Tag Info

New answers tagged

0

My recommendation: Never. You should only have one CSRF token per session. If the session times out, then the CSRF token expires at this point. As there is no way for an attacker to read the CSRF token (at least there's no more of a risk of an attacker reading a CSRF token as the Session ID cookie), there is no need to generate a new one unless you have a ...


0

Well you should study your personal stats. You should ask yourself the following questions: How much time does an user spend in your system? What is the usability impact not changing it in a session? What is your expiring session time? ... Nobody here can answer those questions (among others) better than yourself.


2

PuTTY does not store its configuration in a file. However, PuTTY can use a "proxy command", as described here. In your case, the example config file shows that there should be two encapsulated SSH connections: The outer SSH is done to host login.nets.***. When that connection is done, the command nc is run on that host: it basically forwards data bytes to ...


0

its not, simly said, no encoding is bullet proof, no UID is "un-impersonatable" or however its called, spoofing UID's, MAC adresses or anything with a number, is plausible, the other one harder then the other. so yes, in the long run, you can emulate the ID


0

I've been searching, and I found that to resist distributed denial of service (DDoS) attacks a set of techniques are used on networks attached to the Internet, to protect the target and relay networks. This is done by passing network traffic addressed to the attacked network through high-capacity networks with "traffic scrubbing" filters. DDoS mitigation ...


0

Most distributed denial-of-service (DDOS) attacks are simple "throw data at the server faster than its connection can handle" attacks, and consequently cannot be dealt with at the application level. Rather, they're mitigated at the ISP level, typically by blocking the attacking computers. Non-distributed attacks, on the other hand, can be mitigated at the ...


0

AFAIK, They are similar WRT the end-goal. WS-Trust is SOAP-based involving front-channel (browser) and back-channel (among services) communication, SAML-Passive can optionally use SOAP for backchannel communication, SAML-P can involve no backchannel at all. The XML documents involved have different name spaces: WST vs SAML SAML-P is the name for the ...


1

Given the problems we've seen with SSL recently (both CA-side issues and implementation bugs), I agree that having another layer of security protecting the password is a good idea. The best option I know of is the Secure Remote Password protocol (wikipedia, Stanford, crypto.SE) -- ideally, combined with a slow hash function like scrypt or PBKDF2. Using SRP, ...


0

Since you're building an API from scratch, you could implement a hashing function where a SHA256 (or whatever) hash is put on the username and password matrix and submitted. In this way, only the hash is sent over the wire. This isn't an end-all-be-all solution, but it's just another layer.


1

If you believe in layers, then add some layers. For instance, run your SSL within another SSL, and arrange for the two SSL layers to use distinct algorithms (e.g. the outer SSL works on AES encryption and an ephemeral Diffie-Hellman key exchange, while the inner SSL uses RC4 encryption and RSA-based key exchange). This is undoubtly layered, and, as far as ...


0

If you add limited validity period (like 20minutes) for these keys (csrf, email confirmation) then I would say it is sufficient. Also this is assuming you do not keep any history of the keys.


0

techerrata.com does provide MD5 checksum at its download page http://techerrata.com/browse/twrp2/flo. You can tunnel to a VPN to check if the checksums are shown up the same.


4

The browser fingerprint is public information for any site the user visits, so this information should be treated simply as a 'username' and nothing more. The problem here is if the user changes computers, browsers, or settings they may be locked out of their account. There may be ways around this, but then you veer from your path of simplicity. The other ...


2

You say this: one requirement in the audit is dual layer of security on all channels and that says it all. Your auditors don't understand how cryptography or even security actually works. If they were physicians, they would double doses for all medicines; when they transplant a kidney they would try to hook an extra kidney; when they have to cut off a ...


0

Are you trying to brute force the windows system password or 3rd party software password? If your are cracking over the network, try using a faster network speed might help. Or use those existing brute force software.


2

It looks like you're performing an "online" attack, in which case the speed at which you can work is limited by how fast your target computer is willing to respond to login attempts. Since your code isn't (or at least, shouldn't be) the limiting factor, there's nothing you can do to speed up the attack. If you can acquire the password hashes, you can ...


1

If this form is hackable, others are likely to be also. Getting the content of the database is problematic, but bypassing normal user authentication, altering other users accounts, or just plain trashing the database are all on the table. I doubt your client would want you to try these things on their live database.


