Tag Info

Hot answers tagged

43

Nope, the picture on the left of the password field has nothing to do with the security of the login process. This is, sadly, a "usability" feature. It's called a Visual Hash (here's an example). Actually, the avatar you're currently using is an example of visual hashes. Because Lotus Notes displays a random number of X in the password field, the ...


39

There is some information on this defunct page. Apparently, the idea that the "moving picture" is there to distract shoulder surfers is widespread, and wrong. That's not how this picture works; what it does is actually worse, although it proceeds from good intentions. When you type the password letters, Lotus employs a "fairly complicated" but deterministic ...


18

Overall, the protocol does not appear to increase security over existing technology. If you are looking for the best way to protect your identity online, this is without question not it. But let's go over the pros and cons: Advantages It's impossible to "share" a password in the narrow sense that a malicious website can't use the authentication provided to ...


16

I think it's fair to say that the idea that any large organisation is entirely impervious to attack has been proven false over the last five years or so. Everyone from nation states through large corporations, security consultancies and other security minded companies have had breaches. One reason that a bank hasn't been thrown into "complete chaos" as you ...


10

As usual, take anything related to Steve Gibson with a truckload of salt. Obligatory attrition.org link. Let's have a look at Gibson's description of his protocol. The QR code presented near the login prompt contains the URL of the authentication service for the site. The URL includes a securely generated long random number so that every ...


8

To turn a quick profit, It is easier to go after end users. This is why there are so many phishing attacks and password stealing Trojans. Banks internet-facing operations tend to be well secured. The internal office environments less so, although they tend to have good AV. This stops casual metasploit users, although an advanced attacker with zero day ...


6

When one secure a box, he puts several defenses layer so, would some "hacker" defeat a protection, the immediate consequences will be limited, and by the time a defeats the next following protection layers his action will hopefully be detected and neutralized. This is for a simple box. Now with a bank which is one of the largest international institution, ...


6

It depends on what exactly you were using. Direct inspection computer: if you're using a public (library, etc.) computer, you can check its usage history - browser history, and so on. Keep in mind that most such systems ought to use, and often do use, virtual/sandbox systems such as SteadyState, that erase all traces after you log out. So eye-keeping at ...


5

Focus less on giving a detailed security report and more on answering the user's potential questions. If your app uses TLS to communicate with the servers, then that's a bullet point for your security page. If you hash your passwords with pbkdf2, there's another. If you store a backup copy of user credentials on a server hosted with Amazon in zone ...


5

I'd recommend describing some of the measures you use without going into precise detail. Definitely avoid any mentions of semi-snakeoil topics such as "military grade encryption". A statement of PCI compliance would likely provide a level of comfort that you've at least looked at the basics, but might not satisfy very security sensitive customers. To an ...


5

openssl s_client -connect www.example.com:443 -cipher NULL You might also want to have a look at this blog which details how to test for different ciphers. To test for 64-bit ciphers or lower you can use: openssl s_client -connect www.example.com:443 -cipher LOW To test for 128-bit ciphers: openssl s_client -connect www.example.com:443 -cipher ...


4

I agree with the other comments to certain degree, but I do think there are some merits: To enable SQRL for you, you have to create your master key and store it on your phone. DONE. From that second, you will be able to log into ANY website that uses "SQRL". And that would be an anonymous login - as long as you decide to not provide any further information. ...


3

You can't secure FTP. Remove it and replace with a secure alternative like SFTP if you need file transfer. The way in which you've asked the question implies that you don't have a valid need for it, that it's probably just on by default. Depending on what you're running, 'rpm -e pure-ftpd' or 'dpkg -r pure-ftpd' might do for you.


3

While it sounds odd to someone who is focused only on the technical aspects of hacking into a bank, one reason banks are more secure than many organizations is that they have a comprehensive set of information security policies. These policies guide the organization through many areas that help protect their customers. A good example is a policy that ...


3

Let's debunk a misconception: banks do get hacked, they are just (way) more controlled then the average company. From my experience as a penetration tester, it is not unusual for banks and financial firms to have vulnerable systems, but there are elements that make them harder to succesfully attack. First of all, banks usually respect the minimum privilege ...


