New answers tagged

0

AdHominem is right; using email verification prevents this attack vector. It's a usability challenge, though. I think that for many sites the right (but cumbersome) way to do it is as follows: Allow the user to complete the entire signup process and start using the site with a low-privilege, temporary account. You should probably prevent them from taking ...


4

The email harvesting scenario you describe is really slow and not likely to happen, at least as a way to gather lots of email addresses. The attacker would need to brute force really long strings against your form. As already stated by symcbean, emails are already very cheap if you buy them and it's pretty easy to block such attempts if someone tries to use ...


0

instead we could just use in the login form a username without leaking the registered email, and sending an alert to the users in case there is a failed login attempt to their account to warm them that there is someone who wants to connect... Giving such information/clous will just make brute force easiest for an attacker, for example if i give to a website ...


0

Memory is not cleared on reboot (tested on Macbook). You can check this trivially under Linux by running a program, rebooting so that the program is no longer running, and then grep in /dev/mem for strings contained in the program memory. For example: Run XFCE Reboot in to single mode (no GUI, no desktop) Login as root then # grep -b THUNAR_ZOOM_LEVEL ...


8

The exit node will not know your address. The principle is that every server only knows the address of the previous and the next host but never the whole path. There are three steps between your TOR browser and the webserver: Entry-Node (Knows your address and relay nodes address) Relay-Node (knows entry-node and exit-node address) Exit-Node (knows address ...


3

When you use Tor your Internet traffic is routed via Tor which goes through several random relays before exiting the Tor network. Tor is "designed" so that it is theoretically impossible to know the original computer that the information came from assuming you are using Tor the right way. Exit node can see your plaintext traffic assuming you aren't using ...


1

Production and non-production environments should be isolated as a best practice. Your non-production environments likely have less monitoring, may have unsafe code, may not have updated machines, etc. If you have anything that can go between these environments you are increasing the risk of: Malware traversing from dev to prod Confusion and mixing of ...


2

It's possible that a company subject to PCI or HIPAA audits may need to write a security policy prohibiting sharing data between dev and prod in order to comply with the data security standards, but it's also possible they wrote the policy so that it applies to all data, not just the PCI or health data. This is not necessarily a bad thing. Security isn't ...


1

I can't speak fully as to why your local security officer considers this a security risk/concern, but I can tell you two things that I'm guessing he's thinking; even if he isn't thinking these, this will be my answer as this is what I would be concerned with if I were the local security officer at your organization: You mentioned prod is locked down, and ...


4

I don't think it's possible to answer this generally. But I can think of some things that MIGHT be valid. Prod has data in it that should only be viewed by certain people. Since prod normally feeds dev, the "secret data" would have to be mitigated in some way before it gets to dev, or the data itself is time sensitive. If it's not, then the only ...


1

There is no legitimate way for an unauthorized eavesdropper to access those specific packets. So let's break it down: Make it legitimate. Eve* could ask Alice or Bob for those packets. Authorize it. Eve could be a law enforcement officer, and request the network provider to deliver copies of those packets. Be less specific. If Eve is a thief who just ...


0

Here are two ideas which show the dangers of phishing and social engineering, among other things. If it's a 10BASET or 100BASETX network (unlikely), Bob can fly to LA and try to find their network entry point. If Bob has enough money, this is even easier. Bob shows up pretending to work for the ISP and says he has to fix something. Corporate/business ...


0

You can of course never be sure that there are no back doors in software you get from random places on the internet. So you have to a similar "due diligence" that is always warranted in security: to consider the value of what you are trying to shred up against how much you can trust the vendor. So go with the high-reputation vendors or write your own ...


0

No, such features under mobile OSs today, do not unambiguously separate between 'privacy-leaks' and 'basic needs' — and that operating system developers are partly to blame. Details on this have been provided by other answerers, but this awareness was even reinforced in the question text.



Top 50 recent answers are included