The design-flaw tag has no wiki summary.
10
votes
3answers
427 views
How much information about the reason for an unsuccessful login should a web application give?
After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application ...
5
votes
3answers
157 views
Does a 'reset password' website facility give away too much information?
If a website has a reset password facility (which will e-mail the account holder a reset link), does this facility reveal too much information by allowing someone to probe who holds an account by ...
3
votes
1answer
139 views
Does anyone know how to use TRIKE?
TRIKE is an open source threat modeling methodology and tool, as presented by the authors. After i tried several threat modeling tools and methodologies, I have the feeling that it is the only real ...
2
votes
2answers
96 views
Bad planning causing weak passwords
The athletic department at my university has a facebook page and on it they said "the first 500 people to register for this event will get free t-shirts". When registering one has to create an account ...
1
vote
1answer
249 views
Is using Google Voice number for two-factor authentication a big mistake?
Two-factor authentication is growing in popularity as a security measure. For example, Google, Facebook, Twitter, and many other services all have two-step security options today as well as many banks ...
0
votes
0answers
145 views
NIST hacked – best practices in a “Nuke it from orbit” often world [closed]
This week we have NIST’s vulnerabilities database offline due to being hacked and Microsoft patching a USB physical attack that takes over every version to date with just an insertion of a thumb ...
