Questions tagged [user-management]
The user-management tag has no usage guidance.
2
votes
2answers
84 views
How to provide personal User Page after User already signed up without Password?
I created a small website where participants can sign up with some data (name, email, birthdate, ...) but they don't have to set username and password.
After a while it would be useful to provide ...
5
votes
2answers
212 views
How to convince users that security is a good thing?
So I took over as senior IT manager at a small company a couple months ago. Up to now, there was no "IT department" as such, just another guy who "did computers". To this point: things are running off ...
68
votes
10answers
14k views
Why avoid shared user accounts?
I know its best practice not to allow shared user accounts, but where is this best practice defined? Is it an ISO standard or something? What is the reasons to always create per person accounts?
0
votes
1answer
91 views
How to catch people creating many accounts on the same website using very unique credentials?
Nowadays e-commerce is the new trend compared to the retail stores, but some sellers will manipulate their rankings through false purchases of their own items to boost rankings significantly. The ...
0
votes
0answers
24 views
Most accessible yet secure way to verify a user over the phone who has an account online
We have a service where people register online and log fairly sensitive records. They might want to phone up and ask for a status update on these records.
At the time they are calling, they may not ...
1
vote
2answers
79 views
Should a system require a password confirmation for accounts managed by an administrator?
Suppose you have a user account management subsystem with a web UI. You can change user account passwords in regular masked input password fields in HTML POST forms. I'm wondering, is it fine if such ...
1
vote
1answer
104 views
My boss installs software using domain admin. Should I show that this is bad?
At my workplace, users on most workstations (Win7 and 10 blend) do not have local admin rights. As a technical team we often need this for software installs, and so the director gets called around to ...
3
votes
1answer
89 views
Encrypt User specific Information without a password
Given scenario:
I have an application (NodeJS) running on Heroku, the database is RDS on Amazon and I use Auth0 for authentication. I don't have access to passwords of the users, some users use social ...
1
vote
1answer
39 views
What are the pieces of information delivered in a user profile at the end of a OpenID Connect flow?
From what I understand about using OpenID Connect (over OAuth2), is that we end up with some JSON containing information about the user. That information is transported as a JSON Web Token.
➥ What ...
3
votes
2answers
76 views
Using SessionStorage for Some User Info
I have an application that currently keeps a few properties from a user's profile in session storage for the app to use when necessary. We don't keep sensitive data like username or password or ssn in ...
2
votes
2answers
253 views
Separation of duties for user account creation
Are there any implementations (such as Active Directory) that have applied separation of duties to user account creation, which would require the create user account task and approval task to be done ...
1
vote
1answer
34 views
Center for Internet Security Version 6.1 Critical Security Control 16-10
My project is implementing The CIS Critical Security Controls, Version 6.1
Can anyone please give me some advice on how we can address sub-control 16.10 which says.....
"Profile each user’s typical ...
7
votes
1answer
583 views
How can utilities with setuid set to root be secure if they are debuggable?
Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that:
I can freely debug all programs I have the permission to run, even those that have ...
7
votes
2answers
247 views
Win10: Access other logged on users' memory
How easily can admin users access the data of other users' running processes on Windows 10?
Especially webpages loaded by Chrome.
Example
Context
Bob and Alice share a single Windows 10 ...
0
votes
4answers
160 views
Anything particularly wrong with putting an auth code in marketing emails?
I've been working on my first project, and my initial registered users haven't been particularly sticky. I'd like to send them an email with some news and information and have them be instantly logged ...
5
votes
3answers
255 views
As “Head of IT” is it reasonable not to have access to Email or backup management as could contain sensitive information
I work for a medium sized company of around 100 people or so - and I am employed to be Head of IT responsible for backups, security, sorting out technical issues, among other things etc etc.
However ...
1
vote
1answer
121 views
Dealing with shared credentials when an employee leaves
We have around 20+ accounts of different services (company email inboxes, forums, social media, Github, etc.) we use in my team. For security reasons, whenever some employee leaves us, I need to ...
