"The fix for this bug is simple: check that the length of the message actually matches the length of the incoming request." Why do we even have the client report the length at all? If we can know ...
After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application ...
If a website has a reset password facility (which will e-mail the account holder a reset link), does this facility reveal too much information by allowing someone to probe who holds an account by ...
TRIKE is an open source threat modeling methodology and tool, as presented by the authors. After i tried several threat modeling tools and methodologies, I have the feeling that it is the only real ...
The athletic department at my university has a facebook page and on it they said "the first 500 people to register for this event will get free t-shirts". When registering one has to create an account ...
Two-factor authentication is growing in popularity as a security measure. For example, Google, Facebook, Twitter, and many other services all have two-step security options today as well as many banks ...
I am wanting to develop a web service (classic client/server) where the server is not trusted, so is kept (cryptographically) ignorant about the actual content/messages. Obviously, if you don't trust ...
Our back-end servers (Redhat 5,6 mostly) are very outdated, and are not connected to the Internet for security reasons. I'm looking for the best strategy to update them, without connecting them to ...
Widespread ATM room designs are such that the machine faces the door which is less secure as compared to a situation wherein I face the door when using the ATM.