Tag Info

New answers tagged

0

Are input fields that don’t have name="" sent via the browser Not by the standard HTML form submission process. However JavaScript on the client side can read the contents of the fields and send that data themselves. Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? Yes. All content on a ...


2

Yes. Any HTTP request that isn't protected by SSL/TLS/HTTPS is vulnerable to MitM attacks. Without the integrity that is provided by HTTPS, any component of the HTML served over HTTP is vulnerable to attack or modification by a man-in-the-middle. For instance, the form's action could be changed, so instead of the form being POSTed to your intended page, ...


2

This should probably be closed as a duplicate, but given the sheer volume of duplicates, I figured I'd list them in an answer instead of a comment (to make them fit, and for readability) for posterity: Bank cards - chips vs mag stripe security Why are chips safer than magnetic stripes? Why does my debit card have a stripe AND a chip? What are the problems ...


4

User ID are not nominally secret values; that's why we call them "user ID" and not "passwords", and why graphical interfaces for entering them don't hide the characters". However, creative designers sometimes imagine that user ID are some kind of secret, which leads to situations like what you witness: a site that tries to enforce on the user ID some ...


2

Changing your credit card regularly may "provide better security over time," and it is unlikely to degrade your security significantly. That being said, "over time" is a good way of putting it - you're shifting the odds, nothing more. It might be appropriate to say: risk = threat x vulnerability. By rotating your card, you may lower some aspects of your ...


0

UPDATED Strictly, yes it does increase your security. Let's assume your CC# is enough for the hacker to withdraw funds in one way or another. In this scenario, your CC# is acting as a key (or a password). With this key, you can get into your house and steal your stuff. Your proposal is to change your locks every (year/month/week/day/hour/minute) in order ...


1

The only fields required to charge a credit card are the number (also called a PAN or personal account number), the expiration date, and an amount. Without the CVV it is still very possible to charge the card. Many merchants will require the CVV and/or postal code as basic anti-fraud mechanisms. There is also an incentive for many merchants as providing ...


1

No not really. First of all most banks have a system that likely uses big data to predict your spending pattern. This means any suspicious purchase abroad is likely to get rejected even without 3D secure. 3D Secure is a good way to protect since it provides 2 step verification with a OTP. In UK we have a system with the same name but we simply set a ...


2

Yes, it's a violation of PCI-DSS Requirements, specifically requirement 3.4: Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches: One-way hashes based on strong cryptography (hash must be of the entire PAN) Truncation (hashing cannot be used to ...


0

Yes, you can't write out unencrypted PAN. If someone could force a crash while that file is being worked on, it would leave it sitting around on the server for anyone to access and the file could potentially be read by other processes. There is no such thing as a "temporary" file. There are only permanent files you intend to get rid of soon. Also, ...


1

This is more a security measure for the vendor. Generally speaking, the vendor gets screwed if the transaction is fraudulent, so verifying the purchaser prior to authorizing the transaction is a big plus for the merchant and may also help improve the rates they get for doing the processing. It allows for some level of the benefits of card present ...


0

There is a distinction which must be made between the account and the card. In countries where debit/credit cards have chips, things go the following way when paying in a shop or restaurant: The merchant/waiter shows a payment terminal to the customer. The customer inserts his card into the terminal. Half of the card still sticks out; only the chip is ...


2

There is a difference between using your CC on a machine (ATM, PoS) and online. On a machine you will be identified by the CC number and PIN. If you are using card with a magnetic strip - it can be easily cloned. If you are using chip card, then it's safer, because machines can not read the chip, they can only interact with it and ask it to verify if the ...



Top 50 recent answers are included