meta user
network profile
| bio | website | |
|---|---|---|
| location | Redmond, WA | |
| age | ||
| visits | member for | 1 year, 10 months |
| seen | yesterday | |
| stats | profile views | 9 |
|
Mar 2 |
awarded | Citizen Patrol |
|
Feb 20 |
comment |
Strategies to store/remember very long password? Note that, in your example of using text from the Bible, you're going to have problems if you're not using the same translation/source document. |
|
Feb 13 |
comment |
Preventing online voter fraud Related/potential duplicate(?) is this question. Although I'm somewhat biased, having the answer with the most votes. |
|
Jan 30 |
comment |
SQLi-protection ORDER BY +1 for the whitelisted columns, which is probably the only real option. Although, I'd probably anticipate the provided variable being an 'alias' (as a key to a hashmap with the real column name), as otherwise you're exposing implementation details to the outside world. There's a variety of ways to get the list, but that's somewhat unimportant. Perhaps the best reason to use a whitelist - generally speaking, for performance reasons, you'd want to limit ORDER BY clauses to using columns backed by an index. |
|
Jan 3 |
comment |
How is Chase Mobile Deposit Secure? In regards to point #1, it's possible to sign over a check written to you to someone else. If I do that, the equivalent operation is that I deposited the check, then write you a new check for the same amount - we're just making this a little simpler for us (but not the bank). This may be how some check-cashing (payday loan) operations work. In that case, it's none of the original writer's business what I'm doing with the money. |
|
Jan 2 |
comment |
What does a HTML filter need to do, to protect against SVG attacks? @D.W. - I'm not sure if it applies to SVG (or to what extent), but it's possible to send images (server -> browser, at least) as a solely binary representation (ie no file name/location, although I think you still had to indicate the type). This might take more work, but potentially you could create some sort of 'grammar' (like the tags used here or in phpBB forums). What are the bounds here? |
|
Jan 2 |
comment |
GPU powered Password cracking machine - buy metal or cloud? @F.Hauri - Looks like Amazon has had them for a while. Certainly there's no screen 'directly' attached, but as they point out in the article, there's multiple possible uses for that kind of computing architecture. It's already been used for password cracking |
|
Dec 26 |
comment |
How can a novice find proof of a system compromise? ... If he's not already running an AV or malware scanner, attempting to add/install one would potentially compromise evidence. Besides the potentiality that a good virus may be able to root the AV (or its installer), at which point a check could return nothing. |
|
Nov 29 |
comment |
How serious is a local virus in terms of network security @Tom - Depending on how your AV is setup, it'll popup notifications for even (failed) drive-by-downloading attempts, which never make it past the firewall, let alone being able to install. You'd wipe the machine for something like that? |
|
Nov 27 |
comment |
How serious is a local virus in terms of network security Fine, twist my arm will you... |
|
Nov 27 |
answered | How serious is a local virus in terms of network security |
|
Nov 27 |
comment |
How serious is a local virus in terms of network security There's two possible states I can think of: 1) The AV caught it on 'entry', stopped it, removed it, and logged it, at which point there's nothing else for anybody to really do; and 2) The AV just now noticed something that's been present for a while, so you're already 'compromised'; potentially, any data would have been already exfiltrated, and there's nothing to do but check the logs... |
|
Nov 23 |
comment |
HQL injection example Sorry, without a salt (and even apparently with), MD5 is considered a broken hash. Just have a look around (for example, this question) |
|
Nov 21 |
comment |
Should I give developers admin rights or leave as power users? What languages are you working with? Don't some debuggers (say, for C/C++) require elevated privileges? |
|
Nov 21 |
comment |
HQL injection example Are you sure the passwords are hashed? The naming of stuff up there makes it seem otherwise... And at minimum, you don't appear to be using salts. |
|
Nov 13 |
comment |
consequences of grey hat hacking Please note that, given the TOS of most websites (and some government laws), hacking even your own account is (potentially) illegal, even if it results in no gain (material or otherwise) for you. And they only have your word that you only hacked your dummy accounts, too... |
|
Nov 9 |
comment |
Why are triggers not often used to secure a database? Especially since, with anything short of parameterized query, if you miss something in either validation list (black/white), triggers might not save you anyways; they generally only get the results of the operation against a table, which wouldn't help if the DB allows multiple statements per connection. Oh, and some systems don't automatically turn them back on after a restore, either, so they might not even be on... |
|
Nov 9 |
comment |
Does a 'reset password' website facility give away too much information? Unfortunately, if you don't permit duplicate email addresses, your signup screen could be used to do verify them. |
|
Nov 9 |
comment |
Will antivirus detect all keyloggers? ... And the unfortunate part is, there are legitimate 'keyloggers' that get installed - custom macro-ing programs, hardware vendor software, etc. So you can't just yell about them. It's easiest to find/trap/kill them during installation attempts (via UAC) or data exfiltration (via a firewall). |
|
Nov 9 |
comment |
Login form authentication logic Also, you're probably not allowing duplicate emails between accounts, right? So this sort of thing would have to be coordinated with the signup screen anyways, meaning hackers can use that to check if the email is signed up. Wouldn't help them find the password, though (hopefully). |
