@Ladadadada even if you couldnt star your own question, your conclusion is not directed from your premise. Why couldnt the 2nd account, the one with the answer, star the question?
> Israel tops world ranking of smartphone usage: Survey shows Israelis use their smartphones just about anywhere; rising number of Israelis apt to use smartphones during social gatherings.
Now excuse me, I have to get back to my game of Angry Birds.
So there's one that put half of his rep into a bounty for what? Failing to read all the documentation, or failing to comprehend there's no transaction processing that is easy and will be the same per each transaction type and you can somehow magically assign a complete flag on it even if it's unverified?
I mean I realize the documentation is nearly 250 pages long,... but we're supposed to read all of it? shouldn't he?
@Adnan well the PCI is only the latter part of it, the rest is how do I verify transactions and similar... all of which is in the documentation, but of course it's not as simple as he suggests in the question
He's concerned that the client might bypass the transaction authorisation somehow... and I have a feeling he doesn't understand how transactions are processed at all
How accurate is this XKCD comic from August 10, 2011?
XKCD 936: Password Strength
I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against me on that one. However, XKCD's analysis seems spot on to me.
Am...
@TerryChia yeah... I will probably downvote eventually too... I'm just giving him a bit more time to actually read the documentation, let's see if he realizes he's just lazy
he probably thinks "oh so the process returned, I can now safely mark a transaction as successful and completed" LOL
@TerryChia well I was also, because I honestly dislike the question ... but as I said, OP's misconceptions make it not TL (it's basic PCI processing that he fails to dig, so definitely not TL)
If anything, it's low quality because of lack of previous research on OP's part
@TerryChia I don't care about the bounty. I would care to add a quality answer (if at all possible, considering the question), but I have my own stuff to do ... I have to prepare some web templates for my own e-commerce solution LOL ... yes, the business part works, but the client wanted some lame design that we've been waiting for some PS designer to complete for nearly a year... so I'm digging into my own HTML and tons of custom anchors and settings :P what a nightmare LOL
I could definitely use a slave on this one :)
@ManishEarth !!! Man I dreamt you won the lottery ... two times in a row. :)) I'd seriously go buy the tickets, I have no idea why I dreamt that :O
@TildalWave Well. Some weeks ago I "saw a discussion somewhere" on the use of password strength indicators, concluding that their providing a qualitative score (password is bad just because it's all lowercase, etc.) is simply crap.
@ManishEarth Yeah man it was ... wacky. I have no idea how you came into my dreams all of a sudden... but I remember we were calling for The Bear to help us calculate the odds here in the DMZ :))
@Simon ha dunno, that you're active early in the morning does tell a few things, but nothing too conclusive really. You could be a student, self-employed or occupy a really boring job position :P :))
@Simon test accounts? ID could be (and probably is) auto-incremental, so you make a few test accounts that you later delete, and the ID keeps running into higher numbers
@Simon now that you mention it... I just checked in my own database for sites I built and I'm #2 and there isn't any #1... I nearly forgot, but it's some SQLi trigger that I never touch and it's obviously been there for so long I forgot about it
@Simon oh that... I barely ever touch it, it's just something
mostly to test things a bit... it's hardly worth opening... and I need to buy me a SSL cert too, but have been lazy to add it for a site that even I don't care much about LOL
@Simon IIRC nothing, unless I approve it manually ... you can advance to registered user by registering and then to user verified, but not to status confirmed
@HenningKlevjer @ThomasPornin has mentioned a few times that password meters are by definition crap, since you cannot measure the entropy of the resultant password, but only of the password generation process.
@TildalWave I feel like the message given by your website was slightly customized for me. Now, I see what kind of stuff you do with your website, hehe.
