Tag Info

New answers tagged

0

The attack you describe happens because the user account is a container of credit cards, and Amazon equated "knowledge of a contained object" with "knowledge of the container". It's not surprising, because everyone assumes that a credit card must be kept secret, therefore knowledge of the credit card was evidence that the attacker had knowledge of a secret. ...


0

There isn't really much you can do about the social engineering attacks apart from training you employees better who directly interact with the customers ( customer care reps) in this case. If they learn on how to ask more questions in case of suspicion, or update the whole security training program for them. Again as a dev there isn't much you can do.


1

Assuming you have a password reset function (I'd be surprised if you didn't), I'd just blank/replace the hashes with something empty/useless. This way, nobody can log in, and the proper user can reset their password to regain access. You should consider using a better hashing technique than SHA-1. For simple passwords, there are Rainbow Tables and other ...


1

Generating random passwords and sending them to users is fine. But the most important thing to do, if not already done, is to warn ALL users that their passwords have been compromised and if they are using the same on whatever other website/app they absolutely have to change it.


0

Your code is good for monitoring users activity on the server but to be honest, It can't help preventing DDOS attacks since the aim of DDOS attacks is to send tons of requests to the server to make it too busy to respond to its intended users. your code seems to be doing lots of checking to determine if the number of requests has reached beyond your ...


0

use it do define a key (…), which will then be stored as a session variable. Since the key is never stored anywhere except in the user's head (…) Although temporarily, the key is being stored in the server (eg. a basic session handler uses files in /tmp, a memory dump of memcached could reveal keys even after expired). You should check how is the server ...


3

When the user do the first login your software will ask for a new password. At this time the DB should be empty. Now you have a UserPassword and an empty DB. So the software generate a new random DBdataKey that will be used to encrypt/decrypt the DB contents. To encrypt/decrypt use one of the many known algorithms, like AES or similar one. Now you create 2 ...


0

Depending on the data-protection laws of your country and that of your hoster the files that you store in cloud are your files. That means: storing a blue-ray movie in the cloud is - from the perspective of law - nothing else than storing it on your local hard-drive. Additionally: Since files you put into your cloud drive (say for personal backups) are not ...


1

If files are encrypted and that encryption is done competently, then the contents cannot be inspected by third parties. Crucially, this requires (in your situation) that the encryption is done on your computer, with a key (or password) that you keep for yourself, and do not send to anybody else, in particular the people that host the file storage cloud ...


1

Your keys might be safe, depending among others on the encryption used and how strong user passwords are. But there's a way to make it much safer : don't store them. In your system as you describe it, there is no reason not to let the client take care of the whole encryption/decryption. Thus, the server has no point in knowing user encryption keys. Storing ...


1

Complexity is the enemy of security. So is giving up control of the valuable bits, like keys, when it isn't necessary. As I understand it, your scheme works something like this: User starts client app that can access encrypted local files User enters a) username and b) password User name and password are transmitted to server Server authenticates user ...


1

It is not troublesome, removing these "links" have been done for a very long time, even when disk space was expensive. Since CPU cycles were also expensive, there was no point in securely "overwriting" (like shred) data. If you remove the logical file table entries, the space it addressed as empty and was just overwritten. Alas, it is not "troublesome", ...


0

This topic has really been discussed to death, so this is only the short version. Salts have several benefits. The most important one is that it forces an attacker to break each hash individually. Without salts, the attacker needs to go through his list of possible passwords just once. For each item, he calculates the hash and checks if it matches any of ...


3

This topic is documented extensively all over the web as well as on this site, so taking the time to do some research on your own would have been a much faster way to get answers. However, if you're just having trouble understanding the concept a simple explanation may help. Simply put, it alters the hash of a password so that it does not physically match ...



Top 50 recent answers are included