here on stackexchange registeration is by facebook or G+ Authentication , its easy for users to get into but is it safer than having your authentication Forms and Registeration ...
Please explain , Thanks in Advance
@Adnan so nope=once or twice a week? :P for me the risks of fatty foods far outweigh a few moments of 'taste'. whereas nicotine is truly fabulous, its up there with caffeine for me, perhaps even higher.
@Adnan I don't really, , I'm fully aware of the implications, and always have been. But for some reason I still chose to smoke. I was just trying to point out that we all do things we know are bad for us.
@Xander Ouch sorry, I didn't realize. I hope you're not angry with me for being too pushy, I just thought you switched into editing mode and didn't have time to reply ;)
@TildalWave LOL! No, no worries. Was just on a tablet last night, and and was being lazy. DIdn't want to expend the effort to write the edit on a virtual keyboard.
If a malicious user starts attacking a website by guessing common username/password combinations like admin/admin, the attacker would know that the username is valid is it returns a message of "Password invalid" instead of "Username or password invalid".
If an attacker knows the username is vali...
David's answer is a good baseline of the general principles of server hardening. As David indicated, this is a huge question. The specific techniques you take could depend highly on your environment and how your server will be used. Warning, this can take a lot of work in a test environment to bu...
Despite what you may think, you actually were using HTTPS. This is perhaps an over-simplification, but here's more or less what happened:
When you accessed the website with http:// as the protocol in your Address Bar, you effectively told your computer "Make a request for this webpage, from thi...
@TildalWave yeah I thought that was a little odd, usually I wouldn't complain, but I just couldn't see why. ADS are (were?) quite widely used by rootkits.
@lynks True, plus no one mentioned it before which I find rather odd. It alluded me too LOL. BTW why is there a bounty on that question? What wasn't answered before it was set?
@lynks I would've given it sooner or later anyway, don't get wrong impressions ... I'm not your sockpuppet! :P :)))
The most sure fire way is to use the ‘locale’ command. It will print out all the various and sundry variables that dictate what character set to use. For instance, this is my output on RHEL5.3, set to only use UTF-8 by default.
LANG="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_CTYPE="en_US.UTF-8"...
@ScottPack No idea really, both proper answers (yours and from ss32) are both sitting at score of 0 while all the lame workarounds are upvoted. Those echo tests might not even indicate UTF-8 is supported, but rather some other character set that would result in the same output. Funny.
@RoryAlsop @JeffFerland @AviD One of you guys mind finishing this off? It's too localized, and really I have a hard time taking anything from someone who calls themselves "Hot Licks" as anything other than spam - whether this case is irony or parody, I'm not sure.
I realize this is a bit off-topic, but don't know where else to go to ask...
I've gotten an enormous amount of spam in the past 24 hours (hundreds), even after some relatively good spam filters. Virtually all of this stuff is hokey weight loss schemes, claimed to be forwarded from Beyonce, Pame...
@ScottPack I've had that happen too. And I've seen connections endorsed for skills I know they don't have either. Endorsements seem pretty useless to me, so far.
@Xander It's a not terrible idea, but yeah. Any time you have that kind of setup you have to expect oddities to crop up.
@Xander I know of a guy who put down a skill that I know he doesn't have, and he keeps endorsing people for skills that I also know they don't have. More than anything else it keeps coming down to him being clueless, as opposed to anything sneaky.
@ScottPack Yeah, I like the concept of external validation. Just seems like it needs some refinement to prevent everybody from endorsing everybody else for anything under the sun.
@ScottPack Oh I have Icons endorsed (I didn't put it in the list) by someone I helped make his icons look cuter by running them through some script of mine. Just make sure you're not too helpful, someone might endorse you for firewood chopping :)))
@Xander Yeah. In my case it was Active Directory. I suppose I probably know more about it than the guy who endorsed me, but I wouldn't exactly put it as a skill on my resume.
@ScottPack Know what's a shame? There's really no significant incentive, nor intuitive facilitator, for you to go back and review your down-votes for possible reversal.
3
Though I consider it worse that you can't revoke a close vote after an edit.