1

How can I obtain the database's content using the SQL injection technique? Whether or not you can do this will depend greatly on how the information is used after it is pulled from the database. For example, if the information pulled from the database is only used to see if you have valid credentials, but never displays any of the database content that ...


6

You should ensure that you have the right skill set before offering to perform work for a client. This means that you looking at the website will be worthwhile and you won't give the client a false sense of security. This will be better for you as you will know how to take the correct steps to perform a test legally and won't get sued by the client if you ...


2

The difference is : OAuth 2.0 is a standardized protocol, and there is many implementations in differents langages (JAVA, Python, PHP, JavaScript...etc) for both client and server sides. So you don't need to follow this article to implement something which "seems" similar to the OAuth 2.0 protocol and probably not secured. For the cookie-based token ...


0

The reason we decided not to ask for two-factor auth keys at the same time had nothing to do with security. It turns out asking for an one time password at the same time as the normal username and password can cause autofill misbehavior with various plugins, scripts & browsers. This is a UX reason rather than security, but substantial enough to probably ...


1

My recommendation is either: 1, based on Stack Exchange's own login system. There's absolutely no good reason to crosslink systems. or 1, based on some trusted shared identity hub, if you're already using such a hub other than Stack Exchange's own system. Assuming you have found a single-sign-on system that you do trust. I haven't yet seen one on the ...


2

Before addressing the "hacker gaining access to my Stack Exchange account" using 3rd party authentication, shouldn't you be addressing the security of your 3rd party OpenID/OAuth provider? Sign up for two-factor authentication.


9

If someone compromises your StackExchange account can't they just unlink all your recovery options? Assuming they can't, the model is that: Losing any of the accounts linked to SE is a "compromise". If any of the other accounts linked to SE is not lost then you can "recover". On this model, 2 seems reasonable by your own analysis: 0 is no good, you ...


3

As usual, the problem is one of definition. Namely, what makes the device 'D' more "genuine" than a PC run by some ill-intentioned individual ? If you get down to it, you will say something like: device D is genuine because that's the true piece of tangible hardware, the accumulation of atoms which came out from the factory. This is fine as far as definition ...


3

Simply put, additional logins would have 2 effects: It increases the risk of attacks and account compromission but on the other hand, It lowers the impact of a successful attack by limiting the perimeter of data accessed. Then it's up to you to decide based on the risk you accept, and the balance you want in terms of usability versus security.


21

Adding logins means adding alternative methods to access your account; see this page for details. Thus, additional logins cannot reduce the risk of hostile hijack; in fact, they can only increase the risk since they provide additional entry routes for the attacker. If you have several logins, then your "security level", formally, is no more than that ...


0

When I understood you correctly, the affiliates have banner adds on their websites which look similar to this in HTML code: <a href="http://example.com/store.php?UniqueID=123"><img src="http://example.com/banner.png"></a> and your attack scenario is that when a visitor clicks on that banner, a MITM replaces the UniqueID in the visitors ...


1

What you basically need to do is: Verify that a request is coming from an authenticated user, i.e. a user (or service) that's allowed to use your API; and Ensure a request isn't altered while in transit, commonly known as a Man-in-the-middle attack. You could install X.509 certificates on each publisher's web site and use this to authenticate them over a ...


11

What you present is not an authentication protocol; it is merely a concept, namely the concept of a session token. In plain words: Server authenticates client, and send back a secret key to that client (the session token). When the client comes back, it shows the token to the server to prove that it is the same client as previously. The client can request ...


2

The funny thing about providing a generic 'gist' of an authentication flow is that unless you really screw up the flow, you likely won't find serious issues because there just isn't enough detail to say one way or another. More often than not, its the implementation that is flawed. This is further complicated by the fact that you don't specify what you're ...


14

Yes, this is insecure as specified. Your design seems to be vulnerable to Cross-Site Request Forgery (CSRF also known as XSRF) attacks (need to add a CSRF token with all POST actions that is displayed with the form and stored in a session cookie). Basically, if a user goes to some other website (email, forum, blog) while logged into your website, their ...


2

As others have noted, a big part of the role of the splash screen is to make sure that the user sees the word "securely" and gets the impression that "something is done about security". The best security systems are invisible (when you don't see anything, and business proceeds unimpeded, then the security systems are optimal), but the general public does not ...


