Tag Info

New answers tagged

1

How should I authenticate WebSocket clients like Socket.io on top of HTTPS ? There is no need to authenticate a connection more than once, so if you are using websockets, you can put security token in the first message that client sends after connecting to the service. HTTPS is a must. After handshake you will have secure connection (token can be ...


0

To store the token: For a traditional (non-Ajax) web app you usually store the token in a hidden form field. For a single page app you usually store the token in a JavaScript variable and include it in the JSON data with each request. This approach avoids the token being in the URL, and it works with WebSockets. Most applications use a cookie as the ...


1

Of the two, the prior method is more secure and should be used. As imjoevasquez said, its used to curtail signups and make sure email address is legitimate. The other thing you could do is send a randomly generated code to the email, and ask to enter that to let the user create the account.


0

It is a security vs convenience tradeoff. In the first method, it takes longer for the user to register and get access to the service but the server is able to verify the user's email address. Vice versa in the second method. So it is up to the application developer what he/she wants to prioritise.


3

The proper method is to contact the provider's abuse email which is almost never answered. You will waste an enormous amount of time trying to report addresses. Further, most machines scanning for exploits, are often compromised machines in their own respects. You can try going to an upstream provider, but I can assure you, said providers are often ...


2

fuzzdb contains a collection of web backdoor programs which if they were present on a live server would be a good indication that it had been compromised. This is likely why the A-V tool is reacting to those files. It is a common issue with penetration testing tools that A-V software regards them as malicious. However just downloading them is not going to ...


1

This is an old question, but I've had occasion to look into this question and decided to at least look into what some and CSRF libraries use by default and my results are as follows: Django : 32 random characters from the set [a-zA-Z0-9] : 190.53 bits of entropy Ruby on Rails : 32 bytes of entropy (encoded as base64) : 256 bits of entropy Spring Security : ...


1

Use-after-free attacks require the attacker to be able to allocate some memory reliably on heap. Say I have an object that takes 16 bytes, and happens to be allocated in memory to 0xb00000004 (completely made up numbers here). I delete this object and the memory is returned to the heap. Now I request another heap allocation for 16 bytes (a string for ...


0

Your observation is correct, there are several ways someone can access your files if they are in possession of your machine, even if they do not know your Windows login password. If you are worried about the integrity of your data in the event of a theft then consider deploying full disk encryption. This will require you to input an extra password when you ...


1

Although windows can be installed on top of another copy, this is not required to break into it. A simple password removal tool, like "Offline NT Password and Registry editor" will do the job. I'm not sure I understand what you mean by "security applications". Lojack for laptops? That can reinstall itself even if you format, on supported laptop models.



Top 50 recent answers are included