75

Country-based blocking is usually put in place as a result of some organisational policy whose intention is indeed to "block hackers". This sort of things fail on three points: Such a policy assumes that malicious people can be categorized by nationality. This is old-style, World-War-I type of thinking. Geographical position is immaterial for computers; a ...


26

In my case, our expected customers come from predictable countries, and so to limit the "threat surface", other countries are blocked. This has limited value as any determined person can do what you did and simply re-route their traffic. The side benefit, though, is that the countries we permit are those with stringent cyber-laws and we can get law ...


24

There's always an "Abuse" email address on the whois of a netblock for reporting misuse of an IP address. You can use http://whois.domaintools.com/ to do a whois lookup to get the address. Is it worth your time? That's your call. Will it lead to anything? Nothing you'll ever see. But many of the sites I fix come from people who were first alerted of the ...


7

Professor Koops's excellent summary says that ssh and VPN are legal to use and bring into the country, but that you are required to provide your passwords and encryption keys to the authorities if they ask for them. However, as a general rule, you should trust neither my nor the Professors advice and instead consult a lawyer, in India, who specializes in ...


7

That's why the character class [[:alnum:]] exists; it includes the characters which are considered valid alphanumerics in the currently active locale. Of course, that doesn't work well on a web server in the US when someone in Egypt is attempting to provide input through a form - and it doesn't work with punctuation. But it also doesn't include spaces, and ...


7

As you can probably tell, I'm not a security researcher, I just develop web apps for a small startup. That's your answer right there. Don't be a Dave an invent your own cryptography scheme. Just stick to known protocols that have been studied extensively. It appears that you are already doing just that. Let's say that the NSA really has backdoors into ...


6

First, China has lots of people. It has more than 4 times as many inhabitants than USA. Then lots of them are young and well educated and smart enough to do hacking. And while I'm sure that China has tough laws against hacking of chinese infrastructure, it might even profit from hacking outside infrastructure. This way of thinking is not specifically chinese,...


6

Most drive-by password cracking attempts are going to assume that the password is a subset of ASCII characters. However, targeted attacks (under the Advanced Persistent Threat model) are likely to discover that your users aren't using ASCII passwords and change tact. As such, I suggest the following rules: Identify which languages are likely to be in use, ...


5

All joking aside, xkcd's Password Strength comic may have particular relevance here since it's language-independent: верный лошадь батарейка штапель (example below in Russian) is full of entropy.


5

Assuming you're asking this in the context of Web Development... You can detect appropriate character sets with simple regex validation. However, you may also be falling victim to security theater: input sanitation is not the answer. If you are trying to validate for specific locales, and you don't want to accept any other locales, you can choose specific ...


5

According to the Export Import laws, any device that has a minimum level of encryption is considered as falling under munitions type laws. Let's assume you're talking about the US, here, because obviously this is going to differ from nation to nation (see the Crypto Law survey map, for example). And even within a given area, Crypto is one area where ...


5

As ott mentioned & let me reinforce it: Use a VPN! Especially for email sign in and banking. It's best to use it for any login activities. A traveller named Nomadic Matt wrote a couple of good articles to help you pick out which is the best for you: Everything You Need To Know About VPNs for Travel (HINT: if you are traveling with a phone and a laptop, ...


4

Our answer is that for a truly international application, on general input such as people's names, you should accept everything and encode it at display time. Admittedly that (to some extent) passes the problem down to the guy writing the Encode algorithm. However, if you have an input that is a specific thing, such as a vehicle number plate, or a business ...


4

If you're just accepting files, opening FTP to help them comply with Iranian law is a good idea. If your friends are taking videos and images which are even unintentionally slightly political in nature, then they should keep a low profile. I can't fathom why they'd enter the country with computers and start sending encrypted videos outside the country if ...


4

A previous answer pointed at ICO’s website, where you can find out about the rules that apply in the United Kingdom (which are essentially the same as those in other EU countries, give or take, since the Data Protection Act is the UK implementation of the EU Directive). I just wanted to add, though, that as with many other similar things, the data ...


