Questions tagged [user-management]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
31 views

Make use of encrypted or anonymous data in database [duplicate]

As an answer to the following question, I read the idea of encrypting user data with 2 keys based on random generation and the user password: Store encrypted user data in database But could anyone ...
Sichrisy's user avatar
0 votes
1 answer
131 views

Is every string a possible username?

I have noticed that a lot of websites only allow a fixed amount of username changes, and does not allow the reuse of a previously or currently used username. For example, on Fandom.com once a username ...
God's user avatar
  • 1
-1 votes
1 answer
106 views

Can Outlook stay connected to an email account through a password change?

Corporate setting, multiple people have access to the same email account (it is a functional not a personal account). Order of events: User A opens Outlook, connects to the shared email account, ...
quarague's user avatar
  • 183
2 votes
0 answers
302 views

Active Directory and External Email Accounts

In my place of work we have an on-prem Active Directory with 'staff' accounts. Each of these AD accounts has an associated company email, e.g. jo[email protected] Within the same AD we also have '...
TheOrdinaryGeek's user avatar
1 vote
0 answers
27 views

Account creation flow for semi-internal applications

We are developing an application that is to be used internally at our clients companies, but will be exposed as a public accessible website. We have some clients who wish to use local accounts on our ...
Alexander882's user avatar
1 vote
1 answer
486 views

Is TLS needed on loopback for local security?

So the scenario is that we have a server shared with a number of users, with me being the server administrator and able to determine permission assignments. The server is running a service on loopback ...
Chaser hkj's user avatar
1 vote
2 answers
145 views

How to non-intrusively monitor my team's MacBooks secure configuration?

I'm managing a small remote team. We care about security and I want to be sure that our MacBooks comply with at least basic security standards, such as CIS benchmark. These are the ways I see I could ...
yuresh Shayzer's user avatar
2 votes
1 answer
169 views

Is it safe for website to generate fake profile pages?

Today I found a website which generates a fake profile when asked if said profile exists. Example: www.site.com/user/mycoolname doesn't exist yet. But if I put it in the browser for the site I get a ...
Phaidrin's user avatar
0 votes
0 answers
88 views

Are hashed passwords transferred to a server for user authentication? [duplicate]

A question I came up with while reading in my information security class. Let's say website ABC which uses username and password combinations to authenticate users and has a user John. When John goes ...
Nihal's user avatar
  • 1
1 vote
1 answer
80 views

Securely adding new users to account

In a multi-tenant application, I'm thinking of the right way to let a tenant add users to its account. Assume the "root" user (that signed up and created the tenant) already exists. At some ...
manash's user avatar
  • 143
1 vote
1 answer
220 views

Is there a secure way of handling online payments without user accounts and logging in?

I'm creating a subscription-based desktop application, but there is no authentication on the platform as the "user" is the computer upon which the application is installed. This means no ...
Gumptastic's user avatar
2 votes
3 answers
439 views

Is it more or less secure to use IAM (AWS user management) if you only have one user?

This is an edge case, and as soon as multiple users are accessing the AWS Console in anyway, IAM is the only good option, but what if you only have one user? I've always assumed that if only one ...
TCooper's user avatar
  • 376
0 votes
1 answer
117 views

Is there an effective way to disable root access on linux in an office setting

I'm currently working for SaaS a company and as part of a security audit we were advised to remove all administrative access from all laptops/end-user pc's for a Principle of Least Permissions. Is ...
Exelian's user avatar
  • 101
1 vote
0 answers
98 views

How can OAuth2 (tokens) fit into dynamic sites that still wants to call protected API's via JavaScript?

(I try to understand different concepts regarding web development in general) Most information I find is about Single Page Applications, but how does a dynamic site make use of (for example) OAuth2/...
Hills's user avatar
  • 111
2 votes
1 answer
200 views

Risk associated with Exchange email address as username when AD authentication is enabled

In my existing setup, we have Exchange Server joined with Windows Active Directory. Both the username and email address are the same for user accounts. Our support party also recommended using this ...
web_guy's user avatar
  • 25
4 votes
0 answers
2k views

Maximum password length for user accounts on Ubuntu

I have a VPS hosted at a remote location. Obviously the host can login directly (without SSH or any keys) on this box and I want to make brute force password guessing as hard as possible for a bad ...
Jasper Citi's user avatar
65 votes
2 answers
13k views

How can I prevent a computer from turning ON?