@ScottPack For me it was SharePoint. Which I've installed once. With the help of the Administrators Guide. So, I deleted that one right back off the list.
@Iszi Probably deserves to be closed, yup. I've been trying to give a meaningful answer but it just comes out as some generic setup your filters properly post, whatever I do with it.
@lynks You can. That's how Active Directory and Python ended up on my list. I submitted a 5 line patch to an internal python script. That's my experience. :)
@ScottPack Technically, the LC_CTYPE locale (that's the one relevant here) will not tell you whether your terminal supports UTF-8, but whether the applications you launch in the terminal will assume that the terminal supports UTF-8.
To actually detect UTF-8 support (e.g. as part of a .profile file to adjust the LC_CTYPE environment variable), you have to do some trickery (namely writing out two bytes which are the UTF-8 encoding of a single character, and see how much the cursor has moved)
@ScottPack What's interesting in endorsements is that it tells you who believes in them. People who endorse you either genuinely admire you, or wish for reciprocation, or both.
@ThomasPornin I have never managed to get UTF-8 chars to work, man pages often mess up their alignment, and vim gets very confused if a file contains UTF-8 chars.
@lynks I have switched to all-UTF-8 several years ago and I do not have such problems. But, as is usual with locales, you have to switch system-wide, preferably world-wide (i.e. go UTF-8 on every single machine where you have an account, simultaneously)
The whole idea of "locales" is evil and perverse, but if you are consistent you can actually make it work to some extent.
Here is the scenario:
You get to overwrite 4 (consecutive) Bytes of a Userland Remote Process in Linux without Exploit Mitigation and without the ability to inject any Shellcode and you know the Process Memory Layout. Is this Exploitable?
New user obviously needs a hand in how to ask questions, but I'm not sure how to deal with it... edit the question to include additional info OP added in comments? Or should we just flag it?
In my company, they don't allow accessing the company email or servers from outside the company network.
To access the email from outside the network, you have to use: Username, password and a number generated from a small number generator.
How does this verification method works?
@ThomasPornin Dan Boneh has started with AES and some modes of operation. The course is getting a bit more intense for my level. Do you recommend a book that can help me keep up?
But that might be the opposite of what you look for (you want a book to keep up with Dan Boneh's course, whereas Dan Boneh's course is good to keep up with the handbook)
speaking of celebrities no normal person has heard of, did I mention that I met John Romero? even got him to sign my games-company business card. major nerd-fanboy moment. I was actually stuttering when I spoke to him :P
@TerryChia yeah as Antony says, symmetric block ciphers are very easy on the maths from an implementation point of view, they're just about substitution and permutation.
For example, I can sum up "Rijndael Finite Fields" as "arithmetic mod 256" for all intents and purposes, with a slight modification for multiplication, and you're away and can implement AES and play with it without really needing all that field theory.
@ThomasPornin really? I have never tried to create such a mess, but I thought DEFINE was just a simple text-substitution, and was performed before any kind of tokenisation or lexing.
@lynks No, tokenisation occurs first. Then (and only then) identifiers are recognized (or not) as macro names. So you can #define an indentifier, but not a '+'
In my spare time, around 1999, I wrote my own C preprocessor. Ugly code, but I learned a lot on how C works. At that time, I bought and read the new C standard (C99).
@ThomasPornin every one of the tech-gurus I have come across has at one time or another written at least part of their own compiler for something. perhaps I should look into it.
Meme: Security Monkeys
Synonyms: Chimpanzees, Chimps
Originator: @ThomasPornin, @TomLeek (Security Monkeys), @TomWijsman (Monkeys)
Date of conception: March-April 2013
Cultural height: TBD
Purpose: TBD (see below)
Background: Thomas' answer to a question What technical reasons are there to...
@lynks Something which is very enlightening is implementing your own Forth interpreter. Much simpler than a C compiler, and eye-opening in several ways. One step further is your own Scheme interpreter (Scheme is Forth-with-GC-and-prefix-notation).
@lynks Back in the day (a couple of years ago) our .net teacher gave us an all-semester assignment to create a simple "compiler" C#->CIL->PHP. It was so much fun.
