Tag Info

Hot answers tagged

44

Nope, the picture on the left of the password field has nothing to do with the security of the login process. This is, sadly, a "usability" feature. It's called a Visual Hash (here's an example). Actually, the avatar you're currently using is an example of visual hashes. Because Lotus Notes displays a random number of X in the password field, the ...


41

There is some information on this defunct page. Apparently, the idea that the "moving picture" is there to distract shoulder surfers is widespread, and wrong. That's not how this picture works; what it does is actually worse, although it proceeds from good intentions. When you type the password letters, Lotus employs a "fairly complicated" but deterministic ...


30

Closed source is more secure than open-source as attackers can view the source code and find and exploit vulnerabilities. While I'm not claiming this is always false, with open source software its at least possible for outside experts to review the software looking for gaping vulnerabilities/backdoors and then publicly patching them. With closed source ...


19

Some examples: Bigger keys. 4096-bit RSA, 256-bit AES... more bits are always better. (See the comments: there is no point to have keys bigger than the size which ensures the "cannot break it at all" status; but bigger keys imply network and CPU overhead, sometimes in large amounts.) Automatic enforcement of "safe functions" like snprintf() instead of ...


19

Overall, the protocol does not appear to increase security over existing technology. If you are looking for the best way to protect your identity online, this is without question not it. But let's go over the pros and cons: Advantages It's impossible to "share" a password in the narrow sense that a malicious website can't use the authentication provided to ...


16

I think it's fair to say that the idea that any large organisation is entirely impervious to attack has been proven false over the last five years or so. Everyone from nation states through large corporations, security consultancies and other security minded companies have had breaches. One reason that a bank hasn't been thrown into "complete chaos" as you ...


16

I'll add my own appsec examples that I have seen while consulting: "I'll email you an encrypted zip and include the password in the same email..." This has happened to me more than once. A locked door won't stay locked if you leave the key in the door. "But you couldn't have gotten SQL Injection and SMTP injection, we called sanitize() on everything!". ...


13

As usual, take anything related to Steve Gibson with a truckload of salt. Obligatory attrition.org link. Let's have a look at Gibson's description of his protocol. The QR code presented near the login prompt contains the URL of the authentication service for the site. The URL includes a securely generated long random number so that every ...


11

Passwords must be salted and hashed before storing in the database. SHA-1 is a good fit, SHA-512 is perfect. I still hear that one from many security professionals, security training, and current security guides.


9

Using SSL only for the login page rather than all the authenticated areas of a website.


8

To turn a quick profit, It is easier to go after end users. This is why there are so many phishing attacks and password stealing Trojans. Banks internet-facing operations tend to be well secured. The internal office environments less so, although they tend to have good AV. This stops casual metasploit users, although an advanced attacker with zero day ...


6

It depends on what exactly you were using. Direct inspection computer: if you're using a public (library, etc.) computer, you can check its usage history - browser history, and so on. Keep in mind that most such systems ought to use, and often do use, virtual/sandbox systems such as SteadyState, that erase all traces after you log out. So eye-keeping at ...


6

When one secure a box, he puts several defenses layer so, would some "hacker" defeat a protection, the immediate consequences will be limited, and by the time a defeats the next following protection layers his action will hopefully be detected and neutralized. This is for a simple box. Now with a bank which is one of the largest international institution, ...


5

Focus less on giving a detailed security report and more on answering the user's potential questions. If your app uses TLS to communicate with the servers, then that's a bullet point for your security page. If you hash your passwords with pbkdf2, there's another. If you store a backup copy of user credentials on a server hosted with Amazon in zone ...


5

I'd recommend describing some of the measures you use without going into precise detail. Definitely avoid any mentions of semi-snakeoil topics such as "military grade encryption". A statement of PCI compliance would likely provide a level of comfort that you've at least looked at the basics, but might not satisfy very security sensitive customers. To an ...


4

I agree with the other comments to certain degree, but I do think there are some merits: To enable SQRL for you, you have to create your master key and store it on your phone. DONE. From that second, you will be able to log into ANY website that uses "SQRL". And that would be an anonymous login - as long as you decide to not provide any further information. ...


4

Just one, but it's a biggie: "Information Security is a technology problem, that can be fixed with technology."


4

To answer your first question: As far as I know, there is no way to circumvent this. It's a security feature. To answer your second question: Yes, non-default trusted root certs are definitely potentially problematic. They are often abused. They are sometimes used for workplace or traffic monitoring (which is potentially OK if adequately disclosed, ...


3

It depends on how they implement it, but the most secure would be to use that with a password. They are probably using a certificate based system which wouldn't be able to be guessed and they are turning the phone in to a "what you have" token that can pass the information to the authentication system when you prove you have it by knocking on it. The exact ...


3

SQRL provides no ground breaking improvements. QR codes are an optical barcode format useful for short content distribution - nothing more. Any "auto-login" situation that SQRL is trying to solve could simply use a client certificate stored on the mobile instead. Hypothetically a QR barcode on a HTTPS page could return a server signed or encrypted version ...


3

While it sounds odd to someone who is focused only on the technical aspects of hacking into a bank, one reason banks are more secure than many organizations is that they have a comprehensive set of information security policies. These policies guide the organization through many areas that help protect their customers. A good example is a policy that ...


3

Let's debunk a misconception: banks do get hacked, they are just (way) more controlled then the average company. From my experience as a penetration tester, it is not unusual for banks and financial firms to have vulnerable systems, but there are elements that make them harder to succesfully attack. First of all, banks usually respect the minimum privilege ...


3

SQRL is a convenient solution to the problem of the username/password paradox. (i.e. the convenience/security tradeoff) without using a third-party. It provides a simple alternative to the most popular authentication model (Username & Password), with virtually no compromise to security. It is practically just as secure of any of the common ...


3

You can't secure FTP. Remove it and replace with a secure alternative like SFTP if you need file transfer. The way in which you've asked the question implies that you don't have a valid need for it, that it's probably just on by default. Depending on what you're running, 'rpm -e pure-ftpd' or 'dpkg -r pure-ftpd' might do for you.


2

I would like to address the first question: "one of the problems that I can think of is if the QR reader is compromised, to display www.google.com instead of www.nsa-super-secret-place.gov/123": The master key is used as the seed into HMAC together with the website address (FQDN). So although the QR code may encode completely different URL the protocol will ...


2

At a previous workplace we were using Lotus. I remember asking the guy who installed it for us about that exact feature. He said "this will help you know when you enter the wrong character before submitting the password".


2

The critical resource assuring the security of banks is, surprisingly, not technical at all. :) Most importantly, banks maintain large internal security departments staffed with considerable number of security specialists. Banks are more or less the only organizations who are capable of footing the bill for this sort of operation. The rest is rather ...


2

I presume the idea is that if you're sitting in Starbucks, no-one can learn your password by you tapping on your phone (& that you're unlikely to leave you phone down somewhere). See "Shoulder surfing".


1

I wouldn't do it. Injection attacks have been in the wild for long time, and everyone (in this field) know about them. As I see you are focusing on web applications, my suggestion is to take one of the vulnerabilities in the end positions of the OWASP's ranking, and then research about it.


1

No, You will not. The footage transmission just stops when it can no longer access the internet.(imagine an ink-less pen, you can write with it, but no use of writing since it is not stored / not visible) Make sure to let your router connect to an alternative power source (with any of your favorite options) when the actual one fails.



Only top voted, non community-wiki answers of a minimum length are eligible