Hot answers tagged

44

I just read my bank's page on 3D security. It says: If the site supports payments to be made in additional security, you will see the logos of the respective card organization Verified by Visa or MasterCard SecureCode So apparently it's up to the site to require or not require my 3D password.


43

Security measures like "3D password", CVV, etc. do not exist to protect you the cardholder. Do not assume that someone who lacks them can't use your card number fraudulently. All they do is allow a merchant who chooses to use them as part of their card processing merchant agreement to obtain a lower transaction fee, on the basis that the feature reduce the ...


34

Amazon apparently believes that the overhead of TLS is high enough to justify not encrypting traffic when not performing sensitive actions (like placing orders, payment processing, account management, order history, login, etc.). While the server-side cost of TLS is nearly insignificant with today's hardware, it does still have a non-zero cost. Client-side ...


22

Credit card transactions have varying levels of authentication, ranging from simply submitting the card number, to card+cvc, various password systems, chip-and-pin, and so on. The important thing here is that it is the transaction, not the card, that has this. The type of authentication used influences things like who is liable for fraudulent transactions, ...


13

Amazon advisory links to the original XEN advisory on which one can read: Systems running only x86 PV guests are not vulnerable. So no problem for the PV instances. Regarding the HVM ones, Amazon explains that for performance reasons they managed to replace the HVM hardware drivers by the PV ones for storage and network operations (see PV on HVM). ...


8

Yes, they can theoretically access or monitor the data. No, this should not be a concern. Their incentives (organizationally and individually) to provide a stable, secure service are certainly greater than their incentives to steal your application's data, out of all of the millions of virtual machines and applications that they manage the infrastructure ...


7

I called Amazon and the representative verified that no such email had been sent by Amazon. This is may be a phishing attempt. The original email seems (according to other reports) to include link formatted "Amazon.com" text, which may be a link to a fake version of the site. I can't see this in mine, possibly due to a measure by Yahoo Mail to remove such ...


7

I think the question here should more be answered from a marketing than a security perspective. In general, I would say that Google probably uses a relatively simple API key for usability/accessibility, in order to make it easier for the mass of developers to implement their services (and earn money from that). Amazon probably has more concerns about the ...


6

Amazon does not even request the CVV. The only piece needed to bill a card is the card number. Processing the transaction without the CVV or the 3D will be considered riskier by the card processor (thus being more expensive, or even refusing to provide service to them) but Amazon is keen to do that in exchange of a more streamlined process to their visitors.


5

The Amazon Fire TV is pre-configured with your account: Pre-registered to your Amazon account so you can enjoy favourite titles and personalised recommendations They configure this with your details taken from the account you used to order the device.


5

If you look at the MySQL Internals Documentation, you can see that the protocol initialises SSL/TLS after the initial handshake packet, but before the authentication step:   The two paths shown from the first state are based on whether SSL/TLS is enabled or not. As such, if SSL/TLS is enabled, the authentication occurs after the secure channel is ...


5

1) Can I use my Public DNS address to get the SSL certificate? No; to quote this Amazon tutorial, If you plan to use your EC2 instance to host a public web site, you need to register a domain name for your web server or transfer an existing domain name to your Amazon EC2 host. The "Public DNS address" from Amazon (which looks something like ec2-1-2-3-4....


5

An AWS Account ID can be shared, when required. Like the documentation says, the main thing anyone can use your AWS Account Number for is to construct ARN's. For example, if I had an AWS Account which held an AWS Lambda function, and someone on another account, who I had explicitly granted permission to, wanted to manipulate it, they would use by account ...


5

As you noticed, Alexa could record all the time and send it only after you say the wake word. You could notice it by larger upload size. But at the same time Alexa could analyse the recordings and only send interesting parts like when you mention the word "bomb" which reduces the upload size so you would only notice it if you look at the traffic in a very ...


4

You've kind of answered it in your question: HTTPS provides encryption, which prevents tampering with the request in a lot of cases, but doesn't prove anything about the identity of the person making the request in the first place (unless client certificate authentication is used, which isn't particularly common). By getting the user to sign requests, they ...


3

I've just received a similar email and the email appears legit. I was searching for information on what list it would be to know what else might have been affected. It has the right headers in authentication: Received-SPF: pass (google.com: domain of 2016061614470736b293d09e3b4022b187117dcb50p0eu@bounces.amazon.co.uk designates 176.32.127.205 as permitted ...