@Adnan and you can get one that runs off usb, rather than using your battery all day. but I rather feel that sucking on the end of something that is wired into your computer might garner some odd looks.
alternatively, perhaps thats where @ThomasPornin gets his knowledge from
@lynks I believe that "vast subsection" would be called his "worshipers" and the "misinformation" would be "gospel". And people like you would be called "heretic", "blasphemer", and "infidel".
@Iszi 1. Thomas Pornin releases new 'super-hax0r-proof hash function', advocates its use globally. 2. Thomas Pornin teaches that patching known remote-exploits is unnecessary. 2. Thomas Pornin gets ALL the passwords.
The defect of Scheme, in that matter, is not that it abuses parentheses; the problem is that it does not given an easy way to extend it with a better syntax.
That's the good thing with Forth. Raw reverse Polish is nigh unreadable, BUT with Forth you can define functions which take over the source code right away, and can implement whatever syntax you wish.
I asked 1 question on Sec.SE... taught me a lesson. 1 question on Meta.SO... taught me a lesson.... and 1 question on Travel... I got the best answer for all of them here in DMZ. Taught me a lesson.
@ThomasPornin ah, I see, you are talking about having the x509 granted by the authentication server and then consumed by the service provider as the mechanism of action
@Adnan Indeed LOL! :))) But I didn't know what to say and replied "I just wanted to make his sig smile" ... that didn't come out quite as intended tho :)))
In one of the videos, Dan Boneh says "I'm sure all of you played with substitution ciphers when you were in kindergarten" He made me feel really stupid.
@LucasKauffman, @AviD, and anybody who's doing security stuff for a non-IT company. How would you summarize your day-to-day tasks? Would you please outline your role and the things you do?
@LucasKauffman ooh, have you had to read up the ISO27XXX series past 002? I've read 27001 and 2 for my sins but stopped working in roles that gave me acccess before the others turned up...
@ThomasPornin I still think it has a place as a basic security measure (it shouldn't in an ideal world, but the ease of misconfiguration on firewalls where everyone is addressable, just makes it "feel" like a good idea, I could very easily be wrong....)
@Adnan from my experience in the Big 4 they very rarely take "operational" roles (although it can happen as part of an out-sourcing or co-sourcing deal) they're far more likely to do consultancy. A bit part of it is their attitude to risk management....
@ThomasPornin actually the Internet Census 2012 that the hacker put together made me thing the same thing. There were billions of IP addresses he didn't get a response from making me thing that there's a fair degree of growth still available in IPv4...
@LucasKauffman Yes and no. It's an entry position, so I'll be working in their IT department at first. Everything is very vague at this point and my interview is next Monday.
@ThomasPornin The problem as I see it isn't utilization, it's allocation. Yes, there may be very few IPs actually using port 443, but I could use a few of those IPs, and can't get them.
@ThomasPornin interesting. sounds like there's quite a bit of room for growth. Personally I thought that charging $1/IP/Year would sort out the scarcity problem easily. it's not a large enough amount to hurt anyone running a legitimate service but if you're sitting on 10,000 addresses for no reason it might incentivise you to free them up :)
What is the safty measures you consider in the front page register and log in form ?
To make a secure medium
I realize this is a bit off-topic, but don't know where else to go to ask...
I've gotten an enormous amount of spam in the past 24 hours (hundreds), even after some relatively good spam filters. Virtually all of this stuff is hokey weight loss schemes, claimed to be forwarded from Beyonce, Pame...
Here is the scenario:
You get to overwrite 4 (consecutive) Bytes of a Userland Remote Process in Linux without Exploit Mitigation and without the ability to inject any Shellcode and you know the Process Memory Layout. Is this Exploitable?
In my company, they don't allow accessing the company email or servers from outside the company network.
To access the email from outside the network, you have to use: Username, password and a number generated from a small number generator.
How does this verification method works?
Meme: Security Monkeys
Synonyms: Chimpanzees, Chimps
Originator: @ThomasPornin, @TomLeek (Security Monkeys), @TomWijsman (Monkeys)
Date of conception: March-April 2013
Cultural height: TBD
Purpose: TBD (see below)
Background: Thomas' answer to a question What technical reasons are there to...
