441 reputation
28
bio website software-talk.org
location
age
visits member for 2 years, 4 months
seen 1 hour ago

18h
comment Websites Forcing Weak Password Standards (Updated)
@D.W. To be fair, I think that most of those questions actually ask something quite different (they are about 'good' requirements or special corner cases (the q/z question)). only the first one covers parts of this question (restricted password length). But I did a search now myself and was also able to find this question dealing with special characters.
19h
awarded  Mortarboard
20h
revised Websites Forcing Weak Password Standards (Updated)
added 94 characters in body
20h
awarded  Commentator
20h
comment How does an attacker authenticate to a service using just the hash of the user (after performing a pth attack)
@NirPes it's creatively called pass the hash attack. You can google it, and also see this question and its answer.
20h
revised Websites Forcing Weak Password Standards (Updated)
added 941 characters in body
20h
awarded  Yearling
20h
revised Websites Forcing Weak Password Standards (Updated)
deleted 9 characters in body
21h
answered Websites Forcing Weak Password Standards (Updated)
1d
revised Does it take longer to brute force a password starting with z than one starting with a?
added 183 characters in body
1d
revised Spying cellphones
added 224 characters in body
1d
answered Spying cellphones
1d
comment So how much anonymity is effective?
it depends on the target. if you attack the nsa, you need more anonymity than if you attack the local dentists website. How much exactly? You need just enough anonymity so that nobody can associate an attack with your real life identity and come knocking at your door. Also: some hackers do end up being caught; I would bet that a lot more are not.
1d
answered A folder lock/encryption program that can do this?
1d
comment Security risk stemming from data passed in $_GET superglobal
as I understood this question, it was asked if exposing ids is a security risk (and if using hidden post parameters hides the ids, which it does not). So while this answer is definitely true and important, I don't think that it really answers the question.
1d
answered Does it take longer to brute force a password starting with z than one starting with a?
1d
comment Does clicking lead to DoS attack?
Actually, DoS can very well be about sending prepared data to the server. What you are thinking about is DDoS. It would be very hard for one person alone to DoS a page without sending prepared data which exploits a weakness of the site.
1d
comment Scan interpreted code for long lines to detect code injection?
not a bad idea. You could also check for the density of the code. Obfuscated code seems to have way fewer spaces. You could also go more in-depth and check if the characters in the code are distributed in a natural way (compared to for example the rest of the codebase; but this seems like a lot more work than checking for line-length and amount of spaces). Of course, if these kinds of checks are used by a lot of people, the attackers are going to react and change their code. And to your question: I would guess that hosters that care already perform these checks.
1d
comment Is this Facebook email real or phishing?
except for the two points you mentioned, I cannot find anything wrong with it (but I'm not a phishing expert; facebookmail.com definitely seems legit, and all the received fields seem to check out). When you log in to facebook, do you have $2.30 in your account? And you can always contact facebook (phish@fb.com), maybe they'll even reply
1d
comment Is this Facebook email real or phishing?
can you post the source code of the email?