New answers tagged

0

When a change in the fingerprint of the key is detected, it can mean a few things: the key on the server genuinely changed - this is normal after an OS reinstallation and can happen after the sshd reinstallation someone is posing as your server, trying a MitM attack. This is possible only with password-based authentication. Your comment about a ...


3

I am inclined to say that the bit about tying the session token to the source IP address is harmful and should be removed. Such a tying is often reported as "good for security", but exactly why it is good for security is rarely explained. It is similar, in that respect, to the widespread recommendation for changing your passwords regularly: a ...


2

Well, it is two-factor, so it does add some security. It's not great two factor, for a couple of reasons. The user is very likely to read email on the same machine they log onto your service with, but that's also a problem with SMS a lot of the time. And of course email is a very insecure channel. But on the whole it will usually be better than nothing, ...


5

This is essentially the scheme that Steam uses if you log in from an "unknown" device. It increases the security slightly, as an attacker would need to compromise both the username/password combination for the application, and the email account of the user. This effectively makes non-targeted attacks worthless. This could be argued as a bad thing - if the ...


4

There are a few reasons that IPv4 addressing is not used in this way: IP addresses are not a foolproof indication of location. IP address blocks are assigned to companies and can be used anywhere they are required. A company in asia may get a block from apnic, but then use part of their allocation in north america Systems get different IP addresses all the ...


0

Can this scheme be extended to work with hashed passwords somehow? Not this scheme. Because of how it works it needs to have the password or some specific equivalent (see http://stackoverflow.com/questions/1000281/storing-password-in-tables-and-digest-authentication for details) to do some necessary computations. Of course with a naive approach you ...


0

At least in the latest versions of Authy's Android application authenticator tokens, such as your Gmail TOTP, are sent to api.authy.com only after being encrypted using an AES key derived from your backup password and a randomly generated salt using PBKDF2. According to this source information sent from the API to your mobile phone has the following format: ...


1

Am I right to say that this won't work if the password is not stored in plain text on the server? I fail to see how the server could verify the hash if the password is already hashed (with salt and pepper) on the server. This scheme does require the password to be stored in clear-text. Very bad. Can this scheme be extended to work with hashed ...


1

If you're using a secure channel namely TLS, you don't need to do these sort of tricks. About your first question, yes you're right, this scheme requires the server to have access to password in clear text to be able to reproduce H(nonce+cnonce+password). About your second question, I can't think of a way that won't open you up for replay attacks.(but I'm ...


1

This is essentially identical to simply generating a password that isn't hashed, in security terms. Whether you use your first name for a password or the checksum of the current time doesn't matter; if the thing you send over the Internet is compared with a string directly stored in a list on the server side, then the password isn't usefully hashed. The ...


5

Yes you need a MAC in order to ensure the user hasn't manipulated the value to something else which is a valid user id once decrypted. Also, rather than MAC <userid> you should add some context around it, and then mac that. e.g. userid=<userid> This will prevent a substitution attack elsewhere on your site with data that has been MAC'd. For ...


2

I guess it depends on what the server does, but it doesn't add much protection either way (or is even worse). (Also, does the average user know how to compute a hash on mobile? Sounds quite a hassle to me.) 1. Server stores hashed password This means client sends H = hash(password) to the server, server looks up clients hashed password H' in the DB and ...


1

Would this increase security? No. Any modern application already stores it's passwords hashed in the database. Whenever an authentication attempt is made, the user input is hashed and compared with whatever's in the database. Mostly this happens with a 1-way encryption (the hash cannot be decrypted back to it's raw value). When you would create a hash on a ...


3

You mention in a comment that they sent a picture of "themselves". You may be able to find evidence that they are not who they say they are: Visit https://images.google.com Click the camera icon to the right of the search box Choose "Upload an Image" Upload your image For further help and alternatives, you can read this page: ...


0

The only distinguishing feature of this woman is that she loves your husband (the Dallas point was arbitrary from the beginning). It's impossible to prove that. If you want to come close to proving it, he could just buy her a ticket to the states instead of giving cash. You will see her intentions then, expensively, but that answers your question.


12

This is probably a scam attempt. You need to sever all communication Forgive my bluntness. You appear to be an older person. Your age-range is a primary target for Nigerian 419 scammers. Why? You're in prime retirement age, and likely have a 401k plus other savings ripe for the picking. Please note that nobody will to start a real relationship with a ...


9

They're probably not who they say they are. Don't send them money. If you're actually serious, and you're a U.S. citizen, you can try to investigate the State Department's Notarial and Authentication Services of Consular Officers.


