Skip to main content
639 votes
Accepted

Why can I log in to my Facebook account with a misspelled email/password?

Facebook is allowing you to make a handful of mistakes to ease the login process. A Facebook engineer explained the process at a conference. The gist of it is that Facebook will try various ...
Allison's user avatar
  • 4,035
358 votes
Accepted

What is the purpose of confirming old password to create a new password?

If you are logged in and I sit down at your computer, I can lock you out of your account and transfer ownership to myself.
schroeder's user avatar
  • 131k
186 votes
Accepted

Why would someone open a Netflix account using my Gmail address?

I think it's likely that someone is trying to trick you into paying for Netflix for them. From: https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user/: More generally, ...
jamesdlin's user avatar
  • 2,085
152 votes
Accepted

Company does not want any names on phishing reports

This initial campaign established a baseline first. So, yes, it's normal. "How do we as a company stand? To what level do we need to train? Do we have, as a whole, secure users or do we have, as a ...
baldPrussian's user avatar
  • 2,778
147 votes

What is the purpose of confirming old password to create a new password?

Two main reasons: If your session is compromised (e.g. you leave the computer and someone else jumps on, or there is a remote session compromise vulnerability), it prevents another person from ...
Matthew's user avatar
  • 27.4k
145 votes

Is displaying remaining password retry count a security risk?

Locking accounts is a bad idea in the first place. It might seem like you're making your organization more secure by keeping out "bad people" who are "guessing" at passwords using brute force attacks,...
Sean Werkema's user avatar
  • 2,980
144 votes

Why is storing passwords in version control a bad idea?

The way I see it, not storing passwords in Git (or other version control) is a convention. I suppose one could decide not to enforce it with various results, but here's why this is generally frowned ...
d33tah's user avatar
  • 6,574
144 votes
Accepted

Logged out of Facebook on all devices on a sudden. Should I be worried about being hacked?

Facebook reported a data leak today and forced a large number of accounts to log off as a precaution. Source: NY Times and Facebook. That NYT article says "The company forced more than 90 million ...
Teun Vink's user avatar
  • 6,938
143 votes
Accepted

Why can't I just let customers connect directly to my database?

TL,DR: Don't. (My-)SQL permissions are pretty fine-grained, so I'd wager there shouldn't be any obvious security issues Even with permission on the record level, it does not scale easy. If a user ...
ThoriumBR's user avatar
  • 54.6k
128 votes

Company does not want any names on phishing reports

No, because by giving names you are assigning blame, security needs to move away from blaming individuals and instead take it as a whole. It's the same as finding a security vulnerability in a web ...
McMatty's user avatar
  • 3,260
119 votes
Accepted

Why are files that are not assigned to a user considered a security risk?

On a Linux system you can easily delete a user without having to delete any files owned by that user. Such a file will stay in place and the file owner's user ID (which is stored as an attribute of ...
Arminius's user avatar
  • 45k
117 votes
Accepted

Is it unsafe to show message that username/account does not exist at login?

This is a consideration between security and usability, and therefore there is not really a right answer here. So here follows my opinion. If you can keep usernames secret, then do so. In this case ...
Sjoerd's user avatar
  • 31.8k
115 votes
Accepted

Website returning plaintext password

Quite obviously, if they can display your password, then they are storing your password somehow. They might cache your password on the client-side when you log in (for unjustifiable reasons, like ...
schroeder's user avatar
  • 131k
112 votes
Accepted

Is it good or bad practice to allow a user to change their username?

Many people have looked at the reasons not to allow name changes from both a security and a community standpoint. However, there are plenty of legitimate reasons to allow username changes, even if the ...
fluffy's user avatar
  • 1,352
112 votes

Is this Paypal Github SDK reference really a dangerous site?

No, it's not dangerous at all. Your browser is warning you because a non-Paypal website has Paypal in its name. This is a common technique used by phishing sites that attempt to fool you into thinking ...
forest's user avatar
  • 67k
104 votes

Employer makes me use what I believe to be an insecure website for HR functions. What to do?

To start with the easy bit: you do not have to put real information as the answers to the questions. Random strings work best if you are really paranoid and store them in a password manager just like ...
schroeder's user avatar
  • 131k
103 votes
Accepted

Email received regarding Security flaw in website

TL;DR: It's probably well-intentioned and not a scam, but just poorly written. I don't know of any kind of scam that would be based on this. Certainly there have been attempts to extort website ...
David's user avatar
  • 16.1k
97 votes

What is the purpose of confirming old password to create a new password?

To augment the other answers, I'll add to confirm that the keyboard is working as the user intends. Caps lock can invert the case, and Num lock can change whether typing e.g. a "4" on the keypad will ...
Spencer Joplin's user avatar
95 votes

Why is storing passwords in version control a bad idea?

First, the non-security reason: Password Change Workflow Passwords change independently of a software application code. If a DBA changes a database password, does it make sense for developers to ...
Brandon's user avatar
  • 961
92 votes
Accepted

Can a hacker, that knows my IP address, remotely access accounts I have left logged in on my computer?

No, they would have to have access to your browser cookies in order to abuse them to log into a site you left logged in. Merely knowing your public IP address would not allow them to log into any ...
forest's user avatar
  • 67k
90 votes

Bank wants my Online-banking PIN through the telephone

It is becoming quite commonplace in the US. Many banks and other financial institutions require the caller to provide an identification number that has been set up beforehand to verify they are ...
Tracy Cramer's user avatar
88 votes

Brutalized VPS recovery data now available. Considerations?

I'll start with what to do with your current system: Get in and make a backup of everything. Unless you can demonstrate major losses ($10k+), I wouldn't even begin to think about involving law ...
David's user avatar
  • 16.1k
88 votes
Accepted

Are password managers more secure than a slightly different password for each website?

Yes, decent password managers are more secure than using any password pattern. You have a password manager, and it has created you random passwords: 6AKQ3)mcV!xX3b8-ZgncCe%tdn!&.@3X a6/...
Esa Jokinen's user avatar
  • 19.1k
87 votes

Why can I log in to my Facebook account with a misspelled email/password?

It is long know that Facebook allows you on purpose to log in with the password case reversed or the first character capitalized (see this article). They do this while storing only a hashed password. ...
Ángel's user avatar
  • 19k
86 votes

Are security flaws acceptable if not much harm can derive from them?

Yes. This is a problem - a big problem. Lately I found a design flaw in a business' webshop that allowed me to insert innocent notes in other visitors' charts. Seems innocent, and only annoying, ...
O'Niel's user avatar
  • 2,916
85 votes
Accepted

Google account verification request

Google says it's not a security problem and that you don't have to worry. After investigation they issued a statement in the Google product forums: What happened? During routine maintenance [from 1pm ...
Arminius's user avatar
  • 45k
80 votes
Accepted

What is the suggested best practice for changing a user's email address?

The problem I see with confirming the old email address is that sometimes people change address because they cannot access the old one anymore. For example, the old address might have expired (and ...
reed's user avatar
  • 15.8k
79 votes
Accepted

Bank wants my Online-banking PIN through the telephone

In my opinion, you did the right thing. There is no situation in which you should ever be required to give up a PIN either over the phone or in person, with the exception of typing it into the (HTTPS) ...
dFrancisco's user avatar
  • 2,761
79 votes
Accepted

The most secure way to handle someone forgetting to verify their account?

What I see most commonly is allowing the authentication and signing the user in, but locking meaningful features away until the email is verified. You should bubble up an error reminding the user to ...
Buffalo5ix's user avatar
  • 2,726

Only top scored, non community-wiki answers of a minimum length are eligible