The security risks associated with providing developers the ability to install their computers are numerous. Here's why I would object (speaking as a sys admin) 1) Potential violation of best security practices - One of the 8 rules of security is the rule of least privilege - only give employees...

A Little Background Penetration testing probably feels like the sexiest part of security, but it is also a very small part. It's also exceptionally broad. The term "penetration test" is often used as an umbrella to mean any one of the following: Vulnerability Assessment Security Assessment Sec...

I'm evaluating a credit card processor[1], and I noticed they are using MD5 as part of a salted hash algorithm to protect a secret key. Since I know MD5 is generally considered broken, this feels like a poor solution. Is that enough of a criteria to reject them as our processor? Is it possible to...

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital letter and sometimes a special character. I have found such password patterns are rather hard to foll...

When a site implements something, it is always to serve their interests; however, this sometimes coincides with serving the user's interests as well, e.g. as in "protecting the users against themselves", which is the case here. The point of the restrictions is to (try to) make the password harde...