148

Alice and Eve work for Bob. Alice is a very good worker who does exactly what Bob asks her to do. Eve is a criminal mastermind hell-bent on destroying Bob's company. Alice and Eve both share the same account. Eve logs into the account and uses it to sabotage an important business process. The audit log captures this action. How does Bob know who sabotaged ...


90

Your option 1. is a bad idea: in addition to the User-Experience / Public-Relations reasons you state, you're also giving attackers a window to intercept the password reset tokens and compromise every account on your server. It also doesn't solve your problem if you have even one user who's too lazy to log in / update their password. At first glance, both 2....


30

Real story, happened at a friends workplace (jurisdiction: Germany): A coworker of his rudely insulted clients via her company e-mail. She was fired for this. She did go to court. There, her lawyer made the court aware of the fact that the employees shared their passwords (for instance, for answering a client´s mail in the absence of a certain colleague). ...


22

In general, it is always best to reduce your attack surface. No system is ever perfect and your deactivation protocol will be no exception due to both programmatic and potential human error. Risk 1: Let's say all your terminated employees accounts have been properly de-activated, for example via altering their role in the employee table in the database (or ...


15

You should use separated account in all contexts (security on the top). Adonalsium example show you because it's required. There are some rare situations where it is "not possible" or "not usefull" ... Examples: "not possible" (legacy protocols/applications) "no relevant" (anonymous actions) If it is no possible, but you need to identify, you have to ...


14

If you can do option 3, I don't see why you would even consider the others. It is by far the best option. With this option, my gut feeling would be to consider using two different salts, one for the old algorithm and one for the new one with bcrypt. I'm envisioning a set up like this: Set up your new password system how you would if you were starting today. ...


14

Normally, when su runs, it runs setuid (as root). When you start it with gdb, the setuid bit doesn't take effect (because it's being ptraced), so even if you convince it that you entered the right password, it won't have permission to actually give you a new UID. The reason for this is to mitigate the exact attack you describe.


12

The sum of what the client stores and what your server stores must be sufficient to recover the user-specific secret data (e.g. Facebook access token). What the client stores is, mostly, the user's password (the only permanent storage area on the client side is the user's brain, if we want to allow the user to use several distinct machines at will). If I ...


9

Apparently was turning on "Find My Mac" that turned on the guest account: https://discussions.apple.com/thread/4145011?start=0&tstart=0


9

You certainly should authenticate the user who clicks the link. Otherwise, as you say, someone could inadvertently confirm an email address. However, it is usually possible to authenticate the user transparently, so they don't need to enter their password. The way we achieve this is using a session cookie. During the signup process, the new user is issued a ...


9

The typical answer is accountability, traceability, etc; In other words to be able to know who exactly did what. A shared account has n potential people doing something but all that you have points to one account doing that thing. This problem is usually lifted by making sure someone is legally responsible for the activities of this account. This may or ...


8

You need to distinguish between two types of non-personal account: Generic accounts are accounts that multiple humans can login to. These are generally bad as you lose accountability. If John and Fred both have access, and a malicious event occurs, who do we blame - John or Fred? Service accounts are used by applications, not by humans. Provided these are ...


8

There is no way to prevent multiple registrations. I have two suggestions to offer Make multiple registrations undesirable, for example by charging a fee. Outsource the identity problem to someone else, for example my using Facebook or Google login instead of rolling your own.


7

Voting systems are "gamed" by people voting more times than should be normally allowed (e.g. voting several times). The only way to prevent this is to have a way to identify voters and to prevent multiple votes. Reliable methods entail authenticating users, e.g. with passwords, but this has two drawbacks, namely that 1. users don't like it, and 2. this does ...


7

Give them a choice. For example, my e-mail address is fairly long whilst I usually pick short usernames; you can develop your login form to accept both. Usernames aren't for securing accounts, passwords are. It isn't for no reason that the username is visible when entered in the browser, whilst the password is hidden. Also, users often re-use usernames, ...


