Tag Info

New answers tagged

2

Despite the fact that Facebook locks accounts after many tries as the other answers said, you should keep in mind that "replacing your IP with a new one" is not as trivial as you make it sound. Most internet service provider allow you to release your IP lease and get a new IP address, but the attacker will usually receive one from a small pool of a few ...


1

I know that facebook has a few different security settings and that not everyone uses them to the fullest extent, so I will just go with the settings that I know from personal experience. Your mileage may vary. Facebook has a built in method of determining a users chosen devices that are allowed to access the account. If someone from a new device attempts ...


1

Facebook does temporarily lock accounts. After too many authentication failures, it temporarily locks the facebook account for a few hours, and requires a security question/verification code to unlock the account for more verification attempts. After a 24 timeout period, you can log in again. To the consumer, 24 hours without Facebook is not the end of the ...


1

To put you on the right track, we must first take you out of the wrong track. In your case: If you think "268 + 268 + 108", then you are thinking wrong. That would be the count of possible passwords, assuming that a password is either a sequence of eight uppercase letters, OR a sequence of eight lowercase letters, OR a sequence of eight digits. But that's ...


0

Question (a) There are (26+26+10)^8 different passwords = 218,340,105,584,896. Call that the dictionary_size. The attacker can test 4*10^6 per second => tests_per_hour: (60*60)*4*10^6 = 14,400,000,000 On average he will have to test half the dictionary, to find the average password solution: dictionary_size / 2 / tests_per_hour = 7581.25 hours. ...


0

The question isn't asking you to relate the answers to A and C, it's only saying that an attacker would realize that A is not the most efficient solution if he has more than one batch of passwords to guess, because he can get more than one use out of a rainbow table of 8 character SHA-256 hashed words. So you need to compute the number of possible ...


0

It's asking how many bytes of storage are necessary to store all possible hashes and one password that hashes to it. The way to look at this is to calculate the total number of passwords, then multiply that by the total space required to store both the password and its hash. So, if you have 10 possible passwords requiring 1byte to store each, and you ...


2

I would say: Ask your acquirer. If you roll your own library or use a 3rd party service, the rate limiting might not Count towards you in "fraud fighting score" at all, and you will still be liable if the order makes it through. If you select such services by your acquirer, then the acquirer knows that you are actively fighting against fraud, and the ...


1

You didn't specify what your site is built with. If by chance you're using Ruby, there is an excellent rack-attack library by Kickstarter.


0

I don't see the point in worrying about your scenario #3; that tactic will be just as successful as scenario #4: A botnet targeting many accounts trying one of many common passwords on each attempt. Imagine you have a million users, 10% of which randomly use one of the 1000 most common passwords (123456, password, letmein, ...). If a botnet tries ...


0

Removing old cruft such as support for export ciphers is often seen as a cost saving measure so the code doesn't have to be maintained. Old code like this is often like a submarine. Hard to detect unless it makes itself known, or unless someone is specifically looking for it. It becomes like an appendix. Relatively useless, and can easily be lived ...


3

There are many servers which support export-grade ciphers simply because default cipher sets had, and in some cases (inexplicably) continue to have them enabled. One of the changes in TLS 1.1 (section A.5) was to state that export grade ciphers MUST NOT be used in TLSv1.1. TLS 1.0 (section D.4) leaves it up to the implementation to decide on the required ...


5

These keys are still active because like so many other things the web is fundamentally broken for the purposes of backwards compatability. Technology vendors are quite often stuck with the choice between doing the right thing and supporting what is out there already. Could you imagine the uproar against Google and Apple if they shipped a web browser that ...


7

While your question, why are there so many servers offering export ciphersuites, is valid, your description of the problem is in error. FREAK is: a class of client-side bugs exploitable due to server-side configuration. The vulnerable devices you list are not configured to use export-grade ciphersuites, but they can be tricked into using export-grade key ...



Top 50 recent answers are included