Tag Info

Hot answers tagged

8

Apparently was turning on "Find My Mac" that turned on the guest account: https://discussions.apple.com/thread/4145011?start=0&tstart=0


7

Short answers: No, your key generation isn't secure. Yes, the attacker can find the email from the code. An attacker can obtain the activation code for any email address due to the extremely weak random number generation. mt_rand() isn't suitable for this purpose, add to that the advantage gained by knowing some information about the state of your system ...


6

Voting systems are "gamed" by people voting more times than should be normally allowed (e.g. voting several times). The only way to prevent this is to have a way to identify voters and to prevent multiple votes. Reliable methods entail authenticating users, e.g. with passwords, but this has two drawbacks, namely that 1. users don't like it, and 2. this does ...


6

Only provide the pages over HTTPS (most servers have a requires HTTPS option). HTTPS will make an SSL connection that will protect the information in transit. On the server side, what you need to do to store the information depends greatly on the type and sensitivity of the information, as well as how it will need to be used. For example, is it ...


6

There is no way to prevent multiple registrations. I have two suggestions to offer Make multiple registrations undesirable, for example by charging a fee. Outsource the identity problem to someone else, for example my using Facebook or Google login instead of rolling your own.


6

No - given that most users come in from large ISPs, their IPs are not fixed for all time - the names they give to you certainly aren't fixed Security is not a black and white issue - though it seems too many don't seem to understand that - it's an issue of making the cost of defeating it not worth the reward In the general scenario you're describing, ...


6

Give them a choice. For example, my e-mail address is fairly long whilst I usually pick short usernames; you can develop your login form to accept both. Usernames aren't for securing accounts, passwords are. It isn't for no reason that the username is visible when entered in the browser, whilst the password is hidden. Also, users often re-use usernames, ...


5

You need to distinguish between two types of non-personal account: Generic accounts are accounts that multiple humans can login to. These are generally bad as you lose accountability. If John and Fred both have access, and a malicious event occurs, who do we blame - John or Fred? Service accounts are used by applications, not by humans. Provided these are ...


4

Having a username provides more obscurity than email does which provides security as a bruteforcer would requires the username before being able to perform an attack. An email is not as obscure as a username as email. Users might use their email in every other account registration, subscription to newsletter or even posted it somewhere to have someone ...


4

You are going about it all wrong. Why will you need to send the USER_ID over a GET request to retrieve the secret questions and tokens like you mentioned? You probably store the reset tokens in a table in the database with a foreign key linking it to the user's data stored in another table. You can simply parse the token sent using GET and retrieve all the ...


4

Restricting one-vote-per-IP, can seriously limit B2B participation. Most businesses are behind proxies or NAT which presents the whole organization as a small range of IPs. Given there's real money and real prizes involved, linking an account to a difficult-to-mass-produce alternate identity can really limit abuse. Examples might include your work email ...


4

The company email is likely a bad way to verify someone's identity. In most places, the email address is in a common format that could easily be guessed. Social engineering and pretexting are easy ways to get common information. You should also consider the insider threat, a coworker could impersonate someone with an email address easily. (I am assuming that ...


3

You should always assume that registration information is what your real user wants, any later change and the user should be notified, especially when it comes to critical information such as username and password. When the email address is changed, an confirmation email should be sent to the new address containing a link to activate the new email address. ...


3

You could prevent multi-registration by increasing your identity proofing (See OMB M-04-04). Of course by doing so, registration is now much more difficult for your legitimate customers. So while you could prevent multi-registration, you probably don't want to. (Please note, I'm not seriously suggesting that you upgrade your identity proofing. Increased ...


2

I use Spring Security extensively, but it's intended to solve a different set of problems than the ones you cited: registration, change-password, reset. You'll still need to handle all that yourself. Spring Security is a very effective tool for handling authentication, authorization, and access-control.


