Tag Info

Hot answers tagged

43

Nope, the picture on the left of the password field has nothing to do with the security of the login process. This is, sadly, a "usability" feature. It's called a Visual Hash (here's an example). Actually, the avatar you're currently using is an example of visual hashes. Because Lotus Notes displays a random number of X in the password field, the ...


39

There is some information on this defunct page. Apparently, the idea that the "moving picture" is there to distract shoulder surfers is widespread, and wrong. That's not how this picture works; what it does is actually worse, although it proceeds from good intentions. When you type the password letters, Lotus employs a "fairly complicated" but deterministic ...


18

Overall, the protocol does not appear to increase security over existing technology. If you are looking for the best way to protect your identity online, this is without question not it. But let's go over the pros and cons: Advantages It's impossible to "share" a password in the narrow sense that a malicious website can't use the authentication provided to ...


16

I think it's fair to say that the idea that any large organisation is entirely impervious to attack has been proven false over the last five years or so. Everyone from nation states through large corporations, security consultancies and other security minded companies have had breaches. One reason that a bank hasn't been thrown into "complete chaos" as you ...


15

Since raw emails are not encrypted, what you can read in an email could have (conceptually) been read by anybody. However, to read the email, the attacker would still have to connect to the HTTPS server, which leaves tracks (the IP from which the attacker connects will be known to that server -- of course, that IP will probably be that of a Tor exit node). ...


12

I think there's something to be said for setting a bar, regardless of how low it is. Can Tripwire be bypassed? Sure. Will it catch things that you wouldn't otherwise? Yes it will. The main problem I've seen in a Tripwire installation is tuning it to where it isn't false-positive laden to the point of ignoring it. If it blows up every time someone ...


11

Great question! As it happens, I can present experimental data on this question -- and the data is fascinating. (I noticed that some of the answers contain speculation from first principles about how much security these security images offer. However, the data turns out to have some surprises for all of us!) Experimental methodology. "Security images" ...


11

I don't rate their security particularly high; but they are more than just security theater. They potentially can make the job of the attacker more difficult and the job of a security forensic experts tracking down anomolies easier. Let's say there is no security image/phrase or equivalent. Then an man-in-the-middle attacker can construct a fake version ...


11

One area where ZIP files could present a risk to the application the zip bomb attack. this occurs where an archive is constructed in such a way that when it's opened it consumes a large quantity of space on the server potentially causing it to crash. It might be possible to mitigate this issue by opening zip files on a dedicated filesystem and then ...


10

I'd like to add this to what The Bear has already said This method adds almost no security at all. Why? Exposing the email with the link = Exposing the real message This is almost the same as sending the text in the same email used to send the link. Then why are they doing this? You might ask. Here are some possible reasons: Delivery and reading ...


10

As usual, take anything related to Steve Gibson with a truckload of salt. Obligatory attrition.org link. Let's have a look at Gibson's description of his protocol. The QR code presented near the login prompt contains the URL of the authentication service for the site. The URL includes a securely generated long random number so that every ...


9

Legally speaking, a corporation is one of the best "liability shields" you can have. It is its own entity that is, for most purposes, the entity that the rest of the world is interacting with when they interact with anyone empowered to represent it and make decisions on its behalf. It, and not its agents, bears the full brunt of any legal liability for ...


8

Tripwires are very useful for defending against userland rootkits. Kernelland rookits do not need to replace binaries to subvert the behavior of the system, usually these rootkits are just a Linux Kernel Module (LKM). In fact when you control the kernel like this any executable's behavior can be influenced without needing to modify the binary its self. ...


8

The biggest risk in any language is to have developers who do not master the said language. Secure development requires thinking of all "corner cases" and it does not work unless the developer knows what he does at all points. A competent C programmer who does not know Java will do more secure code in C than in Java (and vice versa). A case can be made that ...


8

To turn a quick profit, It is easier to go after end users. This is why there are so many phishing attacks and password stealing Trojans. Banks internet-facing operations tend to be well secured. The internal office environments less so, although they tend to have good AV. This stops casual metasploit users, although an advanced attacker with zero day ...