1

HTTPS only prevents 3rd parties from doing man-in-the-middle attacks and manipulating the connection (including the cookie). HTTPS does not do anything to protect you from a malicious user. The user could edit their own cookie. You need to use authenticated encryption or sign the cookie's contents yourself if you don't want the user to try to edit the id in ...


0

Ask your co-workers politely to turn around for a second. In a working environment nobody should be surprised or complain.


0

No, it should not be possible to do that! There are several issues raised here: The change password link contains the userid. I'm assuming this is for logged in users to change their passwords - so I'm a bit unsure as to why you're sending out links in that case. You know that they are authorised (or, at least have the ability to log in), so you can ...


0

If you're using oAuth with Facebook or Google you will be issued an "access token" for the user to access your application. This access token will have an expiry. Once it is expired, you should use a "refresh token" to ask for another "access token" for the user. If this is not granted, this is when you should logout the user.


1

One good design is to make the Change Password page accessible to logged in users in such a way that only he can change his own password. (users' identity should be bound to something out of their control(e.g sessionid) and shouldn't be sent as a parameter which is guessable and can be tampered by the user to access change password page for others) Your ...


1

The privacy of a system is all about making clear to the user how their information is going to be used and shared. That is, the amount of control an individual should be able to have and expect. The security of a system is ensuring that this expectation of privacy is met. That is, the mechanisms that can be put into place to provide this level of control.


0

I think it should be possible for each user to get multiple keys, if your key gets lost or stolen (or in case of the tokens that have their own battery, if the battery dies) you should always have a backup token, so you can get in (and disable the other token for example) that's also the reason Google, Github and Dropbox allow Multiple U2F devices.


6

... it sort of suggests the entire site must be https to be truly secure from these types of attacks? Yes, that is exactly the case. All relevant pages on this site (i.e. all in the path to submitting the sensitive information) must be https only, i.e. it should not even be possible to access these pages with http because otherwise tools like sslstrip ...


7

Do as many mitigations as you can. Your goal is to force a wide variety of potential attackers to spend more effort, resources, computer time (and thus electric bill), and most especially "skilled" (rare or scarce, and thus valuable) person-hours. No one protection works against every threat. Not every threat can be protected against while still remaining ...


1

Here you go: Generete SSH keys + protect them with password Allow only specific user to login (AllowUsers) Allow from specific IP username@192.168.1.1 Change default port Create firewall rules and last thing install fail2ban.


0

You successfully blocked that specific ip, but let me tell you something you're gonna get thousands of such malicious computers trying to brute force your ssh in order to get into your box. Some tips: Switch to authentication via certificates than passwords Change default ssh port (this is quite helpful - default is 22) Some lower level tips: Disable ...


5

Security is defined as the state of a system in which confidentiality, integrity and availability of data is granted. Privacy is the ability of a natural person to control the distribution of his or her personal information. If you are using for example a system of a big company - let's call it Oogle - it might be that their system is pretty secure, but ...


0

Most sites will ask for you to input your password again if you're changing settings precisely because the sites know if your cookies have been stolen, then low grade activities can be snooped on. On the other hand, changing passwords would have a time crtitical cookie used. Think about when this change happened in web development. 2004-5?


1

It is worth noting that numerous services exist online that do this sort of thing. Accellion, LiquidFiles, Dropbox, Box.com, and numerous others can grant you this kind of functionality. Depending on volume and complexity, you might even be able to leverage some marketing-oriented online service like salesforce.com or hubspot. There are a zillion things ...


3

You have essentially two issues in your process: providing the update and having it installed. Server Auth Firstly, yes you need to authenticate the server. This means that communication to the server must be done on a secure encrypted channel. Make sure to take the time to understand attacks on SSL so you don't use something that's expired. Ship the ...


0

You can slightly improve it, if you send request parameter denoting, what you want access http://mypage/lasagna?key=LAS (now you can go only to pages with key=LAS, not FIN) server send you 1time password to your phone (123AGN) - now you know server was asked for lasagna page, not financial you fill given password to page as 456ALA which allows you to edit ...


0

There are a few obvious holes. 1) You need to prevent SMS message spamming from a hostile script hitting that page over and over. 2) How is the one time login, once it's authenticated and removed from your control, prevented from accessing financial data? Remember, the attacker can do at least everything you can do once you've logged in, if not more via ...


