Tag Info

New answers tagged

5

Explanations for weak password rules Well, those are obviously bad rules. But here are some possible explanations (or "explanations") for it: Must not start with a number The site owner might actually think that this is a good rule. To prevent for example 1234546 or just prepending a common phrase with '1' (e.g. 1password) Must not have a special ...


3

One reason for enforcing weaker passwords is that a weaker password is easier to remember for the user. When the user forgets their password, an automatic password retrieval procedure must be used. Such a procedure usually entails that a plaintext password is sent to an email account. This offers a lot of attack surface which is outside of the control of the ...


12

If you use the same password for several distinct sites, then you are doing something wrong. Each password shall be site-specific. Therefore, there shall be no reason why the "weaker standards" would have any impact on "all your passwords". (Similarly, there is no rational reason for changing all your passwords on a regular basis. There is a widespread ...


0

If the exe is your code then there are several things you can do. As Bruno Rohée said: Everyone give him an upvote. You can and should sign Windows applications : see http://msdn.microsoft.com/en-us/library/ie/ms537361(v=vs.85).aspx You can try to obfuscate your code using a tool for whatever language you created the application in. This technique ...


0

It is without any doubt that there are many ways to infect not only exe but also the other common file types readable by computers on this Earth. Here are some ways by which one can infect an exe. Non-Destructive Non-Destructive usually involves adding or binding the code at the end of the file or in the beginning. You can then also create jump points in ...


1

You can and should sign Windows applications : see http://msdn.microsoft.com/en-us/library/ie/ms537361(v=vs.85).aspx


1

If your server is properly secured and you don't have an interactive content, it is unlikely that an attacker will be able to modify your file on your server, however unless you use an encrypted connection to your visitors, then it is theoretically possible for someone to get in between you and the visitor and replace your server all together. Either way, ...


2

One aspect I have not seen mentioned is the fact that many login difficulties arise because a user's preferred name was taken before he tried to register for a given site. If "JSmith" tries to log in and can't, what he really wants to know is not whether the site has an account named "JSmith", but rather whether the site has an account for him named JSmith. ...


7

There is an old tradition of not distinguishing between "that username does not exist" and "that username exists but the password is wrong". It comes from older times, when both attackers and defenders were new at the job, and the context was different. At that time, the attacker was "outside" and he wanted to guess a username+password pair in order to enter ...


3

What matters the most in terms of security is what does an attacker gain from knowing whether a specific ID or email address has an account with your site? For instance, if you're doing any kind of business that can be seen as a privacy issue, or whether accounts on your site can be used to spend money or have any intrinsic value (in other words whether I ...


19

The answer is generally it depends. This is really based on the security of your system. Users can create new accounts without restriction If so, it is kind of meaningless to not tell them. You can't have intersecting usernames or email addresses, so you have to inform a new user if their username or email has already been used. An attacker would then be ...


3

No, you should not let them know if the username doesn't exist as it would let an attacker discover account names which they could then attempt to crack. If you send a generic "A reset email has been sent, please check your inbox." even when the account doesn't exist an attacker gains gives nothing from trying.


0

If the CSRF vulnerable application allows itself to be embedded in an Iframe, then yes. How does it help the attacker? Iframes can be made invisible by setting size to zero. So as against the normal csrf where victim might get an idea of something suspicious, in case of invisible iframe, he won't see anything. The attacker will submit the form on victim's ...



Top 50 recent answers are included