Tag Info

Hot answers tagged

58

You are absolutely correct in your assumptions. If you are using a computer owned and operated by your employer, they effectively have full control over your communications. Based on what you have provided, they have installed a root CA certificate that allows them to sign a certificate for Google themselves. This isn't that uncommon in the enterprise, ...


41

No, you are correct that at some point during efforts to prevent attackers from determining valid user identities you will either have to lie to them or provide exceptionally vague error messages. Your app could tell a user that "the requested username is unavailable" and not be specific as to whether it was already in use or just didn't meet your other ...


35

With a cookie! Chrome, like any other browser, is storing a cookie in your file system. Those cookies are what enable you to reconnect automatically to some site. Since it's in your file system, even if you reboot they will still be there. Multiple processes or not is irrelevant here. Then you might wonder, if the cookies are in my file system, does it ...


27

You're making the assumption that the system actually knows which field was entered incorrectly. There are several reasons this is not necessarily true. One possibility is that it's a side effect of implementation. A simplistic method of looking up logins in a database might look something like (using :n for parameters supplied by the user): SELECT 1 ...


15

1 and 2 are answered by David Houde 3: There's not actually any way to tell for sure whether you are securely talking to Gmail when using your company's machine (aside from auditing the machine down to the metal). Even if they didn't change the cert, they could simply modify the web browser to forward all decrypted traffic somewhere. There are a million ...


12

If you use the same password for several distinct sites, then you are doing something wrong. Each password shall be site-specific. Therefore, there shall be no reason why the "weaker standards" would have any impact on "all your passwords". (Similarly, there is no rational reason for changing all your passwords on a regular basis. There is a widespread ...


11

I personally prefer Google Authenticator which is basically an elegant implementation of Time-Based One-Time Password Algorithm but I would not feel comfortable saying it “is more secure”. To use one of my favourite buzzwords… it all comes down to Threat Modelling. What exactly are you trying to protect against? Is it a technical attacker who might be able ...


9

In general, it is harder to brute force a registration page than it is to brute force a log in page, so we benefit from this additional cost. But, in concept, you are correct. There are other ways to enumerate usernames than log in page messages. It is simply 'Good Practice'(TM) to keep log in failure messages generic in order to make it harder for ...


9

From this page: http://blog.chromium.org/2008/09/multi-process-architecture.html There's only one browser process, which manages the tabs, windows, and "chrome" of the browser. This process also handles all interactions with the disk, network, user input, and display, but it makes no attempt to parse or render any content from the web. And from the ...


6

Explanations for weak password rules Well, those are obviously bad rules. But here are some possible explanations (or "explanations") for it: Must not start with a number The site owner might actually think that this is a good rule. To prevent for example 1234546 or just prepending a common phrase with '1' (e.g. 1password) Must not have a special ...


5

How can you know who you authorise if you haven't authenticated? Authentication always comes first, except when everyone is authorised or noone is authorised. Edit: seems like you have two questions now :) 1) You were refused most likely because there is an access control policy that prevents your own original UID from performing an operation on the UID of ...


5

Why don't you have the site so that if a user is signed in, they don't see the sign-in section of the site? Or if it's a menu, logged in users see a menu option called logout, all other users see a menu option called login/sign-up.


5

With a digital signature you might claim ownership of a piece of data, but usually not to your own advantage. A digital signature works like this: The key owner generates a public/private key pair (two mathematical objects sharing a common structure). The public key is made public (hence the name) while the private key is kept private (the structure is ...


5

When you use an "authentication token", the simple presentation of that token by the client grants access (as long as the token is deemed valid by the server). If you store the tokens "as is" in your server's database, then an attacker who could get a glimpse at your database will immediately learn all the tokens, allowing him to send requests in the name of ...


4

which cards are vulnerable to such abuse? First of all you need to recognize whether the card has RFID capabilities or not. These may be advertised with logos, icons (usually the three curved lines also used to indicate "WiFi" in some contexts), or in writing. You can also check on the supplying bank/company/entity, or look for telltales such as "My ...