4

Security Theatre This splash screen is not necessary for the user, but the company chose to introduce a the splash screen showing that they think security is important and saying that they are supposedly away 'doing' security. The only good thing here is that they think security is important to them and their clients. The increased security (ssl/https) ...


0

I could well be wrong, but I suspect that this is just camouflage for some other process that is slow. Setting up an SSL connection - as you note - is usually very fast. For example, TurboTax does exactly what you describe, but I really think that they are just putting up something feasible for the general public when they are performing the authentication ...


0

The "OT" in "HOTP" means "one-time". This is true only if the server indeed rejects passwords corresponding to a counter value which is not greater than the last confirmed value. Having "a little margin" here would mean accepting that a given password is accepted twice, the very thing that HOTP tries to prevent. This is all based on the idea that the HOTP ...


0

Are you developing this software? I would just generate a unique token stored in database such as: TokenId UserId (Or some entity which this token relates to.) TokenKey (Which will be used as an identify to the public.) IsExpired Ip (Which is hashed such as SHA512 so doesn't expose the users IP if compromised.) CreatedOn UsedOn Now, we need reduce ...


2

For this your main concern is making sure that the information is only accessible to the intended recipient; which sounds a lot like what public cryptography / PGP tries to achieve. Unless you want to see if the target non-user has a PGP key published, or if you can get his certificate to encrypt the email with his public key; I think you'd just need to ...


0

What if instead you sent them a generic link that takes them to a page on your site which then generates a random, temporary url for them and forwards them to the registration page.


1

I don't think you can. You know nothing about the intended recepient, so whomever receives and uses the link is as likely as anyone else to be the right guy. A common half-measure is to make the link valid only for a short time.


1

Let C be the attacker. C runs another server, under its own name (C), with its own public key Kc. Occasionally, A connects to C (knowingly, but not knowing that C is Evil, or believing that the evilness of C won't extend beyond C itself). Attack goes thus: Client A connects to C and sends {Kac}Kc to C. Immediately, C connects to server B and claims to be ...


-2

There is a security flaw with the Picture Password. After switching your login method to Picture Password, Windows 8 will then store your Picture password as well as your regular user password using the reversible encryption algorithms. Using the freeware Mimikatz and you can decrypt the Picture Password in no time.


2

There is an informational RFC for use of OpenPGP keys in SSL/TLS; as the RFC says: The term "OpenPGP key" is used in this document as in the OpenPGP specification [RFC4880]. We use the term "OpenPGP certificate" to refer to OpenPGP keys that are enabled for authentication. That's what these keys are for: usages as part of authentication protocols which ...


1

How should I authenticate WebSocket clients like Socket.io on top of HTTPS ? There is no need to authenticate a connection more than once, so if you are using websockets, you can put security token in the first message that client sends after connecting to the service. HTTPS is a must. After handshake you will have secure connection (token can be ...


0

A simple Google search on "django client certificate" reveals this, and this, and this, which all answer to your question as: yes, Django can work with certificate-based client authentication. People don't do that often in practice, because client certificates work only if you can arrange for clients to have certificates, basically meaning that you must ...


1

Also see How safe are password managers like LastPass?. I had concerns about its security integrity and the fact that your passwords are saved on servers that are located in the USA. Even though they only store encrypted data, LastPass is obliged to give this data to the USA government when requested. Since I realized this, I moved to KeePass Password ...


0

http://en.wikipedia.org/wiki/OAuth http://en.wikipedia.org/wiki/OpenID Apparently answers need to be at least 30 characters, and that link wasn't enough


7

I disagree with Mark. A main goal of SSL/TLS is the protection of the long term key (i.e. the private certificate). If an attacker can obtain the key, the implementation must be considered broken. It does not matter if you use two-factor authentication or not. If I know the server's secret key, I can decrypt your traffic either directly (without PFS) or via ...


0

The sms vulnerability reported to Facebook was something else as far as I saw, it uses the Facebook's response to unregistered numbers to receive an unused confirmation code to reset password of other users... If you are using an Android device, I strongly suggest you should check your mobile for any malicious applications. While I was doing some research ...


1

I do not see any security issue in asking for the password and a second factor (token/biometric) at the same time. In fact this increases the security of the system, but it might affect the usability (user experience) of the system. How is that? Let us say that the system take the two-authentication factors (password and OTP) at the same point and test ...



Top 50 recent answers are included