637
votes
Accepted
Why can I log in to my Facebook account with a misspelled email/password?
Facebook is allowing you to make a handful of mistakes to ease the login process. A Facebook engineer explained the process at a conference. The gist of it is that Facebook will try various ...
- 3,995
359
votes
Accepted
What is the purpose of confirming old password to create a new password?
If you are logged in and I sit down at your computer, I can lock you out of your account and transfer ownership to myself.
- 128k
186
votes
Accepted
Why would someone open a Netflix account using my Gmail address?
I think it's likely that someone is trying to trick you into paying for Netflix for them. From: https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user/:
More generally, ...
- 2,085
152
votes
Accepted
Company does not want any names on phishing reports
This initial campaign established a baseline first. So, yes, it's normal. "How do we as a company stand? To what level do we need to train? Do we have, as a whole, secure users or do we have, as a ...
- 2,778
148
votes
What is the purpose of confirming old password to create a new password?
Two main reasons:
If your session is compromised (e.g. you leave the computer and someone else jumps on, or there is a remote session compromise vulnerability), it prevents another person from ...
- 27.4k
146
votes
Is displaying remaining password retry count a security risk?
Locking accounts is a bad idea in the first place. It might seem like you're making your organization more secure by keeping out "bad people" who are "guessing" at passwords using brute force attacks,...
- 2,984
145
votes
Why is storing passwords in version control a bad idea?
The way I see it, not storing passwords in Git (or other version control) is a convention. I suppose one could decide not to enforce it with various results, but here's why this is generally frowned ...
- 6,534
145
votes
Accepted
Logged out of Facebook on all devices on a sudden. Should I be worried about being hacked?
Facebook reported a data leak today and forced a large number of accounts to log off as a precaution. Source: NY Times and Facebook.
That NYT article says "The company forced more than 90 million ...
- 6,898
143
votes
Accepted
Why can't I just let customers connect directly to my database?
TL,DR: Don't.
(My-)SQL permissions are pretty fine-grained, so I'd wager there shouldn't be any obvious security issues
Even with permission on the record level, it does not scale easy. If a user ...
- 53.6k
128
votes
Company does not want any names on phishing reports
No, because by giving names you are assigning blame, security needs to move away from blaming individuals and instead take it as a whole. It's the same as finding a security vulnerability in a web ...
- 3,260
120
votes
What to do if stuck with website that has poor security?
Financial institutions in the United States are obliged by the Gramm-Leach-Bliley Act to ensure the security and confidentiality of personal information. What you describe is a flagrant violation of ...
- 1,091
120
votes
Accepted
Why are files that are not assigned to a user considered a security risk?
On a Linux system you can easily delete a user without having to delete any files owned by that user. Such a file will stay in place and the file owner's user ID (which is stored as an attribute of ...
- 44.7k
117
votes
Accepted
Is it unsafe to show message that username/account does not exist at login?
This is a consideration between security and usability, and therefore there is not really a right answer here. So here follows my opinion.
If you can keep usernames secret, then do so. In this case ...
- 29.6k
116
votes
Accepted
Website returning plaintext password
Quite obviously, if they can display your password, then they are storing your password somehow. They might cache your password on the client-side when you log in (for unjustifiable reasons, like ...
- 128k
113
votes
Accepted
Is it good or bad practice to allow a user to change their username?
Many people have looked at the reasons not to allow name changes from both a security and a community standpoint. However, there are plenty of legitimate reasons to allow username changes, even if the ...
- 1,352
112
votes
Is this Paypal Github SDK reference really a dangerous site?
No, it's not dangerous at all. Your browser is warning you because a non-Paypal website has Paypal in its name. This is a common technique used by phishing sites that attempt to fool you into thinking ...
- 66.5k
105
votes
Employer makes me use what I believe to be an insecure website for HR functions. What to do?
To start with the easy bit: you do not have to put real information as the answers to the questions. Random strings work best if you are really paranoid and store them in a password manager just like ...
- 128k
102
votes
Accepted
Email received regarding Security flaw in website
TL;DR: It's probably well-intentioned and not a scam, but just poorly written.
I don't know of any kind of scam that would be based on this. Certainly there have been attempts to extort website ...
- 16.1k
99
votes
Accepted
Is it possible to detect security breaches as a user before they're announced?
You can't detect it with 100% certainty because not everyone who steals your data wants to phish you, or sell it. But for those who do want to phish you - and that's a large portion of them - there ...
- 22.6k
98
votes
What is the purpose of confirming old password to create a new password?
To augment the other answers, I'll add to confirm that the keyboard is working as the user intends.
Caps lock can invert the case, and Num lock can change whether typing e.g. a "4" on the keypad will ...
- 1,096
95
votes
Why is storing passwords in version control a bad idea?
First, the non-security reason:
Password Change Workflow
Passwords change independently of a software application code. If a DBA changes a database password, does it make sense for developers to ...
- 961
93
votes
Accepted
What to do if stuck with website that has poor security?
If you are concerned about the privacy of your password and thus your account (which should be the case), you should try to educate the customer service. The developer FAQ from the public shaming ...
- 14.4k
92
votes
Accepted
Can a hacker, that knows my IP address, remotely access accounts I have left logged in on my computer?
No, they would have to have access to your browser cookies in order to abuse them to log into a site you left logged in. Merely knowing your public IP address would not allow them to log into any ...
- 66.5k
90
votes
Bank wants my Online-banking PIN through the telephone
It is becoming quite commonplace in the US. Many banks and other financial institutions require the caller to provide an identification number that has been set up beforehand to verify they are ...
- 853
89
votes
Brutalized VPS recovery data now available. Considerations?
I'll start with what to do with your current system:
Get in and make a backup of everything.
Unless you can demonstrate major losses ($10k+), I wouldn't even begin to think about involving law ...
- 16.1k
89
votes
Accepted
Are password managers more secure than a slightly different password for each website?
Yes, decent password managers are more secure than using any password pattern.
You have a password manager, and it has created you random passwords:
6AKQ3)mcV!xX3b8-ZgncCe%tdn!&.@3X
a6/...
- 18.7k
87
votes
Why can I log in to my Facebook account with a misspelled email/password?
It is long know that Facebook allows you on purpose to log in with the password case reversed or the first character capitalized (see this article). They do this while storing only a hashed password. ...
- 18.8k
86
votes
Are security flaws acceptable if not much harm can derive from them?
Yes. This is a problem - a big problem.
Lately I found a design flaw in a business' webshop that allowed me to insert innocent notes in other visitors' charts.
Seems innocent, and only annoying, ...
- 2,772
85
votes
Accepted
Google account verification request
Google says it's not a security problem and that you don't have to worry.
After investigation they issued a statement in the Google product forums:
What happened?
During routine maintenance [from 1pm ...
- 44.7k
81
votes
Accepted
Bank wants my Online-banking PIN through the telephone
In my opinion, you did the right thing. There is no situation in which you should ever be required to give up a PIN either over the phone or in person, with the exception of typing it into the (HTTPS) ...
- 2,721
Only top scored, non community-wiki answers of a minimum length are eligible