@Simon yeah I built a custom in-process WAF that I can control all kinds of things easily with... basically, it's any rules on any data, using regex, like operators,... and I've made me some templates for a few most common things (which would mostly be blacklist/whitelist rules)... honestly tho, I rarely even open this one that controls my own website
@TildalWave I think I didn't explain correctly. I didn't mean that malware will accumulate on your computer and if you get 1000 viruses then it's worse than 5 viruses, because I think both cases are almost equally bad. What I meant was the likelihood. I've edited that part, thank you for mentioning it. — Adnan5 mins ago
I've deleted my comment, I just wanted to point out that it was either worded awkwardly, or it should be mentioned additionally... anyway, the edit makes it better ;)
@AviD well yes ... learn to read between the lines damnit! It was meant to read as "I haven't, have problems admitting it, because most others probably have" :P
@HenningKlevjer hahaha well that proves it, you can't trust community they're all negative :))
tho that ID of -1 probably means it's not even in the database as a user (with any authorisation info), but merely an exception that's handled separately in the code... @Adnan was fiddling with Stack Exchange Data Explorer, maye he can pull some other info out of it ;)
@Adnan Why in heaven's name would it be there, unless it's only meant as a lookup for the display name for other join queries? I sincerely hope there's database locked constraints on authorisation data for negative ID values at least.
@Xander Yes, we all played with our Simon... touching him where requested... and he was polite enough to keep our highscore even :))
So, today a local tabloid asked me to expand my piracy answer and make it into a small article. Apparently, one of their columnists was Googling to find more info about the matter and he found the answer, and after some stalking he found me.
There are several risks when it comes to piracy, both legally and from a security point of view. I'll try to approach them as well as possible.
The downloaded files themselves:
Downloaded with the .avi, .mp4, .mkv, etc. there might be some executable files, with some special icons that can tri...
@Xander I'm worried about one thing, though. They have no section for articles like these. They're the cheapest and most disrespected (yet most read) tabloid in the country. I wonder what they'll do with it.
I mean really, if they have no IT or IT-related section, what would they do with it?
It's a bit strange cross-domain OAuth token requirement here, but I'm wondering if I forgot something (besides a few more attack vectors that are possible on OP's proposed solution that I didn't feel they're worth mentioning on top of those that I already did):
No, this scheme you propose is not secure, because you are potentially exposing your cross-domain authorisation token in server logs and referer strings on any third-party web servers you'll be linking contents from (or possibly injected by XSS to inspect for request values), if you're passing it...
hmmm I need to rewrite that answer a bit... I honestly dunno where I picked that cross-domain login requirement from... I'm slightly too paranoid in my answer then :)
I just made a new account with some eGov service (Belgian government).
I use LastPass (generate long random strings for each site).
But the system told me that the maximum allow length was 16 ASCII symbols. Why do people do this? If they hash it then the length should not matter, right?
Is th...
@Simon basically it is that the card has an RFID chip inside it, but it's not used by the door at all. It just supports RFID readers in case they wanted to use different locks with RFID
the RFID tag inside the card and the magnetic stripe have the same information
so the thief copied the RFID data and used them to clone another magnetic card
@Adnan I'm gonna have to read this after work. It seems quite funny though and very food-oriented. Fruits, doughnuts, beer. I'm hungry now. Thanks for the link.
@Simon you find a website that uses one of the encrypted values as an index for something, pass it a wrong argument and observe unsanitized error reporting service spill the beans :)
@TildalWave I didnt arrange the CTF! I just heard about it on an internal mailing list (i.e. happened to notice on the rare occassion I glance at those emails...)
How accurate is this XKCD comic from August 10, 2011?
XKCD 936: Password Strength
I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against me on that one. However, XKCD's analysis seems spot on to me.
Am...
There are several risks when it comes to piracy, both legally and from a security point of view. I'll try to approach them as well as possible.
The downloaded files themselves:
Downloaded with the .avi, .mp4, .mkv, etc. there might be some executable files, with some special icons that can tri...
I just made a new account with some eGov service (Belgian government).
I use LastPass (generate long random strings for each site).
But the system told me that the maximum allow length was 16 ASCII symbols. Why do people do this? If they hash it then the length should not matter, right?
Is th...
