Collaborate Disseminate
I’m the administrator of a Wordpress site, with just two users: me and one other user. Last days I’ve received multiple password recovery attempts for that other user (as an administrator I get a mail from the Wordfence security plugin). T… Continue reading What’s the security risk in password recovery attempts
If I can change my password with cmd net user example * without needing to confirm my old password, why, when I change my password in the usual way (via settings or control panel), do I need to confirm my old password? If the point of conf… Continue reading Why does Windows not always force me to confirm my password when changing it?
I have a Node.js/Express 4/JWT user authentication service using Passport.js, with Sequelize and MySQL for database.
In my service, upon signing up/resetting a password, the user will be redirected to a page telling them to
click the link… Continue reading Best practice for authenticating resend email requests
I was wondering if the following password-reset mechanism is safe:
The user clicks on ‘I forgot my password’ and enters his mail. After he has submitted, a security_token gets generated. This token consists of the following combination: en… Continue reading Password-reset mechanism based on Sessions
I am new to web development and am trying to implement a password reset feature according to the OWASP cheat sheets: Forgot Password Cheat Sheet
The cheat sheet advises not to send the username as a parameter when the form is submitted and… Continue reading Where should I store a username during a password reset?
A bot network(?) has been after my website for quite a while now. Here is a breakdown of what they do:
They register several accounts using random characters for building a first and last name which look like this:
HludvkxTGVIwP oBScrLdvJ… Continue reading Website attack: What is the attacker’s goal?
I am trying to learn basics of web security vulnerabilities.
I have found a website, where on reset password, you get a link in the email with a token, and when you click this link, the webpage opens and the url is reflected in a form acti… Continue reading Reflected XSS in form action – understanding
I am in the process of developing a web-application which requires MFA on every login. (On the first login, before you can do anything, you are forced to setup MFA. Due to monetary restrictions and development time restraints, the MFA chos… Continue reading What is the best practice for resetting multi-factor when a user requests to recover their password?
Background
Since the middle of last month, I have started receiving multiple Microsoft password reset e-mails a day, sent to my secondary e-mail address, regarding my primary e-mail address.
These e-mails have no phishing-like links in the… Continue reading Repeated Microsoft password reset requests – Should I be concerned?
I recently reset my password on a site that had me enter the new password I wanted to use upfront at the same time I said what email I wanted to reset it for. Then all I had to do was click the link in the email it sent me and it was reset… Continue reading Resetting password upfront, before getting email