Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [user-management]

The tag has no usage guidance.

2
votes
2answers
84 views

How to provide personal User Page after User already signed up without Password?

I created a small website where participants can sign up with some data (name, email, birthdate, ...) but they don't have to set username and password. After a while it would be useful to provide ...
5
votes
2answers
212 views

How to convince users that security is a good thing?

So I took over as senior IT manager at a small company a couple months ago. Up to now, there was no "IT department" as such, just another guy who "did computers". To this point: things are running off ...
68
votes
10answers
14k views

Why avoid shared user accounts?

I know its best practice not to allow shared user accounts, but where is this best practice defined? Is it an ISO standard or something? What is the reasons to always create per person accounts?
0
votes
1answer
91 views

How to catch people creating many accounts on the same website using very unique credentials?

Nowadays e-commerce is the new trend compared to the retail stores, but some sellers will manipulate their rankings through false purchases of their own items to boost rankings significantly. The ...
0
votes
0answers
24 views

Most accessible yet secure way to verify a user over the phone who has an account online

We have a service where people register online and log fairly sensitive records. They might want to phone up and ask for a status update on these records. At the time they are calling, they may not ...
1
vote
2answers
79 views

Should a system require a password confirmation for accounts managed by an administrator?

Suppose you have a user account management subsystem with a web UI. You can change user account passwords in regular masked input password fields in HTML POST forms. I'm wondering, is it fine if such ...
1
vote
1answer
104 views

My boss installs software using domain admin. Should I show that this is bad?

At my workplace, users on most workstations (Win7 and 10 blend) do not have local admin rights. As a technical team we often need this for software installs, and so the director gets called around to ...
3
votes
1answer
89 views

Encrypt User specific Information without a password

Given scenario: I have an application (NodeJS) running on Heroku, the database is RDS on Amazon and I use Auth0 for authentication. I don't have access to passwords of the users, some users use social ...
1
vote
1answer
39 views

What are the pieces of information delivered in a user profile at the end of a OpenID Connect flow?

From what I understand about using OpenID Connect (over OAuth2), is that we end up with some JSON containing information about the user. That information is transported as a JSON Web Token. ➥ What ...
3
votes
2answers
76 views

Using SessionStorage for Some User Info

I have an application that currently keeps a few properties from a user's profile in session storage for the app to use when necessary. We don't keep sensitive data like username or password or ssn in ...
2
votes
2answers
253 views

Separation of duties for user account creation

Are there any implementations (such as Active Directory) that have applied separation of duties to user account creation, which would require the create user account task and approval task to be done ...
1
vote
1answer
34 views

Center for Internet Security Version 6.1 Critical Security Control 16-10

My project is implementing The CIS Critical Security Controls, Version 6.1 Can anyone please give me some advice on how we can address sub-control 16.10 which says..... "Profile each user’s typical ...
7
votes
1answer
583 views

How can utilities with setuid set to root be secure if they are debuggable?

Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that: I can freely debug all programs I have the permission to run, even those that have ...
7
votes
2answers
247 views

Win10: Access other logged on users' memory

How easily can admin users access the data of other users' running processes on Windows 10? Especially webpages loaded by Chrome. Example Context Bob and Alice share a single Windows 10 ...
0
votes
4answers
160 views

Anything particularly wrong with putting an auth code in marketing emails?

I've been working on my first project, and my initial registered users haven't been particularly sticky. I'd like to send them an email with some news and information and have them be instantly logged ...
5
votes
3answers
255 views

As “Head of IT” is it reasonable not to have access to Email or backup management as could contain sensitive information

I work for a medium sized company of around 100 people or so - and I am employed to be Head of IT responsible for backups, security, sorting out technical issues, among other things etc etc. However ...
1
vote
1answer
121 views

Dealing with shared credentials when an employee leaves

We have around 20+ accounts of different services (company email inboxes, forums, social media, Github, etc.) we use in my team. For security reasons, whenever some employee leaves us, I need to ...
21
votes
6answers
6k views

Is there a security advantage or risk in removing disabled user accounts?