3

AWS maintains the notion of "Roles" for EC2 instances. When launching a new instance you are able to assign the server a role. The role must be applied during the build and cannot be added to an already running server. In the Identity and Access Management (IAM) area you can define what a role has permission to do (e.g., launch additional compute units, stop ...


3

See comment #9 on that bug from Peter Bowen at Amazon: It also includes one additional root CA already in the Mozilla program which we wish to have enabled for EV certificate issuance. That suggests that the root was already included in NSS, but not enabled to issue EV certificates; this is a request to change that. Quote from comment #21: I am now ...


3

If you look at Google, they switched from HTTP to HTTPS in 2011, so it is certainly possible to serve big amounts of requests. Maybe the guys at Amazon are just slower, have more servers, more bureaucracy or decided the few people on old devices/browsers matter more. Also, making HTTPS the default is difficult right now, because current browsers start every ...


3

I'm going to say it's fake. If it's a real Amazon password reset demand, then you should be prompted to change your password at next login, not need to follow all those steps. You can also check: does your old password work? Does the temporary password work? If no/yes, then it's real. If yes/no, then it's fake.


3

You are correct to be concerned about the scenarios you presented: If a MITM attack occurs, it cannot be thwarted unless you use SSL. The IP filter will not help because the attack is already "in the middle" of the connection, so all traffic will pass through it in plain text. Once the user/pass is grabbed, the attacker can do whatever those credentials ...


3

You're correct, lsof on an AWS EC-2 does not really provide a good image of what can be accessed on your box from outside. As you already cite in the question, AWS provides you with an extra firewall at a higher level (you can edit that from the user console). Therefore your only concerns there are ntp and rpcbind against the local network. AWS modifies ...


3

The gnome-software process contacts 54.173.79.111 for update purposes, as suggested in this forum thread. There's nothing inherently dodgy about these IPs, they both belong to the AWS cloud. That said, you can't guarantee that the traffic is legitimate by looking at the IPs alone. That's because they only indicate that you're contacting some service hosted ...


3

https://support.mozilla.org's certificate is signed by the Amazon Certificate Authority, Amazon Trust Services. This is widely considered a trustworthy third party for signing certificates, and your browser is apparently configured to trust certificates signed by Amazon Trust Services without prompting you. There are many Certificate Authorities in the ...


3

If you have a device in your room which can record data and which from time to time sends data to some server on the internet there don't need to be any kind of relationship when the device records data and when it communicates with the internet. It is perfectly possible that the device records data and only transmits these data later, maybe even only when ...


2

Some starting points which are by no means an exhaustive list (I will edit the post as people comment; and credit them too): Firewall - only allow access to ports that explicitly require it (in your case probably only SSH and HTTP/S). I've linked to UFW because it's easy. Disable root login - furthermore consider limiting to a particular set of users - you ...


2

I noticed this same phenomenon with my Ubuntu 14.04 machine today (all kinds of connections to EC2 instances such as ec2-52-22-249-100.compute-1.amazonaws.com from Chrome), and on my machine at least, Ghostery and the DuckDuckGo search engine integrated with the omnibar both seemed to call out to EC2. You mention you don't have any extensions installed, what ...


2

I'd think that you don't have to cover US privacy law if you don't have US customers or operate in the US. However, you will probably have to conform to the privacy laws of the country or countries you are residing and/or operating in. You'll basically have to figure out if your Japanese law allow your data to be stored outside your borders, and by a ...


2

Here is what finally worked for me and I was having the same response when I tried logging in.Instead of logging into the default router GUI 192.168.1.1 or entering http://router.asus.com try using one of these addresses: http://www.asusnetwork.net/ or https://www.asusnetwork.net:8443 There are a couple other alternatives but I don't have a good enough ...


2

Your router is just glitchy. "router.asus.com" returns a 301 redirect to "ec2-54-202-251-7.us-west-2.compute.amazonaws.com/find/router.html" (at least for me; it may redirect to other Amazon datacenters for people in other locations), a website hosted on Amazon's cloud. The website itself appears to attempt to find your router's IP address by making ...


Only top voted, non community-wiki answers of a minimum length are eligible