6

Short answers: No, your key generation isn't secure. Yes, the attacker can find the email from the code. An attacker can obtain the activation code for any email address due to the extremely weak random number generation. mt_rand() isn't suitable for this purpose, add to that the advantage gained by knowing some information about the state of your system (...


6

Only provide the pages over HTTPS (most servers have a requires HTTPS option). HTTPS will make an SSL connection that will protect the information in transit. On the server side, what you need to do to store the information depends greatly on the type and sensitivity of the information, as well as how it will need to be used. For example, is it ...


6

No - given that most users come in from large ISPs, their IPs are not fixed for all time - the names they give to you certainly aren't fixed Security is not a black and white issue - though it seems too many don't seem to understand that - it's an issue of making the cost of defeating it not worth the reward In the general scenario you're describing, ...


6

There are a few ways this could be an issue: Considering some of the fallout of the Ashley Madison hack, being able to confirm whether or not a person has an account on a given site can be of value. In the case of this hack (per the Wikipedia article): Following the hack, communities of internet vigilantes began combing through to find famous ...


6

This seems borderline insane. There's two major issues that seem to be overlooked by company directors: Business continuity planning/disaster recovery Role based access controls Without somebody having admin rights to the Exchange server, how are backups even supposed to take place? Is every user responsible for making their own email backups and keeping ...


6

First, a bit of basics: users don't have memory, processes do. Usually these are user processes (such as Alice's Notepad.exe instance), but they can also be system processes (such as services or subsystems - like Local Security Authority Subsystem, LSASS.exe - which may span user sessions and have per-user memory). As you noted, an Administrator-level user ("...


5

Having a username provides more obscurity than email does which provides security as a bruteforcer would requires the username before being able to perform an attack. An email is not as obscure as a username as email. Users might use their email in every other account registration, subscription to newsletter or even posted it somewhere to have someone ...


5

I think an alternative solution might be to ask new users to first specify just an email address, then confirm that with a hashed token, and then ask them to set a password. But I don't see very many online services that do it this way, either. This is the most secure way as it guards against user enumeration attacks. If the email address is already ...


5

So general best practices first: Do not use generic accounts (i.e. ConsultantCo) rather use named accounts (i.e. JSmith_Consultant). One for each contractor. The contractor probably doesn't need Domain Admin. Local Admin on the SharePoint server (and whatever other systems are needed) should be sufficient. Enable logging on the box(es). If possible, ship ...


5

Best practices are nowhere "defined", that's what the term means. A best practice is simply an established way of doing things that most people think is the best way. It goes the other way around. Once a "best practice" is dominant, usually someone on a standards board decides to put it into some ISO or other norm. It then rests there, usually without ...


4

Restricting one-vote-per-IP, can seriously limit B2B participation. Most businesses are behind proxies or NAT which presents the whole organization as a small range of IPs. Given there's real money and real prizes involved, linking an account to a difficult-to-mass-produce alternate identity can really limit abuse. Examples might include your work email ...


4

The company email is likely a bad way to verify someone's identity. In most places, the email address is in a common format that could easily be guessed. Social engineering and pretexting are easy ways to get common information. You should also consider the insider threat, a coworker could impersonate someone with an email address easily. (I am assuming that ...


4

Security issues don't come from the presence of "anonymous" user accounts, but from user actually using them to perform actions (because then the user are not longer accountable: logs will tell you "Administrator did it" and not "Bob did it"). Logging as some account simply means knowing the associated password and using it (however, accounts can be locked ...


4

You are going about it all wrong. Why will you need to send the USER_ID over a GET request to retrieve the secret questions and tokens like you mentioned? You probably store the reset tokens in a table in the database with a foreign key linking it to the user's data stored in another table. You can simply parse the token sent using GET and retrieve all the ...


Only top voted, non community-wiki answers of a minimum length are eligible