New answers tagged

1

I had a similar problem to solve, but from a URL in SMS (simple logon, without username/password). So I generate one time code for it, but you can as well use the existing token (you need to know the keys of course to decrypt or validate it). You can find details of my approach here with an answer on how secure that approach is. So you can always generate ...


0

The Malware creator might use the various points of redirection to change the behaviour of the script after it has been deployed to its target, maybe all systems are under the attackers control and he chooses to redirect different targets to different locations. Another possible answer is that the attacker prepared for the loss of access to one of the (most ...


2

I'm not sure how well defined app is in this case. Depending on which browser you are using, it is a collection of one or more processes. Browser plugins and extensions may or may not be running in their own processes. If you assume that a supercookie isn't utilizing an unpublished browser vulnerability, then only the browser process, and processes that it ...


1

This is how normally you investigate this. If it is a hash of your password, then you could test your password with the hash function and compare the output. This particular (assumed) hash string has 232 hex-digits, which equals to 928 bits. This is the exact size of RSA-280 number, which is used in SHA-1 encryption (along with many other RSA numbers, so you ...


33

There are two reasons to ask if your password is being encrypted: You are worried about the security of the site. You are worried about the security of your password. Regarding site security, with no HTTPS, there is effectively none. You should consider every communication with the site as public and assume that an attacker can pretend to be you. Just ...


20

What you got there is 232 hexadecimal digits, or 116 bytes of data. It is not a plain text string in any normal encoding. It could be a hash of your password, it could be your password encrypted, it could just be some kind of easily reversible obfuscation. Or it could be something completely different from your password, like a session identifier. It could ...


7

When you want to eavesdrop on the communication between your web browser and a server, you can often do that with the developer tools of your web browser (usual hotkey: F12). Most browsers will have some kind of Network tab where all network communication between the current website and the internet is logged in cleartext. When you find your cleartext ...


0

There're two possibilities, your password is either encoded or encrypted into that string. If it was encrypted, then it can only be decrypted using the key defined in the webapp, which is quite secure and need a long time to try breaking it.


4

This is less secure than the normal way to set cookies because you can't set the HttpOnly flag on your cookies. This means that the cookies can be read by Javascript, and this is particularly a problem if the website has an XSS vulnerability. In that case, the attacker can directly read your cookies and take over your session.


3

The idea of a super cookie is that you cannot easily delete it. It consists of replicas of the information on multiple places and if you delete some of these the information will be restored from the remaining places. Some possible places are: Simple cookies. These can usually be easily deleted. But one can make it harder if multiple sites cooperate so ...


0

" When a server supporting the Token Binding protocol receives a bound token, the server compares the TLS Token Binding ID in the security token with the TLS Token Binding ID established with the client. If the bound token came from a TLS connection without a Token Binding, or if the IDs don't match, the token is discarded." draft The problem ...


2

First, a definition from Chrome: Same-site cookies (née "First-Party-Only" (née "First-Party")) allow servers to mitigate the risk of CSRF and information leakage attacks by asserting that a particular cookie should only be sent with requests initiated from the same registrable domain. So what does this protect against? CSRF? Same-site cookies can ...


1

If you've always used that Facebook account through Tor, and never through your normal connection, and the Facebook account is for an anonymous identity rather than your real identity and you never make any references using your real identity to your alter ego and vice versa, and you never login, then using Facebook over Tor does not necessarily compromise ...



Top 50 recent answers are included