00:00 - 20:0020:00 - 00:00
7
My jimmies were somewhat rustled when I didn't get prompted for my current password when modifying it.
NOTE: Not asking for a current password allows an attacker who somehow hijacked the current session to hijack the account, in direct violation of OWASP Guideline AT-011
I decided to change my password via the my logins link, and was presented with this dialog:
Notice the lack of confirmation ...
At the end of 2014, there were reports and talks about the cracking capabilities of the NSA and other Five Eyes agencies. The analyzed data revealed that, e.g. VPNs and HTTPS connections were decrypted routinely, while OTR and PGP apparently were resistant to any attacks.
The documents were som...
Let’s talk about encryption. Specifically, HTTPS encryption. If you’ve been following any of the U.S. election debates, encryption is a topic that the politicians want to talk about – but not in the way that most of us would like. And it’s not just exclusive to the U.S. – the U.K. is proposing banning encrypted services, Australia is similar. If you’re really into it, you can get information about most countries cryptography laws.
But one thing is very clear – if your traffic is not encrypted, it’s almost certainly being watched and monitored by someone in a government somewhe …
00:00 - 20:0020:00 - 00:00
