Reputation
297
Top tag
Next privilege 300 Rep.
Create new tags
Badges
2 8
Newest
 Yearling
Impact
~3k people reached

  • 0 posts edited
  • 0 helpful flags
  • 6 votes cast
Feb
12
comment Fake users in database for compromise detection
Thank you for this, it is more inline with what I was considering. Option 1 is my use case, it's not financial but does have business intelligence issues that could be leveraged in bad ways. When I read about Linode, they had found a known hash of theirs on a darknet forum (being sold I think) and this is how they knew they had been compromised, so fake users seems to provide double chance of discovering compromises after the fact.
Feb
11
awarded  Yearling
Feb
11
awarded  Good Question
Jan
18
comment Fake users in database for compromise detection
Clarified question - I did mean an end user, not the db user. Regarding privilege escalation, I don't think that is a worry (in the website user context). If it is, then I've got bigger issues :)
Jan
18
comment Fake users in database for compromise detection
Clarified question - I did mean a end user, not the db user. I don't think this would add any issues - any user can create an account on my site and in theory, my fake user would be identical so not to look fake.
Jan
18
revised Fake users in database for compromise detection
Clarification to 'users' and 'database'. Looks like some think I mean the db user itself. I meant the website end user.
Jan
18
awarded  Popular Question
Jan
18
awarded  Nice Question
Jan
18
awarded  Curious
Jan
17
asked Fake users in database for compromise detection
Oct
20
comment Using HMAC when sending data through an untrusted server
Let us continue this discussion in chat‌​.
Oct
20
comment Using HMAC when sending data through an untrusted server
I see, I don't think that would be suitable for the pop up then as the user isn't going to use the same machine, browser etc each time and I can't see that the user would move it from place to place. However, that sounds like it would be great for a Android/ios app. Thank you.
Oct
19
awarded  Commentator
Oct
19
comment Using HMAC when sending data through an untrusted server
@atk I am happy to use digital signatures if that is an option, but doesn't it need a certificate? Wouldn't it make it more complicated than using a PIN? I didn't 'choose' hmac, it was the only way I know.
Oct
19
revised Using HMAC when sending data through an untrusted server
It was not clear that FE didn't do the initial hashing. FE never sees the PIN unhashed.
Oct
19
comment Using HMAC when sending data through an untrusted server
Edited question to show preferable to see data and not have it encrypted.
Oct
19
accepted Is it any more secure to use a HTML form instead of a javascript popup?
Oct
19
revised Using HMAC when sending data through an untrusted server
added 88 characters in body
Oct
19
comment Using HMAC when sending data through an untrusted server
@atk Would you mind elaborating? AFAIK, digital signatures requires a certificate and that's not an option. Isn't the process pretty similar, but encrypts the data too? If so, that isn't an option as I would still like the FE to do some basic validation of the data before passing through.
Oct
19
asked Using HMAC when sending data through an untrusted server