New answers tagged

1

Independent of the quality of your 5 digit random number I would like to elaborate on your claim "Provided, the email can only be opened by the administrator of the website." We assume that the administrators email account is protected only by password. This way you combine one password (email password) with probably the password of the web admin interface. ...


1

There is unlikely to be a single answer to this question as each may cover different flaws. Here are some, only concerning token derivation and use of 404: The second part of the token can be directly calculated by any adversary as they know their own IP address. It can therefore be removed without reducing security. The use of a hash in the first part of ...


2

It's not a terribly difficult attack to prevent. I would say prevention has more to do with the developer being security aware than it does with the complexity of preventing it. This is actually true of many security vulnerabilities. To answer your question - no, I don't think you are missing anything. It's just a matter of making sure developers are ...



Top 50 recent answers are included