Tag Info

Hot answers tagged

44

Nope, the picture on the left of the password field has nothing to do with the security of the login process. This is, sadly, a "usability" feature. It's called a Visual Hash (here's an example). Actually, the avatar you're currently using is an example of visual hashes. Because Lotus Notes displays a random number of X in the password field, the ...


41

There is some information on this defunct page. Apparently, the idea that the "moving picture" is there to distract shoulder surfers is widespread, and wrong. That's not how this picture works; what it does is actually worse, although it proceeds from good intentions. When you type the password letters, Lotus employs a "fairly complicated" but deterministic ...


30

Closed source is more secure than open-source as attackers can view the source code and find and exploit vulnerabilities. While I'm not claiming this is always false, with open source software its at least possible for outside experts to review the software looking for gaping vulnerabilities/backdoors and then publicly patching them. With closed source ...


19

Some examples: Bigger keys. 4096-bit RSA, 256-bit AES... more bits are always better. (See the comments: there is no point to have keys bigger than the size which ensures the "cannot break it at all" status; but bigger keys imply network and CPU overhead, sometimes in large amounts.) Automatic enforcement of "safe functions" like snprintf() instead of ...


19

Overall, the protocol does not appear to increase security over existing technology. If you are looking for the best way to protect your identity online, this is without question not it. But let's go over the pros and cons: Advantages It's impossible to "share" a password in the narrow sense that a malicious website can't use the authentication provided to ...


16

I'll add my own appsec examples that I have seen while consulting: "I'll email you an encrypted zip and include the password in the same email..." This has happened to me more than once. A locked door won't stay locked if you leave the key in the door. "But you couldn't have gotten SQL Injection and SMTP injection, we called sanitize() on everything!". ...


16

I think it's fair to say that the idea that any large organisation is entirely impervious to attack has been proven false over the last five years or so. Everyone from nation states through large corporations, security consultancies and other security minded companies have had breaches. One reason that a bank hasn't been thrown into "complete chaos" as you ...


15

Since raw emails are not encrypted, what you can read in an email could have (conceptually) been read by anybody. However, to read the email, the attacker would still have to connect to the HTTPS server, which leaves tracks (the IP from which the attacker connects will be known to that server -- of course, that IP will probably be that of a Tor exit node). ...


13

Any feature that "doesn't provide any additional [...] benefit" should be removed, security-related or otherwise. Besides increasing complexity and friction, it can introduce additional attack surface and end up making you less secure.


13

As usual, take anything related to Steve Gibson with a truckload of salt. Obligatory attrition.org link. Let's have a look at Gibson's description of his protocol. The QR code presented near the login prompt contains the URL of the authentication service for the site. The URL includes a securely generated long random number so that every ...


12

I think there's something to be said for setting a bar, regardless of how low it is. Can Tripwire be bypassed? Sure. Will it catch things that you wouldn't otherwise? Yes it will. The main problem I've seen in a Tripwire installation is tuning it to where it isn't false-positive laden to the point of ignoring it. If it blows up every time someone ...


11

I don't rate their security particularly high; but they are more than just security theater. They potentially can make the job of the attacker more difficult and the job of a security forensic experts tracking down anomolies easier. Let's say there is no security image/phrase or equivalent. Then an man-in-the-middle attacker can construct a fake version ...


11

One area where ZIP files could present a risk to the application the zip bomb attack. this occurs where an archive is constructed in such a way that when it's opened it consumes a large quantity of space on the server potentially causing it to crash. It might be possible to mitigate this issue by opening zip files on a dedicated filesystem and then ...


11

Great question! As it happens, I can present experimental data on this question -- and the data is fascinating. (I noticed that some of the answers contain speculation from first principles about how much security these security images offer. However, the data turns out to have some surprises for all of us!) Experimental methodology. "Security images" ...


11

Passwords must be salted and hashed before storing in the database. SHA-1 is a good fit, SHA-512 is perfect. I still hear that one from many security professionals, security training, and current security guides.


