Tag Info

Hot answers tagged

8

Actually, you cannot. Even without speaking of an actual compromise, from a security perspective you may assume that your application already contains bugs which can be at least be as effective than a software compromise. That's why, when building a secure system, your security must not rely on a single tool. Instead, you must use a layered security ...


7

One of the articles you link to -- If the NSA has been hacking everything, how has nobody seen them coming? -- makes an assumption in posing the question: "If the NSA was owning everything in sight (and by all accounts they have) then how is it that nobody ever spotted them?" The premise for this question is incorrect, because for all we have found out ...


5

Your question is well written, and you clearly understand the issues well. There is nothing fundamentally wrong with the crypto token approach you describe. Some things to be aware of: Most sites these days are database intensive, so storing a password reset token is little additional overhead. You should throttle the number of password reset emails that ...


3

Most security folks are rather cynical about certifications. We get sold a LOT of certs, and we also validate that many of cert holding folks of the world aren't paying very close attention. (CCNA, you know default creds are bad!) My advice: Only get certs your employer pays for If compliance is a concern, go that route first Try not to go vendor ...


2

Since everything from the CLR to 3rd party libraries will be distributed via NuGet in ASP.NET vNext, the NuGet team has committed to supporting signed packages by, I believe, the time Visual Studio 2015 is released. See the blog announcement: http://blog.nuget.org/20150203/package-signing.html Also, see the signing spec: ...


1

This is a great question! Never thought about this until you asked. Firstly, code running inside a secure enclave runs in ring 3. So all restrictions that apply to untrusted non enclave ring 3 code apply. So an enclave cannot write to MSR's. Next, the specs don't explicitly mention anything about MSR's but it does tell you about interaction with IA32 ...


1

Consider FIDO as a standard that's being backed by a lot of large organizations, and has already seen deployments.


1

Consider SQRL. It's a quite new, free, token based authentication system, using a client application. To authenticate, the client signs a cryptographic challenge with a per-domain private key. Thus it offers per-domain pseudonymity. From Wikipedia: SQRL or Secure, Quick, Reliable Login (pronounced "squirrel") is a draft open standard for secure ...


1

Not sure I understand the question completely, but I'll try to answer. How to check for sql injection attack The de-facto standard tool is sqlmap. It is a very powerful tool and is thoroughly documented. which IDE or tool we used? bcoz netbeans and other type of IDE are more secured? NetBeans (or any other IDE) has absolutely nothing to do with ...



Only top voted, non community-wiki answers of a minimum length are eligible