Hot answers tagged

64

The petitions site is purely a mechanism to see whether there may be high enough numbers to support something, and if so, that something will be discussed in Parliament. There are some checks and balances (for example 80,000 fake votes were identified and removed) but there is no need for a strong level of trust here, as nothing is decided by any of these ...


15

General comments Can you be 100% sure that every signature is from a real person? No. Can you take some precautions to make it harder to cheat? Yes. Here are some things that the British government could do (no idea if they actually do it): Require a successful CAPTCHA after X attempts from the same IP. Rate limit by IP. Sure, five persons in the same ...


14

I don't know if this is how things are done in Britain, but this is how things are done in the Netherlands whenever a petition is submitted to the government: A random sample of the signatures is taken; These signatures are verified (I think they call people to ask if they've signed); the resulting ratio of valid:invalid signatures is then applied to the ...


5

Hashing client side Secondly assuming that the connection is compromised because of an MiTM attack. The process of how the leaked hash of the password is created is still unknown because the salt and iterations (based on the pincode) are unknown. In case of a MitM attack (made possible by say incorrect use of TLS) hashing client side will not help you. ...


3

You cannot match postcode to IP location, I use Plusnet in the UK and it shows up as being in Dundee (several hundred miles away) from me when I check my location according to location. So it cannot be using that to check. Similarly, you don't need millions of email addresses, just 1 with many aliases - assuming the email address is actually checked. I ...


3

For the governement tool : I see one interesting point : there is a map showing the distribution accross the votes : http://petitionmap.unboxedconsulting.com/?petition=131215. We can see here that the votes have been made accross all the country, and the distribution seems to follow ppopulation density (more votes on London,...). An elaborate bot could ...


2

The purpose of salting is, that one cannot build a rainbow table to get several passwords at once. Without salting: An attacker could search the internet for precalculated rainbow-tables and find the passwords with no effort. With a constant salt: The attacker has to build one rainbow-table for this specific salt, and can then get all the passwords with ...


2

To answer your questions: Should all web applications implement such a security feature? This is just another good security feature to help the user so if the application can afford (resources not financially) to have this implanted in their system there is no reason not to. Is it desirable that companies store our historical passwords? Since ...


2

While the answer would be 'no', in this case it doesn't matter. All it is, is in 'indicator'. It doesn't need to be trusted to be 'looked at'. If someone were to do internet-voting, then this system would be a very, very bad idea to use.


2

This seems a bit like using the password for both purposes. Technically this works, as long as people are using strong enough passwords all people passwords will be unique (as a good biometric will do), and therefore you can imagine a system where identification too can be accomplished using only a password. However this would open a big flaw since an ...


2

Not sure about whether it can be used as a standalone authentication system but it can be used as a part of multi-factor authentication system. Reference: More info: Identification Identification is nothing more than claiming you are somebody. You identify yourself when you speak to someone on the phone that you don’t know, and they ask you who they’re ...


1

It's not just technical security you have to consider. No online voting system is a secret ballot; there is no way to eliminate social pressure to vote a particular way. A dominant member of the household can bully other family members into signing, or simply use their email addresses to do it himself.


1

They can verify the name and post code against the electoral roll. When they say 80,000 fraudulent names removed, I expect those are the ones that don't match (I don't know this for sure). However, this is flawed because much of the electoral roll is public.


1

When implementing CSRF protection, one generally uses a CSRF cookie that must be included in the body of the request. This prevents CSRF attacks because the malicious website cannot read the other website's cookies. This is fundamentally incorrect. I think you misunderstand the attack vector. A CSRF attack (also called "session riding") will typically ...


1

No. The authorized_keys file contains strictly only the public key, as described in the manual page for sshd: AUTHORIZED_KEYS FILE FORMAT Each line of the file contains one key (empty lines and lines starting with a ‘#’ are ignored as comments). [...] Protocol 2 public key consist of: options, keytype, base64-encoded key, comment. Accepting the ...


1

TPM operations which need the EK: Take the ownership Clear the TPM Change the SRK Change the Owner(obviously) Allow SRK read using SRK auth (tpm_restrictsrk -a) Basically, these are all administration operations. The root key for the AIK is the EK. The goal of the EK is to prove everything we send comes from a valid TPM. So yes, you can use your EK to ...


1

Even though the connection between user agent and servers are secure, the user agent may not be fully protected. Since authorization code flow ensures the user agent is not privy to the tokens, security is improved by reducing exposure of tokens to between servers only.


1

If they are practically unclonable, how is a PUF-based device authenticated? Consider the example of a smart-card chip, assuming that it has a puf-based circuit. If reliable enough then this chip will produce a unique key for a given challenge. Even if an adversary attempts to replicate the same circuit with the same response the output key will be ...



Only top voted, non community-wiki answers of a minimum length are eligible