4

What you're describing is called certificate pinning; essentially, you ignore the whole CA process and just give the user application a certificate to trust. It's actually widely recommended for non-browser applications (e.g., mobile apps) for the exact reason you stated - if you rely on a CA and it goes down, you're in pretty deep trouble, whereas it's ...


4

I agree with both answers given thus far by Thomas Pornin and Steve DL. Authorization always comes after authentication since authorization is the act of looking at a given user's claims and determining whether the user can do what they are trying to do based on those claims and based on the authorization policies in place. I would like to broaden the ...


4

To add to other answers, the only way to ensure, with a reasonable certainty, that you have a secure connection from your browser to the web server, is to use your own equipment. The employer-owned equipment and network is not under your control, and it may be difficult to determine what is included in their standard operating system and applications. Even ...


4

When you use a re-webber proxy (a website where you enter a URL and it shows you the content of that url in its own context), using TLS between you and the end-website becomes impossible, even when the proxy would want to provide it. When you enter https://google.com in the proxy you linked, you get redirected to ...


4

The danger is expressed in Schneier's law: any person can invent a security system so clever that he or she can't imagine a way of breaking it. The only way anyone knows to test if any given system is secure is to have lots and lots of clever people try to break it over a long period of time. You won't have that with a system you rolled yourself.


4

What matters is the respective abilities of Alice and Bob with regards to storage. In your case, you assume that neither Alice or Bob has any memory; they share a secret value (for HMAC), but they have not read-write slot to update. On the other hand, you also assume that Alice and Bob have clocks which are reasonably accurate (within a few minutes of each ...


3

They're using id.avast.com as an authentication provider, not just an external database. So RCE doesn't get you access to it (assuming it's a different host machine), SQLi certainly doesn't, and since it's on a different domain (origin), neither does XSS. They've now significantly isolated their password hashes from the forum software. Using an ...


3

Authentication is about identifying who is issuing the command, and making sure that the caller is really that person/system. Authorization occurs necessarily after, since it is about deciding whether the duly authenticated requester should be allowed to proceed or not. In your case with a su command, there are two authentication/authorization. Suppose that ...


3

Banks like BoA use a risk-based decision engine that examines several variables, including but not limited to: Your visible IP address Your brower's "signature," which incudes the user agent header and detectable display properties such as screen resolution The presence of a persistent cookie The presence of data in another persistent store, such as a ...


3

If the server requests the certificate during the initial handshake, simply use Wireshark and look for the Certificate Request TLS message (just before Server Hello Done). If you look into the details of this package, you should see a certificate_authorities list giving you the list of acceptable CAs. Your local chain will need to match one of these. If ...


3

It depends on what the user name is. There are three main approaches for user names: User selected name Email address Assigned user name - usually a string of digits You are correct that for user selected names, an attacker can use the registration process to infer what names are in use, so there's limited benefit to the login returning a generic ...


3

As others pointed out: Yes, it is possible and it is being done in this case. Trying to detail more the steps involved in this MITM: You know that certificate 028CA85E6765… belongs to gmail because a CA (GeoTrust, Verisign…) has asserted that it does. Your OS/browser contain a list of CAs it trust to do the right thing (not to lie, be properly secured…). ...


3

Application-specific passwords are the only workaround currently provided for applications which don't support two-factor authentication to Google. This does effectively bypass two-factor authentication, but only to a certain degree. Obviously, the primary risk is that a compromised application-specific password can be used to access your account without ...


3

First, it's not a good idea as far as I know to put a secure application in an iframe because that expose you to security issue. The biggest one is probably clickjacking if all else is done correctly. This is why you want to use the header option X-FRAME-OPTIONS to block it from loading in an iframe. Next, you want to communicate between the partner site ...


3

First, in specific to Google Chrome you will find This article very useful. CullenJ mentioned before that Chrome uses processes not threads, but that is untrue. It uses both. According to the article linked above Chrome uses a thread to handle SQlite database operations and gives the example of cookie operations so we can assume that Chrome stores cookies ...



Only top voted, non community-wiki answers of a minimum length are eligible