New answers tagged account-security
0
Knowing an AWS account ID doesn't expose you to any attack in itself, but it can make it easier for an attacker to obtaining other compromising information.
Rhino Security Labs demonstrate a potential compromise vector via misconfigured IAM roles in a blog post here:
AWS account IDs uniquely identify every AWS account and are more
sensitive than you ...
1
Unless you have installed any certificates in your operating system or browser trust store, you can be fairly confident that any page using HTTPS is not the result of a MITM attack. In your particular case, it sounds more like a CSS resource failed to load, resulting in the corrupted layout you briefly observed.
An attacker who is sophisticated enough to ...
-1
Is it bad? Yes. - but it depends on the specific case.
You should provide as less personal information as possible publicly and you should hide this data.
SCENARIO 1:
The problem starts if that username is used on multiple locations and is unique. Let's say you were on a forum which was breached and username/password got leaked, someone can just search ...
2
Is revealing a PC account user name bad?
In short NO.Why?
Well for starters your PC username is not a information that is
unique to you.A lot of people in the world can have the same windows
username.
Since its not unique to a person like an email address where two
people cant have the same email address an attacker cant gain much
information or even tell ...
2
Even if the user has port-forwarded remote-in software, one would have to know the internet address of the computer or the router, of which there's some 4 billion in the IPv4 space, and astronomically more in IPv6. Knowing where to start poking seems a lot harder.
In this statement you assume that an attacker is specifically targeting you. This is often not ...
3
I guess no. Why? Because if you secure your environment in such way that it can eliminate bruteforce attacks/dictionary attacks or any other attack that is trying to force the login, then exposing usernames won't do anything to it, thereafter you can limit the attempts in your LSP. If you look more into the psych of a possible attack, they can generate ...
19
I unlocked a Mac laptop that a friend "found in a bin" without knowing the password and accessed all data on it. After a quick bit of googling I created a new account and reset the existing account password. We worked out who owned the laptop previously, called her, and to my utter surprise, she said she threw it in the bin.
It was an older laptop and about ...
0
Even if you format (wipe) the data, someone clever enough can still recover it, but that requires some serious skills. Try to google "recovering formatted drives".
They would still need to crack your password as macs are encrypted.
35
Your data is probably* safe if the following three criteria are met:
You have FileVault turned on (full disk encryption).
Your laptop requires a password on boot and every time you open the lid (auto screen lock).
Your password is not well known (easy to guess).
TL;DR;
If you don't have FileVault turned on, then your data is in plaintext and anyone can ...
4
Brute Force Options:
Credential Spraying (distributed brute force): try the same password on multiple accounts or multiple systems (or variations on this theme). No one account is getting focus, so the attack on each account goes under the radar.
Offline Brute Force: use a weakness in the system to extract the password database that contains the (hopefully)...
0
While i cant comment on,if you have a malicious code running on your phone or not.The attack you described is not an attack at all.What would the attacker gain by sending you the otp from his phone number as you say.That just makes no sense at all.The attacker would not know the code that whatsapp send you.So the attacker sending you a different code via msg ...
0
You are looking at the problem backwards. The XSS vulnerability IS the problem you have to go after. XSS is one of the most important problems on a web application, and dismissing it you are tossing the diamond out of the window and keeping the peebles.
The session cookie authentication is the default authentication for almost every site. Some will employ ...
2
A site using session tokens is not a vunerability as long as the tokens are long enough that they can never be realistically brute-forced or guessed. This means that the entropy should be at least around 64 bits, but preferably more.
Why is this not a vunerability? It can't be exploited. You can steal the session cookie if you have access to their PC, but ...
1
If you consider the login process as a whole, this measure can actually increase security. Instead of granting users several login attempts to manually fix common misspellings, the site tries to fix those misspellings automatically. As a result, the average number of login attempts a user needs goes down, which means a more strict rate limiting to an ...
Top 50 recent answers are included
