Hot answers tagged

6

If you really used proper end-to-end HTTPS then nobody in between your client and the server could sniff it, no matter if VPN or not. Of course this means that there is a proper certificate validation and you did not skip warnings about invalid certificates. Thus I would consider it more probably that the data were sniffed either before they got encrypted ...


4

Yes, this address can be shared by multiple users. For example: Mobile phone providers often route their 3G/4G traffic for their subscribers via the same public IP. Some ISPs have shared public IP addresses - historically notably AOL. Corporations often have single or multiple gateways, meaning their employee traffic will be shared via the same external ...


4

If you can trick them into clicking something in an email, you can send them a link to any page that you have access to the webserver logs for and find the request in the log (along with their IP). There are also a number of third party services to do this for you that are pretty easy to use (eg http://whatstheirip.com). Now, that said, some of the ...


3

I disagree with @quietsigns answer. There are other people that could potentially see your email. For one - email can be sniffed while in transit. Probably not super likely but still possible. Second - if the destination email is ever compromised (or is currently compromised) then it's likely that this email will just be sitting there. If you are really ...


2

In many cases the merchant can check the amount before shipping the item. However many payment gateways implement a checksum value that is hashed with a secret key and if the hash don't match the value the transaction is aborted. There are several flaws with this approach, I gave a presentation at blackhat asia last year that illustrate some of them. You can ...


2

I would say: Ask your acquirer. If you roll your own library or use a 3rd party service, the rate limiting might not Count towards you in "fraud fighting score" at all, and you will still be liable if the order makes it through. If you select such services by your acquirer, then the acquirer knows that you are actively fighting against fraud, and the ...


2

In addition to the chance that a replacement card with the same PAN, but new expiration date and CVV has been issued (as noted by others in the comments), it can of course be used for spearphishing. Just knowing that John Smith has a platinum card with XYZ bank, and used it to pay for a 10-pack of Nutella sandwich spread opens up for sending him an email or ...


2

Short answer Yes, they can. Long answer If you require PIN to do any transaction, they will have your cards' information, but they can't really do anything about it. Of course this is already bad, and it doesn't improve situation in any level. If it was a credit card that requires you to put zip code only (for example, US credit cards), then they can ...


1

Plenty of things could have happened. To start with, emails which are not digitally signed cannot be trusted: they can be tampered with in transit (not very likely when the exchange is between two large providers) the sender can simply fake the email (such an email may not be accepted by the recipient's system and one could check the path it took to reach ...


1

If your connection was encrypted, as long as you haven't compromised your SSL cert chain at all, and the cert for the airline you chose wasn't compromised, and you were actually connected using HTTPS, I'd say most likely you weren't MITM'd over HTTPS. What a VPN provider COULD DO, however, is set up a MITM attack by stripping HTTPS at their end and then ...


1

If you get user IP with proper method that grab the user network global IP, it will be always unique. But users can send multiple proxy request at a time. To prevent that use captcha along with your IP validation. Than it should work perfect!


1

We have had the same issue here. We decided the quickest and user-friendliest way was to implement a modern Recaptcha ('I am not a Robot') extension. We decided on the Yireo Google Recaptcha extension because it was fast and easy to implement (https://www.yireo.com/software/magento-extensions/recaptcha), but you can also implement your own here ...


1

Yes, you can generate off of a BIN (Bank Identification Number) which is the first 6 digits in the 16 digit credit card string. And if the BIN you are using expires, then depending on if it's a Visa or MasterCard, you can literally keep the month and increase the year by 3 or 4 years. But a far as numbers in general..... If you have a good high limit ...


1

The two main methods that I have considered for this are: 1. User Defined Questions Most of the default questions I see on sites seem to be the same or very similar, easily researchable through social media, etc. I would generally think that allowing users to write their own security questions would be better with some guidance. e.g., "Come up with two ...


1

You didn't specify what your site is built with. If by chance you're using Ruby, there is an excellent rack-attack library by Kickstarter.



Only top voted, non community-wiki answers of a minimum length are eligible