Hot answers tagged

18

There are a huge amount of stupidities when it comes to passwords in websites. Some have purely technical reasons (valid or not, that's another question, but nearly all of them are not): Your password must be four characters length and have only digits. (By limiting a password to 0001 .. 9999 range, you can simply store them as a number, plaintext, ...


9

You're fine as long as you're using a reputable browser (as opposed to one of those weird add-tabs-to-IE6 knockoffs that were floating around years ago). If any browser did that (and people would find out eventually) it would be a public relations nightmare far beyond the Android thing. People check their bank accounts in browsers, look at photos (family and ...


8

Regarding the storage of payment card data, what you're looking for seems to be called the Payment Card Industry Data Security Standards or PCI DSS. According to Wikipedia: The standard applies to all organisations that hold, process, or exchange cardholder information from any card branded with the logo of one of the card brands. Unfortunately I ...


6

According to RFC2616 10.4.4 403 Forbidden The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in ...


6

There are a couple of different ways to deal with this problem. It all depends on your personal preference. Don't commit any configuration files This is probably the easiest, although you have to make sure you never accidentally commit anything with configuration information in it. With git, once it has been committed and pushed out or forked it's ...


5

In short: It is mandatory to get consent of the users. The application should get user consent and acknowledge them about the information that is gathered. Because, by different country laws not disclosing this activity is considered to be crime. Disclaimer : I am not a lawyer, and you may probably would need to contact a lawyer who would advice you on ...


5

When we login using Facebook or Google or Twitter, the protocol used is OAuth. OAuth makes it easier to use existing profiles in new ones, but only a limited set of information is shared, in most cases only your email id. However when the site you are logging into is registered as a Facebook "app" it can request a lot of information from Facebook including ...


5

Should you? Yes. You said it yourself, betray as little as possible. If I was attacking a system and noticed the server responded with 403 codes I would focus on those, instead of moving on. Better a door proclaim it doesn't exist then to proclaim it to be barred. The downside of using 404 requests is that externally it will appear as if the page doesn't ...


5

You need to investigate your legal liability first - which differs from country to country. For example, financial data in the UK cannot be stored in a server in a non UK, (or non EU country depending on what that data is). Data is never 100% secure when unencrypted, heck it's not even 100% safe when encrypted, but a good encryption algorithm and keeping ...


5

Don't overthink things, the obvious way (render image instead of text) is exactly the right thing to do here. Nowadays, any time delay or processing cost involved in an extra server call wil be negligible compared to the kind of time it takes a user to move a mouse and perform a click in the first place. (From the viewpoint of a computer, people move in ...


4

Is there any situation or circumstance when any of those browsers would take it upon itself to send the opened web pages from http://localhost:port/* to its company or any other third party? Yes. Lots and lots of situations in which this could possibly happen. The actual probability is zero. But there are situations where it could happen. Did you, ...


4

My two cents. Keep in mind, this particular community is likely to be a cross section of programmers, so we aren't your average user. :) I can see reading my own thoughts that I'm answering as the "user who knows how to program", and not a regular human being. We used to send the last stacktrace of java when user presses "send error report" button. As ...


4

Some loosely connected advice for best practices (IMHO anyway): 1. Ask for permission Put the fact that you are collecting positioning data in the ToS, but ask for permission nevertheless when it comes to collecting them. Of course, put "Always remember" to not annoy your users. 2. Process the data locally This applies in some contexts, e.g. an app ...


4

Your question comes down to how well you can change the individual components that make up a digital "fingerprint". There are some that you can't control (at least not without going to a whole lot of effort), but remember you only have to change some of them to alter the fingerprint, and some are rather easy to change depending on what sort of lengths you're ...


4

You could use Piwik from http://piwik.org . It's essentially an open source, host it yourself, web analytics tool. It has most of the major features of GA and is just as easy to use.


3

PEM was a proposed IETF standard for secure email. It depended on a single root certificate for its public key infrastructure (PKI), which was impractical and had its own problematic implications for security. PGP started as a "proof of concept" for a less centralized "web of trust" PKI, and proved to be much more practical, finding widespread adoption and ...


3

The answer is History We seem to forget that the basis of a lot this comes from a time when storage was not effectively free (on disk or in memory) when our ability to manage all these things was somewhat less than it is now and equally the ability of automated systems to attempt to crack same was also somewhat less. There are lots of rants about passwords ...


3

However for easier conversion, you can send the subscriber a reminder as follows: a) 15 days - thanking them for subscribing to your services, and letting them know that there is only one more step to go to activate their account b) 45 days - Letting them know that they are missing out on the goodies on your site or news letter c) 75 days - letting them ...


3

Yes, I've been in your situation. In no way did we impose our choice on clients when that choice of analytics tool had implications for both privacy of data transfer and storage but also external/third-party use of the data. Our legal counsel's recommendations (and you should absolutely check with yours) were the following: tell clients what you're ...


3

Always show the stack trace. A magic mail is opening doors for law suits. Always respect privacy. See point 1 above - that is the option for user to deny sending it to you if they find any private info. Ideally NONE of the parameters should come to you. Always have an EULA that gets them to agree to this. Again, law suits. I have seen mobile apps that ...


3

Since you're including credit card numbers, you might want to look at the PCI data security standards in use. While the Wikipedia article doesn't seem to mention third-party hosts, the requirements to track access make this seem unacceptable. This is the minimum necessary to accept credit cards yourself (at least in the US). There are sufficiently many ...


3

I think your approach is broadly sound. I wouldn't go down the route of using an MVC framework, it's a bit of an overkill for this kind of thing. If you're using, for example, Perl's CGI module, then the output of the key as a simple text string or JSON string etc. is very simple, you just ask the CGI script to output a content header and the content as ...


2

The exact answer depends on what country you are in - remember it is up to individual countries to implement directives so it will vary. In Britain, if you use cookies for sessions when users log-in or storing preferences, it seems to boil down to wait and see. http://www.torchbox.com/blog/eu-law-cookies-and-ico


2

For something like a social network, or web-mail, or Stack Exchange - no, there are no legal security standards whatsoever. You could store user passwords on pieces of paper stuck to the outside of your corporate headquarters, and you wouldn't be breaking any laws. (I'm talking just about the USA - it might be different in other places.)


2

IMHO, It is outright foolish of any site/app that uses modern hashing and/or salting to store passwords to not allow for spaces in passwords. But, some legacy systems(read about this somewhere) still pass around passwords in plaintext - so not allowing spaces there may make sense. Also, some apps may "strip" all string inputs they receive. So, a password ...


2

On 26 May 2011, a new EU directive comes into force Yeah... It now needs to be transcribed in member countries. Which can take another months or even years if a few of them drag their feed. Don't hold your breath. There's something sweet, with respect to internet law: for looking into whether what you're doing is illegal on the internet, it might be ...


2

You can encrypt each line seperately. If you can afford to leak your file names and approximate line lengths and the line numbers on which lines changes occur, you can use something like this: https://github.com/ysangkok/line-encryptor As each line is encrypted seperately (but with the same key), the uploaded changes will (like usually) only involve the ...


2

Why not use an image as stated above, and include a (lightly) encrypted email address for each image, along with a local Javascript function to resolve the obfuscated email upon click? That way everything stays single-trip, but most spam harvesters aren't going to be hooking into the event and looking for a process path for a result, they're just going to ...



Only top voted, non community-wiki answers of a minimum length are eligible