New answers tagged disclosure
Any issue with a federal government web application, I would contact the office of my congress-person. They are becoming increasingly aware of and concerned with security and privace of government computer systems. You can say what you want about our deadlocked, ineffective congress, but they are still pretty good at making things happen at the various ...
Most countries have a Computer Emergency Response Team (CERT) that you could contact, ie: US-CERT, CERT Australia, etc. They usually have the correct connections to get the matter addressed. Google CERT plus your country name to get started.
You practically answered your own question, It's completely viable to use a plain response for harden your system against an analysis attempt. Other option could be: Use a random UUID to identify your users publicly and keep the primary key only for internal use. A UUID of 16 characters should be enough to mitigate this type of attack. Finally you should ...
It's a case of usability vs "implied" security. By making the requests have the same response code a user has lost the ability to determine if "the website isn't working" due to them typing in the wrong url or the wrong password. As value of the response code itself isn't a necessity for HTTP to work, or even directly related to the url requested. The ...
Top 50 recent answers are included