Tag Info

Hot answers tagged

29

The author of that JS library seems to have made a common, yet mistaken, assumption, though based on just enough knowledge to get things wrong. You can't just sprinkle magik crypto faerie dust and expect to get more security, like chocolate chips. What the author is missing is that once you sign the session id, and put that in the cookie - the signed ...


6

As far as I know, the zxcvbn project is an entirely client-side javascript app, meaning that, in theory, no data needs to be sent back to the server. In order to find out if it's sending data back or not, you can do several things; Use a packet sniffer, like wireshark, to inspect any data that this web page is sending back to the server. On the page you ...


4

The first step is to patch the vulnerability by escaping any HTML entities or removing any dangerous characters all together. Reflected XSS is a client-side attack method, caused by a server side vulnerability. I wouldn't worry too much about any damages if you didn't catch an XSS worm in action or actually saw anyone using the exploit to attack other ...


4

Email verification doesn't provide extra security. It just validates than the newly registered user is the legitimate owner of that email address. For security concern a best practice for a web site would be not to send any email to an unconfirmed email address. This prevent leaking information to someone who mistyped his email address. Anyhow you ...


3

Eran Hammer, one of the maintainers of the yar session management module for NodeJS, had this to say on the matter: Disclaimer: like any security advice from someone who doesn't know the specifics of your own system, this is for educational purposes only. Security is a complex and very specific area and if you are concerned about the security of ...


3

To turn your attack scenario through 90 degrees; consider the attacker who, instead of using a list of passwords against a single user, instead uses a single password against a list of users. Imagine I (as the attacker) don't care which account I get access to, I simply want access to any account (say, a bank account). Instead of trying to brute force a ...


3

Drawbacks I see from this approach are: More complicated to implement, especially over a scalable platform, cross thread. May not be effective across load balanced servers. Users may need to be patient. For the above reasons it is not widely implemented.


3

Using the MAC address as a condition for session termination in general Generally a changed MAC address might be used as a weak condition to terminate sessions, but be aware they can be arbitrarily faked for most network cards (so you just need to find one which makes this possible) they will also change when a user is on the same device, but switches ...


2

If you're contracting with a company to pen test and audit your app, you will be wise to scope out exactly what is in the limits of said test, what will be tested and how (it appears you are giving them source to be able to white-box test as well). They will likely work with you to establish the legal agreements that indemnifies them. It should also spell ...


2

What should I do to mitigate the damage? Usually, it is the user's browser that is compromised by XSS vulnerabilities on web sites. You probably won't see any damage done to your site, especially since it was reflected XSS. The attacker would need to target each user separately and convince them to click a malicous link in an email or visit a malicious ...


2

I'm not sure why it'd be any more difficult to implement than locking the account, or why load balance rs would have any effect. Both approaches require centralized co-ordination about what to do (lock vs delay). I think the main reason is that it's strange behavior, and makes your website look like it's broken (I don't think this is simply patience). ...


1

That should never happen. User is requesting your site via https://example.com. The user's browser will expect the server to provide a cert with hostname of example.com. Hacker can not MITM that as hacker will not have the example.com private key to sign a message and authenticate as example.com. User's browser will report an severe warning. If hacker ...


1

Email verification stops spam and validates that user have this email. Before you send user an email message (or some confidental message like bank), you know that you are sending this message to this user, who has not mistaken in writing the adress, and nobody else.


1

If all you need to do is paste that link into the browser and you're redirected to http://security.stackexchange.com then yes it is a vulnerability. The seriousness of the vulnerability depends on the expectations of the site and how much a user trusts it. If I can send some person a link to your site that contains a redirect to my malicious site, and they ...


1

As @whoami mentioned, it does just move the issue to another place. As you mentioned it allows you to move it out of code (if you've hardcoded it), password protect it (if it was originally just a PEM or whatever on disk), and ACL it to the requisite permissions. The problem is that you do need to know the key to unlock it, and that of course requires ...


1

This is sort of how JA-SIG CAS (enterprise SSO) works. To apply that architecture to your instance, setup the following on WebsiteB: Have WebsiteB generate a unique token in the link such as in the query string and make sure it uses SSL. Store the token information in a database (or similar method). Be sure to include a timestamp for when it was issued ...


1

Put a challenge-response-system in the code - the server sends "12345", the client answers with "SHA256(12345+any-secret-key)". If the server knows the "secret key", it can check the hash. That would stop people just sniffing the network data, but the app might still get decompiled. If you want the app to send data, you need to make a "login" first - ...


1

For a typical email activation it should be okay, however for a password reset or an email confirmation which logs you in afterwards you usually want to ensure tokens are single use. That ensures that a man-in-the-middle logging requests (ie. a corporate network administrator) can't follow the same link and log in after the legitimate user. Your expiry ...


1

The answer is "no" it can't be done, at least not with a directory traversal attack by itself. There are several issues here. 1) Directory traversal attacks should be blocked by the Web server to begin with. Of course, since you set up a lab environment, you have control and may have defeated the protection against it. 2) Directory traversal attacks like ...


1

That's the old dilemma Security vs Usability, and only you can answer this question. Having the admin panel on your PC only is surely safer, but having it on the server means that you can access it even when you're not at home. And that other people can, too; unless you whitelist the access IPs, which however will also prevent you from accessing it from ...


1

I think you're interested in being a PayFac: Provide payment transaction routing Settle to sub-merchants And use tokenization to avoid holding card details. I think PayFac is a Vantiv-specific term, so you may want to look at the bullet items on that page and try to match them to the processor you're using, to determine if they have an equivalent.


1

I came across this thread while resolving to issue myself. The resolution I had is that cookie paths are case sensitive. Here is the related question. http://stackoverflow.com/questions/399982/why-are-cookie-paths-case-sensitive My resolution was to redirect from the landing page to the correct path. Be sure to look out for possible redirect loops. ...


1

Is hotlinking to external file (like described above) dangerous or can it be a potential risk to your website or website visitors? If any of your users are unpatched and you are including content from an externally linked domain, it would be possible for the external domain to switch the content to a malicious image, Flash file or Word document. ...



Only top voted, non community-wiki answers of a minimum length are eligible