New answers tagged account-security
1
Use a password manager.
A) I can access it, but no one else can.
This is quite tricky on a shared machine. Using a password manager does ensure nobody will be able to access the stored token as it will be encrypted, but malware may still be able to keylog your password manager's master password when you enter it. But in the case of malware, the token can ...
1
Receiving a plain text password (That the user must change upon login) and receive a link with a token it's the same, as long as they meet security policies that are not attached to any type by its own. Some good policies are:
Time based expiration of the temporary password or token.
Complex and random generated passwords/token (Not guessable, based on user'...
1
I recently had to change email addreses on a numb er of sites, because my ISP stopped doing email (their reason bopiled down to "it's tooooooo hard, mommy"). An email address I have had since 1993 stopped working in August last year.
I came across a couple of sites whose policy was simply "you can't change your email address." I had to ...
1
You probably don't want to confirm with the old email address, as one reason to migrate is because an old email account has been compromised and is no longer in the control of the legitimate account owner. You might want to inform the old email address that the account has been changed, and provide them with a point of contact where they can contest this ...
0
There are two types of registration codes.
Codes that identify you. These essentially serve the role of a user name. You might receive something like a "member number" from your credit union or an "attendee ID" when you register for a conference. These are meant to identify. Typically you will need this piece of information to start an ...
2
1.How can I fix this so I stop getting signed up for accounts?
You can't - anyone who knows your email address can do this. Anyone whom you ever emailed or anyone who read an email they forwarded has your mail address; it could be nothing to do with the breach
2.Is that email address far gone and I just need to get a new one?
Maybe, but you need to ...
0
Let's start with whether you need anti-CSRF tokens if you are using JWT tokens. The question is rather, if you are passing JWT token via cookie or not. If you don't pass the token via cookie, you don't need anti-CSRF tokens.
Regarding what you need to consider to do make you application secure. There are different approaches to application security. I would ...
8
The only useful thing about your routine is cleaning the cookies. It's not useful in itself, it is just that, this way, you delete your login session and so a new login (which requires inputting a secret like a password) is required to interact with the shopping site. A better alternative (in terms of your user experience and security) would be logging out ...
23
So if I wish to open "any" site on a new tab while doing my online shopping, is it safe
The same origin policy should prevent other sites from accessing your data in the online shopping site. That is assuming that the shopping site has no vulnerabilities that leak data (CSRF, XSS, XSSI, broken CORS, broken messaging, etc.).
Having only one tab ...
2
I do this to ensure any other websites that I open on new tab does not
sneak into my credit card information. Is this even possible or just a
myth?
That is simply not possible, because the browser doesn't allow such a request due to the same origin policy without the website explicitly stating it in their CORS headers; apart from that, credit card info isn'...
55
I'm probably stupid and don't understand the issue, but to me it looks like the problem can easily be avoided by providing the necessary information only via email (which an attacker isn't supposed to be able to access). If you don't want to leak any information, then the public messages must not be distinguishable, whether an email is already been used or ...
5
This is a bigger question then it might seem. I'll try an focus on the privacy aspect, rather then the engineering aspect.
This scenario isn't entirely implausible, given the Ashley Madison leaks, and the repercussions individuals and/or companies received.
The core issues here are:
How do I provide a secure experience, without some semi-unique publicly ...
0
This is a very good question. In my opinion we need to clarify what you use in order to identify a user. Is it an email address, a username that the user selects or a username you give to your user.
Each of the above must be handled differently. If you use as email as account identification then the data leak is a lot more important. Remember email is ...
5
An idea I have: on the creation form, only ask for an email address. Upon submission, immediately send an email to that address, including a link to a page which allows the user to choose / reset their password.
On the page, display a message like "An email has been sent to your address in order to verify your account or reset your password."
First ...
34
In addition to what nobody said there's a more practical, but mostly internal, requirement here. Changing a local password in Windows without knowing the original password is called a reset. Resets cause DPAPI keys to be invalidated (because they're protected by a primary secret based on the user password). Once the reset happens those original keys are dead ...
13
Changing the password from command line requires an elevated command prompt (i.e. administrative privileges). Normal users cannot do this. This makes sense since the admin should be able to change the password of any user.
If, however, you have left your computer logged in as an admin user then having your password reset by the intruder would be the least of ...
0
I did something similar before. The web version I put behind a VPN, which had a local rule to forward an IP to a locally hosted webserver. This works if you just want to keep it on web.
I then expanded on it where I actually had a mobile app to pull information through an API. That mobile app had certificate that would allow mutual authentication on the ...
1
Of course, a lot of things like that will come down to trust. You either have to completely trust Bravo to not do any harm (intentional or accidental), or you could assume everything is compromised. Depending on how access was granted to Bravo, you may want to take steps to secure your account, such as verifying personal details and changing your password.
...
1
There is a hint in the congrats page that suggests the account you created is a shared account, which means the students will use the same credentials to login to the online school. The people behind this choice must have a proper business justification. Only them can tell the motivation.
They are telling you :
Your students can now start accessing the ...
2
Please don't look up a web development standard and forward it to the school. That is not going to do a thing but get them to roll their eyes at you. Even if they are violating every security principle known to programming, "preaching at them" is not going to get results.
This is an enrollment form designed for parents to sign up multiple students. ...
Top 50 recent answers are included
