Tag Info

New answers tagged

3

It is safe as everything on the client-side is, by definition, already accessible client-side. If you're worried about the password being exposed and read by passers by of the user's screen, then normal users will not have the console active. If they did, it would also be possible to see the password entered via the Network tab: Screenshot taken from ...


0

It is safe simply because even the least skilled attacker can simply add their own. And the java-script is only really knows what the end user already knows anyway. But on that note it is also poor programming practice to produce excessive console output.


0

This very much depends on where the application is running, as code running in different environments will have different levels of access to system information. Browser Analytics have access to a relatively standard set of the information provided by the browser. The easiest/best way to block these is to use browser privacy plugins like ghostery which ...


1

An old question, but adding an answer for modern times. For sensitive responses, you should set the following header: Cache-Control: no-store, must-revalidate These days, you probably don't need to worry about the HTTP 1.0 Expires header. Pragma is only for requests, not responses. To refresh the page just after session timeout (so that the login form ...


1

A better way to protect against cryptolocker is to set up a NAS, that will force versioning of files. With force, I mean that all Changes of files will be saved on the NAS, and the client has no way to affect this. Then you save all important data on this versioned NAS. If the cryptolocker encrypts your NAS, you simply tell the NAS to rollback the files ...


1

Since a virus infected PC has to download (encrypt) reupload the entire file, and repeat the process for every network drive, is is possible to detect this unusually high bandwidth event? Is there a way to respond to it (via QOS or something?) You're mistaken: the malware doesn't need to transfer the file. It uses asymmetrical encryption: the file is ...


0

Vulnerabilities can range from "go home, you're pwned" to "pest". Of course, if you completely take over a system, all its data is there for you to harvest. Data leakage can be intrinsic to the design of an application (transmitting data on the wire in plaintext), a mistake in programming (hey, that session ID is off by one!), or it can stem from ...


2

"Data Leakage" is typically defined as unauthorized data that becomes available due to the actions of the normal operation of the program/user. As for your example of data transmitted unencrypted, I would see that as not a a vulnerability analysis but a normal part of a data analysis (any place the data touches requires appropriate protections for the ...



Top 50 recent answers are included