I was reading this question on Stack Exchange Workplace community and it indicates that an IT team was able to prevent a user from turning their laptop on (power on). My laptop access has been shut ...
DxTx's user avatar
  • 1,403
2 votes
0 answers
351 views

Grace period for users after re-enabling account disabled by PCI-DSS 8.1.4?

We have an automated system to disable user accounts that have seen no logins for 90 days. We also have a process of re-enabling such accounts (at the behest of the affected users), and this process ...
KlaymenDK's user avatar
  • 343
0 votes
3 answers
906 views

Associate API key with user

I am creating a public API that will require API key authentication. When a user wants to register a new API key, they send a request to one of our endpoints with a list of permissions they want. We ...
Brad Stevanus's user avatar
1 vote
0 answers
115 views

How can I stop an authorized user from consuming all the bandwidth on my home network? [closed]

Me and my neighbours share a home network managed by me, paid for by the landlord. This person overloads the bandwidth on the regular, jitter spikes up to the 300s,down speed fluctuates, overall ...
Bandwidth Bonanza's user avatar
11 votes
2 answers
4k views

When should user invite links (tokens) expire?

We have a system in which external users can be invited to our identity management system. The users are not employees of our company, but of our customers. The administrators of the customer do not ...
Philipp Grathwohl's user avatar
0 votes
1 answer
145 views

Should admin user be visible to regular users

When building a system, where all users belong to the same organisation, should regular users be able to see admin users? On one hand one could argue that there is no need for this information to be ...
Misha the wild cat's user avatar
1 vote
0 answers
107 views

using public key crypto instead of password for authentication [closed]

I'm the head of IT and development in a small group of enthusiasts spending their free time with a bit of hobby development. We don't have an office yet, but maybe consider to rent some small office ...
cryptearth's user avatar
2 votes
2 answers
191 views

How to provide personal User Page after User already signed up without Password?

I created a small website where participants can sign up with some data (name, email, birthdate, ...) but they don't have to set username and password. After a while it would be useful to provide ...
RandomRouter's user avatar
6 votes
2 answers
470 views

How to convince users that security is a good thing?

So I took over as senior IT manager at a small company a couple months ago. Up to now, there was no "IT department" as such, just another guy who "did computers". To this point: things are running off ...
agentroadkill's user avatar
71 votes
10 answers
23k views

Why avoid shared user accounts?

I know its best practice not to allow shared user accounts, but where is this best practice defined? Is it an ISO standard or something? What is the reasons to always create per person accounts?
Steve Venton's user avatar
0 votes
1 answer
165 views

How to catch people creating many accounts on the same website using very unique credentials?

Nowadays e-commerce is the new trend compared to the retail stores, but some sellers will manipulate their rankings through false purchases of their own items to boost rankings significantly. The ...
Pherdindy's user avatar
  • 109
0 votes
0 answers
89 views

Most accessible yet secure way to verify a user over the phone who has an account online

We have a service where people register online and log fairly sensitive records. They might want to phone up and ask for a status update on these records. At the time they are calling, they may not ...
Digital Skateboarders's user avatar
2 votes
2 answers
177 views

Should a system require a password confirmation for accounts managed by an administrator?

Suppose you have a user account management subsystem with a web UI. You can change user account passwords in regular masked input password fields in HTML POST forms. I'm wondering, is it fine if such ...
lsh's user avatar
  • 21
1 vote
1 answer
169 views

My boss installs software using domain admin. Should I show that this is bad?

At my workplace, users on most workstations (Win7 and 10 blend) do not have local admin rights. As a technical team we often need this for software installs, and so the director gets called around to ...
Anon's user avatar
  • 11
3 votes
3 answers
512 views

Encrypt User specific Information without a password

Given scenario: I have an application (NodeJS) running on Heroku, the database is RDS on Amazon and I use Auth0 for authentication. I don't have access to passwords of the users, some users use social ...
Can's user avatar
  • 131
1 vote
1 answer
104 views

What are the pieces of information delivered in a user profile at the end of a OpenID Connect flow?

