New answers tagged account-security
0
Different usernames
What I think the reason for that is to avoid credentials reuse across multiple websites. While probably you are aware of how passwords should be unique, a large number of bank customer are people older than 60, which are kind and not aware of issues like that.
No Firstname Lastname Usernames
I believe is because they try to avoid phishing....
2
Your arguments seems to be based on the assumption that the majority of tracking is done based on the browser type - which it is not. It is instead based on simple things like cookies, Etag etc but also on more complex things like Javascript based fingerprinting. Such fingerprints do not only depend on the type of browser used, but also on capabilities of ...
0
I have to give a Callback URL to receive some sort of validation, to use an API.
I assume that you are talking about a callback URL as in this scenario: this will be the URL where the server will redirect the browser to after a successful authentication.
Note that the server cannot directly access localhost from outside and usage of VPN does not matter. But ...
0
Localhost is the name that each computer (most computers) has on its loopback interface. You should see this interface as an interface that is attached only to your local system. By definition, the whole 127.0.0.0/8 (or ::1/128 for IPv6) subnet is reserved for this interface. Only your own computer can access this network.
If your service only listens to the ...
0
Laptop
If you use proper password on your laptop, then guessing it can take millions of years. The more realistic scenario would be to shut your laptop down, extract disk, read it in some other system. If your file system is not encrypted, then the attacker may read cookies and try to restore your session. If your laptop was stolen by some occasional people, ...
0
What kind of security risks would I have if I have both my passwords and 2FA within the same app?
What is your threat scenario?
It's convenient. On my laptop, both are available without any external devices. If I log on a website on a computer I don't own, I look up the password and OTP on my phone. The attacker in this scenario will get password, but not ...
Top 50 recent answers are included