So I'm having a debate with someone about whether or not to remove disabled accounts. My stance is that it is good network hygiene, reduces the amount of noise to sift through, etc. However, the ...
2
votes
2answers
209 views

Password same-account indicators on websites

I am creating a user system which will be used across multiple websites without the use of SSO (the extra hassle really isn't worth it at the minute). I am looking at ways of telling users that they ...
5
votes
1answer
156 views

Is there any danger in subpages that can be called by url but cannot compile due to missing includes?

I have a webpage that basically uses the following structure: index.php functions.php pages/a.php pages/b.php ... When I call index.php, the user is prompted to login or is logged in automatically ...
1
vote
2answers
111 views

Self-Coded User Authentication Security

We are currently using Apache Shiro for our User Authentication needs. We have dynamic authorization\authentication needs, in some cases users will be authenticated using Active Directory while some ...
2
votes
1answer
241 views

User Credentials for Accessing Network Resources

I am in the process of setting up the infrastructure for microservices using RabbitMQ as our message broker for our company. I am trying to figure out the best way to handle security for the system. ...
1
vote
1answer
121 views

Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?

When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system? Is it ...
3
votes
3answers
188 views

What attacks are possible if you can scrape a list of users?

Have there been any attacks (or can you think of a potential attack) that hinged on being able to figure out if a user exists in a system? For example, in a web app there is a "Reset password" page ...
1
vote
1answer
252 views

Rubber ducky windows mitigation

So I am familiar with badusb or rubber ducky attacks, I lack possession of one currently to test any of my questions. Essentially my question is can you mitigate rubber ducky attacks using windows ...
-6
votes
1answer
214 views

Why threat modelling and risk planning does not consider the sex of users? [closed]

Isn't it scientifically proven that men and women have very different psychologies? So that, at least they must have different attitudes towards security policies and guidelines compliance. All of ...
0
votes
1answer
47 views

Jira external users verification

I have a Jira site where my customers' employees can open bugs, view bug statuses and so on. I manage these users inside my Jira (external users) and they have username and password with limited ...
3
votes
1answer
157 views

Is it good practice if all programs have their own user ID? [closed]

Typically, each physical user on a system has an ID, and a running process is run as the user who starts it. This means the process is able to access all of the user's files, even those that not ...
-1
votes
1answer
283 views

plutil -p /Library/Preferences/com.apple.preferences.account.plist

plutil -p /Library/Preferences/com.apple.preferences.accounts.plist shows some deleted usernames that I am in the same school with. Am I hacked by them?? I am really concerned. Additional information:...
2
votes
2answers
142 views

storing user's information without been able to access it

For a university project of mine I am making a password manager online and I want to be able to store user's passwords on my server without being able to access it myself. Here is what I intend to do: ...
1
vote
2answers
91 views

How to safely setup user rights inside a backup folder?

I use a Synology NAS that has full Linux based user rights control and I want to setup a root shared folder called backup where I'll save backups from different technologies: Time Machine and Windows ...
1
vote
1answer
63 views

Should I have two accounts in my NAS (ex.: Bob as user and Poseidon as admin, both controlled by me)?

I have a Synology NAS running in a SOHO network and I'd like to maintain it secure. First thing I did was disable the default admin and guest accounts, second I created some accounts and this is what ...
4
votes
1answer
127 views

IT Contractor with domain administrator credentials best practice?

We are going to be hiring an external contractor to do some work on our SharePoint server and they will need admin rights for kerberos setup and etc. What are the best practices of setting up the ...
1
vote
1answer
395 views

Is an anonymous FTP user always a risk (even if this user doesn't have access to anything)?

