A countermeasure is an action, process, device, or system that can prevent, or mitigate the effects of, threats to a computer, server or network.
2
votes
3answers
240 views
If an ATM is stolen, how easy can the personal information of the users be recovered?
ATMs get occasionally stolen. How easy would be for the thiefs to retieve the PINs and other information of the users that have previously used the ATM? Is there a periodic wipe of all ...
0
votes
2answers
128 views
YouTube channel gone crazy!
OK, I use youtube just for listening music and watching videos. I don't upload, and I don't comment. Sometimes I do like some videos/comments.
But today I accessed my channel and I saw like 20 ...
0
votes
0answers
30 views
How can I tell if I've been hacked? [duplicate]
Possible Duplicate:
How can I know if I my PC is getting infected?
I'm a home computer user and a programmer by profession. But my knowledge of security is embarrassingly slight. What ...
11
votes
5answers
2k views
Could mint.com be more secure, and if so, how?
After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit.
The site has a bunch of links explaining how they're so secure. I ...
3
votes
2answers
84 views
Automated browser-level countermeasures to look-alike login pages
For example, say an unsuspecting visitor gets a link security.stackexchange.com/.... Then it re-opens the login page, with or without an explanation as to why they have to log in again. (this is more ...
4
votes
3answers
160 views
What alternatives do email services provide when an account is hacked?
I am concerned about how does email services like Yahoo, Gmail, Hotmail etc provide security to their costumers and prevent their account from being compromised.
For example,
I have seen that if ...
5
votes
1answer
456 views
SQL Injection on URL, not on parameters
Should WAF or any protecting method, block SQLi done on URLs?(eg GET /test/url'or 1=1--)
5
votes
6answers
320 views
Spam fighting idea
I have this crazy idea that spam e-mail would not be worth the time of the senders. This is how it's going to work.
Someone sets up a reputation-based site, much like stackexchange sites, where ...
10
votes
4answers
356 views
How should I secure a contact form that appears on every page of a website?
My client has a small "Contact Us" form on every page of their website. They are adamant about not including CAPTCHA verification on these forms, to keep them easy to use, but I feel it is my ...
3
votes
3answers
287 views
Is Content Security Policy an approach that is worth to support?
Mozilla Firefox 4.0 supports something called Content Security Policy that disables the interpretation of embedded Java Script. Only external Java Script files that are referenced using a script tag ...
1
vote
2answers
309 views
AntiXSS for ASP.NET 1.1
Unfortunately, a client of mine still has an application based on ASP.NET 1.1.
Yes yes, I know - horribly insecure, support ending, and on and on... I've already been through that with them.
...
0
votes
4answers
118 views
Safely changing text links to HTML anchors
I'm trying to change text links to real anchors. So for example I want to change http://example.com to <a href="http://example.com">http://example.com</a>.
Since this is a user given ...
1
vote
2answers
1k views
Should CSRF 'Double Submit Cookie' technique have a different seed value for the cookie versus the HTTP POST?
I'm reading about the OWASP double submit cookies method of protection and there it states that the cookie value between the header and form should match.
That seems to be somewhat of a risk, as the ...
12
votes
7answers
815 views
SQL Injection Prevention
SQL Injection is always a hot topic particularly when it comes to web security.
In this regard I am interested in what are the steps that should always be taken to prevent SQL Injection within any web ...
15
votes
2answers
992 views
Does an ORM framework such as hibernate completely mitigate SQL injection?
I know that to prevent (prevent all or most?) SQL injection attacks that you should use parametrized queries. I've been using hibernate for a while instead of hand writing my sql statements. Are there ...
17
votes
8answers
739 views
How to protect against brute forcing
How do you properly implement defenses against brute forcing? Is it best to store how many times someone tried to log in and block them after X attempts? And how would "someone" be identified? With ...
