611

Facebook is allowing you to make a handful of mistakes to ease the login process. A Facebook engineer explained the process at a conference. The gist of it is that Facebook will try various permutations of the input you submitted and see if they match the hash they have in their database. For example, if your password is "myRealPassword!" but you submit "...


177

I think it's likely that someone is trying to trick you into paying for Netflix for them. From: https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user/: More generally, the phishing scam here is: Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim ...


117

Quite obviously, if they can display your password, then they are storing your password somehow. They might cache your password on the client-side when you log in (for unjustifiable reasons, like session management), but more likely their password database is in clear text. Either way, it's stored and it should not be. And it looks like they are running a ...


80

What I see most commonly is allowing the authentication and signing the user in, but locking meaningful features away until the email is verified. You should bubble up an error reminding the user to re-send an activation email if they try to access one of the restricted features. It is poor design to ever lie to a user - if they submit the correct username ...


79

It is long know that Facebook allows you on purpose to log in with the password case reversed or the first character capitalized (see this article). They do this while storing only a hashed password. Are you seeing that more differences are allowed? Apparently, they also have some similar usability features for the email address. Automatically "correcting" ...


78

The idea would be that different parts of the server code interpret the request in different ways, resulting in an application that is vulnerable to HTTP Parameter Pollution. For your example /editpost/?postuid=19348&postuid=1 the query string would be parsed differently for the code parts that carry out authorization (those would have to check for ...


77

You can use git reflog in a clone and checkout the last commit before this happened. It happened because .git/config on your webserver (in the directory of the cloned repo) includes the remote URLs and people added username:password in it which should never be the case - people should use SSH, deploy keys or authenticate on each pull. Never store your ...


76

If you want to implement a security measure, you need to know what you secure yourself against. In this case, you want to secure yourself against a Man-in-the-Middle attack. As you said yourself, a change of IP address is not a good indicator for that, for actually two reasons: There are many reasons why an IP address would change for legitimate reasons, ...


70

I guess I receive those mails because I use a VPN (always same public IP) and some privacy plugins in Firefox. Yes, this is likely the reason. You use these plugins in order to prevent that the other side can detect that you are the same user on the same device as the previous time. And that's exactly what the mail from Google says: it detected a login from ...


55

It's generally undesirable to have multiple people knowing the same password. Instead, systems that requires multiple user to be able to access the same resources usually requires each user to create their own accounts, each with their own password that's only known to themselves, and the system would simply allow all the users to access the same resources. ...


51

If you are storing all the relevant information (token, expiration time, user) in the database anyway, the only thing you need to make sure about the token is that it is impossible to guess a token. Your token is impossible to guess if at least one of these two holds: The secret remains secret. It has to have very high entropy, and never be leaked. The ...


50

Is 2FA via mobile the best security there is? No. SMS 2FA is the weakest form of 2FA, however, it's still worthwhile because it does improve security and it has a relatively low barrier of entry especially for non-technical users. What can be improved? You can use TOTP token using apps like Google Authenticator. This still uses your mobile phone, but it ...


49

I doubt that the hackers pushed a "delete all" commit, or else you could simply revert the last commit. Rather, they force-pushed a different commit with the note to the HEAD of the master branch, making it look like your entire commit history is gone. As others have pointed out, you can easily use a local repo to force push the correct code to the server. ...


49

The most probable situation is that someone used an arbitrary Gmail address (yours) in order to sign up for a free trial, or mistakenly tried to change their email to the wrong address (maybe to have a friend/family also get emails). This would not be a "hack" or even a phishing attempt, just using any available address. This does mean that your Gmail ...


35

Your data is probably* safe if the following three criteria are met: You have FileVault turned on (full disk encryption). Your laptop requires a password on boot and every time you open the lid (auto screen lock). Your password is not well known (easy to guess). TL;DR; If you don't have FileVault turned on, then your data is in plaintext and anyone can ...


27

If you consider the login process as a whole, this measure can actually increase security. Instead of granting users several login attempts to manually fix common misspellings, the site tries to fix those misspellings automatically. As a result, the average number of login attempts a user needs goes down, which means a more strict rate limiting to an ...


