Tag Info

Hot answers tagged

24

Last year, I made a bet with a friend that I can get a browser-trusted certificate with his domain name in order to launch a successful MiTM attack on his login form to steal his password. Long story short: I lost the bet; I wasn't able to convince any of the 16 CAs I contacted that I'm the legitimate owner of the domain. Even though I had an email account ...


20

Having worked with RESTful Web Services doing code-review and code-assisted app penentration-tests on RESTful apps that were over 3 MLOC, I can tell you that the problems outlined by John Wilander in REST and Stateless Session IDs is the dominant, growing problem. If you do not have this problem (which is a very big problem) in your RESTful Web Services, I ...


13

I don't understand how these database tables are accessed. Surely it is not SQL Injection, as that should be a thing of the past with prepared statements, Ahhh assumptions.. Have you seen the OWASP Top Ten project? SQL injections have always been a constant source of security issues. I cannot see how changing any session state would effect the ...


10

Answer to the original question: No, it's not a security risk for your employees to use Disqus etc. -- at least, no more than any other form of communication. Of course, if employees post sensitive corporate information on these systems, then that may harm the corporation's interests. But you could say the same of any other means of communication. ...


9

First of all, except flash you have to disable all other browser plugins, the most obvious one is Java. Java has been a target in browser exploitation as much as flash has been. the website cannot use my email and send spam mails to my contacts If you open it in incognito mode a malicious website can't steal your cookies or other data because those data ...


9

From what I can tell from that article it was an error with the Facebook "Connect" API. This is the button on a site that says "Log in with Facebook". It is just a link the site owner puts on the page. When the user clicks it, you are redirected to Facebook's server. The site owners have no control over what happens after this. It doesn't "bypass ...


9

A SIM card is a smart card. It follows all the relevant standards for smart cards, it is produced by smart card vendors. A smart card is "just" a tamper-resistant computer. It has its own CPU, RAM, ROM, storage area (often EEPROM). Power and clock are provided from the outside. The device is supposed to be resistant to physical extraction of the internally ...


8

I dont see any flaws, but I do think you're overdoing it. It seems to me - I might be missing something - that you use a token because you think you should, not because there is a legitimate reason. The best approach would be to first identify your (security) requirements and then look for the solutions. One of the things you should think about with ...


8

If you're talking about SSL, the answer is why not? If I had the choice, I'd prefer that every site on the internet provided HTTPS. Is it strictly necessary? Of course not. Does it stop anyone from snooping on my content? Yes. Does it reduce the chances of an attacker injecting content into a page via man-in-the-middle? Yes. Are either of these scenarios ...


8

You need to define with high precision what it is that you exactly want. Here, you want to allow accesses from you, personally. The business with the secret key means that access will be granted to whoever/whatever knows the secret key. Embedding the key in the application means that the application knows the key, not you; and, as you note, secrets embedded ...


7

How concerned are you about an insider threat and how savvy would you expect insiders to be? That's your biggest factor. Almost any security mechanism you put on the machine's hard drive can be cracked if the attacker gets a hold of or too much access to the hard drive. How long that will take will be a factor of how well you've secured the drive. I can ...


7

Am I essentially giving scorecardresearch.com access to my users and user's cookies for my domain, since the script tag is on my page? Yes. Any script included in your page either directly or indirectly (via disqus) has full access to interfere with the user's experience for everything on the hostname it is included on. Stealing client-side ...


7

You are not communicating directly with MySQL, you're communicating with REST server (presumably over HTTPS), and therefore need an SSL certificate, not for MySQL, but for your REST API. If the REST service is your own, then you need to make it SSL-enabled by installing a certificate on the web server that runs it. If it's run by someone else, then they ...


6

I think you should just stick with https. If major parts are generated in client-side javascript (e.g., the sha1 of the token), how difficult would it be for a MITM attack, where an attacker leads people to a faked version of your site, where the javascript is altered to reveal the secret key to the server? (E.g., alter the DNS and spoof the site on a ...


6

OWASP (The Open Web Application Security Project) provides a lot of resources for developers and pen-testers. OWASP is an open community dedicated to enabling organizations to conceive, develop, acquire, operate, and maintain applications that can be trusted. All of the OWASP tools, documents, forums, and chapters are free and open to anyone interested ...


