New answers tagged account-security
1
If there was a breach then your information are likely no longer only at their server anymore and it is impossible to delete all copies. If you want to stop using these apps and want to make sure that your data are removed now (before a possible breach) you need to check this with the companies responsible for the apps since only these can remove the data. ...
1
The "S" part of "HTTPS" only means that the connection between you and that website is encrypted. It doesn't actually have anything to do with whether or not the website can be trusted not to abuse your connection to it. Generally these days there isn't much an attacker can do to you simply by visiting a website (unless they're advanced and know some special ...
2
Security questions are a terrible idea.
There are no "best practices" like there are for passwords: a password should be hard to guess, long enough, etc. Are security questions any of that? By design, they are the opposite of secure: easy to guess, guessable using a dictionary attack or a list of last names, etc.
You may not want to let people access your ...
4
Steffen's answer is about how the activity of posting on twitter could be detected. Mine is how to change hints that something is suspect into evidences that a specific human being has posted messages.
Once an governmental agency thinks you could be suspected to illegaly (in their sense) use internet, the can revert to the good old methods. That means that ...
5
While the communication between your browser and Twitter is encrypted with HTTPS and also additionally in case of Shadowsocks, the messages you publish can be seen by others - that's the point of Twitter. Depending on the content and time of these messages it might be possible to narrow down who might have send these messages. And the more messages you post ...
0
I'm not going to say "ignore them entirely", but this is pretty common.
They're automated scans for logins - basically, anyone and their dog/cat/cow/python/rat can scan a site for common login URLs. If the scan finds them, then they'll usually probably try following up with credential stuffing attacks (i.e. using username/password combos that are either ...
0
I commonly use that when I have to signup to a server and I do not want to be later spammed bothered by advertisements:
I create a new pseudo-random address on my ISP
I declare that new address on my mail reader
I use it to sign into the server
When I no longer need to use the service, or if I find that it does not worth an email address, I just removes ...
0
In GMail, you can use disposable emails of your own by just adding "+" and any string following it.
Eg:
john.doe+newsletters@gmail.com
john.doe+forums@gmail.com
0
If I suppose that the person who built this build-server is not a good guy, and he backdoored the Docker images, (...)
If the administrator of the server is malicious, he could have backdoored it so that he knows every interaction you do with its service (including passwords entered there).
I mean even I use the public key and SSH login, without typing ...
5
The general rule of thumb is to only allow business accounts access to business assets.
If an employee is let go, there are a lot of different access rights to remove. If I was an employee and had to register for access, I would need to let someone in charge know that my personal email fluffybunny@gmail.com was me, and was allowed access. Then when I was "...
1
Congratulations! You have just given a nice example that different applications with different security requirements use different approaches.
The highest requirements for whatsapp are availability and ease of use because they are targetting end users and assume that they can trade a light confidentiality risk (do not ask password on each new session) for ...
Top 50 recent answers are included
