Tag Info

New answers tagged

1

The problem you are trying to solve is that the client needs to be identified by the server (to know which user this is) but the server needs also be reliably identified by the client to detect phishing. I agree that simply using HTTPS for identification of the server is not enough, since an attacker might simply own a similar looking domain (e.g. paipal.com ...


1

Security measures strengthen in inverse proportion to convenience... so I probably wouldn't do this... and I don't know a single site that does this... but... you did ask. How about a workflow like this: User accesses web site and enters user name Site looks up user's phone number and sends one time code or a random word as SMS. Site displays one time ...


1

I know of one that let's users upload a picture of their own choosing when the account is set up. (They can change it later.) The picture is shown on the password screen, after the user ID is entered. Wrong or no picture == fake web site. You would want to use a back-end program to make the pics a standard size and to strip out meta data before storing ...


0

I've been doing some research on mitigating brute force attacks and came across this post. I recently implemented the following approach: In a 24 hour period: On 20 or more failed authentication attempts for a single IP address we require captcha for each subsequent attempt. At 100 failed attempts, we blackhole requests, but give no indication that the ...



Top 50 recent answers are included