6

I work at Disqus and I feel the answers above are misinformed about how our application works. Basically, our application is loaded almost entirely inside an iframe. This dramatically changes how your site is exposed to both our code and 3rd-party code. Am I essentially giving scorecardresearch.com access to my users and user's cookies for my domain, ...


6

Given that RSS feeds are simply summarised web pages then the requirement to encrypt the data would be driven by the general need to encrypt the original information hosted on the website. However, you've got to be careful when using technology to drive a solution. Is RSS the right technology to deliver secured content to a user? Are there alternative ...


6

The class of malware which prevents itself or other programs from being seen is called rootkits. They work by replacing key system calls that are used to detect what is going on in the system. For example, when you go to Task Manager, Task Manager asks Windows for a list of programs running on the system, but suppose that another bad program was able to ...


6

You are basically right. In an authentication scheme where there is only one message, from client to server, whatever the client shows "grants access" and, as such, is password-equivalent and can be replayed. If sending the hash of the password works, then the hashed password is password-equivalent. Indeed, what your colleague suggests does not add security; ...


5

Chrome has not yet been formally verified (nor has any program or OS that I'm aware of), so there are no guarantees. That being said, unless you make yourself a target by someone equipped with a very powerful, underground, unbeknownst-to-all, weaponized, 0-day exploit -- you can probably give yourself a virtual high-five for being the most secure Win7 ...


5

This should be secure against man-in-the-middle attacks if your machine checks that it has received a valid certificate for Paypal from its correspondent. Be warned that some SSL libraries leave it up to you to implement/request this check, so you will need to carefully confirm that your code is performing that check. (Since your machine is initiating the ...


5

Recommended approach. I recommend that you use SSL and authenticate the client using their password. Then you won't need any fancy MAC, hash, PBKDF2, etc. Details. You asked how to authenticate the user. Here is a simple approach. Use SSL sitewide. When the user logs in (entering their password in via a web client), then set a session cookie that ...


5

So I hope I have this correct. You want a secure way of confirming the identity of a client using a valid API key? I think that securely storing the API key is largely responsible on the company that developed the application and not your company. You will need to encrypt and obfuscate the key to protect it from the casual hacker but I don't think you will ...


5

Since you are usually loading CSS, JavaScript and graphics from a CDN anyone with root-like permissions on the CDN servers (i.e. the company running the CDN) can: replace your images with other ones, such as porn or other things you don't want your users to see on your website replace your CSS to load said images, mess up the design, etc. - for IE and ...


5

No. The API keys need to be stored in cleartext. They are not passwords: they are cryptographic keys. These keys are used for things like authenticating requests (using SHA1-HMAC). The server needs to know the crypto key to apply the cryptographic algorithms. Therefore, the API key needs to be stored in cleartext on the server. If the server stored ...


5

Hashing is not storage; it irreversibly destroys data. We can get away with calling password hashing as "password storage" because when we actually need the password, we have a handy human operator to type it in. Indeed, when we hash the password we do not store the password, but only a token sufficient to verify the typed-in password. An API key must be ...


5

The best practice is: The basic idea. Create an API key (a 128-bit symmetric key) for each separate user account. This key needs to be securely stored on the server, and also securely stored on the user's client. For each request made by the client, add an extra request parameter that has a "signature" on the entire request. The "signature" should be ...


5

Actually, the whole WCF/SOAP security stack in .NET is based around these sets of standards for encryption and signing (if you are referring to what Thomas linked to). Message security with encryption uses it to encrypt the message. I have no hard evidence of it, but I believe its fairly well used in WCF-centric shops. We use it for our stuff. It's all ...


5

According to Jager's and Somorovsky's paper "How to Break XML Encryption" (PDF), The W3C XML Encryption specification today marks the de-facto standard for data encryption in complex distributed applications. The use of XML as core data syntax, e.g. for major business, e-commerce, financial, healthcare, governmental and military applications, has ...


5

Right there in that same Wikipedia article is the answer you're looking for: Note that the ability to construct an arbitrary Python object may be dangerous if you receive a YAML document from an untrusted source such as the Internet. The function yaml.safe_load limits this ability to simple Python objects like integers or lists. (emphasis added) The ...



Only top voted, non community-wiki answers of a minimum length are eligible