7

Self protection: What you list in your answer sounds pretty good. About my only thought would be to change your long ranty fake security question answers to truly fake answers. Either sentences or more pseudo-random characters. But assuming you get somewhere with trying to change the system, I don't think you want those in there when some guy who is ...


7

One this that hasn't yet been mentioned is that this approach can improve security from a different angle: rather than addressing privacy concerns (which it clearly doesn't), it definitely helps in establishing verifiability. Anyone can send an email and forge the headers to make it appear to have come from your vendor, but (presuming their systems are ...


7

The problem with a zip is that you aren't really sure what's inside of them. You would need to unzip the contents, scan for virusses and then you know that there aren't any known virusses in them. Second of all, when fileuploads are in use, you can only allow a certain amount of file extensions (white list rather than blacklist) and you need to verify that ...


7

There are no security threat. At least not any that are specific to zip files. The major concerns have already been outlined by other users. However, all of these are either not harmful to the application itself or not specific to zip files. Zip Bomb attacks, as described by Rory McCune. These are only a concern if the files will be unpacked. Inclusion ...


6

When one secure a box, he puts several defenses layer so, would some "hacker" defeat a protection, the immediate consequences will be limited, and by the time a defeats the next following protection layers his action will hopefully be detected and neutralized. This is for a simple box. Now with a bank which is one of the largest international institution, ...


6

It depends on what exactly you were using. Direct inspection computer: if you're using a public (library, etc.) computer, you can check its usage history - browser history, and so on. Keep in mind that most such systems ought to use, and often do use, virtual/sandbox systems such as SteadyState, that erase all traces after you log out. So eye-keeping at ...


5

I agree with the above comments, plus a relevant business issue: security measures cost money (in the same way that software features cost money) and a business has finite budget for security, usually not enough. The two downsides to ineffective controls are that some budget is being wasted and that the impression the board will get of their security team is ...


5

In addition to the answers from Rook and Jeff, Tripwire and similar solutions also have real time alerting value. To subvert a Tripwire system that is also monitoring its own files you need to prevent it alerting during the subversion process. Not as straightforward an attack any more. So in summary - you can get around any controls given enough ...


5

In the general case I would agree with you that cloud services are no more inherently risky than e-mail providers. Any time you store data with a 3rd party there are security risks, especially if you're using a consumer grade service which doesn't have things like contracts in place where you can specify security/audit requirements. I'd say that there's a ...


5

This is exactly what you want, I googled: only allow root ssh lan First hit... http://drsavoye.blogspot.com/2010/06/enable-root-login-from-lan-only.html On Linux, edit /etc/ssh/sshd_config. On Macs, edit /etc/sshd_config. Locate the line that defines PermitRootLogin, uncomment if it is commented out, and change its value to yes. On a separate ...


5

Account for poor backend security If they're storing your password in plaintext (which is more than reasonable to suspect) then there's really nothing you can do about that. But what you can do is limit the amount of exposure to yourself that a security breach would cause. To the extent that their poor security isn't your problem, you don't really have to ...


5

One trick I've seen before is a single-use download link. If you visit the link, you cannot download the file after the first attempt. If you get there and the file has already been downloaded before you try it, then you have detected a compromise. Hopefully this site records the address and time of downloaders at a minimum.


5

openssl s_client -connect www.example.com:443 -cipher NULL You might also want to have a look at this blog which details how to test for different ciphers. To test for 64-bit ciphers or lower you can use: openssl s_client -connect www.example.com:443 -cipher LOW To test for 128-bit ciphers: openssl s_client -connect www.example.com:443 -cipher ...


5

I'd recommend describing some of the measures you use without going into precise detail. Definitely avoid any mentions of semi-snakeoil topics such as "military grade encryption". A statement of PCI compliance would likely provide a level of comfort that you've at least looked at the basics, but might not satisfy very security sensitive customers. To an ...


5

Focus less on giving a detailed security report and more on answering the user's potential questions. If your app uses TLS to communicate with the servers, then that's a bullet point for your security page. If you hash your passwords with pbkdf2, there's another. If you store a backup copy of user credentials on a server hosted with Amazon in zone ...



Only top voted, non community-wiki answers of a minimum length are eligible