Tag Info

New answers tagged

0

You might want to consider using hybrid locational services to validate your GPS inputs. This Wikipedia page on Wi-Fi location services should be a good start - http://en.wikipedia.org/wiki/Wi-Fi_positioning_system


0

No, at least not without being a device administrator and locking down a bunch of stuff on the phone. Android very intentionally supports fake GPS information for debugging purposes and as far as I know, you would need to be able to disable that, which would be difficult if not impossible to do without being a device administrator and even then wouldn't ...


1

It sounds like your problem could be solved with anti-CSRF tokens or maybe you have them elsewhere already? See link below for details. Basically, with each form request a unique token would be sent and validated by the server. If the token is invalid, the request is blocked. The token would be unique, valid for that request only, and a malicious user would ...


1

If the salt used for PBKDF2 is of non-trivial length, say 128 bits, and the salt is stored with the form ID on the server (only), then this will allow you to check whether the form ID has been tampered with. There must be a secret component to the hash because of Kerckhoffs' principle, AKA Shannon's maxim. In this case, the salt, stored only on the server, ...


2

Just XORing the plaintext blocks doesn't prevent some types of attack. For example: If the first or the last block of the message consists entirely of null bytes, you can just delete the IV (so the first encrypted block will be considered the IV) or the last encrypted block and the message will still be judged as valid. In the same fashion, if the first ...


7

The decision to use SHA1 for message authentication is part of the formal transport design specification (RFC 4253). Furthermore, SHA2 is now recommended as an update to the protocol (RFC6668). According to this reference the use not only ensures data integrity but also prevents replay attacks. SSH was originally more like what you are suggesting using ...


5

Strictly speaking, it's not about "consistency" but about "integrity", i.e. the data B receives is the same that A sent. XOR is a simple and reversible operation, with many possible attack vectors even for encrypted data. An attacker may for instance change one bit from 0 to 1 and another one from 1 to 0 in the ciphertext and this may go undetected by XOR. ...


5

Just a guess, but XOR isn't a great way at detecting defects in data, and therefore isn't a great way to checksum something. If you XOR each of the blocks and have a bit error in two of the blocks in the same position, the final XOR value would be the same as if there weren't an error. With a hash checksum, any small change would be reflected in the final ...



Top 50 recent answers are included