The Stack Overflow podcast is back! Listen to an interview with our new CEO.

New answers tagged

8

This very high end GPU cracker performs 200GH/s: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 That's 200 billion hashes per second (2e11 hashes/s). With a search space of 1e19 possible numbers, that means it will take ~500,000 seconds (about 1.5 years) to exhaustively search parameter space. Of course on average you'll find a match in ...


1

Simple answers: Is this server under attack? No more than any other server on the internet. This is just the background noise of the internet. In short, any computer that is accessible to the internet will find itself being regularly scanned by various bot nets for many different reasons. All the more reason to keep your servers secure. How does UFW‌ ...


0

Web scrawling is the method which used by attackers to get links in web applications. Usually web scrawling is not giving too much false positives. In the other hand, with force browsing you can find bunch of "hidden" directories which you can't find from scrawling(like /admin/, /test/ and etc.). The methodology is doing web scrawling and then force browsing....


0

Leaving this, rather worrying, fact aside for the moment: it always comes with the same token for that particular account then an eight-character, alphanumeric, randomly generated reset token shouldn't be a vulnerability if properly handled by the server. A password reset token should essentially be a one-time-use object: you ask to reset the password, ...


4

Brute-forcing a single round of SHA1 is extremely fast. An individual high-end graphics card can compute billions of such hashes per second; by parallelizing it even further (using multiple cards, cloud services, or custom hardware) the rate can be driven to even greater orders of magnitude. While the nonce and timestamp prevent building a rainbow table, ...


3

Not a well-known attack I looked into this question myself in 2015. Nobody talked about this back then, and looking for it again recently, it's still not a well known risk. You are right: with a standard gigabit connection (which was already quite standard in 2015) you can work through the couple of terabytes needed in a matter of minutes. Or, on 100mbps, ...


1

Let's say you want to be extra careful and hash the token in case of a database leak (tokens should expire anyway, but maybe some are still valid shortly after a leak). You also don't want to have any useful information in the token since emails aren't difficult to intercept, in fact, you don't even want to have an incrementing reset token id because someone ...


0

At only 15000 requests per second, it would take on average over 200 billion years to randomly guess your token, which would indeed be long enough. However, your estimate of only 15000 is likely way on the low side. lg(36¹⁵) ≈ 77.5, so your token would only have 77.5 bits of entropy. Consensus today is that you really want 128 bits of entropy for security, ...


0

Depending on your server, you might be able to disable "directory indexing", which means a person can't list out the contents of the directory. Alternatively, you can place the private images outside the document root. Create the url with a token. For the image request, use the token to look up the real image location and provide the real image. If the ...


Top 50 recent answers are included