10

I'd like to add this to what The Bear has already said This method adds almost no security at all. Why? Exposing the email with the link = Exposing the real message This is almost the same as sending the text in the same email used to send the link. Then why are they doing this? You might ask. Here are some possible reasons: Delivery and reading ...


9

Legally speaking, a corporation is one of the best "liability shields" you can have. It is its own entity that is, for most purposes, the entity that the rest of the world is interacting with when they interact with anyone empowered to represent it and make decisions on its behalf. It, and not its agents, bears the full brunt of any legal liability for ...


9

Using SSL only for the login page rather than all the authenticated areas of a website.


8

Tripwires are very useful for defending against userland rootkits. Kernelland rookits do not need to replace binaries to subvert the behavior of the system, usually these rootkits are just a Linux Kernel Module (LKM). In fact when you control the kernel like this any executable's behavior can be influenced without needing to modify the binary its self. ...


8

The biggest risk in any language is to have developers who do not master the said language. Secure development requires thinking of all "corner cases" and it does not work unless the developer knows what he does at all points. A competent C programmer who does not know Java will do more secure code in C than in Java (and vice versa). A case can be made that ...


8

To turn a quick profit, It is easier to go after end users. This is why there are so many phishing attacks and password stealing Trojans. Banks internet-facing operations tend to be well secured. The internal office environments less so, although they tend to have good AV. This stops casual metasploit users, although an advanced attacker with zero day ...


7

There are no security threat. At least not any that are specific to zip files. The major concerns have already been outlined by other users. However, all of these are either not harmful to the application itself or not specific to zip files. Zip Bomb attacks, as described by Rory McCune. These are only a concern if the files will be unpacked. Inclusion ...


7

The problem with a zip is that you aren't really sure what's inside of them. You would need to unzip the contents, scan for virusses and then you know that there aren't any known virusses in them. Second of all, when fileuploads are in use, you can only allow a certain amount of file extensions (white list rather than blacklist) and you need to verify that ...


7

Self protection: What you list in your answer sounds pretty good. About my only thought would be to change your long ranty fake security question answers to truly fake answers. Either sentences or more pseudo-random characters. But assuming you get somewhere with trying to change the system, I don't think you want those in there when some guy who is ...


7

One this that hasn't yet been mentioned is that this approach can improve security from a different angle: rather than addressing privacy concerns (which it clearly doesn't), it definitely helps in establishing verifiability. Anyone can send an email and forge the headers to make it appear to have come from your vendor, but (presuming their systems are ...


6

When one secure a box, he puts several defenses layer so, would some "hacker" defeat a protection, the immediate consequences will be limited, and by the time a defeats the next following protection layers his action will hopefully be detected and neutralized. This is for a simple box. Now with a bank which is one of the largest international institution, ...


6

It depends on what exactly you were using. Direct inspection computer: if you're using a public (library, etc.) computer, you can check its usage history - browser history, and so on. Keep in mind that most such systems ought to use, and often do use, virtual/sandbox systems such as SteadyState, that erase all traces after you log out. So eye-keeping at ...


5

In addition to the answers from Rook and Jeff, Tripwire and similar solutions also have real time alerting value. To subvert a Tripwire system that is also monitoring its own files you need to prevent it alerting during the subversion process. Not as straightforward an attack any more. So in summary - you can get around any controls given enough ...


5

In the general case I would agree with you that cloud services are no more inherently risky than e-mail providers. Any time you store data with a 3rd party there are security risks, especially if you're using a consumer grade service which doesn't have things like contracts in place where you can specify security/audit requirements. I'd say that there's a ...


5

I agree with the above comments, plus a relevant business issue: security measures cost money (in the same way that software features cost money) and a business has finite budget for security, usually not enough. The two downsides to ineffective controls are that some budget is being wasted and that the impression the board will get of their security team is ...



Only top voted, non community-wiki answers of a minimum length are eligible