36,203 reputation
1485155
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 7 months
seen 17 hours ago

Security expert and experienced Windows programmer


1d
comment What are the drawbacks of login request throttling?
Personally, I am very anti-CAPTCHA in almost all scenarios it is commonly used (and in general, for that matter). That said - if this is a threat that you need to mitigate, I would suggest implementing a conditional CAPTCHA - e.g. after the 2nd time it gets locked. That said, at some point other mitigations are called for, e.g. blocking (or graylisting) the IP, etc.
1d
comment What are the drawbacks of login request throttling?
@paj28 "short" is very context-dependent. While there is a valid threat of repeated locking, such that even 5 minute timeout would cause an account DoS - I at least have not seen that. It would likely be either very targeted (eg a personal attack, which is easier to handle), or a hit-and-run style to blanket all the thousands of users, once. Persistent account lockout for many users (i.e. repeatedly locking each account every 5 minutes) seems that would require quite a bit of resources.
2d
comment What are the drawbacks of login request throttling?
@paj28 it varies. Basic technical solution is short lockouts, as the OP mentioned. Others have put in CAPTCHAs (which, while I am not a fan, can help raise the bar a bit). Oh yeah, and then there is always that one that decides to abolish lockouts altogether :-S
Jun
28
comment What are the drawbacks of login request throttling?
@paj28 that is not correct, I have seen this at non-megascale sites also - banking apps, auction and sale sites, even corporate systems...
Jun
27
reviewed Approve How to use Kalibrate and rtl-sdr to detect my GSM modem?
Jun
27
revised Can anyone give me sample php code that is vulnerable to SQL injection
edited tags
Jun
23
comment How critical is it to keep your password length secret?
The total amount of entropy provided the by password length is not too difficult to calculate, or rather the MAXIMUM entropy... let's assume passwords can be any length between 1 character and 32, then it is 5 bits of entropy at most, with of course a heavy bunching down near the bottom by the minimum required length. Of course, some banks will restrict you to 12 characters (minimum 6), so that's only 2.5 bits AT MOST. All that is of course assuming that the length is secret, which its not...
Jun
23
comment Why do so many banks have relatively weak e-banking security?
@NateKerkhofs Shame on you! SwiftOnSecurity definitely IS the real Taylor Swift, she said so herself! ;-)
Jun
22
awarded  Good Answer
Jun
22
revised Why is it insecure to store the session ID in a cookie directly?
Removed harsh Dave-ness
Jun
22
comment Dom based Xss Query - location.hash
@m1ke or even a simple "document.write()", or any element.append, or or or...
Jun
21
awarded  Nice Answer
Jun
21
comment Why is it insecure to store the session ID in a cookie directly?
@gabeio 1) While I appreciate the offer, its big task to cover all relevant dependencies and such. So thanks, but I'm not going to review all the relevant code. 2) Usually it is not the crypto library that is broken, but how it is used. 3) HMAC is not what is typically known as "signing", so if the devs are confusing between known terminology it just enforces what I suggested, the chance of getting something wrong in the implementation. 4) all that aside, it doesn't matter, since what I said still stands: crypto is delicate, don't throw it around contextless, if you do you may break something.
Jun
21
comment Why is it insecure to store the session ID in a cookie directly?
On the other hand, the downside of just throwing on some cryptodust all willy nilly without considering the context and threats, is that these things are delicate. If you throw on broken crypto, on top of an already strong sessionid, you might weaken it needlessly. (I'm not saying that library's crypto IS broken - but I am saying it is a non-negligible probability that it might be).
Jun
21
comment Why is it insecure to store the session ID in a cookie directly?
Again, if the session id is properly constructed - long, random, etc - then guessing the session id is irrelevant, and tamper detection does not add any significant protection from that threat. I still don't understand why you are worried about tampering as a threat - if the attacker tampers with his sessionid, then it would no longer be valid... which is exactly what we want.
Jun
21
comment Why is it insecure to store the session ID in a cookie directly?
@gabeio My point is that there is typically no need for this, however if you have a specific threat you are worried about then that is what should be mitigated specifically.
Jun
21
comment Why is it insecure to store the session ID in a cookie directly?
@gabeio What is the threat you are trying to mitigate here? An attacker trying to guess valid sessionids? If so, then tampering is irrelevant, as long as you don't accept invalid ids (though you might want to look at some rate limiting). Or are you worried about something more esoteric, like SQL injection based on the sessionid? Well then you should prevent SQLi by using all the proper mitigations, and anyway the sessionid should just be a lookup to retrieve the session data (usually in memory, though this could be in some persistent state db).
Jun
21
comment Is it a good idea to use the user's username as a salt when hashing a password like hash(username_str + password_str)?
See also this ancient answer on SO - stackoverflow.com/a/536756/10080 (it predates security.se...)
Jun
21
answered Why is it insecure to store the session ID in a cookie directly?
Jun
21
comment Why is it insecure to store the session ID in a cookie directly?
Hi, welcome to Information Security. I'm not sure what makes you think that it is at all insecure to store the user's sessionid in his cookie (as long as you do it right). From what I can tell, you found that some random js library does something unintuitive. That doesn't mean it is insecure, or that that is the reason for it. You shouldn't be surprised if this is a halfbaked idea...