Tag Info

Hot answers tagged

3

Using the MAC address as a condition for session termination in general Generally a changed MAC address might be used as a weak condition to terminate sessions, but be aware they can be arbitrarily faked for most network cards (so you just need to find one which makes this possible) they will also change when a user is on the same device, but switches ...


3

No. There is no field on either track 1 or track 2 to indicate if the card is EMV capable. There is nothing that would prevent the card issuers from doing that but they haven't. https://en.wikipedia.org/wiki/ISO/IEC_7813#Track_1 It is very possible that your merchant agreement with the major networks, prohibits you from requesting a customer use EMV chip ...


3

Being able to convert an archive from one format to another without decompressing it is very rare. Different formats use different file structures and algorithms that are incompatible and you'll be forced to decompress the source format at some point. When conversion by decompression is done, many of the vulnerabilities could be exploitable. The attack ...


3

Generally, reuse of passwords across different sites is a bad idea for this reason; you never know whether they are taking measures to secure your password from view of staff or hackers who might grab the database. Of course, once one of these sites is compromised, hackers will try the same password combination for other common accounts like Facebook, ...


2

How to reproduce the same? There are multiple answers on this site for exactly that question. Typing HTTP method into the Search box pulls up: How to exploit HTTP Methods How to identify the HTTP methods supported by a web server? Testing for HTTP TRACE method How can I test that I have correctly disabled unnecessary HTTP methods? How ...


2

The way you convert a jpg to a bmp would be to essentially decompress the jpg and write it as a bmp. To convert one archive format to another you'd have to decompress the original first and then compress in the new format. Whether this is "safer" or not depends on whether the tool you're using to automatically decompress has different vulnerabilities to the ...


1

If HTTP resources are loaded into an HTTPS page, then the padlock icon will disappear from the client's browser because the page isn't secured properly. This is very bad because users will be unable to distinguish between the real banking site and a phishing website. (Hopefully most users will notice the absence of a padlock and exit straight away.)


1

This is not currently support (as far as I can tell) by any of the browsers. There is an outstanding bug on Firefox to introduce some kind of support for this but it has not been resolved. You can support this in Javascript by using OpenSSL compiled with Emscripten although that link only provides the bones, you will need to build the JS linkage to your ...


1

That's the old dilemma Security vs Usability, and only you can answer this question. Having the admin panel on your PC only is surely safer, but having it on the server means that you can access it even when you're not at home. And that other people can, too; unless you whitelist the access IPs, which however will also prevent you from accessing it from ...



Only top voted, non community-wiki answers of a minimum length are eligible