Collaborate Disseminate
I’ve enabled 2FA on my website. During tests, I’ve noticed that users can use the 2FA codes multiple times. How can I ensure that each code can only be used once?
Continue reading How to prevent 2FA codes from being used multiple times?
Suppose I have a domain whose name is example.com. example.com is maintained by other developers. Now suppose my job is to create a website named subdomain.example.com. Both websites are publicly accessible through public net.
After some t… Continue reading How can I keep a subdomain secure when its parent domain is not secure?
In a professional context, users would ideally have a company-provided computers, company-provided smartphone (if needed) and managed Microsoft/Apple accounts. Then all is good. They can benefit from the Apple/Microsoft sync goodness betwe… Continue reading Best-practices on the handling of managed and private Microsoft/Apple accounts
I am not good with technology. Could someone explain to me why, when I check Facebook security logins, I see two separate IP addresses? What can cause that? Also I don’t think that in terms of Google, all the devices are mine in the secu… Continue reading How do i know if someone has access to my accounts, specifically Facebook and Google? I ask out of concern that its my ex [closed]
I am using Keycloak 25 to protect several web applications in our company (Open ID Connect). There is the "Remember me" option in Keycloak, which can be enabled for the entire realm.
Currently, I have this option disabled, which … Continue reading How secure is the "Remember me" feature in Keycloak?
I was reading some articles, like this one, about the risks of SMS-based multi-factor authentication and I started to think: doesn’t an account recovery number present the same problems? Should I consider removing it and just using a recov… Continue reading Doesn’t the recovery number suffer from the same problems as 2-factor authentication by SMS?
Since we are accessing Gmail from the Edge browser, Microsoft could have access to the Gmail password. Theoretically, Microsoft can track this password along with sending it to Gmail servers. What prevents Microsoft from tracking password … Continue reading What prevents a browser from saving and tracking passwords entered to a site?
I’m trying to meet a requirement where devs can log in to a server, launch, and test code without having the ability to pull (or access any ssh keys)code from the repository.
I don’t want to grant them access to push or pull from Git.
Curr… Continue reading How can I keep git ssh keys from developers in server
I’m writing my own networking layer for my video games startup and am using TCP for connection/authentication. I wanted to know how safe my authentication scheme was and what I could do to improve it.
Our apps aren’t web, and they run most… Continue reading What’s wrong with my app authentication scheme?
Today while browsing my phone, I suddenly got a notification from my Google account about some suspicious activity from my account and more shockingly it’s from my own Laptop and so they logged out my account from the laptop Google Chrome…. Continue reading Regarding Suspicious Activity in my Google Account