3

First of all, I would point out that one-time-password is not a replacement for your password, it is a supplementary security feature, in addition to your password. Second, but most important. You have forgotten that you are using a non-trusted computer. Take the following scenario, you go to Wikipedia and sign in, with your password and one-time-password. ...


1

This is a base64 encoding followed what seems to be a substitution cipher. Since it is monoalphabetic, it should be easy to crack. Have fun: http://www.cryptoclub.org/tools/substitution_cipher.php


3

The trailing = usually proposes that it is encoded (not encrypted!) using base64. You can decode it simply as from Linux shell (or there are some web tools): echo "Wmd5emhzIHhya3N2aSBkemggbGlydHJtem9vYiBkaXJnZ3ZtIHVsaSBnc3YgU3Z5aXZkIHpva3N6eXZnIHptdyByaCB6IGhrdnhyem8geHpodiBsdSBnc3YgenV1cm12IHhya3N2aS4gR3N2IHVvenQgcmggemd5NGhzMWhoMGgxbmtvMw==" | base64 -d ...


2

Risks of keeping logged in: CSRF and XSS attacks could be used to compromise your sessions, if the site in question is vulnerable. If the application uses weak or predictable session tokens, yours could be brute forced. A physical attack (e.g. laptop stolen), could possibly allow access to all your logged in sessions. This could be mitigated using disk ...


1

Not staying logged in increases the potential damage a keylogger could do. Also your passwords are going to be much more simpler because you need to recall them all the time. Staying logged in increases the damage a session stealer could inflict. The latter is only usable if the attacker is in the same network. If you are always in your own, safe network, ...


0

An X.509 certificate is a format for sharing a public key along with the name of the entity that holds that public/private key pair and optional extensions such as usage. It is usually signed by a certificate authority in order that it is trusted. A X.509 certificate is used in many applications that rely on public/private keys for authentication and/or ...


0

X509 is the type for SSL certificates, these can differ in the purpose they have. When using a SSL connection with a server you use a X509 certificate with the purpose of server authentication: TLS Web Server Authentication (1.3.6.1.5.5.7.3.1) when using it for client authentication (2 way SSL) you need a certificate with TLS Web Client Authentication ...


0

Agree with everyone else in stating that the first email address is the only valid one. Would also like to point out that it's a bad practice to allow for additional spaces at the end of a logon name. If I understand this correctly you're attempting to make the point of potential similarities in user/customer logons to the system. So in answer to your ...


1

There is definitely a security issue that stems from a provider allowing the registration of almost identical email addresses. But it's not quite the one that your specific examples are testing. And its effects aren't even necessarily limited to users of the email service, but can more broadly impact anyone receiving mail from a user that service. The ...


-3

I develop Web applications for a living, and I can say this. While it may not be a "big" security risk, it certainly is sloppy development to allow someone to register with test@test.com; and/or 'test@test.com '. Simply because the developer did not take the usually minimal time to add input validation. I mean even using plain HTML5, if you used an ...


1

All but the first should be rejected simply because they are not valid email addresses. When you copy&paste them verbatim into your favorite email client they might do what you expect, but the most likely behavior is that it interprets them all the same. So if you want email addresses to uniquely identify users, you should insist on entering one ...


17

Only the first email address is actually a valid address. Of course, email address validation is hard, so trying to implement perfect validation does not make sense. At a maximum, you can approximate validation, and for usability reasons, you should be lenient with your filter. Because of this, you should not base your security on the validity of email ...


33

The one and foremost problem with this approach is that in your example, only the first one is actually a syntactically valid email address. The three others are not. This means that one of the two following options holds: The "email address" is merely a suggestion. The system wants a unique login identifier; email addresses are reasonably good identifier ...


0

I use one key per client computer, and all the remote servers I need to access have 1 or more lines in their authorized_keys file, depending on which clients should be allowed to access them. So if you have a home laptop, a home mobile, and a work laptop, each of those would get one keypair. Then you upload each public key to every remote computer that each ...


0

Continuing my obsession with hardware tokens and YubiKey NEO devices, I generated an GPG key on token, exported the public key, and used gpgkey2ssh to convert it to the format that goes in my authorized_keys file. Instead of using ssh-agent to decrypt my key file from disk, I plug in my security token and use gpg-agent. Access now requires that the key is ...


0

While there's nothing I can imagine that will protect you from a really determined individual with admin access to your machines, an alternative to passphrases on files stored locally is to use a smart card - there is support in PuTTY, WinSCP and for ssh/scp/sftp on Linux and probably other OS too.



Top 50 recent answers are included