Collaborate Disseminate
Background: My team’s mobile apps have biometric sign in (Touch ID, Face ID, fingerprint). You can enable and disable biometric sign in when you are signed in. You always have the option to sign in with username and password (and have to i… Continue reading Should password reset disable biometric sign in until the user signs in with username and password again?
(There is a highly related question, however I believe mine is not a duplicate, since it deals with resetting a password without access to the account, not changing it while being logged in.)
Say someone has gained access to my email that… Continue reading How does password reset work if 2FA is enabled?
The domain registrar giant said that the breach started in October 2019. Continue reading GoDaddy Hack Breaches Hosting Account Credentials
We’ve recently overhauled the backend to our mobile app from having a very basic authentication mechanism that went through the API to having both an authentication server and an API server, with the auth server issuing OAuth2 JWT tokens (… Continue reading Where should ‘reset password’ functionality be?
Linksys Smart Wi-Fi users were forced to reset passwords after researchers discovered router hack. Continue reading Attacks on Linksys Routers Trigger Mass Password Reset
Hi all I have created a chatbot on a custom community and also added it to the home page but I have to add it to the communities login page which I am not able to find the solution can you please help me.
Thanks.
You have a friend called Bob.
You have a copy of Bob’s passport.
Bob uses 2FA for all of his accounts.
Would you, in general, be able to bypass this 2FA and access his accounts, by doing the following:
Emailing support
Explaining to s… Continue reading Will 2FA, in general, be bypassed by a stolen passport?
We have a system where if you forgot your password and want to reset it, to go to the forgot password page and enter your email address. A temporary link will be sent to your email to reset your password.
Now, when we subjected our app to… Continue reading Password reset giving clues of possible valid email addresses
Which is harder to exploit:
Password reset link with tokens/timestamps/code/ticket etc
Or, temporary password sent on user mail using which login can be done and password can be changed.
Any suggestions on how they can be exploited please… Continue reading Password reset link vs Temporary password
Yes, there was a breach. But it’s an old one that the crooks are trying to use again. Continue reading Cryptocurrency exchange Poloniex issues password reset warning