Tag Info

Hot answers tagged

16

There are a huge amount of stupidities when it comes to passwords in websites. Some have purely technical reasons (valid or not, that's another question, but nearly all of them are not): Your password must be four characters length and have only digits. (By limiting a password to 0001 .. 9999 range, you can simply store them as a number, plaintext, ...


9

You're fine as long as you're using a reputable browser (as opposed to one of those weird add-tabs-to-IE6 knockoffs that were floating around years ago). If any browser did that (and people would find out eventually) it would be a public relations nightmare far beyond the Android thing. People check their bank accounts in browsers, look at photos (family and ...


7

Regarding the storage of payment card data, what you're looking for seems to be called the Payment Card Industry Data Security Standards or PCI DSS. According to Wikipedia: The standard applies to all organisations that hold, process, or exchange cardholder information from any card branded with the logo of one of the card brands. Unfortunately I ...


5

When we login using Facebook or Google or Twitter, the protocol used is OAuth. OAuth makes it easier to use existing profiles in new ones, but only a limited set of information is shared, in most cases only your email id. However when the site you are logging into is registered as a Facebook "app" it can request a lot of information from Facebook including ...


5

Should you? Yes. You said it yourself, betray as little as possible. If I was attacking a system and noticed the server responded with 403 codes I would focus on those, instead of moving on. Better a door proclaim it doesn't exist then to proclaim it to be barred. The downside of using 404 requests is that externally it will appear as if the page doesn't ...


5

You need to investigate your legal liability first - which differs from country to country. For example, financial data in the UK cannot be stored in a server in a non UK, (or non EU country depending on what that data is). Data is never 100% secure when unencrypted, heck it's not even 100% safe when encrypted, but a good encryption algorithm and keeping ...


5

In short: It is mandatory to get consent of the users. The application should get user consent and acknowledge them about the information that is gathered. Because, by different country laws not disclosing this activity is considered to be crime. Disclaimer : I am not a lawyer, and you may probably would need to contact a lawyer who would advice you on ...


4

Is there any situation or circumstance when any of those browsers would take it upon itself to send the opened web pages from http://localhost:port/* to its company or any other third party? Yes. Lots and lots of situations in which this could possibly happen. The actual probability is zero. But there are situations where it could happen. Did you, ...


4

According to RFC2616 10.4.4 403 Forbidden The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in ...


4

Some loosely connected advice for best practices (IMHO anyway): 1. Ask for permission Put the fact that you are collecting positioning data in the ToS, but ask for permission nevertheless when it comes to collecting them. Of course, put "Always remember" to not annoy your users. 2. Process the data locally This applies in some contexts, e.g. an app ...


4

Your question comes down to how well you can change the individual components that make up a digital "fingerprint". There are some that you can't control (at least not without going to a whole lot of effort), but remember you only have to change some of them to alter the fingerprint, and some are rather easy to change depending on what sort of lengths you're ...


4

You could use Piwik from http://piwik.org . It's essentially an open source, host it yourself, web analytics tool. It has most of the major features of GA and is just as easy to use.


3

The available hardware/os specifications given to an application running on a device are no more secret than the user agent of a web browser hitting a given web page. I assume that every web site out there is collecting information about that I am browsing with a linux firefox application. Some of this information is widely reported (Google has such ...


3

PEM was a proposed IETF standard for secure email. It depended on a single root certificate for its public key infrastructure (PKI), which was impractical and had its own problematic implications for security. PGP started as a "proof of concept" for a less centralized "web of trust" PKI, and proved to be much more practical, finding widespread adoption and ...


3

The answer is History We seem to forget that the basis of a lot this comes from a time when storage was not effectively free (on disk or in memory) when our ability to manage all these things was somewhat less than it is now and equally the ability of automated systems to attempt to crack same was also somewhat less. There are lots of rants about passwords ...


3

However for easier conversion, you can send the subscriber a reminder as follows: a) 15 days - thanking them for subscribing to your services, and letting them know that there is only one more step to go to activate their account b) 45 days - Letting them know that they are missing out on the goodies on your site or news letter c) 75 days - letting them ...


3

Yes, I've been in your situation. In no way did we impose our choice on clients when that choice of analytics tool had implications for both privacy of data transfer and storage but also external/third-party use of the data. Our legal counsel's recommendations (and you should absolutely check with yours) were the following: tell clients what you're ...


3

Always show the stack trace. A magic mail is opening doors for law suits. Always respect privacy. See point 1 above - that is the option for user to deny sending it to you if they find any private info. Ideally NONE of the parameters should come to you. Always have an EULA that gets them to agree to this. Again, law suits. I have seen mobile apps that ...


3

My two cents. Keep in mind, this particular community is likely to be a cross section of programmers, so we aren't your average user. :) I can see reading my own thoughts that I'm answering as the "user who knows how to program", and not a regular human being. We used to send the last stacktrace of java when user presses "send error report" button. As ...


3

Since you're including credit card numbers, you might want to look at the PCI data security standards in use. While the Wikipedia article doesn't seem to mention third-party hosts, the requirements to track access make this seem unacceptable. This is the minimum necessary to accept credit cards yourself (at least in the US). There are sufficiently many ...


3

You might be able to mitigate this problem with more rigorous use of a version control system with good branching support. When a pair of programmers starts working on something, they create a branch. The pair commits their progress to that branch frequently, but at least whenever one of them leaves work for more than a few minutes. Anyone who needs access ...


2

The exact answer depends on what country you are in - remember it is up to individual countries to implement directives so it will vary. In Britain, if you use cookies for sessions when users log-in or storing preferences, it seems to boil down to wait and see. http://www.torchbox.com/blog/eu-law-cookies-and-ico


2

For something like a social network, or web-mail, or Stack Exchange - no, there are no legal security standards whatsoever. You could store user passwords on pieces of paper stuck to the outside of your corporate headquarters, and you wouldn't be breaking any laws. (I'm talking just about the USA - it might be different in other places.)


2

IMHO, It is outright foolish of any site/app that uses modern hashing and/or salting to store passwords to not allow for spaces in passwords. But, some legacy systems(read about this somewhere) still pass around passwords in plaintext - so not allowing spaces there may make sense. Also, some apps may "strip" all string inputs they receive. So, a password ...


2

You can encrypt each line seperately. If you can afford to leak your file names and approximate line lengths and the line numbers on which lines changes occur, you can use something like this: https://github.com/ysangkok/line-encryptor As each line is encrypted seperately (but with the same key), the uploaded changes will (like usually) only involve the ...


2

If you must code this way (it seems very awkward to me), you could set up virtual machines where development will actively take place, and share the usernames (obviously different from your "real" personal usernames) and passwords to those. We have a few dev VMs like that here, but not for pair-programming so much as a sandbox to test things out which we ...


1

If you are collecting personally identifiable information (PII) then you should tell them quite loudly what you are doing. Beyond that it's pretty much a given that most applications report non-PII usage info back to their home base. However, in the real world, you should tell them if you are collecting anything at all regardless of if its PII. You should ...


1

IANAL but some countries view IP addresses as personal information. Its not worth the risk, just anonymise your data. Also some users could get upset if they find out. Is it worth risking upsetting your userbase for the sake of a couple of hours work even if it is legal?


1

My only comment is to seek legal advise. You maybe in violation of privacy laws in your country and could face a costly legal battle or/and criminal or/and civil chargers.



Only top voted, non community-wiki answers of a minimum length are eligible