Tag Info

New answers tagged

3

No. There is no field on either track 1 or track 2 to indicate if the card is EMV capable. There is nothing that would prevent the card issuers from doing that but they haven't. https://en.wikipedia.org/wiki/ISO/IEC_7813#Track_1 It is very possible that your merchant agreement with the major networks, prohibits you from requesting a customer use EMV chip ...


2

The way you convert a jpg to a bmp would be to essentially decompress the jpg and write it as a bmp. To convert one archive format to another you'd have to decompress the original first and then compress in the new format. Whether this is "safer" or not depends on whether the tool you're using to automatically decompress has different vulnerabilities to the ...


3

Being able to convert an archive from one format to another without decompressing it is very rare. Different formats use different file structures and algorithms that are incompatible and you'll be forced to decompress the source format at some point. When conversion by decompression is done, many of the vulnerabilities could be exploitable. The attack ...


-1

Never use the same password for multiple sites. Never. It is as simple as that. IMHO, the best solution would be to use some kind of password manager. Create master password for the password vault and generate all your passwords for all sites randomly. This solution really works and using this system, you can forget about your password worries for good.


3

Generally, reuse of passwords across different sites is a bad idea for this reason; you never know whether they are taking measures to secure your password from view of staff or hackers who might grab the database. Of course, once one of these sites is compromised, hackers will try the same password combination for other common accounts like Facebook, ...


2

How to reproduce the same? There are multiple answers on this site for exactly that question. Typing HTTP method into the Search box pulls up: How to exploit HTTP Methods How to identify the HTTP methods supported by a web server? Testing for HTTP TRACE method How can I test that I have correctly disabled unnecessary HTTP methods? How ...


0

Wrote about formal methods and security many years ago here -- http://www.tssci-security.com/archives/2007/11/23/formal-methods-and-security/ -- the basics of which is how to apply old-school Orange Book standards to modern software. If I had to rewrite that blog post in 2015, some of the updates I'd add are that SMT-based model checkers have become a lot ...


0

I have recently had a similar issue to this with a small company I was working with. They recently had an e-commerce platform exploited through the administration endpoint (RCE) and wanted to make it inaccessible to anyone unless employed by them. The solution that the client selected in the end was to run a VPN form their office and allow users to direct ...


1

This is not currently support (as far as I can tell) by any of the browsers. There is an outstanding bug on Firefox to introduce some kind of support for this but it has not been resolved. You can support this in Javascript by using OpenSSL compiled with Emscripten although that link only provides the bones, you will need to build the JS linkage to your ...


-1

What if you set up a VPN on the server, then only allow 'admin panel' access to VPN'd IPs... that way you have the security of VPN and the accessibility of anywhere.


1

That's the old dilemma Security vs Usability, and only you can answer this question. Having the admin panel on your PC only is surely safer, but having it on the server means that you can access it even when you're not at home. And that other people can, too; unless you whitelist the access IPs, which however will also prevent you from accessing it from ...



Top 50 recent answers are included