4

When talking about data protection laws the first thing to note is that they are laws so you should check with a lawyer if in doubt. However, with things such as the UK laws (which you seem to be asking more specifically about) the guidance the information commissioner has on their website is pretty straightforward and nicely enshrines a lot of the ...


4

That probably depends on the banking application and how the bank allows you to recover a lost PIN. I would normally say "you should enable PIN or fingerprint authentication", but in fact you might not be required to. PIN/fingerprint is breakfast for security-aware individuals. Let's analyse the few information you provided. That you are enabled to pay by ...


4

Only your company can know the answer to that question. However, I would suggest that there is still a firm answer here. Europe may be blacklisted If someone at your company wanted to track people connecting internationally, then they certainly can. However, that wouldn't be my concern. My concern would be that I would show up and find myself blocked ...


3

It's true, if a hacker would like to get access to your page, it will not help, he can simply use a vpn or proxy. But if you think about all the bots out there which attack every page they find to test exploits and/or passwords, you will be able to block a lot of them. This will also help you against ddos attacks, if you block every country except the one ...


3

implement HTPS in a secure way: SSL + PFS (perfect forward secrecy) seems the way to go atm; it is was hashing salting was to password-protection use a setup that doesnt fall into recent found attack-scenarios (BREACH, CRIME, BEAST); suggestion on cipher-suites depends on your user-base and used implementation run your site completely in HTTPS, use HSTS - ...


3

Sure, but it's got nothing to do with the chatting itself. If your computer is attached to the internet, it is possible to get hit with an attack. Malware is abundant, as are random drive-by attacks. If you want to protect yourself, all the usual stuff applies: Keep your OS patches up to date. Keep your browser and browser add-ons/plugins up to date. Keep ...


3

This site is a good survey of laws on cryptography around the world. For Iran, they state: According to the 2005 HRW report False Freedom, use of encryption for exchanging information requires a license. Users have to request permission by submitting crypto algorithm and keys and information about 'related parties' to the Supreme Council for Cultural ...


3

In theory, yes, it's munitions grade. However, the level for encryption to be considered "munitions grade" is 64 bits, which is considered insecure by modern standards. Furthermore, the restrictions are massively relaxed from the 90s - essentially just "if you use encryption in a product you sell overseas, tell the government", unless you're selling it ...


2

This is kind of tangential to the question, but that courthouse is in walking distance for me so I followed the PATCO case closely (and the defense lawyers are across the street from my office). The magistrate's logic is horrid... and unfortunately a judge accepted that recommendation, so that particular case was decided. However, (US legal theory) this is ...


2

Use of SSH and VPN is fully legal in India as long as the software uses less than 256 bit encryption. Users are liable to provide and comply to all requests by security agencies in this regard. There was a legal battle over encryption in Blackberry Tiger Messaging not being accesible to security agencies and after the incident Department of Telecommunication ...


2

I did find a Microsoft TechNet article, Passwords must meet complexity requirements, that seems to apply to their Windows Server based products. That adds another character group for "letters" that are neither upper nor lower case. Passwords must contain characters from three of the following five categories: Uppercase characters of European ...


2

I don't think it would -- at least not any regular person who isn't already under a watchful eye of law enforcement. China doesn't block encrypted communication, it just makes it inconvenient for people to use (e.g. you can use https when accessing non-Chinese sites while in China, it's just throttled to all heck, in the hopes to force you to use cleartext ...


2

No one knows at this very moment. (thanks @Terry) It is highly possible that it is not even defined. There are several options, depending on what the Brazil government wants to do: do they want to stop spying, or do they want to stop spying from NSA ? (In the latter case, this means that Brazil could want to maintain possibility of spying by themselves). ...


2

I'd think that you don't have to cover US privacy law if you don't have US customers or operate in the US. However, you will probably have to conform to the privacy laws of the country or countries you are residing and/or operating in. You'll basically have to figure out if your Japanese law allow your data to be stored outside your borders, and by a ...


2

You need to protect against 2 things: theft and trojans/malware. The model you specified is pretty safe from start. It is encrypted by default. You cannot access any data without the password/pin/pattern, if you have either set. If you unlock boot-loader, it will erase everything in the phone, including internal storage. So the anti-theft part is fine. ...


Only top voted, non community-wiki answers of a minimum length are eligible