Tag Info

New answers tagged

1

As has already been said, blocking IP's will not work. DDoS attacks are very hard and sometimes impossible to protect against. I would recommend using a service like CloudFlare. The DDoSers themselves use it to protect themselves from their fellow DDoSers. It has a free tier and a paid tier. If what you are protecting is low scale (i.e, smaller than a ...


2

If you care about DDOS attacks blocking by IP address will probably not help much, because DDOS means Distributed Denial Of Service and thus is typically caused by a large number of hosts, usually some botnet. In this case there are not only lots of sources for the attack but they also often change over time, so simply blocking by source IP address does not ...


4

If you're interested in understanding methods of protection on a more technical level, there are plenty of articles detailing more in depth strategies to protect yourself from a DDOS attack, such as this one from Cisco: http://www.cisco.com/c/en/us/support/docs/security-vpn/kerberos/13634-newsflash.html That being said, you may have noticed that even some ...


1

It's very hard or impossible to exploit this vulnerability over the network as Nic Barker already stated. I want to mention that it's best practice to define a lockout threshold for authentication mechanisms. For example: If a client authentication fails for the 7th time, further authentication for this client is blocked for at least 5 minutes. If a lockout ...


0

How feasible the attack is depends on how much noise you have to remove to get to the signal you want to have. If you can do a lot of tests against the website you should be able to increase the level of signal which might be enough to filter out enough noise to make this kind of attack feasible. But details depend a lot on the actual setup of the system you ...


1

While this is certainly a very interesting idea, in practise I think it's pretty much impossible to exploit. We're on a fiber connection here, and even the response time direct to our ISP is all over the place: If the difference you're looking for is a few nanoseconds, you'd literally have to already have access to the local machine to even begin to hope ...


3

This is not a good idea. I would also like to quote the question: I still feel like most people are probably using a password that is the required length or only 1 or 2 characters over the limit. Agree! Well, I don't actually assume people to create passwords of one or two characters if you set the minimum length to 0, but most of your unrestricted ...


52

One related question that you missed in your list is this one: How critical is it to keep your password length secret? The accepted answer there (disclaimer: mine) shows that if you have a password scheme which allows all 95 printable ascii characters, then the key space ramps insanely quickly every time you increase the length of the password by 1. You ...


13

The answer is in your question. Assuming the use of only alphanumeric characters, requiring 8+ characters removes about 3.5 trillion password possibilities (most of them would just be random gibberish). This leaves ~13 quadrillion passwords that are 8-9 characters. Establishing a minimum length, or even an exact length, for passwords forces the user to ...


4

Not uniformly applying a password policy introduces unnecessary security risks and definitely does not improve security. Allowing weak passwords to exist just improves the likelihood that the attacker will crack a hash using a list of common passwords. This problem is made worse as the number of users increases. If 1/100 accounts have a password that ...


1

Taking AES-128 as an example, you have a 128 bit key. The "stupid" brute force attack would require you to check every possible 128-bit key until you get back plain text that makes sense. There are 2^128 possible keys and hence the complexity of brute force on AES-n, where n represents the key size is O(2^n). Now obviously there are ways to constrain the ...


7

While this of course depends on the encryption method, the usual, short answer is: no, making the file bigger does not make exhaustive search harder. In general, someone tries an exhaustive search on some key because he is interested in the file contents, meaning that he has context: he already knows the kind of data that he will find. Decrypting only the ...


0

John The Ripper seems to welcome external contribution especially through their "Jumbo" aka "community enhanced" version of the software instead of the mainstream one. It is described as having a lower quality standard, but easier for patch integration allowing more people to integrate new modules in a more convenient way which, I think, is precisely what ...


3

Theoretically speaking, Scrypt gives higher safety per unit compute time than already similar known ones. It is also possible, with Scrypt, to set the memory space needed to compute the result thus making a brute-force attacker pay penalties (in terms of memory and processor ... and GPU). From a theoretical and algorithmic perspective Scrypt is ...


0

it is really not clear to me what is the question but it seems you have a problem with sending and receiving the cookie. But I think you should look at the following python package http://docs.python-requests.org/en/latest/user/quickstart/# http://docs.python-requests.org/en/latest/user/quickstart/#cookies But I think this is really a programming ...



Top 50 recent answers are included