The tag has no wiki summary.

learn more… | top users | synonyms

58
votes
3answers
6k views

Heartbleed: Why does the client supply the length of the message at all?

"The fix for this bug is simple: check that the length of the message actually matches the length of the incoming request." Why do we even have the client report the length at all? If we can know ...
11
votes
3answers
804 views

How much information about the reason for an unsuccessful login should a web application give?

After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application ...
5
votes
3answers
231 views

Does a 'reset password' website facility give away too much information?

If a website has a reset password facility (which will e-mail the account holder a reset link), does this facility reveal too much information by allowing someone to probe who holds an account by ...
3
votes
1answer
372 views

Does anyone know how to use TRIKE?

TRIKE is an open source threat modeling methodology and tool, as presented by the authors. After i tried several threat modeling tools and methodologies, I have the feeling that it is the only real ...
2
votes
2answers
158 views

Bad planning causing weak passwords

The athletic department at my university has a facebook page and on it they said "the first 500 people to register for this event will get free t-shirts". When registering one has to create an account ...
2
votes
4answers
3k views

Is using Google Voice number for two-factor authentication a big mistake?

Two-factor authentication is growing in popularity as a security measure. For example, Google, Facebook, Twitter, and many other services all have two-step security options today as well as many banks ...
1
vote
0answers
85 views

Untrusted central server and self-hosted/local client

I am wanting to develop a web service (classic client/server) where the server is not trusted, so is kept (cryptographically) ignorant about the actual content/messages. Obviously, if you don't trust ...
-1
votes
1answer
259 views

How is the widespread design of ATM rooms more secure? [closed]

Widespread ATM room designs are such that the machine faces the door which is less secure as compared to a situation wherein I face the door when using the ATM.