21
votes
6answers
6k views
Is there a security advantage or risk in removing disabled user accounts?
So I'm having a debate with someone about whether or not to remove disabled accounts. My stance is that it is good network hygiene, reduces the amount of noise to sift through, etc. However, the ...
2
votes
2answers
209 views
Password same-account indicators on websites
I am creating a user system which will be used across multiple websites without the use of SSO (the extra hassle really isn't worth it at the minute).
I am looking at ways of telling users that they ...
5
votes
1answer
156 views
Is there any danger in subpages that can be called by url but cannot compile due to missing includes?
I have a webpage that basically uses the following structure:
index.php
functions.php
pages/a.php
pages/b.php
...
When I call index.php, the user is prompted to login or is logged in automatically ...
1
vote
2answers
111 views
Self-Coded User Authentication Security
We are currently using Apache Shiro for our User Authentication needs. We have dynamic authorization\authentication needs, in some cases users will be authenticated using Active Directory while some ...
2
votes
1answer
241 views
User Credentials for Accessing Network Resources
I am in the process of setting up the infrastructure for microservices using RabbitMQ as our message broker for our company. I am trying to figure out the best way to handle security for the system. ...
1
vote
1answer
121 views
Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?
When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system?
Is it ...
3
votes
3answers
188 views
What attacks are possible if you can scrape a list of users?
Have there been any attacks (or can you think of a potential attack) that hinged on being able to figure out if a user exists in a system?
For example, in a web app there is a "Reset password" page ...
1
vote
1answer
252 views
Rubber ducky windows mitigation
So I am familiar with badusb or rubber ducky attacks, I lack possession of one currently to test any of my questions.
Essentially my question is can you mitigate rubber ducky attacks using windows ...
-6
votes
1answer
214 views
Why threat modelling and risk planning does not consider the sex of users? [closed]
Isn't it scientifically proven that men and women have very different psychologies? So that, at least they must have different attitudes towards security policies and guidelines compliance. All of ...
0
votes
1answer
47 views
Jira external users verification
I have a Jira site where my customers' employees can open bugs, view bug statuses and so on.
I manage these users inside my Jira (external users) and they have username and password with limited ...
3
votes
1answer
157 views
Is it good practice if all programs have their own user ID? [closed]
Typically, each physical user on a system has an ID, and a running process is run as the user who starts it. This means the process is able to access all of the user's files, even those that not ...
-1
votes
1answer
283 views
plutil -p /Library/Preferences/com.apple.preferences.account.plist
plutil -p /Library/Preferences/com.apple.preferences.accounts.plist shows some deleted usernames that I am in the same school with. Am I hacked by them?? I am really concerned.
Additional information:...
2
votes
2answers
142 views
storing user's information without been able to access it
For a university project of mine I am making a password manager online and I want to be able to store user's passwords on my server without being able to access it myself. Here is what I intend to do:
...
1
vote
2answers
91 views
How to safely setup user rights inside a backup folder?
I use a Synology NAS that has full Linux based user rights control and I want to setup a root shared folder called backup where I'll save backups from different technologies: Time Machine and Windows ...
1
vote
1answer
63 views
Should I have two accounts in my NAS (ex.: Bob as user and Poseidon as admin, both controlled by me)?
I have a Synology NAS running in a SOHO network and I'd like to maintain it secure. First thing I did was disable the default admin and guest accounts, second I created some accounts and this is what ...
4
votes
1answer
127 views
IT Contractor with domain administrator credentials best practice?
We are going to be hiring an external contractor to do some work on our SharePoint server and they will need admin rights for kerberos setup and etc.
What are the best practices of setting up the ...
1
vote
1answer
395 views
Is an anonymous FTP user always a risk (even if this user doesn't have access to anything)?
I found some FTP servers in a network that seem to allow login with an anonymous FTP user. I confirmed this with the ftp-anon NSE script in Nmap.