27

SMS 2FA is not only a bad idea; it's worse than not having 2FA at all (password only). This is because virtually all services offering "SMS 2FA" are actually delivering SMS 1FA! That is, they allow full account recovery via SMS, with no need to have the account password. This means anyone who can: convince your mobile carrier to port your number convince ...


24

I don’t know of any actual web apps that employ such a system. But it is very much possible. Specifically, what your asking about is called a threshold signature. The idea is that a group of N people each get their own secret credential. They can each use their credentials to partially sign a message. There will be some number M, often called the “quorum”, ...


19

I unlocked a Mac laptop that a friend "found in a bin" without knowing the password and accessed all data on it. After a quick bit of googling I created a new account and reset the existing account password. We worked out who owned the laptop previously, called her, and to my utter surprise, she said she threw it in the bin. It was an older laptop and about ...


14

The only consideration is the one of risk. Controls (like this control) are put in place to mitigate risks. What risks are you trying to mitigate? You say that it might mitigate MitM. Ok. Is that your web service's responsibility to do that? Does it make sense for the service to do that? Then let's consider the actual scenario. Your control mitigates MitM ...


13

The plaintext password is a gaping security issue. First, they shouldn't even know it. Passwords should be stored hashed and salted. Anyone who doesn't do that is an [censored by editors]. Second, sending the password over the wire when not strictly necessary is a second huge security mistake. Third, including it in the webpage at this point only adds ...


11

The PSK passphrase is (by design) stored in a retrievable format by the Modem vendor, in this case Arris, but the same standard is supported by many other modem vendors. In DOCSIS cable modems this is most commonly done via SNMP against this specific OID: clabWIFIAccessPointSecurityKeyPassphrase OBJECT-TYPE SYNTAX SnmpAdminString (SIZE(0..63)) ...


11

Because of the "dots don't matter" gmail policy, this is not likely to be someone else's bona fide Netfix account, unless a typo has occurred in the name other than dot placement. Even so, you should not hijack this account, it is not yours. So no changing the email address to another domain. The scam depends upon you having a Netflix account, and using your ...


8

They do that via an iframe with one of Google's beta features which is currently closed. You can see the iframe in the following screenshot of Medium's website. However, this does not mean Medium will be able to access your user information. The content inside of the iframe is sandboxed and can only be accessed if Google adds a same origin policy ...


8

I agree with Buffalo5ix, but email verification should not be considered a part of account security. Email verification: proves the ownership of the address, just to know that the user has entered correct address for you to send spam password recovery emails. serves as a very light deterrent for registering multiple fake accounts. It's pretty easy to ...


7

You don't want to leak the information that the username exists in response to an unauthenticated login attempt. That would allow attackers to determine which of the email addresses on their list exist with your service. But if the user logs in with the password that they supplied upon registration, that's not the situation you're in. You know (as much as ...


7

Indeed I do this quite often. GMail has a feature where you can do this using the '+' sign. According to Google: Append a plus ("+") sign and any combination of words or numbers after your email address. For example, if your name was hikingfan@gmail.com, you could send mail to hikingfan+friends@gmail.com or hikingfan+mailinglists@gmail.com. The benefits ...


6

If more branches are affected, you may need to checkout all branches first with the following command before performing git push -u --all -f for branch in `git branch -a | grep remotes | grep -v HEAD | grep -v master `; do git branch --track ${branch#remotes/origin/} $branch done https://gist.github.com/octasimo/66f3cc230725d1cf1421


6

To be honest, we don't know. They could store the password in plaintext, they could store it encrypted. Both would be quite desastrous. They could store it in the session (i.e. server-side) when you log in which would be somewhat less desastrous but still bad. They could even have you store it in a cookie (i.e. client-side) and then have the script showing ...


6

As I understand your question, you are storing the user ID in a cookie. The server then blindly trust this value when the client sends back a user ID. That design is vulnerable, and trivial to hack. An attacker doesn't even need to copy a cookie, just set one to an arbitrary number and bam, you are logged in as that user. Your suggested fixes does not solve ...


Only top voted, non community-wiki answers of a minimum length are eligible