I found some FTP servers in a network that seem to allow login with an anonymous FTP user. I confirmed this with the ftp-anon NSE script in Nmap. PORT STATE SERVICE 21/tcp open ftp |_ftp-anon: ...
0
votes
1answer
106 views

Should all local users with the same username have the same UID in all the machines of an organization?

We have a datacenter environment where there are servers with the username "java" that has the UID 5000. Now, we are creating the same local user, "java", in some thinclients. Is it important that ...
1
vote
3answers
5k views

Identity and Access Management (IAM/IdAM) deployment guide

I'm working on a set of applications that require authentication and authorization. Can you point me in the right direction to some architecture design for this when I want to have multiple services ...
0
votes
1answer
80 views

Securing Macbooks in an Enterprise Environment [closed]

I have been looking online at different forums/websites but was not able to find a direct answer. Does a checklist/process or software exist to secure Macbook computers in a enterprise environment( ...
1
vote
2answers
332 views

Should users be allowed to reuse/recyle the same login credentials across a network for different systems?

Should users be allowed to reuse/recycle the same login credentials across a network for different systems? Should this be disallowed/discouraged, or are the security implications minimal? If it's ...
95
votes
6answers
5k views

Should passwords be automatically reset when the underlying method changes

I'm currently an engineer on a project in development phase. One 'module' on this project gives the ability for user authentication/authorization. However it's come to our concern that the password ...
3
votes
1answer
120 views

What are the security implications of having a dummy user account representing unauthenticated users?

In my web application, users are assigned to groups and groups are granted permissions on objects. The application exposes some objects to unauthenticated public users (i.e. people casually visiting ...
9
votes
1answer
612 views

How to protect a Wifi network from Microsoft WiFi Sense

Microsoft is deploying a new feature, WiFi Sense, which provides users a way to easily share passwords to wireless networks with all of their contacts. This introduces a new security failure mode: a ...
3
votes
1answer
102 views

Why is it a terrible idea to implement restrictive measures in .bashrc?

Asking this because apparently there are multiple people who genuinely don't realize just how bad of an idea this is, and I want there to be a single, easy-to-find place for them to go / be sent.
0
votes
1answer
463 views

Staying logged in as a user for remote access (such as Team Viewer) Pros & Cons

This company we newly help have no remote access policy for say, but they allow the users to use Team Viewer. I have noticed some user leave their PC logged in all night and weekends and just shut ...
4
votes
4answers
1k views

How to give rights to a System Administrator in an application?

I am designing a security model for a web application which restricts access to certain parts of the app depending on what rights and permissions the user has. These rights and permissions are grouped ...
0
votes
1answer
75 views

Custom publickey authentication

I'm working on a REST account management system over https that should support both username/password and username/publickey authentication schemes. I.e. when a user registers an account, they may ...
1
vote
0answers
52 views

Resources and Examples for Modeling Application Security Groups

I am searching for some resources and documentation on modeling security groups for a web application, but seem to be coming up rather dry. I am interested in creating a visio-like diagram that ...
3
votes
1answer
8k views

Generating token for email validation and registration security

My boss gave me a list of 8K users in csv format and asking me to create accounts for them. The list have users with gmail, hotmail, and organization email addresses. I am using MVC 5 and ASP.NET ...
2
votes
3answers
911 views

How secure is an Activation Email?

Is there any risk to an Activation Email? My ASP.NET Site is set up so that a user has to check their Email and click an activation link which is made of a GUID created as their user ID in the SQL ...
3
votes
2answers
107 views

Ubuntu/Debian Is it okay to use a sudouser account as my primary on a workstation?

This question comes to you from the the common WindowsNT advice that "I", as the computer administrator, should login with a normal unprivileged user account for day to day use. Does this concept have ...
12
votes
4answers
5k views

Should email verification be followed by password-based login? Why?

[This is a duplicate, considered off-topic at https://stackoverflow.com/questions/26564992/should-email-verification-be-followed-by-password-based-login-why] A typical account creation process seems ...