Tag Info

New answers tagged

3

Is it correct that targeted attacks from highly trained and well-funded hacking groups are practically impossible to defend against? For the average person, or even corporation, in my opinion the answer to that question is a resounding YES. Have you ever seen the types of technology organizations like the NSA have at their disposal? Check out ...


2

The response by schroeder boils my blood, and I believe it’s this train of thought, that undermine security as a whole. Here goes my response which is likely to get me either banned, or have this post moderated to below -10000 points. Schroeder states: The issue is that an attacker typically has unlimited time, and thereby has unlimited resources to ...


4

The issue is that an attacker typically has unlimited time, and thereby has unlimited resources to eventually find a way in. It's an error in logic to then conclude that they cannot be defended against. Of course you can defend, which increases the time it would take them. More importantly then, is your ability to RESPOND to an attack, successful or ...


0

Cross Site Request Forgery (also known as CSRF or XSRF attacks) is an attack which allows attackers to execute undesired actions on a web application in which a user currently is authenticated. The attack is possible when the targeted application does not properly validate the origin of the request, and relies solely on the existence of a valid session ...


0

In the context of your description there are a couple concerns. They will be tied into CSRF later. First off, your member’s area should be encrypted. For example, http://www.site.com has public info and is fine to be unencrypted. https://www.site.com/member/* would be where only authenticated users can access their profiles, and do anything else that ...


3

In the context of CSRF and XSS, the attacker is bound by the Same-Origin Policy. XSS can be used to bypass Same-Origin Policy, and perform any action as a user. Where as the goal for CSRF is to perform a specific action, and this is permitted because that action lacks a proof-of-work. If a request lacks a CSRF token, or proof-of-work, it is therefore ...


1

TL;DR I expect it to be a non-issue provided both the disk and the BIOS manufacturers know their stuff. Otherwise there's a very slight possibility of it being an issue after all. The disk encryption password scenario depends on the BIOS. If the BIOS supports the caching feature, then it can cache the password between warm boots, and re-supply it to the ...


10

This is because SMTP does not offer great spoofing protection, so typically you can connect to a server and claim to be someone else. The best way to fix this would be to set up an SPF record with a hard fail, which is expressed using a- and typically is at the end of the record as -all. You would have to be certain of where your emails are coming from. You ...


3

So there is nothing you can do about his activity, except to ignore it as the comments suggest. What you can do, is to re-evaluate your security practices, and make sure your house is in order in case he decides he wants to try to do some digital damage, to ensure you're as well protected as can be. This means: Choose strong passwords. Don't reuse ...


3

Stored procedures are a form of parameterised query. The fundamental problem that causes SQL injection is data being treated as query language. $query = "SELECT * FROM users WHERE username = '$username' AND password = '$password'"; In this example, if I set $password to foo' OR 'x'='x, we get this: SELECT * FROM users WHERE username = 'blah' AND password ...


2

A SQL database works a statement in several steps. At first the test of the SQL statement is parsed, after that it will be optimized and compiled. When this is finished the database has now a internal piece of software that can run the given SQL statement. Stored procedures are pre compiled. In other words the database creates that internal piece of ...



Top 50 recent answers are included