344

If you are logged in and I sit down at your computer, I can lock you out of your account and transfer ownership to myself.


166

I think it's likely that someone is trying to trick you into paying for Netflix for them. From: https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user/: More generally, the phishing scam here is: Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim ...


154

This initial campaign established a baseline first. So, yes, it's normal. "How do we as a company stand? To what level do we need to train? Do we have, as a whole, secure users or do we have, as a whole, unsecure users?" This report establishes this and the extent to which management needs to engage in phishing training. Were only 5% of users to fall ...


148

Locking accounts is a bad idea in the first place. It might seem like you're making your organization more secure by keeping out "bad people" who are "guessing" at passwords using brute force attacks, but what have you really solved? Even with this policy and a perfect userbase who never makes security mistakes, an attacker can perform a denial-of-service ...


145

Facebook reported a data leak today and forced a large number of accounts to log off as a precaution. Source: NY Times and Facebook. That NYT article says "The company forced more than 90 million users to log out early Friday, a common safety measure taken when accounts have been compromised." Additional article from The Hacker News - "unknown hacker or a ...


142

Two main reasons: If your session is compromised (e.g. you leave the computer and someone else jumps on, or there is a remote session compromise vulnerability), it prevents another person from changing the password, locking you out of your own account. If you are enforcing a password change, you can then check that the old and new passwords don't match, ...


140

The way I see it, not storing passwords in Git (or other version control) is a convention. I suppose one could decide not to enforce it with various results, but here's why this is generally frowned upon: Git makes it painful to remove passwords from source code history, which might give people a false idea that the password was already removed in the ...


130

No, because by giving names you are assigning blame, security needs to move away from blaming individuals and instead take it as a whole. It's the same as finding a security vulnerability in a web site: you shouldn't blame the developer but should instead look to improve the entire process. We run phishing campaigns and do not identify users. What we use it ...


121

On a Linux system you can easily delete a user without having to delete any files owned by that user. Such a file will stay in place and the file owner's user ID (which is stored as an attribute of the inode) remains unchanged. This way a file can become effectively ownerless. If you then later create a user with the same ID, the user will automatically ...


119

Quite obviously, if they can display your password, then they are storing your password somehow. They might cache your password on the client-side when you log in (for unjustifiable reasons, like session management), but more likely their password database is in clear text. Either way, it's stored and it should not be. And it looks like they are running a ...


118

Financial institutions in the United States are obliged by the Gramm-Leach-Bliley Act to ensure the security and confidentiality of personal information. What you describe is a flagrant violation of the FTC's Safeguards Rule. I would immediately file a complaint with the FTC.


113

Many people have looked at the reasons not to allow name changes from both a security and a community standpoint. However, there are plenty of legitimate reasons to allow username changes, even if the username is separate from the display name, for example: Someone has changed their real life name or the name by which they'd prefer to be called, due to ...


112

No, it's not dangerous at all. Your browser is warning you because a non-Paypal website has Paypal in its name. This is a common technique used by phishing sites that attempt to fool you into thinking the site is official. For example, a website might be called paypal.secure1234.com and made to look like the official site, enticing you to trust it and input ...


108

This is a consideration between security and usability, and therefore there is not really a right answer here. So here follows my opinion. If you can keep usernames secret, then do so. In this case there is no way to figure out whether a username exists, and the login reacts the same whether a user exists or not. Note that this also means taking the same ...


106

To start with the easy bit: you do not have to put real information as the answers to the questions. Random strings work best if you are really paranoid and store them in a password manager just like a password. The rest (no brute force protection, potentially outdated software) is a shame, but there is nothing that you can do, from a security perspective. ...


103

TL;DR: It's probably well-intentioned and not a scam, but just poorly written. I don't know of any kind of scam that would be based on this. Certainly there have been attempts to extort website owners for money based on knowledge of website vulnerabilities (and the implicit threat to exploit them), but that doesn't look like the case here. It's not a very ...


100

You can't detect it with 100% certainty because not everyone who steals your data wants to phish you, or sell it. But for those who do want to phish you - and that's a large portion of them - there are some tricks you can apply. In most places, you cannot provide fake details. You need to enter your name, physical address, credit card information, social ...


94

To augment the other answers, I'll add to confirm that the keyboard is working as the user intends. Caps lock can invert the case, and Num lock can change whether typing e.g. a "4" on the keypad will instead move the cursor left. Some interfaces show a warning, but many don't. Most OSs have software keyboard layouts. Being able to type your old password ...


92

First, the non-security reason: Password Change Workflow Passwords change independently of a software application code. If a DBA changes a database password, does it make sense for developers to have to update the code, get a new build and release to production, and try to time it all? Passwords are a runtime configuration artifact, not development ...


91

It is becoming quite commonplace in the US. Many banks and other financial institutions require the caller to provide an identification number that has been set up beforehand to verify they are indeed talking to an authorized user of the account. They used to ask personal information - social security number, old addresses, security questions, etc. Those ...


90

If you are concerned about the privacy of your password and thus your account (which should be the case), you should try to educate the customer service. The developer FAQ from the public shaming project for this kind of recklessness lists a few good points and is worth a read. Also, you should point out that you feel insecure and lose trust in the company ...


90

I'll start with what to do with your current system: Get in and make a backup of everything. Unless you can demonstrate major losses ($10k+), I wouldn't even begin to think about involving law enforcement. They have their hands full, and given the current patterns on the internet, it's highly likely that your culprit is in a different country than you are. ...


89

No, they would have to have access to your browser cookies in order to abuse them to log into a site you left logged in. Merely knowing your public IP address would not allow them to log into any website. If you are asking this question though, I would not be so sure that there are "immense barriers" between them and your personal computer. A good hacker can ...


86

Yes. This is a problem - a big problem. Lately I found a design flaw in a business' webshop that allowed me to insert innocent notes in other visitors' charts. Seems innocent, and only annoying, until I looked further and found that I was also able to insert Javascript code (XSS) into those notes. So in other words, I could exploit XSS on every visitor's ...


85

Google says it's not a security problem and that you don't have to worry. After investigation they issued a statement in the Google product forums: What happened? During routine maintenance [from 1pm to midnight PST yesterday], a number of users were signed-out from their Google accounts. This may have resulted in you being signed out of your ...


83

In my opinion, you did the right thing. There is no situation in which you should ever be required to give up a PIN either over the phone or in person, with the exception of typing it into the (HTTPS) bank's website to login to your account or on a physical banking terminal such as an ATM. The entire purpose of a personal-identification-number (PIN) is to ...


76

You can use git reflog in a clone and checkout the last commit before this happened. It happened because .git/config on your webserver (in the directory of the cloned repo) includes the remote URLs and people added username:password in it which should never be the case - people should use SSH, deploy keys or authenticate on each pull. Never store your ...


73

Just because you had not set a password, that does not mean that your account could be accessed. Without seeing the code, I cannot be sure, but it is possible that you could not log in to your account until you used the link in the email to set the password. You were still using the same session ID while you continued to use the site.


70

I guess I receive those mails because I use a VPN (always same public IP) and some privacy plugins in Firefox. Yes, this is likely the reason. You use these plugins in order to prevent that the other side can detect that you are the same user on the same device as the previous time. And that's exactly what the mail from Google says: it detected a login from ...


67

As a programmer who has created a user signup workflow like this I can assure you that there is nothing to worry about. A little background info When you enter your email, no user account is created (yes, you read it right). The email, link, expiry time and other details are stored. Once you verify your email and enter the password, a new user account is ...


Only top voted, non community-wiki answers of a minimum length are eligible