2

Why would proxies and TOR be a sign that a user is unscrupulous? Tor is a sign that someone is privacy conscious, or lives in a country that restricts access to information. A proxy is a sign that someone is logging in from a business network more than a sign they are up to no good. I assume you are trying to prevent a single individual from creating ...


2

There is little to be gained by having a secret username or something of the like. As long as you enforce a suitable password policy, brute force attacks will be ineffectual, regardless of whether the username is public or not. If an attacker intercepts the password in someway, through a keylogger or packet sniffing, he can also intercept the secret ...


2

You are asking to generate secret data from a single, non-secret source. It can't be done under those exact conditions. You need a 'source of secrecy'. You can try to squirrel a key away in a config file, perhaps encrypted with yet another key, or you can move some aspect to a different, secure machine, such as using a Hardware Security Module (HSM) to host ...


2

Usually you can't log in with an OS user unless someone has created an user with the very same name to trick the admin. You shouldn't be worry about that but you can review these users from time to time and check if they are being genuinely used by the system or by a suspicious user. Nevertheless, the IT audit people are right, it is considered a bad ...


2

The sum of what the client stores and what your server stores must be sufficient to recover the user-specific secret data (e.g. Facebook access token). What the client stores is, mostly, the user's password (the only permanent storage area on the client side is the user's brain, if we want to allow the user to use several distinct machines at will). If I ...


2

I was at the 10th ISC conference of security and cryptology last week and there I saw someone proposed a method for storing user-pass tokens using Neural Network. He's created a NN that learns user-pass tokens and updated itself using a fast NN learning method. It is a new method and promise security but needs lots of attention on learning. UPDATE The ...


2

Sounds like you require a centralised authentication system and a centralised audit system for monitoring. You could configure a LDAP server for centralised authentication using the Linux PAM module. This server would manage Role Based Access Control and sudo permissions across systems. For logging user activity, you could use something like snare, splunk, ...


2

Security issues don't come from the presence of "anonymous" user accounts, but from user actually using them to perform actions (because then the user are not longer accountable: logs will tell you "Administrator did it" and not "Bob did it"). Logging as some account simply means knowing the associated password and using it (however, accounts can be locked ...


2

There are two sides to this. First is verifying the identity of the user, and the other is verifying the legitimacy of the help desk. This is a pretty big deal because social engineering calls will almost always be directed toward the helpdesk or be impersonating a help desk member. Since normal users are typically less sophisticated than help desk ...


2

Larger enterprises go through centralized initiatives led by the infrastructure team - the very same team that typically manages authentication. To make sure the access rights management works and scales correctly, many turn to standard architectures such as the one pue forward in XACML and older specifications. This architecture defines the notion of: ...


1

Although it is up to you, common way is a user can set other users equal to them. There can be many admins if it is wished to be so.. Giving a lower rule is a harder case in my opinion.. I made you admin and you can un-admin me? weird huh? well...this could happen... So yeah, I can set you equal to me, than you can downgrade me. Thus, having only one ...


1

The PBKDF2 algorithm available from the passlib library will do the trick. It doesn't have some appealing properties of bcrypt such as being hard to speedup using GPUs but it is still a strong password hashing with a configurable iteration count.


1

You can require voters to have an old facebook (or twitter) account that was created prior to the voting start, this is something that will make it impossible for someone to register just to vote, and the possibility of someone having allot of accounts on those social networking site is very small, and can probably be handled by other methods, like ...


1

Two answers: If you have to use iPads, then think of them as "kiosk" devices and whatever each "user" does they must log into specific applications to do. You could do that by just having each individual application represented on the device, and they log in individual, or if you want to make it seem "slick" you could use something like citrix and have a ...


1

We've recently been testing Good for Enterprise which has turned out to be great. Users can install it on any device IOS or Android (assuming it is compliant to your standards(ie not jailbroken for example)) then set up quickly and easily. All your personal data (email, contacts, documents etc) are synced and stored within the encrypted application. If you ...



Only top voted, non community-wiki answers of a minimum length are eligible