PORT STATE SERVICE
21/tcp open ftp
|_ftp-anon: ...
0
votes
1answer
106 views
Should all local users with the same username have the same UID in all the machines of an organization?
We have a datacenter environment where there are servers with the username "java" that has the UID 5000. Now, we are creating the same local user, "java", in some thinclients.
Is it important that ...
1
vote
3answers
5k views
Identity and Access Management (IAM/IdAM) deployment guide
I'm working on a set of applications that require authentication and authorization.
Can you point me in the right direction to some architecture design for this when I want to have multiple services ...
0
votes
1answer
80 views
Securing Macbooks in an Enterprise Environment [closed]
I have been looking online at different forums/websites but was not able to find a direct answer. Does a checklist/process or software exist to secure Macbook computers in a enterprise environment( ...
1
vote
2answers
332 views
Should users be allowed to reuse/recyle the same login credentials across a network for different systems?
Should users be allowed to reuse/recycle the same login credentials across a network for different systems? Should this be disallowed/discouraged, or are the security implications minimal? If it's ...
95
votes
6answers
5k views
Should passwords be automatically reset when the underlying method changes
I'm currently an engineer on a project in development phase. One 'module' on this project gives the ability for user authentication/authorization. However it's come to our concern that the password ...
3
votes
1answer
120 views
What are the security implications of having a dummy user account representing unauthenticated users?
In my web application, users are assigned to groups and groups are granted permissions on objects. The application exposes some objects to unauthenticated public users (i.e. people casually visiting ...
9
votes
1answer
612 views
How to protect a Wifi network from Microsoft WiFi Sense
Microsoft is deploying a new feature, WiFi Sense, which provides users a way to easily share passwords to wireless networks with all of their contacts. This introduces a new security failure mode: a ...
3
votes
1answer
102 views
Why is it a terrible idea to implement restrictive measures in .bashrc?
Asking this because apparently there are multiple people who genuinely don't realize just how bad of an idea this is, and I want there to be a single, easy-to-find place for them to go / be sent.
0
votes
1answer
463 views
Staying logged in as a user for remote access (such as Team Viewer) Pros & Cons
This company we newly help have no remote access policy for say, but they allow the users to use Team Viewer. I have noticed some user leave their PC logged in all night and weekends and just shut ...
4
votes
4answers
1k views
How to give rights to a System Administrator in an application?
I am designing a security model for a web application which restricts access to certain parts of the app depending on what rights and permissions the user has. These rights and permissions are grouped ...
0
votes
1answer
75 views
Custom publickey authentication
I'm working on a REST account management system over https that should support both username/password and username/publickey authentication schemes. I.e. when a user registers an account, they may ...
1
vote
0answers
52 views
Resources and Examples for Modeling Application Security Groups
I am searching for some resources and documentation on modeling security groups for a web application, but seem to be coming up rather dry.
I am interested in creating a visio-like diagram that ...
3
votes
1answer
8k views
Generating token for email validation and registration security
My boss gave me a list of 8K users in csv format and asking me to create accounts for them. The list have users with gmail, hotmail, and organization email addresses.
I am using MVC 5 and ASP.NET ...
2
votes
3answers
911 views
How secure is an Activation Email?
Is there any risk to an Activation Email?
My ASP.NET Site is set up so that a user has to check their Email and click an activation link which is made of a GUID created as their user ID in the SQL ...
3
votes
2answers
107 views
Ubuntu/Debian Is it okay to use a sudouser account as my primary on a workstation?
This question comes to you from the the common WindowsNT advice that "I", as the computer administrator, should login with a normal unprivileged user account for day to day use. Does this concept have ...
12
votes
4answers
5k views
Should email verification be followed by password-based login? Why?
[This is a duplicate, considered off-topic at https://stackoverflow.com/questions/26564992/should-email-verification-be-followed-by-password-based-login-why]
A typical account creation process seems ...