From what I understand about using OpenID Connect (over OAuth2), is that we end up with some JSON containing information about the user. That information is transported as a JSON Web Token. ➥ What ...
Basil Bourque's user avatar
3 votes
2 answers
983 views

Using SessionStorage for Some User Info

I have an application that currently keeps a few properties from a user's profile in session storage for the app to use when necessary. We don't keep sensitive data like username or password or ssn in ...
Muirik's user avatar
  • 171
2 votes
2 answers
604 views

Separation of duties for user account creation

Are there any implementations (such as Active Directory) that have applied separation of duties to user account creation, which would require the create user account task and approval task to be done ...
synthesis's user avatar
  • 155
1 vote
1 answer
86 views

Center for Internet Security Version 6.1 Critical Security Control 16-10

My project is implementing The CIS Critical Security Controls, Version 6.1 Can anyone please give me some advice on how we can address sub-control 16.10 which says..... "Profile each user’s typical ...
Joe's user avatar
  • 113
9 votes
1 answer
1k views

How can utilities with setuid set to root be secure if they are debuggable?

Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that: I can freely debug all programs I have the permission to run, even those that have ...
gaazkam's user avatar
  • 5,747
7 votes
2 answers
818 views

Win10: Access other logged on users' memory

How easily can admin users access the data of other users' running processes on Windows 10? Especially webpages loaded by Chrome. Example Context Bob and Alice share a single Windows 10 ...
Hanswurst's user avatar
0 votes
4 answers
216 views

Anything particularly wrong with putting an auth code in marketing emails?

I've been working on my first project, and my initial registered users haven't been particularly sticky. I'd like to send them an email with some news and information and have them be instantly logged ...
user3238414's user avatar
5 votes
3 answers
380 views

As "Head of IT" is it reasonable not to have access to Email or backup management as could contain sensitive information

I work for a medium sized company of around 100 people or so - and I am employed to be Head of IT responsible for backups, security, sorting out technical issues, among other things etc etc. However ...
Jeff's user avatar
  • 183
1 vote
1 answer
325 views

Dealing with shared credentials when an employee leaves

We have around 20+ accounts of different services (company email inboxes, forums, social media, Github, etc.) we use in my team. For security reasons, whenever some employee leaves us, I need to ...
user avatar
20 votes
6 answers
12k views

Is there a security advantage or risk in removing disabled user accounts?

So I'm having a debate with someone about whether or not to remove disabled accounts. My stance is that it is good network hygiene, reduces the amount of noise to sift through, etc. However, the ...
POSH Geek's user avatar
  • 330
2 votes
2 answers
258 views

Password same-account indicators on websites

I am creating a user system which will be used across multiple websites without the use of SSO (the extra hassle really isn't worth it at the minute). I am looking at ways of telling users that they ...
XLR's user avatar
  • 149
5 votes
1 answer
213 views

Is there any danger in subpages that can be called by url but cannot compile due to missing includes?

I have a webpage that basically uses the following structure: index.php functions.php pages/a.php pages/b.php ... When I call index.php, the user is prompted to login or is logged in automatically ...
VVZPHIL's user avatar
  • 51
1 vote
2 answers
181 views

Self-Coded User Authentication Security

We are currently using Apache Shiro for our User Authentication needs. We have dynamic authorization\authentication needs, in some cases users will be authenticated using Active Directory while some ...
Marcel Marino's user avatar
1 vote
1 answer
435 views

User Credentials for Accessing Network Resources

I am in the process of setting up the infrastructure for microservices using RabbitMQ as our message broker for our company. I am trying to figure out the best way to handle security for the system. ...
Michael Harris's user avatar
1 vote
1 answer
188 views

Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?

When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system? Is it ...
BugHunterUK's user avatar
2 votes
3 answers
245 views

What attacks are possible if you can scrape a list of users?

Have there been any attacks (or can you think of a potential attack) that hinged on being able to figure out if a user exists in a system? For example, in a web app there is a "Reset password" page ...
tau's user avatar
  • 407
1 vote
1 answer
589 views

Rubber ducky windows mitigation

So I am familiar with badusb or rubber ducky attacks, I lack possession of one currently to test any of my questions. Essentially my question is can you mitigate rubber ducky attacks using windows ...
TiDoX's user avatar
  • 28
-5 votes
1 answer
270 views

Why threat modelling and risk planning does not consider the sex of users? [closed]

Isn't it scientifically proven that men and women have very different psychologies? So that, at least they must have different attitudes towards security policies and guidelines compliance. All of ...
Draif Kroneg's user avatar
0 votes
1 answer
101 views

Jira external users verification

I have a Jira site where my customers' employees can open bugs, view bug statuses and so on. I manage these users inside my Jira (external users) and they have username and password with limited ...
Aaron_S's user avatar
  • 11