director gets called around to ...
- 11
3
votes
3
answers
512
views
Encrypt User specific Information without a password
Given scenario:
I have an application (NodeJS) running on Heroku, the database is RDS on Amazon and I use Auth0 for authentication. I don't have access to passwords of the users, some users use social ...
- 131
1
vote
1
answer
104
views
What are the pieces of information delivered in a user profile at the end of a OpenID Connect flow?
From what I understand about using OpenID Connect (over OAuth2), is that we end up with some JSON containing information about the user. That information is transported as a JSON Web Token.
➥ What ...
- 147
3
votes
2
answers
983
views
Using SessionStorage for Some User Info
I have an application that currently keeps a few properties from a user's profile in session storage for the app to use when necessary. We don't keep sensitive data like username or password or ssn in ...
- 171
2
votes
2
answers
604
views
Separation of duties for user account creation
Are there any implementations (such as Active Directory) that have applied separation of duties to user account creation, which would require the create user account task and approval task to be done ...
- 155
1
vote
1
answer
86
views
Center for Internet Security Version 6.1 Critical Security Control 16-10
My project is implementing The CIS Critical Security Controls, Version 6.1
Can anyone please give me some advice on how we can address sub-control 16.10 which says.....
"Profile each user’s typical ...
- 113
9
votes
1
answer
1k
views
How can utilities with setuid set to root be secure if they are debuggable?
Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that:
I can freely debug all programs I have the permission to run, even those that have ...
- 5,747
7
votes
2
answers
818
views
Win10: Access other logged on users' memory
How easily can admin users access the data of other users' running processes on Windows 10?
Especially webpages loaded by Chrome.
Example
Context
Bob and Alice share a single Windows 10 ...
- 73
0
votes
4
answers
216
views
Anything particularly wrong with putting an auth code in marketing emails?
I've been working on my first project, and my initial registered users haven't been particularly sticky. I'd like to send them an email with some news and information and have them be instantly logged ...
5
votes
3
answers
380
views
As "Head of IT" is it reasonable not to have access to Email or backup management as could contain sensitive information
I work for a medium sized company of around 100 people or so - and I am employed to be Head of IT responsible for backups, security, sorting out technical issues, among other things etc etc.
However ...
- 183
1
vote
1
answer
325
views
Dealing with shared credentials when an employee leaves
We have around 20+ accounts of different services (company email inboxes, forums, social media, Github, etc.) we use in my team. For security reasons, whenever some employee leaves us, I need to ...
user15194
20
votes
6
answers
12k
views
Is there a security advantage or risk in removing disabled user accounts?
So I'm having a debate with someone about whether or not to remove disabled accounts. My stance is that it is good network hygiene, reduces the amount of noise to sift through, etc. However, the ...
- 330
2
votes
2
answers
258
views
Password same-account indicators on websites
I am creating a user system which will be used across multiple websites without the use of SSO (the extra hassle really isn't worth it at the minute).
I am looking at ways of telling users that they ...
- 149
5
votes
1
answer
213
views
Is there any danger in subpages that can be called by url but cannot compile due to missing includes?
I have a webpage that basically uses the following structure:
index.php
functions.php
pages/a.php
pages/b.php
...
When I call index.php, the user is prompted to login or is logged in automatically ...
- 51
1
vote
2
answers
181
views
Self-Coded User Authentication Security
We are currently using Apache Shiro for our User Authentication needs. We have dynamic authorization\authentication needs, in some cases users will be authenticated using Active Directory while some ...
- 111
1
vote
1
answer
435
views
User Credentials for Accessing Network Resources
I am in the process of setting up the infrastructure for microservices using RabbitMQ as our message broker for our company. I am trying to figure out the best way to handle security for the system. ...
- 129
1
vote
1
answer
188
views
Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?
When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system?
Is it ...
- 297
2
votes
3
answers
245
views
What attacks are possible if you can scrape a list of users?
Have there been any attacks (or can you think of a potential attack) that hinged on being able to figure out if a user exists in a system?
For example, in a web app there is a "Reset password" page ...
- 407
1
vote
1
answer
589
views
Rubber ducky windows mitigation
So I am familiar with badusb or rubber ducky attacks, I lack possession of one currently to test any of my questions.
Essentially my question is can you mitigate rubber ducky attacks using windows ...
- 28
-5
votes
1
answer
270
views
Why threat modelling and risk planning does not consider the sex of users? [closed]
Isn't it scientifically proven that men and women have very different psychologies? So that, at least they must have different attitudes towards security policies and guidelines compliance. All of ...
- 263
0
votes
1
answer
101
views
Jira external users verification
I have a Jira site where my customers' employees can open bugs, view bug statuses and so on.
I manage these users inside my Jira (external users) and they have username and password with limited ...
- 11