3

Information security management requires brains as the first resource: there must be somebody, in the organization, who "groks security", understands what is going on, and thinks about the issues. This will be the CISO, in fact if not in title. ISMS are pre-digested tools which will help a CISO cope with the sheer size of the scope of information security ...


3

SQRL provides no ground breaking improvements. QR codes are an optical barcode format useful for short content distribution - nothing more. Any "auto-login" situation that SQRL is trying to solve could simply use a client certificate stored on the mobile instead. Hypothetically a QR barcode on a HTTPS page could return a server signed or encrypted version ...


3

It depends on how they implement it, but the most secure would be to use that with a password. They are probably using a certificate based system which wouldn't be able to be guessed and they are turning the phone in to a "what you have" token that can pass the information to the authentication system when you prove you have it by knocking on it. The exact ...


3

SQRL is a convenient solution to the problem of the username/password paradox. (i.e. the convenience/security tradeoff) without using a third-party. It provides a simple alternative to the most popular authentication model (Username & Password), with virtually no compromise to security. It is practically just as secure of any of the common ...


2

I presume the idea is that if you're sitting in Starbucks, no-one can learn your password by you tapping on your phone (& that you're unlikely to leave you phone down somewhere). See "Shoulder surfing".


2

I would like to address the first question: "one of the problems that I can think of is if the QR reader is compromised, to display www.google.com instead of www.nsa-super-secret-place.gov/123": The master key is used as the seed into HMAC together with the website address (FQDN). So although the QR code may encode completely different URL the protocol will ...


2

One of the services we use is something called Cassandra to track vulnerabilities. You create a profile and then tell it what servers and software you are using and it sends you notifications of vulnerabilities.


2

In addition to the solution suggested by @Lucas (with openssl), you can try this tool, which will give you the list of all cipher suites supported by your server, along with some other information. The cipher suites which do not actually encrypt data are TLS_NULL_WITH_NULL_NULL, TLS_RSA_WITH_NULL_MD5, TLS_RSA_WITH_NULL_SHA and TLS_RSA_WITH_NULL_SHA256. If ...


2

Nope. It makes absolutely zero improvement in security and disables a normally useful feature. As you're probably well aware, there's a number of shortcuts that work to do all the things you've mentioned like F2 to rename files, Ctrl+C for copy, Ctrl+v for paste. It does absolutely nothing to prevent keyloggers, screen cappers, viruses/malware etc. To ...


2

The critical resource assuring the security of banks is, surprisingly, not technical at all. :) Most importantly, banks maintain large internal security departments staffed with considerable number of security specialists. Banks are more or less the only organizations who are capable of footing the bill for this sort of operation. The rest is rather ...


1

There are a few different kind of labs available. There are ones you can construct yourself in VM's such as Vulnhub and they have a lot of links to good resources there. Another site i can recommend with good resources is Pentesterlab, i tend to steer clear of the online sites such as hackme so can't give much as to online but hope these help.


1

FTP is a very old protocol and not recommended anymore today because credentials are transmitted in plaintext which can be read by sniffing the network traffic. If you don't need it you should uninstall it or you can block this port with a firewall. On Linux you could use iptables to block all traffic to this port as follows: iptables -A INPUT -p tcp ...


1

ASP.NET uses something called request validation to prevent stored (and possibly reflected?) XSS attacks. Request validation basically looks for malicious content when requests are submitted. If it finds any it will block the request. By default request validation is enabled, but users can disable it. It should be noted that request validation will not ...


1

I wouldn't do it. Injection attacks have been in the wild for long time, and everyone (in this field) know about them. As I see you are focusing on web applications, my suggestion is to take one of the vulnerabilities in the end positions of the OWASP's ranking, and then research about it.


1

This is simply because you are logged in to your Google account when searching Google. Similarly, if you have autocomplete on, Chrome will provide a drop-down "suggestion" on common things, such as name, email address, etc. Unless you can provide more details, at this point from what I can tell from your post, you are simply seeing expected behavior. Google ...



Only top voted, non community-wiki answers of a minimum length are eligible